CCNP Security key terms

A logical grouping of interfaces, VLANs, or subnets that share one security policy. Firewalls permit or deny traffic between zones while usually allowing unrestricted traffic inside a zone.

A Cisco firewall configuration model in which interfaces join zones and policy defines which traffic may pass between them, replacing older per-interface inspection rules with clearer, scalable controls.

An ordered set of permit and deny statements matched against packet headers such as addresses, protocols, and ports. Used for traffic filtering, NAT matching, and routing policy.

A quality-of-service mechanism that rate-limits traffic sent to a router's or switch's CPU, shielding routing protocols and management services from floods and denial-of-service attacks.

A standards-based suite that encrypts and authenticates IP packets using AH or ESP, providing confidentiality and integrity for site-to-site and remote-access virtual private networks.

The Internet Key Exchange version 2 protocol negotiates, authenticates, and refreshes IPsec security associations. It offers stronger authentication options, mobility support, and fewer message exchanges than IKEv1.

A Cisco IPsec framework built on IKEv2 that uses a single configuration approach for site-to-site, hub-and-spoke, and remote-access tunnels, including routing integration and per-peer policy.

Dynamic Multipoint VPN combines multipoint GRE, next-hop resolution, and IPsec so spokes can build tunnels to the hub and to each other without preconfigured peer addresses.

A value inserted into a packet header that identifies the group an endpoint belongs to. Enforcement devices apply segmentation policy using the tag instead of IP addresses.

The split of security duties between a cloud provider and its customer. The provider secures the underlying infrastructure; the customer secures data, identities, configurations, and workloads they control.

A control point placed between users and cloud services that discovers shadow IT and enforces visibility, data protection, threat prevention, and compliance policy across SaaS and IaaS.

A cloud-delivered security stack that commonly bundles secure web gateway, cloud access security broker, zero trust network access, and data loss prevention to protect access regardless of user location.

An architecture that converges wide-area networking with cloud-delivered security services, delivering connectivity and policy close to users and branches from a single vendor platform.

A stateful virtual firewall attached to cloud instances or network interfaces. Rules define which inbound and outbound flows are allowed, and everything else is denied by default.

A trust relationship in which an identity provider authenticates users and passes signed assertions to service providers using standards such as SAML or OpenID Connect, avoiding separate credentials per application.

A proxy-based control that inspects user web requests and enforces policy for URL categories, malware, application use, and encrypted traffic before content reaches the browser.

A control that sorts requested web destinations into categories and applies allow, block, or warn actions based on policy, user identity, and reputation.

A proxy function that terminates incoming TLS, inspects the plaintext for threats and policy violations, then re-encrypts traffic toward the destination, subject to privacy and compliance exceptions.

Detection and control of sensitive information such as personal data, credentials, or card numbers moving through email, web, endpoints, or cloud, with actions ranging from logging to blocking.

A mail filtering control that inspects inbound and outbound messages for spam, phishing, malware, and sensitive content using reputation, content analysis, and attachment detonation.

A cloud lookup that scores files and URLs by prevalence, age, and known verdicts, letting security devices block known-bad objects quickly without full local analysis.

Running suspicious files or links in an isolated, instrumented environment to observe behavior and detect malicious activity that signatures and static checks would miss.

Agent software on endpoints that blocks known and unknown threats using signatures, heuristics, exploit mitigation, and behavioral rules, focusing on prevention rather than investigation.

Endpoint software that continuously records process, file, and network telemetry, then applies analytics and response actions so analysts can detect, investigate, and contain incidents.

A platform that correlates telemetry from endpoints, network, email, identity, and cloud sources into unified detections, reducing tool sprawl and speeding cross-domain investigation and response.

Controls that block the memory-corruption and scripting techniques attackers use to execute code, protecting hosts even when the payload has no known signature.

Detection that watches sequences of process, file, registry, and network activity for malicious patterns such as credential dumping or mass encryption, instead of relying on file signatures.

A proactive, hypothesis-driven search through collected telemetry for hidden adversary activity, performed by analysts rather than waiting for automated alerts.

A response action that cuts a suspected host off from the network while keeping the agent manageable, preventing spread while analysts investigate and remediate.

An IEEE standard for port-based network access control that authenticates a supplicant through EAP exchanges before the switch port or wireless session grants access.

A fallback access method that authenticates a device by its MAC address when no 802.1X supplicant is present, providing weaker assurance and usually limited authorization.

A AAA protocol carrying authentication, authorization, and accounting between network access devices and a central policy server, commonly transporting EAP messages inside its attributes.

A framework of authentication methods exchanged between supplicant and server, carried inside 802.1X and RADIUS. Variants include EAP-TLS, PEAP, and EAP-FAST.

A policy platform providing RADIUS and TACACS+ services plus device profiling, posture, guest lifecycle, and identity-based segmentation enforcement across wired, wireless, and VPN access.

Evaluation of an endpoint's compliance, including patch level, antimalware state, and disk encryption, before or after access is granted, with remediation or restricted access for failures.

A framework that authenticates users and devices, checks endpoint compliance, and places them into the right network segment or VLAN before granting access.

An access model replacing broad remote-access VPN with per-application connectivity granted after verifying user identity, device posture, and context, without placing users on the corporate network.

A security philosophy that grants no implicit trust from network location and instead verifies identity, device health, and context for every request, enforcing least privilege continuously.

A Cisco AAA protocol that separates authentication, authorization, and accounting and encrypts the entire payload, widely used to control administrative access to network devices.