I85PREP
⌘ K
CCNP Security study materials
CCNP Security study resources

CCNP Security: Secure Access

CCNP Security · Work through your exam, one topic at a time.

All guide sections

Secure Access

Concepts to know

Secure access is identity-centric: Cisco ISE with 802.1X, MAB, web authentication, guest and BYOD flows, profiling, posture, and authorization policies. Know EAP-TLS (certificate), PEAP-MSCHAPv2 (credentials), and MAB (MAC address) tradeoffs. TrustSec uses security group tags (SGTs) and SGACL enforcement; inline tagging carries tags in the frame, while SXP propagates them to devices that cannot tag. pxGrid shares context. Zero Trust and ZTNA emphasize identity, device posture, and least privilege. Remote access includes AnyConnect and Duo MFA.

Traps

  • MAB is not authentication of the user; it is identity by MAC and is spoofable.
  • Authorization policy order matters; the first matching rule wins.
  • Profiling identifies a device; posture checks its compliance-do not confuse them.
  • 802.1X requires supplicant, authenticator, and authentication server; a missing supplicant may fall back to MAB or web auth.
  • SGT inline tagging requires hardware support; SXP is a propagation protocol, not enforcement.

Worked example

A laptop connects to a switch port. The supplicant starts EAP-TLS; ISE authenticates the certificate, profiles the device, checks posture, and assigns an SGT via authorization. If the supplicant is absent, the switch can use MAB, but policy should treat it as less trusted. Rule of thumb: authenticate, authorize, then posture-and log the identity source.