Network Security and Device Management
What you must understand
Device hardening: strong admin credentials, RBAC (CX roles), AAA (RADIUS/TACACS+), SSH (disable Telnet), ACLs, and control-plane policing. Port security: 802.1X (authenticator/supplicant), MAC authentication, RADIUS, and DHCP snooping / dynamic ARP inspection to stop spoofing. On CX, client-insight and ClearPass integration appear.
Management: SNMPv3 (auth + priv), syslog to a remote server, NTP for accurate timestamps, firmware/image management, and config backup. Also know RADIUS vs TACACS+ (TACACS+ encrypts the whole payload and separates AAA; RADIUS encrypts only the password).
Traps
- Telnet sends credentials in clear text - always prefer SSH.
- SNMPv1/v2c use community strings (clear text); v3 adds auth and privacy.
- DHCP snooping trusted ports must face the DHCP server/uplink; untrusted ports drop server replies.
- 802.1X port states: unauthorized → authorized after RADIUS accept.
Rule of thumb
For any "secure management access" question, the answer set is SSH + AAA + SNMPv3 + NTP + syslog + ACL restricting management subnets. If a distractor offers Telnet or SNMPv2c, eliminate it.