Security Fundamentals
The Security Fundamentals domain (15%) tests security concepts, AAA, ACLs, Layer 2 protections, VPNs, and device hardening. Most questions ask you to select the control that fits a threat or to evaluate an ACL's effect.
Security concepts and AAA
Confidentiality, integrity, and availability guide controls. Threats include phishing, malware, reconnaissance, and man-in-the-middle attacks; mitigations include segmentation, patching, and strong authentication. AAA separates authentication (who), authorization (what), and accounting (what happened). TACACS+ encrypts the full payload and separates functions; RADIUS encrypts only the password. 802.1X uses a supplicant, authenticator, and authentication server.
Access control lists
Standard ACLs match source IP only and should be placed near the destination; extended ACLs match source, destination, protocol, and ports and are placed near the source. Wildcard masks invert the subnet mask: /24 becomes 0.0.0.255, and host means 0.0.0.0. Every ACL ends with an implicit deny any; apply the correct direction with ip access-group in|out.
Layer 2 security
Port security limits MAC addresses per port; violation modes are protect (drop), restrict (drop and log), and shutdown (err-disable). DHCP snooping marks trusted ports toward the server and blocks rogue offers. Dynamic ARP Inspection uses the DHCP snooping binding table. BPDU Guard, Root Guard, and storm control protect the switching topology.
VPNs and hardening
Site-to-site VPNs connect networks through IPsec; remote-access VPNs use client software or clientless browsers. Harden devices with SSH instead of Telnet, local user secrets, exec-timeout, banner messages, disabled unused services, and centralized logging.
Worked example
To permit only 192.168.1.0/24 to reach server 10.0.0.5 on TCP 443, use an extended ACL near the source: access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.5 eq 443. The wildcard 0.0.0.255 matches the whole /24, and host 10.0.0.5 is equivalent to 10.0.0.5 0.0.0.0. Remember the implicit deny that follows.
Traps
Forgetting the implicit deny; reversing wildcard masks; placing a standard ACL far from the destination; and confusing protect and restrict, where only restrict logs.