Six topics and where each one goes
| v1.1 topic | In our words | v2.0 |
|---|---|---|
| 5.1 | Tell threats, vulnerabilities, exploits and mitigation techniques apart | Not listed |
| 5.2 | The parts of a security program: user awareness, training, physical access control | Not listed |
| 5.3 | Protect device access with local passwords | Local users continue in 4.1 |
| 5.4 | Password policy, plus alternatives such as MFA, certificates and biometrics | Not listed |
| 5.5 | IPsec remote-access and site-to-site VPNs | 4.5, which adds IKE, ESP, AH and transport vs tunnel mode |
| 5.8 | AAA concepts | Configuring a device as an AAA client stays in 4.1 |
Per Cisco’s v1.1 and v2.0 topic pages, checked October 29, 2026. Cisco weights Security Fundamentals at 15% across ten topics; this area holds six, so our even-split estimate is about 9%.
Site-to-site and remote-access IPsec
| Point of comparison | Site-to-site | Remote access |
|---|---|---|
| Tunnel endpoints (differs) | A VPN gateway at each site, a router or a firewall | A client on the user’s device and a VPN headend |
| Who runs VPN software (differs) | Only the gateways; hosts behind them need no VPN client | Every user device |
| Typical lifetime (differs) | Long-lived between fixed locations | One user session at a time |
| What gets authenticated (differs) | The gateways, by pre-shared key or certificate | The user, often through AAA, and the device |
| Usual IPsec mode | Tunnel mode | Tunnel mode |
≠ marks rows where the two differ.
Architecture per RFC 4301.
The IPsec parts v2.0 names
- IKE (Internet Key Exchange)
- Negotiates and authenticates the security associations and their keys. IKEv2 is RFC 7296.
- Security association (SA)
- A one-way agreement on algorithms and keys, so a working tunnel needs a pair, one per direction (RFC 4301).
- ESP (IP protocol 50)
- Encrypts the payload and adds integrity and origin authentication (RFC 4303).
- AH (IP protocol 51)
- Integrity and origin authentication with no encryption. AH also covers unchanging fields of the IP header, so a NAT device in the path breaks it (RFC 4302).
- Tunnel mode
- Protects the whole original packet and adds a new outer IP header: the gateway-to-gateway case.
- Transport mode
- Protects the payload and keeps the original IP header: host to host, or Generic Routing Encapsulation (GRE) over IPsec, where GRE already supplies the outer header.
Device passwords and the policy around them
Topic 5.3 is the hands-on one: protect the console, the VTY lines and privileged mode with credentials stored on the device. Topic 5.4 is the policy behind those credentials (minimum length, complexity, expiry, limits on reuse, lockout after failed attempts) and the alternatives that take the reusable password out of the login: multifactor authentication, which combines factors from different categories, certificates and biometrics.
IOS can enforce part of that policy itself. The lines below set a minimum password length, block new logins for two minutes after three failures inside a minute, and close VTY sessions that sit idle for five minutes.
Password-policy lines on IOS
security passwords min-length 12login block-for 120 attempts 3 within 60!line vty 0 4 login local exec-timeout 5 0Threats, programs and AAA
Topic 5.1 is vocabulary first: vulnerability, threat, exploit and mitigation are four different nouns, so practice naming which one a scenario describes. Beyond the words, sort attack families by what they target: reconnaissance (ping sweeps, port scans), spoofed identities at Layer 2 and Layer 3, password attacks such as brute force and dictionary guessing, malware, and social engineering such as pretexting or tailgating through a badge door. The switch-side mitigations against spoofing, DHCP snooping, dynamic ARP inspection and port security, are covered in ACLs and Layer 2 security.
Topic 5.2 asks what a security program holds beyond technology. User awareness is the ongoing layer of reminders and notices; training is structured, often role-specific and sometimes tested; physical access control covers badges, locks and controlled rooms.
Topic 5.8 names AAA: authentication, authorization and accounting. On a Cisco device, AAA replaces per-line passwords with method lists that point at TACACS+ or RADIUS servers, with local users as the fallback when no server answers. TCP 49 and full-body encryption against UDP 1812/1813 and password-only encryption: that split is laid out on TACACS+ vs RADIUS.
Security frames
In a concept-heavy area the rejected options teach as much as the key, so open their notes after each answer. The same area runs inside the practice test filtered to security and VPNs.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 018 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 018
Which of the following is a key feature of IPsec site-to-site VPNs?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A gateway can run many site-to-site tunnels at once, one or more per peer.
