CCNP Security cheat sheet

IKEv2 uses a four-message exchange (IKE_SA_INIT plus IKE_AUTH); IKEv1 main mode uses six messages and aggressive mode uses three.

ESP provides confidentiality and integrity; AH provides integrity only and is not NAT-friendly because it hashes the immutable IP header fields.

DMVPN phase 3 uses NHRP shortcuts: the hub returns redirect information so spokes build direct tunnels for spoke-to-spoke traffic.

FlexVPN is an IKEv2-only framework covering site-to-site, hub-and-spoke, and remote access with a single configuration model.

Zone-based firewall: traffic between interfaces in the same zone is not inspected; inter-zone traffic requires an explicit policy with an inspect action.

uRPF strict drops packets whose source is not reachable via the ingress interface; loose mode only verifies the source prefix exists in the routing table.

MACsec (802.1AE) encrypts each Layer-2 hop with keys negotiated by MKA (802.1X-2010); unlike IPsec, it is hop-by-hop rather than end-to-end.

CoPP applies MQC policy-maps with police actions to control-plane traffic to protect the CPU from punted-packet floods.

TrustSec carries the 16-bit SGT inline in the CMD field or via SXP; SGACLs enforce policy by tag instead of by IP address.

Shared responsibility: the provider secures facilities, hardware, and hypervisor; the customer secures guest OS, identities, data, and configuration from IaaS upward.

CASB modes are forward proxy, reverse proxy, and API; API mode gives visibility and control of sanctioned SaaS without redirecting user traffic.

AWS security groups are stateful and allow-only; NACLs are stateless, evaluated in rule order, and support both allow and deny entries.

Umbrella blocks at the DNS layer: endpoints and networks point resolvers at Umbrella, so malicious domains never resolve to an IP address.

Umbrella SIG adds cloud firewall, CASB, DLP, and TLS inspection on top of DNS-layer security and removes the need to backhaul traffic to a physical edge.

VPC flow logs record IP/traffic metadata such as 5-tuple, byte counts, and accept/reject decisions, but not packet payloads.

Containers share the host kernel, so a kernel-level exploit can cross container boundaries; VMs each run a separate kernel.

Cisco Stealthwatch Cloud consumes VPC flow logs and provider APIs to build behavioral baselines without deploying agents.

SPF authorizes sending IPs in a DNS TXT record; DMARC aligns SPF/DKIM with the visible From domain and sets policy to none, quarantine, or reject.

DKIM signs selected headers and body with a private key; the matching public key is published at selector._domainkey..

On an ESA, the Host Access Table on each listener decides which senders may relay; message filters and content filters act on accepted mail.

WSA explicit proxy listens on port 3128; transparent deployment requires WCCP or PBR to intercept client HTTP/HTTPS without client configuration.

TLS decryption requires distributing the WSA-generated CA to clients; certificate-pinned applications and mutual TLS must be bypassed.

AMP for email detaches attachments for reputation and sandbox analysis, and verdict changes retroactively quarantine already-delivered messages.

DLP combines content classifiers, document fingerprints, and sensitivity levels; policies can be enforced on ESA, WSA, and Umbrella.

URL category governs acceptable-use policy, while URL reputation scores likelihood of maliciousness and drives malware and phishing blocks.

Roaming clients (Umbrella roaming client or AnyConnect module) apply DNS and web policy off-network without tunneling all traffic to headquarters.

AMP uses file reputation, static and dynamic analysis, and exploit prevention; verdicts can change retroactively and trigger automatic quarantine.

Exploit prevention blocks techniques such as heap spray, ROP chains, and buffer overflows rather than file signatures, covering zero-day memory corruption.

File trajectory maps parent/child execution lineage across the organization to scope an outbreak to affected hosts.

EDR continuously records process, file, network, and registry telemetry and supports response actions such as host isolation.

XDR correlates telemetry across endpoint, network, email, cloud, and identity sources; EDR is endpoint-centric.

Cisco SecureX ties Secure Endpoint, Firepower, Umbrella, and Email together for threat response and orchestration workflows.

Application allow listing is default-deny against an approved binary list; it stops unknown malware but demands ongoing list maintenance.

Cisco Secure Endpoint can isolate a host, cutting all traffic except to the cloud console, to contain an active threat.

802.1X has three roles: supplicant, authenticator (switch or WLC), and authentication server (ISE); EAP-TLS requires certificates on both client and server.

PEAP builds a TLS tunnel using a server certificate and then runs inner MSCHAPv2 for user credentials.

MAB falls back to MAC-address authentication for supplicant-less devices; MAC spoofing makes it a low-assurance method.

ISE authorization policies run after authentication and can assign a VLAN, DACL, SGT, or redirect the session to a portal.

CoA (RFC 5176) changes an active session's authorization, such as VLAN, DACL, or SGT, without forcing re-authentication.

Posture checks (AV, patch level, disk encryption) gate full access; non-compliant endpoints are placed in a remediation VLAN or portal.

pxGrid publishes ISE identity and session context to Firepower, Stealthwatch, and other platforms, replacing point-to-point integrations.

SGTs can be assigned dynamically by ISE via SXP or inline tagging and enforced by SGACLs on TrustSec-capable switches.

ZTNA brokers per-application access based on identity and device posture instead of granting broad network-level VPN access.