CCIE Security flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security Group Tag

A 16-bit Cisco TrustSec value assigned to a user or device that classifies traffic for SGACL enforcement, independent of IP address or VLAN.

SXP purpose

SGT Exchange Protocol propagates IP-to-SGT bindings between network devices over TCP 64999 so that tags survive across devices that cannot carry inline metadata.

ESP versus AH

ESP encrypts and authenticates the payload and supports NAT traversal; AH authenticates only, covers the outer IP header, and is incompatible with NAT.

DMVPN Phase 3

Adds NHRP redirect on the hub and shortcut switching on spokes, letting spoke-to-spoke traffic bypass the hub without disabling split horizon on the tunnel interface.

CoPP function

Control Plane Policing uses MQC class and policy maps applied globally to rate-limit traffic destined to the router CPU, protecting the control plane from DoS.

Dynamic ARP Inspection

A switch feature that validates ARP packets against the DHCP snooping binding table, dropping spoofed ARP replies used in man-in-the-middle attacks.

Zone-based firewall default

Traffic between interfaces in the same zone is not inspected; traffic between different zones requires a zone-pair policy with an inspect or pass action.

Cloud shared responsibility

The provider secures physical and hypervisor layers; the customer secures identity, data, guest OS patching on IaaS, and configuration of provider-native controls.

Security group statefulness

AWS security groups are stateful and allow-only, so return traffic is automatically permitted; network ACLs are stateless and need explicit rules in both directions.

Gateway Load Balancer endpoint

A VPC endpoint that redirects traffic to firewall or inspection appliances, requiring route tables to send the return path back through the endpoint.

IAM explicit deny

In AWS policy evaluation, an explicit deny in any applicable policy overrides every allow, including those from service control policies and resource policies.

Azure NSG priority

Rules use priority 100 to 4096, evaluated lowest number first; processing stops at the first match, so a deny must precede a broader allow.

Umbrella DNS enforcement

DNS queries are forwarded to Umbrella resolvers, so blocking occurs before a TCP connection is established, which stops the request at name resolution.

KMS envelope encryption

A customer master key wraps a data key that encrypts the data; key policies and grants control who may use the master key.

ESA mail pipeline

Messages pass the workqueue, listener, host access table, sender and recipient groups, then content and message filters before delivery or quarantine.

WSA identity order

Identification profiles are evaluated in order and the first match determines identity; ordering therefore decides which access policy applies to a user.

WSA TLS decryption

The appliance re-signs connections with its own certificate authority; certificate pinning and non-standard ports commonly cause decryption bypass or application breakage.

Umbrella intelligent proxy

A selective proxy that only inspects risky domains rather than all web traffic, reducing the need for full inline decryption of known-good categories.

CDR versus sandboxing

Content disarm and reconstruction strips active content and rebuilds the file; sandboxing detonates the file and returns a verdict. They are complementary controls.

SBRS score

SenderBase Reputation Score ranges from -10 to +10; the ESA can mark a message as spam based on the score threshold without any content filter match.

Secure Endpoint file flow

The connector queries cloud reputation first; only unknown or malicious files are uploaded for analysis, subject to policy file-size and CPU limits.

Exploit prevention behavior

Secure Endpoint intercepts malicious behavior at the API level, such as DLL hijacking and heap spray, so it can block fileless attacks that have no signature.

Endpoint isolation

The browser session is tunneled through Cisco's cloud instead of the endpoint network stack, so users can view content but cannot download or execute it.

Cisco XDR telemetry

Correlation across endpoint, network, email, and identity requires each relevant sensor's telemetry module to be enabled and forwarding to the detection platform.

MAB authentication

MAC Authentication Bypass authenticates only the device MAC address as a fallback for non-supplicant devices; profiling and CoA should re-authorize once identified.

ISE posture flow

The Secure Client posture module reports assessment results to ISE, which returns an authorization result such as a downloadable ACL, SGT, or VLAN change.

RADIUS versus TACACS+

RADIUS uses UDP 1812 and 1813 and combines authentication with authorization; TACACS+ uses TCP 49, encrypts the full payload, and separates all three functions.

EAP-TLS requirement

Both client and server present certificates, giving mutual certificate authentication; PEAP instead needs only a server certificate and tunnels an inner method.

802.1X three roles

The supplicant is the client, the authenticator is the switch or wireless controller, and the authentication server is ISE. EAPOL runs to the authenticator; RADIUS runs to ISE.

ISE policy set order

Policy sets are evaluated top-down and the first matching set wins; inside a set, authentication matches identity and authorization returns VLAN, DACL, or SGT.

CoA reauthorization

RFC 5176 Change of Authorization lets ISE change a live session's authorization without reauthentication; the NAD must accept CoA on UDP 1700 with a matching secret.

OIDC versus OAuth

OAuth 2.0 delegates authorization through access tokens; OpenID Connect adds an identity layer that issues a signed JWT ID token for authentication.