Security Concepts
Security Concepts is the largest slice of 350-701 (25%). It does not test product configuration; it tests whether you can look at an incident or a design and name the threat, the vulnerability, the control type, and the residual risk in the vocabulary Cisco uses everywhere else in the exam.
The vocabulary chain
- Asset - anything of value (data, server, reputation).
- Vulnerability - a weakness (unpatched CVE, weak password policy, missing segmentation).
- Threat - a potential cause of harm (actor plus capability plus intent).
- Exploit - the concrete technique that turns a vulnerability into compromise.
- Risk - likelihood × impact of the exploit succeeding against the asset.
Threat actors are described by motive and skill: script kiddie, hacktivist, organized crime (financial), nation-state/APT (persistence, stealth, long dwell time), and insider (misuse of legitimate access). Attack categories worth naming precisely: reconnaissance, social engineering (phishing, spear phishing, vishing, smishing, tailgating), DoS/DDoS (volumetric, SYN flood, application-layer), on-path/MITM, spoofing, credential attacks, SQL injection, XSS, buffer overflow, and privilege escalation.
Control types and AAA
Controls are preventive, detective, or corrective; and administrative, technical, or physical. AAA separates authentication (who you are), authorization (what you may do), and accounting (what you did). Non-repudiation comes from digital signatures, not from logging alone.
Cryptography facts the exam reuses
Symmetric (AES) is fast and used for bulk data but has a key-distribution problem. Asymmetric (RSA, ECDSA) solves key exchange and signatures but is too slow for bulk data. Hashing (SHA-256) gives integrity, not confidentiality, and a hash is not encryption. A digital signature is a hash of the message encrypted with the sender's private key, verified with the public key. PKI supplies trust: CA, RA, CRL versus OCSP for revocation, and a certificate chain to a trusted root.
Worked example
A database server is valued at $500,000. A successful DDoS would take it offline for four hours, so the exposure factor is 25%. Three events per year are expected. SLE = $500,000 × 0.25 = $125,000. Current ALE = $125,000 × 3 = $375,000. A scrubbing service lowers the expected rate to one event per year, giving ALE = $125,000. The maximum annual spend the analysis justifies is therefore about $250,000 before residual risk adjustments. That is the quantitative reasoning the item expects.
Traps that cost marks
Mixing up threat and vulnerability; using asset value as SLE; calling a hash "encryption"; claiming asymmetric crypto encrypts the bulk session; and confusing authentication with authorization in scenario stems.