Overview
Security Fundamentals is 15% of the CCNA, ten objectives mixing concepts and configuration. It covers key security concepts (threats, vulnerabilities, exploits and mitigation); security program elements such as user awareness and training; configuring device access control with local passwords; password policy elements including complexity, MFA and certificates; IPsec remote access and site-to-site VPNs; configuring and verifying access control lists; Layer 2 security features including DHCP snooping, dynamic ARP inspection and port security; comparing authentication, authorization and accounting; wireless security protocols WPA, WPA2 and WPA3; and configuring a WLAN with WPA2 PSK in the GUI.
The configuration objectives, ACLs and the Layer 2 security trio, produce some of the trickiest simulation items, because a misordered ACL fails silently. The exam rewards both defining security concepts and configuring the practical controls correctly, building security onto the networks from the earlier domains.
How it's tested
CCNA questions in this domain mix concept identification with configuration, and ACLs and Layer 2 security often appear as simulations. For ACL items, trace the packet through each entry from the top and note the interface and direction where the list is applied before choosing.
-
Security concept
A threat or principle is described, and you identify the concept, AAA element or VPN type.
-
Configure ACLs
A filtering need is described, and you build or order an access control list correctly.
-
Layer 2 and wireless security
A switch-port or wireless need is described, and you choose the Layer 2 feature or wireless protocol.
An access control list must permit a specific host but deny the rest of its subnet, yet the deny-subnet rule is placed before the permit-host rule, and the host is blocked. ACLs are processed top-down and stop at the first match, so the broad deny matches the host first. Ordering the more specific permit-host rule before the deny-subnet rule lets the host through, which is the ACL-ordering principle the exam expects, since a misordered ACL fails silently.
Domains 10
Official domains from the Cisco outline, in outline order.
5.1 Define key security concepts (threats, vulnerabilities, exploits, mitigation)Threats, vulnerabilities, exploits and mitigation.
- What it means
- This covers key security concepts: threats, vulnerabilities, exploits, and mitigation techniques, and the vocabulary used to describe and reason about network security risks.
- What to understand
- A vulnerability is a weakness, a threat is a potential danger, an exploit takes advantage of a vulnerability, and mitigation reduces risk. Understanding these terms and how they relate frames the rest of security. The concepts are foundational and definitional.
- How it shows up
- A security situation is described, and you must identify the threat, vulnerability, exploit or mitigation.
- Common confusion
- Confusing a vulnerability (a weakness) with a threat (a potential danger) or an exploit (the attack using it).
5.2 Describe security program elementsUser awareness, training and physical access control.
- What it means
- This covers security program elements: user awareness programs, training, and physical access control, which address the human and physical dimensions of security beyond technical controls.
- What to understand
- People are a major security factor, so awareness programs and training reduce risks like phishing, and physical access control protects equipment. These organizational elements complement technical defenses. Recognizing their role is the expected knowledge.
- How it shows up
- A human or physical security need is described, and you must identify the program element.
- Common confusion
- Overlooking user training and physical access control as parts of a security program.
5.3 Configure and verify device access control using local passwordsSecuring device access with local passwords.
- What it means
- This covers configuring and verifying device access control using local passwords: securing console, VTY and privileged EXEC access with passwords, and encrypting them in the configuration.
- What to understand
- Local passwords protect access to the device's console, remote VTY lines and privileged mode, and should be encrypted in the configuration. This basic access control is the first line of device security and a common, tested configuration task.
- How it shows up
- A device access need is described, and you must configure or verify local password control.
- Common confusion
- Leaving passwords unencrypted in the configuration, or securing only some access lines.
5.4 Describe security password policy elementsManagement, complexity, MFA, certificates and biometrics.
- What it means
- This covers password policy elements: password management, complexity requirements, multifactor authentication, digital certificates, and biometrics, as ways to strengthen authentication.
- What to understand
- Strong authentication goes beyond passwords: complexity and management policies, multifactor authentication adding a second factor, certificates for cryptographic identity, and biometrics. Understanding these elements and how they strengthen access security is the expected knowledge.
- How it shows up
- An authentication-strengthening need is described, and you must identify the password policy element.
