CCIE Security cheat sheet

Cisco TrustSec: Security Group Tag (SGT) is a 16-bit value carried in the CMD (EtherType 0x8909) or inline in the 802.1Q tag; enforcement is done by SGACL on the egress device, so policy follows the tag, not the IP address.

SXP (SGT Exchange Protocol) propagates IP-to-SGT bindings between devices over TCP 64999; SXP is not encrypted by default and should be authenticated with a password and restricted to a management VRF.

IPsec: IKEv1 uses 2 phases (ISAKMP SA then IPsec SA); IKEv2 uses IKE_SA_INIT and IKE_AUTH with a minimum of 4 messages. ESP provides confidentiality and integrity; AH provides integrity and authentication only and cannot traverse NAT.

DMVPN phases: Phase 1 = hub-to-spoke only; Phase 2 = spoke-to-spoke with split-horizon disabled on the hub tunnel; Phase 3 = NHRP redirect and shortcut, which scales better than Phase 2.

MACsec (802.1AE) protects hop-by-hop Layer 2 frames with GCM-AES-128/256; it requires a point-to-point link and does not extend beyond the next Layer 3 hop.

Zone-based firewall: interfaces are assigned to zones; traffic between interfaces in the same zone is not inspected, and traffic between different zones requires a zone-pair policy with an inspect or pass action.

Control plane protection: CoPP uses MQC (class-map + policy-map) applied globally with 'service-policy input' to rate-limit punted traffic; CPPr provides per-interface and per-protocol granularity with host/transit/CEF-exception subinterfaces.

First-hop security: DHCP snooping builds the binding table; Dynamic ARP Inspection validates ARP against it; IP Source Guard uses it to filter spoofed source IP/MAC pairs. All three depend on the snooping binding database.

Site-to-site VPN redundancy: with HSRP/VRRP on the outside interface, IPsec NAT-T and IKE identity must match the virtual IP, or the peer's crypto ACL must permit the post-NAT source address.

Shared responsibility split: the provider secures physical, hypervisor, and managed-service infrastructure; the customer secures identity, data classification, guest OS patching (IaaS), and configuration of provider controls.

AWS security groups are stateful and allow-only; network ACLs are stateless and evaluated in numbered order, so an explicit deny must have a lower number than a broader allow.

AWS VPC traffic inspection: a Gateway Load Balancer endpoint (GWLBE) redirects traffic to third-party or firewall appliances; the appliance VPC must be in the same Region and the route tables must point the return path to the GWLBE.

IAM policy evaluation order: explicit deny > SCP > resource-based policy > identity-based policy > permissions boundary > session policy. An explicit deny anywhere wins.

Azure NSG rules have priority 100-4096, lower numbers evaluated first; Azure Firewall is stateful and supports FQDN filtering and threat intelligence, which NSGs cannot do.

Cisco Umbrella uses DNS-layer enforcement: the roaming client or VA forwards DNS to Umbrella resolvers (208.67.222.222/208.67.220.220), and blocking happens before the TCP connection is established.

Cloud posture: CIS Benchmarks and the provider's native tools (AWS Security Hub, Azure Defender for Cloud, GCP Security Command Center) map findings to controls; the exam expects mapping of a finding to the responsible control, not tool trivia.

Encryption in the cloud: KMS envelope encryption wraps a data key with a customer master key; key policies and grants determine who can use the CMK, and deleting a CMK is irreversible after the waiting period.

Cisco ESA (Email Security Appliance): the mail flow pipeline is workqueue -> listener -> HAT (host access table) -> sender/receipt/recipient groups -> content filters and message filters -> outbound queue.

ESA message filters use a rule-action model with 'if' conditions on envelope, header, body, and attachment attributes; filters run before content filters and can quarantine, drop, or add headers.

Cisco WSA (Web Security Appliance): proxy authentication modes are IP-based, LDAP/AD, and explicit; identity is resolved by the first matching identification profile in order, so ordering matters.

