25 Network Security questions with answers for ccna roles — 7 easy, 11 medium, 7 hard.
About Network Security
Security is now a large part of the CCNA. This topic covers standard and extended ACLs with wildcard masks, port security, DHCP snooping, Dynamic ARP Inspection, AAA with TACACS+ and RADIUS, 802.1X, site-to-site and remote-access VPNs, IPsec and device hardening. Interviewers ask how you would block, allow and audit traffic without breaking the business.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What are the key elements of a security program for a network?
A security program combines user awareness training, physical access control, and technical controls such as strong authentication, firewalls, IPS, VPNs and patching. It is built around the CIA triad: confidentiality, integrity and availability. Policies define what is allowed, and logging and monitoring detect problems. CCNA focuses on device hardening, ACLs, Layer 2 security, AAA, VPNs and wireless security.
02
What is the difference between standard and extended ACLs?
Standard ACLs (1 to 99 and 1300 to 1999) match only the source IP, so they should be placed close to the destination. Extended ACLs (100 to 199 and 2000 to 2699) match protocol, source, destination and ports, so they can be placed close to the source to drop unwanted traffic early. Named ACLs work for both and allow editing individual lines by sequence number.
03
How are ACL entries processed and what is the implicit deny?
ACL entries are checked top-down and the first match decides permit or deny; later lines are ignored. Every ACL ends with an invisible deny any, so traffic that matches no line is dropped. Therefore specific entries must come before general ones, and an ACL with only deny statements blocks everything. Always add a permit for allowed traffic and test after applying.
04
Explain password security best practices for network devices.
Use enable secret, not enable password, so the hash is strong (type 8 or 9 on modern IOS). Create local users with secret, enforce minimum length with security passwords min-length, and use AAA with TACACS+ for central control. Disable Telnet, use SSH v2, set exec-timeout on lines, and add login block-for to slow brute force. Avoid type 7 passwords, which are easily reversed.
05
A user's port keeps going into err-disabled state. How do you investigate?
I run show interfaces status err-disabled and show errdisable recovery to see the cause, such as psecure-violation, bpduguard or link-flap. If it is port security, the user may have plugged in a small switch or a docking station with an extra MAC, so I check show port-security interface. I fix the cause, then shut and no shut the port, or set the max MAC count appropriately.
06
How do you configure port security with sticky MACs?
Situation: as a fresher I realised many interview questions asked about recent attacks. Task: build a habit of learning. Action: I follow vendor security advisories, CERT-In alerts and a few security newsletters, practise in a home lab with packet captures, and read the release notes of devices we use. Result: I can explain current threats in interviews and suggested patching a vulnerable IOS version in my internship.
08
What is a wildcard mask and how is it used in ACLs?
A wildcard mask tells the router which bits must match: 0 means must match and 1 means ignore. It is often the inverse of the subnet mask, so 192.168.1.0 0.0.0.255 matches the whole /24. host 10.1.1.1 equals 0.0.0.0 and any equals 255.255.255.255. Wildcards are also used in OSPF network statements. Calculate it by subtracting the mask from 255.255.255.255.
09
What is port security and what are its violation modes?
Port security limits the MAC addresses allowed on an access port, either statically or by sticky learning. If an extra MAC appears, the violation mode acts: shutdown (default) err-disables the port, restrict drops the frames, logs and increments a counter, and protect silently drops frames. It stops MAC flooding and unauthorised devices on user ports.
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
11
What is AAA and the difference between TACACS+ and RADIUS?
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
12
What is the difference between site-to-site and remote-access VPNs?
A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.
13
A server team says an ACL you applied blocked all traffic, including allowed services. What happened?
Most likely the ACL lacks a permit for normal traffic, so the implicit deny dropped everything, or the order put a broad deny above the specific permits. It may also be applied in the wrong direction or on the wrong interface. I check show access-lists for hit counts, fix the sequence by inserting lines, and add a final permit or the needed entries. I always test ACLs with a rollback timer.
14
Users suddenly receive IP addresses from a wrong subnet. What do you suspect and how do you fix it?
A rogue DHCP server, often a home router plugged into a wall port, is answering requests. I find it by checking the DHCP server IP on an affected client with ipconfig /all, then tracing its MAC with show mac address-table. I shut that port, and prevent it permanently by enabling DHCP snooping on user VLANs with only uplinks trusted.
15
Guest Wi-Fi users must reach only the internet, not internal networks. How do you enforce it?
