I85PREP
⌘ K
CNPA study materials
CNPA study resources

CNPA: Network Security Fundamentals

CNPA · Work through your exam, one topic at a time.

All guide sections

Network Security Fundamentals

This domain tests defensive fundamentals: the CIA triad, AAA, threat recognition, control types, filtering logic, VPN building blocks and Layer 2 hardening. Items are often scenario-based, asking what a control prevents or where an ACL belongs.

Principles and controls

  • Confidentiality, integrity, availability; identification, authentication, authorization, accounting.
  • Least privilege, defense in depth, separation of duties, zero trust (verify explicitly, assume breach).
  • Controls are administrative (policy, training), technical (ACL, encryption, 802.1X) or physical (locks, cameras), and preventive, detective (IDS, logs) or corrective (restore, patch).

Threats to recognise

  • Spoofing: IP, MAC, ARP poisoning (on-path), DNS cache poisoning, rogue DHCP server.
  • DoS/DDoS: SYN flood, UDP amplification, volumetric attacks.
  • VLAN hopping via switch spoofing (DTP) or double tagging; DHCP starvation exhausting the pool.
  • Rogue AP and evil twin, deauthentication attacks, phishing and social engineering, credential stuffing.

Enforcement tools

  • Stateless ACLs filter on the 5-tuple; stateful firewalls track sessions; NGFWs add application inspection. A DMZ hosts public-facing services.
  • ACL evaluation is top-down, first match wins, with an implicit deny at the end. Standard ACLs match source only and belong near the destination; extended ACLs belong near the source.
  • IPsec: AH provides integrity and authentication only; ESP adds confidentiality. IKE negotiates security associations; tunnel mode protects site-to-site traffic.
  • Layer 2 hardening: port security with sticky MACs (protect drops silently, restrict logs, shutdown err-disables), DHCP snooping, dynamic ARP inspection, BPDU guard, unused ports shut down, native VLAN changed.
  • Crypto: symmetric AES for bulk data, asymmetric RSA/ECDSA for key exchange and signatures, SHA-256/HMAC for integrity, PKI certificates for trust.

Worked example

Requirement: deny HTTPS from 192.168.10.0/24 to 10.1.1.10 but allow everything else. On the router interface facing 192.168.10.0/24, inbound: access-list 100 deny tcp 192.168.10.0 0.0.0.255 host 10.1.1.10 eq 443 access-list 100 permit ip any any Order matters: if the permit came first, every packet would match it and the deny would never be evaluated. Omitting the final permit would trigger the implicit deny and black-hole all traffic from that subnet.

Traps

  • Assuming AH encrypts payloads; only ESP does.
  • Placing a standard ACL near the source, where it blocks more traffic than intended.
  • Thinking port security protect mode sends alerts; it drops frames silently.
  • Believing NAT or a hidden SSID is a security control.
  • Confusing hashing (one-way integrity) with encryption (reversible with a key).