CCNP Security flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

ESP versus AH

ESP provides confidentiality plus integrity and authentication; AH provides integrity and authentication only, and AH breaks NAT traversal because it authenticates the IP header.

DMVPN phase 3

Spokes register with the hub using NHRP; the hub returns shortcut information so spokes build direct IPsec tunnels and send spoke-to-spoke traffic without traversing the hub.

uRPF strict mode

The router checks that a packet's source address is reachable through the interface it arrived on; spoofed sources are dropped. Loose mode only checks the routing table contains the prefix.

MACsec 802.1AE

Layer-2 hop-by-hop encryption using MKA for key exchange; it protects individual links against wiretapping and is distinct from end-to-end Layer-3 IPsec encryption.

Zone-based firewall default

Interfaces are assigned to zones; traffic between interfaces in the same zone passes without inspection, while inter-zone traffic requires an explicit policy with an inspect action.

Security Group Tag

A 16-bit TrustSec tag carried inline in the CMD field or propagated by SXP; SGACLs enforce policy based on the tag, decoupling rules from IP addressing.

Control Plane Policing

Applies MQC policy-maps with policers to traffic destined for the router CPU, rate-limiting protocol traffic so a flood cannot starve or crash control-plane processes.

Shared responsibility model

The cloud provider secures facilities, hardware, and hypervisor; the customer secures the guest OS, identities, data, and configuration for IaaS, PaaS, and SaaS workloads.

CASB deployment modes

Forward proxy, reverse proxy, and API-based. API mode discovers and monitors sanctioned SaaS applications without redirecting user traffic through an inline device.

Security group versus NACL

Security groups are stateful, allow-only, and attached to network interfaces; NACLs are stateless, evaluated in order, and support both allow and deny rules at the subnet level.

Umbrella DNS-layer security

Endpoints and networks forward DNS queries to Umbrella resolvers; requests for malicious domains are blocked before any IP connection to the destination can occur.

Umbrella SIG

A cloud-delivered secure internet gateway adding firewall, CASB, DLP, and TLS inspection on top of DNS-layer protection, replacing backhaul of branch traffic to a physical edge.

Container isolation limits

Containers share the host kernel, so a kernel exploit can cross container boundaries; virtual machines each run a separate kernel and therefore isolate more strongly.

SPF record

A DNS TXT record listing IP addresses authorized to send mail for a domain; receiving servers compare the connecting IP against the list to detect sender spoofing.

DKIM signing

The sender signs selected headers and the body with a private key; the public key published at selector._domainkey.domain lets receivers verify integrity and domain authenticity.

DMARC policy

Ties SPF and DKIM results to the visible From domain through alignment, then tells receivers how to handle failures: none, quarantine, or reject.

WSA explicit proxy

Clients are configured to send HTTP and HTTPS to the web proxy on port 3128; used when transparent interception by WCCP or PBR is not available.

TLS decryption limitation

The proxy cannot inspect certificate-pinned applications or mutual-TLS sessions; those destinations must be placed in a decryption bypass policy.

AMP for email

The email appliance detaches attachments for reputation and sandbox analysis; when a verdict changes later, already-delivered messages are retroactively pulled from mailboxes.

URL reputation versus category

Category describes the site's content type for acceptable-use policy; reputation scores how likely the site is malicious and drives malware and phishing blocking decisions.

Exploit prevention

Blocks attack techniques such as buffer overflows and ROP chains instead of matching known file signatures, so it can stop zero-day memory-corruption exploits.

Retrospective verdict change

A file first judged clean can be reclassified after new threat intelligence arrives; the endpoint agent then automatically quarantines it on every host that saw it.

File trajectory

Graphs the parent-child lineage and execution path of a file across the organization, letting analysts scope an outbreak to the hosts actually affected.

Host isolation

An endpoint response action that cuts all network communication except to the management console, containing an active compromise while allowing investigation to continue.

EDR versus XDR

EDR collects and analyzes telemetry from endpoints only; XDR correlates telemetry from endpoint, network, email, cloud, and identity sources into unified detections.

Application allow listing

Only explicitly approved executables may run, blocking unknown malware by default; it requires ongoing maintenance as legitimate applications are added and updated.

802.1X roles

The supplicant is the client, the authenticator is the switch or wireless controller, and the authentication server is ISE; EAP carries credentials between supplicant and server.

MAB authentication

MAC Authentication Bypass authenticates a device by its MAC address when no 802.1X supplicant exists; because MAC addresses can be spoofed, assurance is low.

Change of Authorization

RFC 5176 CoA lets ISE push new authorization such as a VLAN, DACL, or SGT to a switch for a live session without forcing re-authentication.

Posture assessment

ISE checks endpoint compliance, such as antivirus running, patch level, and disk encryption, before granting full access; non-compliant endpoints enter a remediation state.

pxGrid

A Cisco ISE platform service that shares identity and session context with products like Firepower and Stealthwatch, replacing one-off point-to-point integrations.

ZTNA

Per-application access granted by identity and device posture through a broker or proxy, rather than broad network-level VPN access for the entire device.