Note on B
Per-user login belongs to remote-access VPNs; site-to-site tunnels authenticate the gateways, not each user.
Note on C
Browser-based access describes clientless SSL VPNs for remote users, not a gateway-to-gateway tunnel.
Note on D
Correct: two gateways build an IPsec tunnel, so whole LANs reach each other across the internet with no client software on hosts.
Best answer: D · why
A site-to-site IPsec VPN connects two networks through their gateways, such as routers or firewalls. Hosts send ordinary traffic and the gateways encrypt it with ESP, after IKE authenticates the peers and agrees on keys. Remote-access VPNs, by contrast, connect individual users with a client or a browser.
- Frame 002 of 018
Which advanced multifactor authentication method best mitigates the risk of credential theft due to phishing attacks?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: a stolen password alone fails because the login also checks a biometric and a known device, and risky context triggers extra checks.
Note on B
A one-time code can be phished in real time along with the password, so codes alone give weaker protection.
Note on C
With one factor, a phished password is all an attacker needs, however complex it is.
Note on D
Static shared keys are a single secret that can be phished or leaked and never change.
Best answer: A · why
Phishing steals what a user knows or types. Adaptive MFA ties the login to something the attacker lacks, such as a biometric on an enrolled device, and steps up checks when the context looks unusual. One-time codes help but can be relayed by a real-time phishing page; single passwords and static keys offer no second factor.
- Frame 003 of 018
Which security strategy involves implementing multiple layers of security controls throughout an information system?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A single point of control is a weakness if it fails, the opposite of layering defenses.
Note on B
Zero Trust means never trusting by network location and verifying every request; it is a model, not layering as such.
Note on C
Least privilege limits each account to the access it needs, one control among many layers.
Note on D
Correct: defense in depth stacks physical, technical and administrative controls so that one failure does not expose the system.
Best answer: D · why
Defense in depth layers independent controls, such as physical locks, firewalls and ACLs, port security, endpoint protection, MFA, training and policies, so that an attacker who gets past one layer meets the next. Least privilege and Zero Trust are principles that fit inside such a design.
- Frame 004 of 018
Which command is used to set an encrypted password for privileged EXEC mode?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
This applies weak, reversible type 7 encryption to clear-text passwords in the config; it sets no password.
Note on B
Correct: ‘enable secret’ stores the privileged EXEC password as a hash, and it takes priority over ‘enable password’.
Note on C
‘enable password’ is stored in clear text unless type 7 encryption is turned on.
Note on D
‘exec-timeout’ sets how long an idle line session lasts; it has nothing to do with passwords.
Best answer: B · why
enable secret protects privileged EXEC mode with a hashed password (type 5 MD5 by default on older IOS; newer IOS supports type 8 or 9 with algorithm-type). If both are set, enable secret wins over enable password. service password-encryption only obscures clear-text passwords with reversible type 7.
- Frame 005 of 018
How do digital certificates contribute to network security in a Cisco environment?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Certificates add a little overhead to handshakes; they do nothing to raise throughput.
Note on B
Certificates authenticate devices and servers, but admin logins and other secrets still exist.
Note on C
Correct: a CA-signed certificate binds a public key to an identity, so peers can prove who they are.
Note on D
Software updates are a separate process; a certificate only vouches for identity.
Best answer: C · why
A digital certificate, issued and signed by a certificate authority, binds a public key to a name such as a device or server. Peers verify the signature, and the holder proves possession of the private key. Cisco devices use certificates for HTTPS, IPsec peer authentication and 802.1X with EAP-TLS.
- Frame 006 of 018
Which element of security monitoring deals with recording and reporting what actions were taken on a network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Authentication checks who the user is; it does not record what they did afterwards.
Note on B
Correct: accounting records sessions, commands and data use, so actions can be reported later.
Note on C
Authorization decides what an authenticated user is allowed to do, before the action happens.
Note on D
Alerting is not one of the three AAA functions.
Best answer: B · why
AAA splits access control into authentication (who you are), authorization (what you may do) and accounting (what you did). Accounting records start and stop times, commands entered and resources used, usually on a TACACS+ or RADIUS server, for audits and billing.
- Frame 007 of 018
Which VPN technology uses UDP port 500 for key exchange?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
L2TP itself uses UDP 1701 and relies on IPsec, with its own IKE exchange, for security.
Note on B
PPTP uses TCP 1723 for control plus GRE, not UDP 500.