Put guests in their own VLAN and subnet, ideally terminating on a firewall or a separate VRF. Apply an inbound extended ACL on the guest SVI that permits DHCP and DNS to the allowed servers, denies all RFC 1918 destinations, and then permits any to the internet. Enable client isolation on the wireless side and rate limit the guest SSID so it cannot consume the WAN.
Allow web traffic from one subnet to a server and block the rest of that subnet.
ip access-list extended WEB-ONLY
10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443
20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255
30 permit ip any any
interface vlan 10
ip access-group WEB-ONLY in
show access-lists WEB-ONLY
17
How do you restrict SSH access to devices from only the management subnet?
Use a standard ACL on the VTY lines.
ip access-list standard MGMT-ONLY
permit 10.99.0.0 0.0.0.255
deny any log
line vty 0 15
access-class MGMT-ONLY in
transport input ssh
exec-timeout 10 0
login block-for 120 attempts 3 within 60
18
Tell me about a time you found a security issue and reported it.
Situation: during a routine audit I noticed SNMP v2c with the default community public on several access switches. Task: close the gap without disrupting monitoring. Action: I reported it to my lead with evidence, proposed SNMPv3 with an ACL, tested with the monitoring team and rolled out in two batches. Result: the risk was closed in a week and SNMP checks were added to our device baseline.
DAI checks ARP packets on untrusted ports against the DHCP snooping binding table and drops ARP replies whose IP-to-MAC mapping does not match. This stops ARP spoofing and man-in-the-middle attacks where an attacker claims to be the default gateway. Static hosts need ARP ACLs. It requires DHCP snooping enabled in the same VLAN and trusted uplink ports.
802.1X lets a switch or access point block a port until the user or device authenticates. The supplicant is the client, the authenticator is the switch or AP, and the authentication server is a RADIUS server. EAP messages are carried over the LAN as EAPoL and then inside RADIUS. On success the RADIUS server can assign a VLAN or ACL. MAB is a fallback for devices without supplicants.
IPsec uses IKE (v1 or v2) to authenticate peers and negotiate keys, ESP to encrypt and authenticate data, and optionally AH for authentication only, which breaks with NAT. Algorithms include AES for encryption, SHA-256 for integrity and Diffie-Hellman groups for key exchange. Tunnel mode encrypts the whole original packet and is used for site-to-site VPNs.
22
Auditors find that network devices use shared admin passwords and Telnet. What is your remediation plan?
Disable Telnet with transport input ssh, enable SSH v2, and move admin login to AAA with TACACS+ so each engineer has a personal account with command authorisation and accounting logs. Keep one local fallback account in a password vault. Restrict VTY access with an ACL to the management subnet. Roll out with automation, test on a pilot, then document it for the audit.
Enable per VLAN, trust uplinks and rate-limit user ports.
ip dhcp snooping
ip dhcp snooping vlan 10,20
no ip dhcp snooping information option
ip arp inspection vlan 10,20
interface GigabitEthernet1/0/48
ip dhcp snooping trust
ip arp inspection trust
interface range Gi1/0/1 - 46
ip dhcp snooping limit rate 15
show ip dhcp snooping binding
24
How do you configure AAA with TACACS+ and a local fallback?
Define the server, then method lists with local as backup.
aaa new-model
tacacs server ISE1
address ipv4 10.0.0.60
key Tac@csKey1
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting commands 15 default start-stop group tacacs+
username breakglass privilege 15 secret L0calOnly!
25
A security scan shows that switch and router management interfaces are reachable from user VLANs. How do you lock down management access?
Move management to a dedicated VLAN or out-of-band network, ideally in a management VRF. Apply an access-class ACL on VTY lines allowing only the jump host subnet, disable Telnet and HTTP, keep SSH version 2 and HTTPS only if needed, and use AAA with TACACS+ for per-user login and logging. Add control plane policing, block management subnets at the user VLAN gateways and rescan to confirm the fix.
Frequently asked questions
How important is Network Security in CCNA interviews?
Security is now a large part of the CCNA. This topic covers standard and extended ACLs with wildcard masks, port security, DHCP snooping, Dynamic ARP Inspection, AAA with TACACS+ and RADIUS, 802.1X, site-to-site and remote-access VPNs, IPsec and device hardening. Interviewers ask how you would block, allow and audit traffic without breaking the business.
How should I use the Network Security sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.