Security Fundamentals
Security Fundamentals
Security Fundamentals tests defensive design rather than exploits: the CIA triad, threat categories, AAA, ACLs, Layer 2 hardening, VPN types, and wireless security standards.
Core rules
- ACLs process top-down and stop at the first match; every ACL ends with an implicit deny. Standard ACLs filter source only and go near the destination; extended ACLs filter source, destination, protocol, and port and go near the source.
- Wildcard masks invert the subnet mask: /24 = 0.0.0.255, one host = 0.0.0.0, any = 255.255.255.255.
- Port security limits MAC addresses per access port: default maximum 1. Violation modes are protect (drop, log), restrict (drop, log, count), and shutdown (err-disable).
- DHCP snooping marks uplinks trusted; untrusted ports cannot offer DHCP. Dynamic ARP Inspection uses the snooping table to drop forged ARP replies.
- Site-to-site VPNs use IPsec: ESP encrypts, AH provides integrity only. Remote access commonly uses TLS or IPsec IKEv2. WPA2 uses AES-CCMP; WPA3 replaces the PSK handshake with SAE.
Worked example
Permit only 192.168.1.0/24 to reach 10.0.0.5 on TCP 443: access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.5 eq 443 The wildcard 0.0.0.255 matches the /24, and host supplies a 0.0.0.0 wildcard for the server address.
Traps
Writing the subnet mask instead of the wildcard; forgetting the implicit deny blocks everything not explicitly permitted; enabling port security on a trunk; and confusing AH (no encryption) with ESP.