I85PREP
⌘ K
Cisco ENNA 300-445 study materials
Cisco ENNA 300-445 study resources

Cisco ENNA 300-445: Security Fundamentals

Cisco ENNA 300-445 · Work through your exam, one topic at a time.

All guide sections

Security Fundamentals

Security Fundamentals

This domain tests the security controls that protect enterprise access and transit: AAA, ACLs, Layer 2 defenses, VPN concepts, and wireless security. Questions often ask where a control is applied and what it actually inspects.

Core rules

  • AAA separates authentication (who), authorization (what), and accounting (what was done). TACACS+ uses TCP 49 and encrypts the entire payload; RADIUS uses UDP 1812/1813 and encrypts only the password.
  • Standard ACLs (1-99, 1300-1999) match source IP only. Extended ACLs (100-199, 2000-2699) match source, destination, protocol, and ports. Wildcard bits: 0 means match, 255 means ignore. Every ACL ends with an implicit deny.
  • Place extended ACLs near the source; place standard ACLs near the destination. Apply inbound or outbound on an interface; an empty or wrong direction can block or permit unintended traffic.
  • Layer 2 security: port security limits MAC addresses per port; DHCP snooping blocks rogue DHCP servers; Dynamic ARP Inspection validates ARP against the snooping table; IP Source Guard binds source IP/MAC to the binding table.
  • 802.1X uses a supplicant, authenticator (switch), and authentication server (RADIUS). VPNs use IPsec with AH for integrity or ESP for encryption and integrity; IKE negotiates security associations.
  • Wireless: WPA2/WPA3 use AES; WPA3 adds SAE. Enterprise mode uses 802.1X/EAP; personal mode uses a pre-shared key.

Worked example

Permit HTTP from 10.1.1.0/24 to host 172.16.1.10 and deny other IP traffic. Extended ACL: access-list 101 permit tcp 10.1.1.0 0.0.0.255 host 172.16.1.10 eq 80, then access-list 101 deny ip any any. Apply it inbound on the router interface facing 10.1.1.0/24. The /24 wildcard is 0.0.0.255; the host uses wildcard 0.0.0.0 or the host keyword. The explicit deny makes the implicit deny visible and logs if configured.

Traps

  • Writing permit ip any any at the top, which makes later lines unreachable.
  • Using a /24 mask as 0.0.0.255 in the wrong position; source and destination each need their own wildcard.
  • Forgetting that ACLs are stateless: return traffic needs its own rule or reflexive/stateful inspection elsewhere.
  • Assuming port security stops IP spoofing; it limits MAC addresses, not IP addresses.