WSA access policies are evaluated top-down and the first match wins; a policy can apply URL filtering, application visibility/control, anti-malware, and DVS (Data Security) engines.

TLS decryption on WSA requires a certificate authority to re-sign; certificate pinning and non-standard ports are the common causes of decryption bypass or breakage.

Cisco Umbrella Secure Web Gateway: the intelligent proxy selectively proxies risky domains instead of all traffic, which avoids full inline decryption for known-good categories.

Content disarm and reconstruction (CDR) strips active content and rebuilds the file; sandboxing (Cisco Threat Grid/AMP) detonates the file and returns a verdict, so the two are complementary rather than substitutes.

Anti-spam verdicts: ESA uses SBRS (SenderBase Reputation Score, -10 to +10), CASE for graymail, and outbreak filters; a message can be marked spam by score threshold without matching a content filter.

Cisco Secure Endpoint (formerly AMP for Endpoints): the connector sends file reputation queries to the cloud, and only unknown or malicious files are uploaded for analysis; the policy sets file size and CPU limits.

Exploit prevention in Secure Endpoint intercepts behavior at the API level (e.g., protection from DLL hijacking, heap spray, and command-shell abuse) rather than matching signatures, so it can block fileless attacks.

Isolation (Secure Endpoint Isolation / Umbrella) tunnels the browser session through Cisco's cloud; the endpoint's own network stack is not used, so the user can view but not download or execute content.

Cisco XDR correlates telemetry from endpoint, network (Secure Network Analytics/Stealthwatch), email, and identity; detection requires the telemetry module to be enabled on the relevant sensor.

Cisco Secure Client (formerly AnyConnect) with ISE Posture: the posture module returns posture assessment to ISE, and the authorization result is applied via downloadable ACL, SGT, or VLAN change.

802.1X with MAB: MAB is a fallback for devices that cannot supplicate; it authenticates the MAC address only, so it should be combined with profiling and CoA to re-authorize when the device is identified.

Windows Defender and third-party AV conflict: Cisco recommends registering Secure Endpoint as the AV provider or excluding directories to avoid double-scanning, because two real-time scanners degrade performance.

Cisco ISE deployment: standalone, distributed (PAN, MNT, PSN, pxGrid nodes) and each persona can be combined; a distributed deployment requires a primary PAN and at least one PSN, and the PSN is what NADs point to for RADIUS.

RADIUS vs TACACS+: RADIUS uses UDP 1812/1813 and combines authentication and authorization in one exchange; TACACS+ uses TCP 49, encrypts the entire payload, and separates authentication, authorization, and accounting.

EAP types: PEAP and EAP-TLS establish a TLS tunnel; EAP-TLS requires certificates on both client and server, PEAP/MSCHAPv2 requires only a server certificate. EAP-FAST uses PACs instead of certificates.

802.1X roles: the supplicant (client), authenticator (switch/WLC/NAD), and authentication server (ISE). EAPOL runs between supplicant and authenticator; RADIUS runs between authenticator and ISE.

ISE policy sets are evaluated top-down and the first matching set wins; within a set, authentication policy matches identity, and authorization policy matches conditions to return a result (VLAN, DACL, SGT, URL redirect).

CoA (Change of Authorization, RFC 5176) lets ISE re-authorize a session without reauthentication; it requires the NAD to accept CoA on UDP 1700 and the shared secret to match.

SAML vs OAuth 2.0 vs OIDC: SAML is XML-based SSO for browser flows; OAuth 2.0 is authorization delegation (access tokens); OIDC adds an identity layer on OAuth 2.0 with a signed ID token (JWT).

MFA factors are categorized as something you know, have, or are; TOTP is a possession factor and is phishable via real-time relay, while FIDO2/WebAuthn binds the credential to the origin and resists phishing.

Guest and BYOD flows in ISE: guest uses sponsor and self-registration portals with a guest type defining access duration; BYOD uses a certificate provisioning portal and the device must be registered before it is authorized.