JNCDS-SEC key terms

The process of interviewing stakeholders to capture what must be protected, which compliance rules apply, who needs access, and which threats matter most, before selecting any product or topology. It produces measurable acceptance criteria rather than vague goals.

A structured evaluation that ranks threats by likelihood and business impact so security spending targets the highest-value exposures. Outputs typically feed a prioritized control list that later design decisions must trace back to.

The set of systems, data flows, and locations subject to a regulation such as PCI DSS, HIPAA, or GDPR. Defining it early constrains segmentation, logging retention, and encryption choices throughout the design.

Layering independent controls so that failure or bypass of one does not expose the whole environment. Network examples include edge firewalls, internal segmentation, endpoint controls, and identity-based access working together rather than as a single chokepoint.

A model that grants access per session based on verified identity and device posture instead of implicit trust from network location. It typically combines strong authentication, least-privilege policy, and continuous monitoring of every request.

Dividing a data center or campus network into fine-grained policy zones, often down to individual workloads, so east-west traffic is filtered rather than freely flowing inside a VLAN. It limits lateral movement after a compromise.

Cisco's identity-based segmentation approach using Security Group Tags carried in the packet so switches and firewalls enforce policy by group label rather than by IP subnet. It decouples policy from addressing and simplifies rule sets.

An IEEE port-based access control standard where a supplicant proves identity to an authenticator, which consults a RADIUS server before permitting network access. It is the foundation for wired and wireless identity-based admission.

A fallback for devices that cannot run an 802.1X supplicant, such as printers or cameras, where the switch authenticates the device by its MAC address against the RADIUS server. It is weaker than certificate-based identity and should be scoped narrowly.

Detecting device type from DHCP, CDP/LLDP, HTTP user-agent, and MAC OUI attributes so policy can be applied to unknown or headless endpoints. It often supports dynamic VLAN or SGT assignment before full authentication succeeds.

A separate SSID or VLAN for visitors with restricted egress, client isolation, and no path to internal resources. Design must also address captive portal, bandwidth limits, and legal disclaimers.

A screened subnet hosting externally reachable services, positioned between the internet edge and internal networks with distinct firewall policy in each direction. It minimizes blast radius if a public-facing server is compromised.

Pairing firewalls in active/standby or active/active so that a device failure does not sever traffic. Design must cover state synchronization, failover link placement, and how routing reconverges around the failed unit.

HSRP, VRRP, or GLBP, which present a shared virtual gateway address so hosts keep connectivity when a distribution switch fails. The design must align the FHRP active node with the spanning-tree root and the routing next hop.

Choosing root bridges, port roles, and loop-prevention features such as PortFast, BPDU Guard, and Root Guard so Layer 2 topologies converge predictably. Deterministic root placement also keeps switched paths aligned with routing and FHRP roles.

Bundling multiple physical links into one logical link using LACP or a static bundle to add bandwidth and link redundancy. Members must match in speed, duplex, and VLAN configuration, and the bundle should span separate physical paths.

Cisco technologies that combine two physical switches into one logical device for simplified management and multi-chassis EtherChannel. They remove the need for spanning tree to block one uplink, improving both convergence and utilization.

The classic access, distribution, and core layering that separates user attachment, policy and aggregation, and high-speed transit. Each layer has clear roles, which keeps failure domains small and scaling predictable.

A two-tier design where distribution switches also perform core functions, used in smaller campuses where dedicated core capacity is unnecessary. It reduces cost and hop count but limits scaling and path diversity.

Pushing Layer 3 to the access switch so each closet is its own subnet and VLANs do not span the campus. This shrinks broadcast domains, speeds convergence, and simplifies policy at the cost of more routing adjacencies.

Calculating total power drawn by powered devices per switch and per power supply so that access points, cameras, and phones receive the class of power they need. Designs should account for failover scenarios where one supply is lost.

Planning AP placement, channel reuse, and controller or Catalyst 9800 capacity so coverage and roaming meet application needs. It depends on a site survey and on the throughput and latency requirements gathered for each client class.

A WAN architecture that centralizes policy and uses an overlay across multiple transports, steering traffic by application over the best path. It replaces static branch routing with centralized control and encrypted tunnels.

A hub-and-spoke tunneling design using mGRE and NHRP so spokes can build direct tunnels without static peer configuration. It is a traditional option when an SD-WAN overlay is out of scope.

A suite that authenticates and encrypts IP traffic using IKE for key exchange and ESP for payload protection. Designs must choose tunnel versus transport mode, interesting traffic, and whether to use a hub for spoke-to-spoke paths.

Classifying traffic by application signature and steering it over the path that meets its SLA, such as latency or jitter targets. It depends on accurate classification and continuous path-quality measurement.

The point where the network begins trusting or marking packet priority, usually the access edge or WAN handoff. Placing it correctly prevents users from spoofing priority while preserving markings across the WAN.

Choosing physical and logical interfaces, media, and routing at the boundary with a service provider, including whether to use BGP, static routes, or a managed CE. It determines how failover and SLA monitoring work.

Deciding autonomous system numbers, peering relationships, route filtering, and path selection so internal and external routing behave predictably. In campus and WAN designs it is usually paired with careful prefix advertisement and summarization.

Dividing a routing domain into areas, typically with a backbone and stub or totally stubby areas, to bound flooding and speed convergence. Area boundaries should align with summarization points and topology changes.

Advertising a single aggregate prefix instead of many specific routes to reduce table size and hide instability. It requires contiguous addressing and careful placement at area or autonomous system boundaries.

The paths used for device administration and telemetry, such as out-of-band consoles, management VLANs, AAA, and syslog. It should be separated from user traffic and reachable only through controlled access.

Centralized authentication, authorization, and accounting for device logins, commonly with TACACS+ for per-command authorization. It removes local credentials as the primary control and produces an audit trail.

Mechanisms for collecting device health and performance data, with SNMP polling as the legacy approach and model-driven streaming telemetry as the scalable alternative. Both require careful access control and rate planning.

A separate physical or logical path, such as a console server or dedicated management network, used to reach devices when the production network is down. It is essential for recovery from misconfiguration or outages.

A data center topology where every leaf connects to every spine, giving uniform, predictable any-to-any latency and easy horizontal scaling. It relies on Layer 3 routing or an overlay such as VXLAN to use all paths.

A data center overlay that encapsulates Layer 2 frames in UDP and uses BGP EVPN as the control plane for MAC and IP reachability. It enables large Layer 2 segments across a routed fabric without flooding.

The underlay is the routed physical fabric carrying loopback-to-loopback connectivity; the overlay is the logical tunneling layer built on top. Clear separation lets each scale and be troubleshot independently.

Cisco ACI, a policy-driven data center fabric where endpoint connectivity is defined by application profiles and contracts rather than per-switch CLI. It centralizes intent but requires a clear naming and policy model.

The design for linking two or more data centers for replication, workload mobility, or disaster recovery, using dark fiber, DWDM, or overlay tunnels. Choices hinge on latency, bandwidth, and whether Layer 2 extension is truly required.

Selecting hot, warm, or cold standby capacity and the replication and failover mechanisms that meet recovery time and recovery point objectives. It must be validated with tested runbooks, not just documented intent.