I85PREP
⌘ K
CNEpv study materials
CNEpv study resources

CNEpv: Network Security, Access Control, and Threat Mitigation

CNEpv · Work through your exam, one topic at a time.

All guide sections

Network Security, Access Control, and Threat Mitigation

This domain tests defense in depth: identity, segmentation, policy enforcement, and detection. Expect AAA, 802.1X, ACL logic, DMZ design, IPsec and TLS, PKI, common attacks, and Layer 2 protections such as DHCP snooping and dynamic ARP inspection.

Core rules

  • Least privilege and default deny reduce blast radius. AAA separates authentication, authorization, and accounting.
  • 802.1X roles are supplicant, authenticator, and authentication server. MAB is a fallback for devices that cannot run a supplicant, not a strong replacement.
  • Standard ACLs filter by source and are placed near the destination; extended ACLs filter source, destination, protocol, and port and are placed near the source.
  • ACLs are evaluated top-down and end with an implicit deny. Stateful firewalls track sessions; stateless ACLs must permit return traffic explicitly.
  • DHCP snooping blocks rogue DHCP servers; dynamic ARP inspection validates ARP against the snooping binding table; port security limits MAC addresses per port.
  • Encryption provides confidentiality, hashing provides integrity, and signatures provide origin authentication. TLS and IPsec combine mechanisms.

Worked example

Users on 10.10.10.0/24 need HTTPS to server 172.16.1.10. An extended ACL on the user-facing router interface inbound should permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 443 before any deny. If users also need DNS, add a permit for UDP 53 to the resolver first. Placement near the source stops unwanted traffic early. The implicit deny blocks all other traffic, so the rule order and required services must be checked.

Traps

ACL order matters; a broad deny before a permit makes the permit unreachable. NAT can change source or destination before or after filtering depending on direction. A DMZ server should not have unrestricted access to the internal network. Port security does not stop ARP spoofing by itself.