Security
Core concepts
Security questions span port access control (802.1X, MAC authentication, captive portal), RADIUS/CoA, DHCP snooping, dynamic ARP inspection (DAI), and Role-Based Access Control (RBAC) on AOS-CX. Understand the order of authentication methods on a port, how reauthentication and CoA work, and how roles map to ACLs. On the wireless side, know WPA3/SAE, 802.1X with EAP-TLS vs. PEAP, and ClearPass as the policy engine.
Traps to watch
- Method ordering: A port with MAC auth then 802.1X behaves differently than the reverse. Questions test whether you know which method wins when both are configured.
- DHCP snooping trust: Uplinks must be trusted; if not, client DHCP offers are dropped and clients get APIPA addresses.
- DAI depends on DHCP snooping: DAI without snooping bindings will drop legitimate traffic.
- CoA vs. reauthentication: CoA pushes new policy without a full reauth; confusing the two is a common distractor.
- WPA3 transition mode weakens security by allowing WPA2 clients - know when it is appropriate.
Worked example
A client fails 802.1X but has a valid MAC in ClearPass. If the port is configured MAC-auth-first, the client may be admitted with the MAC role before 802.1X runs. The exam asks why the client got a weaker role - answer: method ordering admitted it via MAC auth first.
Rule of thumb
Trace the authentication decision as a pipeline: method order → credential check → role assignment → role-to-ACL enforcement.