Note on C
SSL/TLS VPNs run over TCP 443 and negotiate keys inside TLS.
Note on D
Correct: IPsec negotiates keys and security associations with IKE on UDP 500, moving to UDP 4500 behind NAT.
Best answer: D · why
IPsec uses IKE (version 1 or 2) on UDP 500 to authenticate peers and agree on keys and security associations; ESP (IP protocol 50) then protects the traffic. When NAT is detected, both IKE and ESP move into UDP 4500. TLS-based VPNs use TCP 443 instead.
- Frame 008 of 018
Which phrase best describes an element of network security awareness aimed at educating employees about phishing attacks?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: awareness training teaches staff to spot fake senders, links and urgent requests, so fewer phishing emails succeed.
Note on B
Encryption protects stored data but does not teach anyone to recognize a phishing email.
Note on C
Two-factor login limits the damage of a stolen password; it is a technical control, not education.
Note on D
Firewalls filter traffic by rules; they do not educate employees.
Best answer: A · why
User awareness is one of the security program elements in the CCNA topics, alongside training and physical access control. A phishing awareness program teaches people to check senders and links and to report suspicious messages, often with simulated phishing tests. Encryption, MFA and firewalls are technical controls.
- Frame 009 of 018
In which section of the Cisco Router’s IOS CLI can an administrator configure AAA settings?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Line mode applies a named method list with ‘login authentication’, but the AAA model and lists are defined globally.
Note on B
Correct: ‘aaa new-model’, the authentication and authorization method lists and the servers are all set in global configuration.
Note on C
Privileged EXEC is for show and debug commands; configuration needs ‘configure terminal’ first.
Note on D
Interface mode configures one port; AAA is a device-wide setting.
Best answer: B · why
AAA starts in global configuration with aaa new-model, followed by method lists such as aaa authentication login default group tacacs+ local and the server definitions. Lines can then reference a named list with login authentication NAME, but the lists themselves are global.
- Frame 010 of 018
Which type of network attack attempts to exhaust a system’s resources by generating a high volume of traffic or requests?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Password cracking guesses or derives credentials; it is not about flooding a system with requests.
Note on B
SQL injection sends crafted input to a database query, not a high volume of traffic.
Note on C
A man-in-the-middle sits between two parties to read or change traffic rather than overwhelming a target.
Note on D
Correct: a DoS floods a target with traffic or requests until it cannot serve legitimate users; from many sources it is a DDoS.
Best answer: D · why
A denial-of-service attack exhausts bandwidth, CPU, memory or connection tables so that legitimate users are refused service. When many compromised hosts take part it is distributed (DDoS). Mitigations include rate limiting, upstream filtering and scrubbing services.
- Frame 011 of 018
In the context of a risk-based security assessment, what is the primary purpose of conducting a vulnerability analysis?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Keeping antivirus signatures current is routine maintenance, not an analysis of weaknesses.
Note on B
Compliance may require the analysis, but its purpose in a risk assessment is reducing risk, not only passing audits.
Note on C
ROI calculations belong to budgeting; vulnerability analysis looks for weaknesses.
Note on D
Correct: it identifies exploitable weaknesses and rates them, so the riskiest ones are fixed first.
Best answer: D · why
In a risk-based assessment, vulnerability analysis finds weaknesses such as unpatched software, weak configurations or open services, and rates how likely and harmful their exploitation would be. Combined with asset value and threats, the result is a ranked list that decides which fixes come first.
- Frame 012 of 018
Which of the following authentication methods uses physical characteristics to verify identity?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A token is something you have, such as a key fob or a phone app, not a physical trait.
Note on B
A password is something you know.
Note on C
A certificate proves possession of a private key, which is something you have.
Note on D
Correct: biometrics such as fingerprints, face or iris are something you are, measured from the person.
Best answer: D · why
Authentication factors are something you know (password, PIN), something you have (token, smart card, certificate on a device) and something you are (biometrics such as fingerprint, face or iris). Combining factors from different groups is multifactor authentication.
- Frame 013 of 018
Which type of attack involves an attacker intercepting communication between two parties without either party knowing the attacker is in the middle?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Brute force tries many passwords or keys; it does not intercept a conversation.
Note on B
Social engineering manipulates people into giving access; interception is a technical step.
Note on C
Correct: the attacker relays traffic between two parties, often after ARP spoofing, and can read or change it unnoticed.
Note on D
DoS aims to make a service unavailable, not to read traffic secretly.
