Infrastructure Security and Services
AAA and identity
TACACS+ runs over TCP 49, encrypts the entire payload, and separates authentication, authorization and accounting - the right fit for device administration. RADIUS runs over UDP 1812/1813, encrypts only the password field, and is the standard for 802.1X and VPN access. In 802.1X the supplicant speaks EAPoL to the authenticator (switch), which relays RADIUS to ISE. MAB is the fallback for devices with no supplicant but supports no EAP exchange, so it is weaker.
Edge and control-plane security
DHCP snooping builds a trusted/untrusted binding table; Dynamic ARP Inspection and IP Source Guard consume that table. Unicast RPF strict mode drops packets whose source is not reachable via the incoming interface - asymmetric routing breaks it, so loose mode is the alternative. CoPP protects the control plane with a classification ACL plus policers.
Services
Know FHRP behaviour (HSRP/VRRP/GLBP roles and preemption), NAT order of operations, NTP/PTP, SNMPv3 with authPriv, syslog severity levels, NetFlow export and IP SLA probes.
Traps
Wildcard masks are inverted subnet masks - a very common source of wrong answers. Read ACL direction and interface binding carefully. In NAT questions, confirm whether translation happens before or after routing for the direction stated. Also check that a first-hop redundancy group's virtual MAC and priority match the described failover behaviour.
Worked rule of thumb
To write the wildcard mask for a /22 (255.255.252.0), subtract each octet from 255: 0.0.3.255. So "permit 10.10.16.0 0.0.3.255" matches 10.10.16.0 through 10.10.19.255.