Network Security
Network Security is the second-largest domain at 20% and is where firewall, VPN, and IPS mechanics are tested. Expect questions about how Cisco Secure Firewall Threat Defense (FTD) processes a packet, how IPsec phases fail, and how segmentation is enforced.
Firewall platforms and management
The classic ASA runs ASA software, managed by ASDM or FMC-classic. FTD is the unified image that combines ASA-style ACLs with Snort intrusion prevention, managed centrally by Firewall Management Center (on-premises) or the cloud-delivered FMC; a single device can instead be managed locally by Firepower Device Manager. Deployment modes: routed, transparent (Layer 2), inline set (IPS only, no filtering), and passive/tap. High availability is active/standby failover or clustering.
The FTD packet path
Ingress → prefilter policy → access control → Snort/IPS (intrusion and file policy) → egress. The prefilter is the key concept: rules there can fastpath traffic (bypassing Snort entirely), send it to the tunnel for decryption, or force analysis. If a question says the IPS never alerted, ask whether a prefilter fastpath or an access-control rule with intrusion policy disabled caused it.
VPN mechanics
Site-to-site IPsec runs IKE phase 1 (ISAKMP SA: encryption, hash, DH group, authentication) then phase 2 (IPsec SA: ESP, optional PFS). DMVPN is mGRE plus NHRP plus IPsec for hub-and-spoke with spokes building direct tunnels. FlexVPN is IKEv2-based with virtual tunnel interfaces. Remote access uses Cisco Secure Client (AnyConnect) over TLS/DTLS or IKEv2, with split tunneling deciding what enters the tunnel.
Segmentation and device hardening
Zones with ACLs, Control Plane Policing, uRPF, DHCP snooping, dynamic ARP inspection, BPDU Guard, and private VLANs. Implicit deny at the end of every ACL is authoritative.
Worked example
Two peers fail in phase 1 with "no proposal chosen." Reason it in order: the IKE policy attributes must match exactly - encryption, hash, DH group, and authentication method. A pre-shared-key mismatch produces an authentication failure instead, which tells you the proposal matched. If phase 1 succeeds but phase 2 fails, look at proxy identities (interesting-traffic ACLs must be mirror images), PFS settings, and the transform set. That ordered reasoning distinguishes the options.
Traps that cost marks
AH provides integrity and authentication but no confidentiality and breaks under NAT; ESP with NAT-T uses UDP 4500; the implicit deny at the ACL end; prefilter fastpath bypassing IPS inspection; and confusing DMVPN phase behavior with FlexVPN design.