Domain 5 Review: Security Fundamentals

0s14★ 35 XP

Lesson 165Interactive lesson

Domain 5 Review: Security Fundamentals

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format7 sections1 code block2 practice itemsUpdated Oct 2, 2026

Below is a sample security configuration covering the highest-yield topics tested in Domain 5. Every line is a concept that could appear in an exam question — whether the question asks you to identify the config, spot the error, or explain what a specific command does.

bash

! === ACLs ===
access-list 10 permit 10.10.20.0 0.0.0.255
access-list 10 deny any log
!
ip access-list extended WEB_TO_DB
 permit tcp 10.10.20.0 0.0.0.255 host 10.10.99.10 eq 3306
 deny ip any any log
!
interface Gi0/1
 ip access-group WEB_TO_DB in
!
! === Port Security ===
interface Gi0/5
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict
!
! === SSH Hardening ===
hostname R1
ip domain-name corp.example.com
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 15
 transport input ssh
 login local
 access-class 20 in
!
! === AAA ===
aaa new-model
aaa authentication login default group TACACS+ local
!
! === Wireless Security (conceptual config) ===
! SSID: CORP-WPA3-ENT
! Security: WPA3-Enterprise
! Authentication: 802.1X with RADIUS
! PMF: Required

#High-Yield Topics#link

▪Standard vs. extended ACLs — matching fields and placement
▪ACL implicit deny — everything not explicitly permitted is blocked
▪Wildcard masks — 0 = must match, 1 = ignore; inverse of subnet mask
▪Named ACLs — sequence numbers for editing
▪Port security — maximum MAC count, sticky, violation modes (shutdown/restrict/protect)
▪DHCP snooping — trust boundaries, rate limiting
▪Dynamic ARP Inspection — uses DHCP snooping binding table
▪IP Source Guard — uses DHCP snooping binding table, prevents IP spoofing
▪AAA — authentication, authorization, accounting; RADIUS vs. TACACS+
▪RADIUS vs. TACACS+ — RADIUS encrypts password only; TACACS+ encrypts full packet
▪SSH config — required steps: hostname, domain name, RSA key, version 2
▪WPA2 vs. WPA3 — PSK vs. Enterprise, AES vs. TKIP
▪Site-to-site vs. remote-access VPN
▪IPsec — IKE, ESP, tunnel vs. transport mode
▪802.1X — supplicant, authenticator, authentication server

★ 15 XPmedium

quiz BLOCK (★ 15 XP)

An ACL rule `permit tcp 10.10.10.0 0.0.0.255 any eq 443` — what traffic does this permit?

Select your proof vectors above

★ 20 XPmedium

quiz BLOCK (★ 20 XP)

You need to block SSH (port 22) from any source to a specific server, without affecting other traffic. Which ACL type and placement?

Select your proof vectors above

STRICT SECURE AUDIT RULE

The two most common ACL mistakes on the exam: (1) forgetting the implicit deny — students write only permit rules and then wonder why other traffic is blocked; (2) placing standard ACLs near the source — which blocks all traffic from that source, not just traffic to the intended target. Both are testable and both are commonly missed.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 35 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

High-Yield Topics

Content

Last updated

October 2, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "https://vulnarex.com/api/content/lessons?courseSlug=complete-ccna-200-301&lessonSlug=6-security-fundamentals-review&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.

! === ACLs ===

access-list 10 permit 10.10.20.0 0.0.0.255

access-list 10 deny any log

ip access-list extended WEB_TO_DB

permit tcp 10.10.20.0 0.0.0.255 host 10.10.99.10 eq 3306

deny ip any any log

interface Gi0/1

ip access-group WEB_TO_DB in

! === Port Security ===

interface Gi0/5

switchport mode access

switchport port-security

switchport port-security maximum 2

switchport port-security mac-address sticky

switchport port-security violation restrict

! === SSH Hardening ===

hostname R1

ip domain-name corp.example.com

crypto key generate rsa modulus 2048

ip ssh version 2

line vty 0 15

transport input ssh

access-class 20 in

! === AAA ===

aaa new-model

aaa authentication login default group TACACS+ local

! === Wireless Security (conceptual config) ===

! SSID: CORP-WPA3-ENT

! Security: WPA3-Enterprise

! Authentication: 802.1X with RADIUS

! PMF: Required