I85PREP
⌘ K
CNPE study materials
CNPE study resources

CNPE: Network Security

CNPE · Work through your exam, one topic at a time.

All guide sections

Network Security

The Network Security domain tests whether you can place controls where they actually reduce risk - segmentation, filtering, identity and encryption - on the right device and in the right order.

Segmentation and filtering

  • Segment by function and trust level (guest, user, server, management, DMZ) with a routed or firewalled boundary rather than one flat VLAN. VRFs separate overlapping address space on shared hardware.
  • Standard ACLs (1–99, 1300–1999) match source only and belong near the destination. Extended ACLs (100–199, 2000–2699) match source, destination, protocol and port, and belong near the source so unwanted traffic never crosses the core.
  • ACLs are first-match and end in an implicit deny, so an explicit permit for the traffic you need is mandatory.
  • Stateful firewalls track sessions, so return traffic needs no rule; stateless filters need one in each direction.

Identity and cryptography

  • 802.1X roles: supplicant, authenticator (switch or AP), authentication server (RADIUS, UDP 1812/1813). EAP-TLS certifies both ends; PEAP and EAP-TTLS build a TLS tunnel and usually certify only the server.
  • TACACS+ (TCP 49) separates authentication, authorisation and accounting; RADIUS bundles authentication with authorisation.
  • IPsec: IKE on UDP 500 (NAT-T 4500) negotiates SAs; ESP (protocol 50) encrypts and authenticates; AH (51) authenticates including the outer IP header but never encrypts. Tunnel mode protects the whole original packet, transport mode only the payload.
  • Layer 2 hardening: DHCP snooping builds the binding table that dynamic ARP inspection checks against; port security limits MACs per port; BPDU guard err-disables an edge port that receives a BPDU.

Worked example

A guest VLAN needs internet and DNS at 10.20.5.53 but must never reach finance 10.20.0.0/16. Applied inbound on the guest SVI, the extended ACL is: permit udp any host 10.20.5.53 eq 53, deny ip any 10.20.0.0 0.0.255.255, permit ip any any. Swap the first two and DNS dies; omit the last and the implicit deny blocks everything.

Traps that cost marks

Treating NAT as a security control. Placing an extended ACL near the destination and wasting WAN capacity. Assuming AH provides confidentiality. Thinking 802.1X validates users when the deployment is really MAC authentication bypass, which is a weak fallback.