Security Fundamentals
Vocabulary and program elements
Separate vulnerability (a weakness), exploit (the method that abuses it), and threat (a potential actor or event). Mitigations map to confidentiality, integrity, and availability. Program questions test user awareness training, physical access control, and incident response - they are not configuration tasks.
Hardening and AAA
Minimum baseline: enable secret rather than enable password, service password-encryption, a login banner, exec-timeout, SSH instead of Telnet, disabled unused services, and unused ports shut or parked in an unused VLAN. AAA means authentication, authorization, accounting. In 802.1X the supplicant is the client, the authenticator is the switch, and the authentication server is RADIUS - trap: the switch is never the authentication server.
Layer 2 protections
Port security limits MACs per port. Violation modes: protect (drop, no log), restrict (drop, log, increment counter), shutdown (err-disable, the default). Sticky learning writes learned MACs into the running config. DHCP snooping trusts only ports toward the legitimate server; untrusted ports drop server-sourced offers. Dynamic ARP Inspection uses the snooping binding table to drop spoofed ARP replies.
ACLs
Standard ACLs (1–99, 1300–1999) match source only and belong near the destination. Extended ACLs (100–199, 2000–2699) match protocol, source, destination, and ports, and belong near the source. Every ACL ends with an implicit deny any. Wildcard masks invert the subnet mask.
Rule of thumb
For /27 (255.255.255.224), wildcard = 255 − 224 = 0.0.0.31. Apply the same subtraction to every octet to build any wildcard.