CCNA Plan

Security Fundamentals

15% of the CCNA · blueprint 200-301 v1.1 (effective 2024-08-20)

Short answer

Domain 5.0 is 15% of the CCNA. It covers security concepts (threats, vulnerabilities, exploits, mitigation), the security program elements, device access control with local passwords, password policy elements, IPsec remote-access and site-to-site VPN concepts, configuring and verifying standard and extended IPv4 access lists, Layer 2 security (DHCP snooping, dynamic ARP inspection, port security), AAA concepts, wireless security protocols and WPA2/WPA3 PSK configuration.

Why it matters on this exam

ACL questions reuse subnetting through wildcard masks; Layer 2 security questions test whether you know which feature stops which attack.

Key concepts (objectives 5.1–5.10)

Common mistakes

Worked example

Permit only 10.1.2.0/24 to reach server 10.9.9.9 on TCP 443: access-list 110 permit tcp 10.1.2.0 0.0.0.255 host 10.9.9.9 eq 443, applied inbound on the interface closest to 10.1.2.0/24. Everything else is dropped by the implicit deny.

Original practice questions

Security FundamentalsDifficulty 3/5

Which ACL entry permits only hosts in 10.1.2.0/24 to reach server 10.9.9.9 on HTTPS?

  1. Aaccess-list 110 permit ip host 10.9.9.9 10.1.2.0 0.0.0.255
  2. Baccess-list 110 permit tcp any host 10.9.9.9 eq 80
  3. Caccess-list 10 permit 10.1.2.0 0.0.0.255
  4. Daccess-list 110 permit tcp 10.1.2.0 0.0.0.255 host 10.9.9.9 eq 443
Show answer and rationale

Correct: D. An extended ACL matches protocol, source, destination and port. The wildcard 0.0.0.255 covers the /24 source, 'host 10.9.9.9' is the destination and 'eq 443' is HTTPS. The implicit deny drops everything else.

  • C — A standard ACL cannot match destination or port.
  • A — Source and destination are reversed, and 'ip' allows all protocols.
  • B — 'any' allows every source and 80 is HTTP.
Security FundamentalsDifficulty 2/5

Which feature prevents a rogue DHCP server on an access port from handing out addresses?

  1. ADHCP snooping
  2. BDynamic ARP inspection
  3. CBPDU Guard
  4. DPort security
Show answer and rationale

Correct: A. DHCP snooping drops DHCP server messages (Offer/Ack) arriving on untrusted ports and builds a binding table. Only ports toward the legitimate server are marked trusted.

  • D — Port security limits MAC addresses, not DHCP messages.
  • B — DAI validates ARP using the snooping binding table; it does not stop DHCP offers.
  • C — BPDU Guard protects against rogue switches sending BPDUs.
Security FundamentalsDifficulty 3/5

Which statement correctly contrasts RADIUS and TACACS+?

  1. ARADIUS uses TCP 49 and encrypts the entire packet body
  2. BTACACS+ uses TCP 49, encrypts the entire packet body and separates authorization from authentication
  3. CTACACS+ uses UDP 1812 and encrypts only the password
  4. DBoth use UDP and are functionally identical
Show answer and rationale

Correct: B. TACACS+ (Cisco) runs over TCP 49, encrypts the whole payload, and separates AAA functions, enabling per-command authorization. RADIUS uses UDP 1812/1813, encrypts only the password, and combines authentication and authorization.

  • A — Those are TACACS+ properties.
  • C — UDP 1812 and password-only encryption describe RADIUS.
  • D — They differ in transport, encryption and function separation.
All 4 Security Fundamentals questions →

2 flashcards for Security Fundamentals

Practice this topic

Blueprint-mapped questions with full rationales for every choice.

Start practice
Related areas: Network Fundamentals · Network Access · IP Connectivity · IP Services

Primary references

  1. CCNA Exam v1.1 (200-301) Exam Topics — Cisco Systems · primary · retrieved 2026-09-21, verified 2026-09-21
Last reviewed: 2026-09-21Next review by: 2026-11-20Draft — pending editorial reviewHow we verify facts