- Common confusion
- Confusing multifactor authentication with simply requiring a complex password.
5.5 Describe IPsec remote access and site-to-site VPNsVPN types and IPsec.
- What it means
- This covers describing VPNs: IPsec remote access VPNs that connect individual users securely, and site-to-site VPNs that connect whole networks over the internet using encryption.
- What to understand
- VPNs create secure tunnels over untrusted networks. Remote access VPNs connect individual remote users, while site-to-site VPNs connect entire locations. IPsec provides the encryption and integrity. Understanding the VPN types and their use cases is the descriptive knowledge expected.
- How it shows up
- A secure-connectivity need is described, and you must identify the VPN type.
- Common confusion
- Confusing remote access with site-to-site VPNs.
5.6 Configure and verify access control listsStandard and extended ACLs and their ordering.
- What it means
- This covers configuring and verifying access control lists: standard and extended ACLs, matching traffic by source, destination, protocol and port, applying them to interfaces in a direction, and ordering rules correctly.
- What to understand
- ACLs filter traffic by permit and deny rules processed top-down, stopping at the first match, with an implicit deny at the end. Order matters critically: a more specific rule must come before a broader one, or it never takes effect, and a misordered ACL fails silently. Applying the ACL to the right interface and direction is also essential.
- How it shows up
- A filtering need is described, and you must build, order or apply an ACL correctly.
- Common confusion
- Misordering ACL rules so a broad rule matches first, or applying the ACL to the wrong interface or direction.
5.7 Configure and verify Layer 2 security featuresDHCP snooping, dynamic ARP inspection and port security.
- What it means
- This covers Layer 2 security features: port security to limit which devices connect to a switch port, DHCP snooping to validate DHCP messages, and dynamic ARP inspection to prevent ARP spoofing using the snooping database.
- What to understand
- The Layer 2 security trio works together: port security limits who plugs in, DHCP snooping decides which DHCP offers are legitimate and builds a binding database, and dynamic ARP inspection uses that database to stop ARP spoofing. Configuring them correctly protects the access layer.
- How it shows up
- A switch-port protection need is described, and you must choose or configure the Layer 2 security feature.
- Common confusion
- Confusing the three Layer 2 features, or forgetting that dynamic ARP inspection relies on the DHCP snooping database.
5.8 Compare authentication, authorization, and accounting conceptsAAA and RADIUS versus TACACS+.
- What it means
- This covers comparing authentication, authorization and accounting: verifying identity, granting permissions, and recording activity, and the protocols RADIUS and TACACS+ that provide AAA services.
- What to understand
- AAA separates verifying who you are (authentication), what you may do (authorization) and what you did (accounting). TACACS+ is Cisco-proprietary, uses TCP and separates the three functions with full command authorization, while RADIUS is open, uses UDP and combines authentication and authorization. Knowing these distinctions is a frequent exam point.
- How it shows up
- An access-control need is described, and you must identify the AAA element or the right protocol.
- Common confusion
- Confusing authentication with authorization, or RADIUS (open, UDP, combined) with TACACS+ (Cisco, TCP, separated).
5.9 Describe wireless security protocols (WPA, WPA2, WPA3)WPA, WPA2 and WPA3.
- What it means
- This covers wireless security protocols: WPA, WPA2 and WPA3, their relative strength, and the move toward WPA3 as the current, strongest standard.
- What to understand
- Wireless encryption has evolved from WPA to the stronger WPA2 to the current WPA3, each improving security. WPA3 is the preferred modern standard. Knowing the order of strength and that WPA3 is current is the expected knowledge.
- How it shows up
- A wireless security need is described, and you must choose the protocol.
- Common confusion
- Choosing an older protocol such as WPA or WPA2 where WPA3 is the stronger, current choice.
5.10 Configure and verify WLAN within the GUI using WPA2 PSKSecuring a WLAN with a pre-shared key in the GUI.
- What it means
- This covers configuring and verifying a WLAN in the controller GUI using WPA2 with a pre-shared key, so wireless clients connect securely with a shared passphrase.
- What to understand
- In the controller GUI, a WLAN is secured with WPA2 PSK by setting the security type and the pre-shared key, letting clients authenticate with the passphrase. This is the practical GUI counterpart to the wireless security concepts, and configuring it correctly is the tested skill.
