CCIE Security key terms

Logical groupings of interfaces that share the same trust level and policy treatment on a firewall. Traffic moving between zones is inspected and controlled, while traffic within a zone is typically permitted without policy evaluation.

A Cisco IOS and IOS XE configuration model where interfaces are assigned to zones and traffic between zone pairs is governed by class maps and policy maps instead of legacy interface ACLs.

A configuration object that identifies traffic by matching criteria such as ACLs, protocol, or application. It is referenced by a policy map to determine which traffic a policy action applies to.

A configuration object that binds one or more class maps to actions such as inspect, drop, or pass. It defines what the device does with traffic that matches the referenced classes.

A feature that rate-limits and filters traffic destined for the device CPU using modular QoS policy, protecting routing and management protocols from denial-of-service floods without affecting transit traffic.

A feature restricting which interfaces may accept management protocols such as SSH, SNMP, or HTTPS, reducing the attack surface exposed on a router or switch.

An IPsec mode that protects only the payload of the original IP packet, leaving the original IP header intact. It is used mainly for host-to-host and some management traffic.

An IPsec mode that encapsulates the entire original IP packet inside a new IP header, hiding original addresses and enabling site-to-site VPNs between gateways across untrusted networks.

A one-directional agreement between IPsec peers specifying security parameters such as encryption algorithm, keys, and SPI. IKE negotiates pairs of SAs, one per direction, for each protected flow.

A property ensuring that compromise of a long-term key does not expose previously established session keys. It is achieved by deriving each session key from fresh ephemeral Diffie-Hellman exchanges.

Internet Key Exchange version 2, the protocol that authenticates IPsec peers, negotiates security associations, and supports features such as MOBIKE, EAP authentication, and asymmetric authentication methods.

A Cisco solution that builds IPsec tunnels between spoke sites on demand using NHRP and mGRE, avoiding full-mesh static configurations while supporting hub-and-spoke and direct spoke-to-spoke traffic.

A Cisco IPsec framework based on IKEv2 that unifies site-to-site, remote-access, and hub-spoke deployments using virtual templates, authorization attributes, and a single configuration model.

Numeric trust values from 0 to 100 assigned to ASA interfaces. By default, traffic from a higher level to a lower level is permitted and traffic in the reverse direction is denied unless explicitly allowed.

Cisco's stateful firewall and VPN platform family, configured with interface security levels, access control lists, and inspection policies. It is now largely superseded by Firepower Threat Defense.

A firewall that combines stateful inspection with application identification, user awareness, intrusion prevention, and threat intelligence, enabling policy based on applications and identities rather than ports alone.

A technique that intercepts and decrypts TLS traffic for content and threat inspection, then re-encrypts it toward the destination. It requires certificate trust configuration and careful handling of privacy and pinned applications.

The newest widely deployed TLS version, which reduces handshake round trips, removes legacy ciphers, and encrypts more of the handshake, complicating passive inspection and requiring updated decryption approaches.

A Cisco architecture that assigns security group tags to traffic and enforces group-based policy across network devices, decoupling access control from IP addressing and topology.

A metadata value inserted into a packet, or derived from identity context, that identifies the classification of the source. Network devices use it to enforce role-based access policy.

IEEE 802.1AE link-layer encryption that protects Ethernet frames between adjacent devices using hop-by-hop keys, providing confidentiality and integrity for wired links without IPsec overhead.

An approach where access decisions are based on authenticated user or device identity rather than static address, typically implemented with 802.1X, profiling, and group-based policy enforcement.

An IEEE standard for port-based network access control that authenticates a supplicant through an authenticator to an authentication server before granting network access.

Extensible Authentication Protocol, a framework carried inside 802.1X and RADIUS that supports multiple authentication methods such as EAP-TLS, PEAP, and EAP-TTLS.

An EAP method requiring certificates on both client and server for mutual authentication. It resists password-based attacks but demands a certificate enrollment and lifecycle process.

A protocol carrying authentication, authorization, and accounting attributes between a network access device and a central policy server. It commonly transports EAP methods for 802.1X deployments.

A Cisco-developed AAA protocol that encrypts the full packet body, separates authentication, authorization, and accounting, and is commonly used for administrative device access control.

The combined functions of authentication, authorization, and accounting that verify identity, determine permitted actions, and record activity for users and devices.

An XML-based standard for exchanging authentication and authorization assertions between an identity provider and a service provider, widely used for browser-based single sign-on.

An identity layer built on OAuth 2.0 that issues signed ID tokens containing user claims, enabling single sign-on and API authorization for modern applications.

An authorization framework issuing access tokens that grant scoped access to resources on behalf of a user or client, without sharing credentials. It is not itself an authentication protocol.

A trusted service that authenticates users and issues assertions or tokens about their identity to relying applications, often integrating with directory services and multi-factor authentication.

Public Key Infrastructure, the policies, roles, and systems that issue, distribute, validate, and revoke digital certificates, establishing trust between parties through certificate authorities.

A client-side control that binds a service to a specific certificate or public key, preventing acceptance of fraudulently issued certificates and complicating inspection-based decryption.

A security model that removes implicit trust based on network location and instead verifies every request using identity, device posture, and context before granting least-privilege access.

Cisco Identity Services Engine, a policy platform providing 802.1X authentication, device profiling, posture assessment, guest access, and group-based policy enforcement.

The process of checking an endpoint's compliance with security requirements, such as patch level, antivirus state, and disk encryption, before or after granting network access.

A security platform that continuously records endpoint activity, detects malicious behavior through analytics, and provides investigation and response capabilities such as isolation and process termination.

Streamed operational and security data from endpoints and network devices, sent to an analytics platform for detection, correlation, and investigation rather than local-only logging.

A standard protocol for forwarding event messages from network devices to a central collector, commonly used for audit trails, troubleshooting, and correlation with other security data.

A Cisco flow-export technology that summarizes traffic metadata such as addresses, ports, byte counts, and timing, supporting traffic analysis and anomaly detection without full packet capture.

A gateway that inspects inbound and outbound mail for spam, malware, phishing, and policy violations, often integrating with directory services and advanced sandboxing.

Detonating suspicious files or URLs in an isolated environment to observe behavior and derive verdicts, then using those verdicts to block similar threats elsewhere.

A proxy that enforces acceptable-use and threat policy for web traffic, applying URL categorization, malware scanning, and application controls to user requests.

Controls that detect and block sensitive data leaving an organization through email, web, or endpoint channels, using content classifiers, fingerprints, and policy actions.

A control point between users and cloud services that enforces visibility, data protection, threat protection, and compliance policy for sanctioned and unsanctioned cloud applications.

Cloud applications adopted without IT approval. Discovering and classifying them is a primary function of cloud access security brokers and cloud discovery tools.

A cloud-delivered security service providing DNS-layer enforcement, secure web gateway, and firewall capabilities, enforcing policy for users regardless of location.

A cloud construct acting as a stateful virtual firewall attached to instances or interfaces, allowing rules that reference other security groups as sources rather than only CIDR blocks.

Managing cloud and network resources through declarative templates and version control. Security review must cover templates because misconfigured definitions can silently expose resources.

The division of security duties between a cloud provider and its customer. The provider secures the underlying infrastructure, while the customer secures data, identities, and configuration.

Securing compute instances and containers in cloud environments through hardening, vulnerability management, runtime monitoring, and least-privilege identity, independent of the underlying provider network controls.