Network Security Fundamentals for Campus Access
What this domain covers
Campus access security focuses on controlling who and what connects. Key concepts: authentication, authorization, and accounting (AAA); 802.1X port-based access control with a supplicant, authenticator (switch/AP), and authentication server (RADIUS); and MAC authentication as a fallback for devices without supplicants. Understand segmentation via VLANs and ACLs, and role-based access. Learn DHCP snooping, Dynamic ARP Inspection, and IP Source Guard as protections against spoofing. Know port security (limiting MAC addresses per port). For wireless, know WPA2/WPA3, PSK versus enterprise (802.1X) modes, and guest network isolation. Understand the principle of least privilege and defense in depth.
Traps to watch
A frequent trap: mixing up the 802.1X roles - the supplicant is the client, the authenticator is the switch/AP, the authentication server is RADIUS. Another: assuming PSK is as secure as enterprise 802.1X (it is not - shared keys don't identify individual users). DHCP snooping questions test that trusted ports face the DHCP server and untrusted ports face clients.
Worked example / rule of thumb
Rule of thumb: authenticate at the edge, segment by role, and trust only known infrastructure ports. Example: enable 802.1X on access ports for employee laptops; use MAC auth for printers/IoT; configure DHCP snooping with uplinks to the DHCP server as trusted and user ports as untrusted.