- How it shows up
- A WLAN security configuration is described, and you must configure WPA2 PSK in the GUI.
- Common confusion
- Misconfiguring the WPA2 PSK security settings so clients cannot authenticate.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Threat vs. vulnerability vs. exploit
Danger, weakness, and the attack using it.
- Remember
- Distinct security terms.
- Tested as
- Concept questions.
- Trap
- Confusing the terms.
-
Device access control
Local passwords on console, VTY and EXEC.
- Remember
- Encrypt passwords in config.
- Tested as
- Access questions.
- Trap
- Leaving passwords unencrypted.
-
Multifactor authentication
A second factor beyond a password.
- Remember
- Stronger than complexity alone.
- Tested as
- Policy questions.
- Trap
- Confusing with complexity.
-
Remote access vs. site-to-site VPN
Individual users versus whole networks.
- Remember
- IPsec secures both.
- Tested as
- VPN questions.
- Trap
- Confusing the two.
-
ACL ordering
Top-down, first match wins, implicit deny.
- Remember
- Specific rules before broad ones.
- Tested as
- ACL questions.
- Trap
- Misordering so a broad rule matches first.
-
ACL placement
Right interface and direction.
- Remember
- Standard near destination, extended near source.
- Tested as
- ACL questions.
- Trap
- Wrong interface or direction.
-
Port security
Limits devices on a switch port.
- Remember
- First line of Layer 2 defense.
- Tested as
- Layer 2 questions.
- Trap
- Leaving ports open.
-
DHCP snooping
Validates DHCP messages, builds a binding database.
- Remember
- Blocks rogue DHCP servers.
- Tested as
- Layer 2 questions.
- Trap
- Trusting all DHCP offers.
-
Dynamic ARP inspection
Stops ARP spoofing using the snooping database.
- Remember
- Depends on DHCP snooping.
- Tested as
- Layer 2 questions.
- Trap
- Forgetting the snooping dependency.
-
RADIUS vs. TACACS+
Open UDP combined versus Cisco TCP separated.
- Remember
- TACACS+ separates AAA functions.
- Tested as
- AAA questions.
- Trap
- Confusing the two.
-
WPA3
Current strongest wireless protocol.
- Remember
- Prefer over WPA and WPA2.
- Tested as
- Wireless questions.
- Trap
- Using an older protocol.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Authentication vs. authorization vs. accounting
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Authentication | Verifies identity | Who you are | Confusing with authorization |
| Authorization | Grants permissions | What you may do | Confusing with authentication |
| Accounting | Records activity | What you did | Overlooking it |
RADIUS vs. TACACS+
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| RADIUS | Open standard, UDP | Combines auth and authz | Confusing with TACACS+ |
| TACACS+ | Cisco, TCP 49 | Separates AAA, full command authz | Confusing with RADIUS |
Layer 2 security trio
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Port security | Limits devices per port | Who plugs in | Leaving ports open |
| DHCP snooping | Validates DHCP, builds bindings | Which DHCP offers are legitimate | Trusting rogue servers |
| Dynamic ARP inspection | Stops ARP spoofing | Uses the snooping database | Forgetting the dependency |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Misordered ACL
- What candidates pick
- Place a broad deny rule before a specific permit rule in an ACL.
- Why it looks right
- All the rules are present.
- Why it's wrong
- ACLs match top-down and stop at the first match, so the broad deny blocks the host before the permit is reached; specific rules must come first.
Clue to watch for A permitted host is unexpectedly blocked by an ACL.
-
DAI without snooping
- What candidates pick
- Enable dynamic ARP inspection without DHCP snooping.
- Why it looks right
- DAI stops ARP spoofing.
- Why it's wrong
- Dynamic ARP inspection relies on the DHCP snooping binding database; without snooping it has nothing to validate against.
Clue to watch for DAI is configured but has no binding data.
-
RADIUS separates AAA
- What candidates pick
- Choose RADIUS when full, separate command authorization is required.
- Why it looks right
- RADIUS provides AAA.
- Why it's wrong
- TACACS+ separates authentication, authorization and accounting with full command authorization; RADIUS combines authentication and authorization.