Best answer: C · why
In a man-in-the-middle attack, the attacker sits on the path between two parties, for example through ARP spoofing or a rogue DHCP server or access point, and can read or alter traffic while both sides think they talk directly. Dynamic ARP Inspection, DHCP snooping and authenticated encryption counter it.
- Frame 014 of 018
In the context of network security, what does the CIA triad stand for?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: confidentiality, integrity and availability are the three goals that security controls protect.
Note on B
Identity is handled by authentication, but it is not the I in the triad.
Note on C
Authorization is part of AAA; the triad’s A is availability.
Note on D
Authentication is an AAA function, not the A of the CIA triad.
Best answer: A · why
The CIA triad names the three goals of information security: confidentiality (only authorized parties read data), integrity (data is not changed undetected) and availability (systems and data are there when needed). Authentication and authorization belong to AAA, which supports these goals.
- Frame 015 of 018
Which type of software is specifically designed to identify and exploit vulnerabilities in computer systems?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A threat is the potential danger or actor, not the tool that takes advantage of a flaw.
Note on B
A vulnerability is the weakness itself, not the code that abuses it.
Note on C
Correct: an exploit is code or a technique written to take advantage of a specific vulnerability.
Note on D
A mitigation technique reduces risk, the opposite of attacking a weakness.
Best answer: C · why
Security terms: a vulnerability is a weakness, a threat is a potential danger that could use it, an exploit is the code or method that actually takes advantage of the vulnerability, and a mitigation technique reduces the likelihood or impact. Risk combines threat, vulnerability and impact.
- Frame 016 of 018
What type of security control would installing security cameras in a data center be classified as?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A corrective control fixes a problem after it happens, such as restoring a backup.
Note on B
Correct: cameras record events so staff can see and investigate an intrusion, and they are part of the physical environment.
Note on C
A preventive logical control, such as an ACL or a password, blocks access in software; cameras do not block anyone.
Note on D
Compensating administrative controls are policies that stand in for a missing control; a camera is a device, not a policy.
Best answer: B · why
Controls are grouped by type (physical, technical or logical, administrative) and by function (preventive, detective, corrective, deterrent, compensating). Security cameras are physical controls that mainly detect and record events, though visible cameras also deter. Door locks and badge readers are physical and preventive.
- Frame 017 of 018
Which type of firewall is designed to filter traffic based on the source IP address using specific rule numbers?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A proxy firewall terminates and inspects connections at the application layer on behalf of clients.
Note on B
Correct: a packet filter checks each packet against numbered rules on source and destination addresses and ports, like an IOS ACL.
Note on C
An application-layer firewall looks into payloads such as HTTP, not just the source address.
Note on D
Stateful inspection also tracks connection state, so it does more than match addresses against rules.
Best answer: B · why
A packet-filtering firewall checks each packet on its own against ordered rules on header fields: source and destination address, protocol and ports. A numbered IOS ACL is the classic example. Stateful firewalls also track sessions and allow return traffic, and proxy or application-layer firewalls inspect the content.
- Frame 018 of 018
Which advanced authentication method mitigates replay attacks by incorporating time-based token generation?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A static key is the same every time, so a captured value can be replayed.
Note on B
Correct: each TOTP code is derived from the current time and expires within seconds, so a captured code soon becomes useless.
Note on C
A certificate without time limits does not by itself stop a captured exchange from being reused.
Note on D
A simple password stays the same at every login and is the easiest thing to replay.
Best answer: B · why
A time-based one-time password (TOTP) is computed from a shared secret and the current time and is typically valid for 30 seconds. Because each code expires quickly and is used once, a code captured on the wire cannot be replayed later. Static keys and passwords stay the same and can be reused by an attacker.
IPsec in v2.0
The v2.0 list (when it applies) keeps IPsec as topic 4.5 and adds its protocol layer: IKE, ESP and AH, and transport versus tunnel mode, which is what the definition list above covers. Threats, the security program, password policy and AAA concepts leave the list, while configuring a device as an AAA client stays under 4.1.
References
- [1]Cisco Learning Network: CCNA v1.1 exam topicsTopics 5.1 to 5.5 and 5.8. Checked October 29, 2026.
- [2]Cisco Learning Network: CCNA v2.0 exam topicsTopics 4.1 and 4.5. Checked October 29, 2026.
- [3]RFC 4301: Security Architecture for the Internet Protocol
- [4]RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2)
Concepts in this study area
- TACACS+ vs RADIUSTransport, encryption scope and the three A’s.