Clue to watch for The requirement is granular, separate command authorization.
-
WPA2 over WPA3
- What candidates pick
- Secure a new wireless network with WPA2 when WPA3 is available.
- Why it looks right
- WPA2 is widely used.
- Why it's wrong
- WPA3 is the current, strongest standard and should be chosen when available.
Clue to watch for The network needs the strongest current wireless security.
-
ACL wrong direction
- What candidates pick
- Apply an ACL in the wrong direction or on the wrong interface.
- Why it looks right
- The ACL exists.
- Why it's wrong
- An ACL only filters traffic in the direction and on the interface it is applied; placement determines whether it works.
Clue to watch for An ACL has no effect on the intended traffic.
Answer framework
For any Domain 5 scenario, use these steps to find the answer CCNA expects.
- Identify whether the need is a security concept, device access, a VPN, an ACL, Layer 2 security, AAA or wireless security.
- For concepts, distinguish threats, vulnerabilities, exploits and mitigation, the AAA elements, and remote access versus site-to-site VPNs.
- For ACLs, order rules from specific to general, remember the implicit deny, and apply the ACL to the correct interface and direction.
- For Layer 2 security, combine port security, DHCP snooping and dynamic ARP inspection, remembering DAI depends on snooping.
- For AAA and wireless, choose TACACS+ or RADIUS appropriately and prefer WPA3, configuring WPA2 PSK in the GUI when required. Where two controls seem to fit, pick the one aimed at the specific threat, such as DHCP snooping against a rogue DHCP server rather than an ACL.
Practice question
Want more like this? The CCNA practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Approach this domain as concepts plus high-stakes configuration. Start with the definitional content, the security terms, program elements, password policy, VPN types and the AAA elements, keeping authentication, authorization and accounting distinct and RADIUS (open, UDP, combined) separate from TACACS+ (Cisco, TCP, separated).
Then invest in the configuration objectives that produce tricky simulations. Master access control lists, especially rule ordering (specific before general), the implicit deny, and correct interface and direction, because a misordered ACL fails silently. Learn the Layer 2 security trio as one story: port security, then DHCP snooping, then dynamic ARP inspection, which depends on the snooping database. Finally, know the wireless protocols, preferring WPA3, and configure WPA2 PSK in the GUI.
Because ACLs and Layer 2 security are hands-on, practice them in a lab until ordering and placement are automatic. Write extended ACLs for small scenarios, place them close to the source, and use the hit counts in show access-lists to confirm each entry matches what you intended. Afterwards, move to Domain 6, Automation and Programmability.
FAQ
How much of the CCNA is Domain 5?
Security Fundamentals is 15% of the exam, mixing security concepts with configuration, especially access control lists and Layer 2 security.
Why do access control lists fail silently when misordered?
ACLs are processed top-down and stop at the first matching statement, with an implicit deny at the end. If a broad rule comes before a specific one, the broad rule matches first and the specific rule never takes effect, with no error shown.
How do the Layer 2 security features work together?
Port security limits which devices connect to a port, DHCP snooping validates DHCP messages and builds a binding database, and dynamic ARP inspection uses that database to stop ARP spoofing, so DAI depends on DHCP snooping.
What is the difference between RADIUS and TACACS+?
RADIUS is an open standard, uses UDP, and combines authentication and authorization. TACACS+ is Cisco-proprietary, uses TCP, and separates authentication, authorization and accounting with full command authorization.
What is the difference between authentication, authorization and accounting?
Authentication verifies who you are, authorization determines what you are allowed to do, and accounting records what you did. Together they are the AAA framework for access control.
Which wireless security protocol should I choose?
WPA3 is the current, strongest wireless security protocol and should be chosen when available, over the older WPA2 and WPA, which are progressively weaker.
How does Domain 5 connect to the rest of the exam?
Security applies to the devices and switched network from Domains 1 and 2, the routed network from Domain 3, and the services from Domain 4, hardening the whole network built across the exam.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 5 knowledge
You have covered security concepts, ACLs, Layer 2 security, AAA and wireless security. Test whether you can configure and apply security correctly under exam conditions.