CCNA Security Study Guide

Exam 210-260

Troy McMillan

• Publisher: Sybex
• Year: 2018
• Print ISBN: 9781119409939
• eBook ISBN: 9781119409915
• Edition: 2
• Topic: Computer Science
• Subtopic: Certification Guides in Computer Science
• Index: Computer Science

Cisco has announced big changes to its certification program.

As of February 24, 2020, all current certifications will be retired, and Cisco will begin offering new certification programs.

The good news is if you're working toward any current CCNA certification, keep going. You have until February 24, 2020 to complete your current CCNA. If you already have CCENT/ICND1 certification and would like to earn CCNA, you have until February 23, 2020 to complete your CCNA certification in the current program. Likewise, if you're thinking of completing the current CCENT/ICND1, ICND2, or CCNA Routing and Switching certification, you can still complete them between now and February 23, 2020.

Lay the foundation for a successful career in network security

CCNA Security Study Guide offers comprehensive review for Exam 210-260. Packed with concise explanations of core security concepts, this book is designed to help you successfully prepare for the exam. Expert instruction guides you through critical concepts relating to secure network infrastructure, access management, VPN encryption, Firewalls, intrusion prevention and more, with complete coverage of the CCNA exam objectives. Practical examples allow you to apply your skills in real-world scenarios, helping you transition effectively from "learning" to "doing". You also get access to the Sybex online learning environment, featuring the tools you need to maximize your study time: key terminology and flash cards allow you to study anytime, anywhere, while chapter tests and practice exams help you track your progress and gauge your readiness along the way.

The CCNA Security certification tests your knowledge of secure network installation, monitoring, and troubleshooting using Cisco security hardware and software solutions. When you're ready to get serious about preparing for the exam, this book gives you the advantage of complete coverage, real-world application, and extensive learning aids to help you pass with confidence.

• Master Cisco security essentials, standards, and core technologies
• Work through practical examples drawn from real-world examples
• Track your progress with online study aids and self-tests

• Develop critical competencies in maintaining data integrity, confidentiality, and availability

Earning your CCNA Security certification validates your abilities in areas that define careers including network security, administrator, and network security support engineer. With data threats continuing to mount, the demand for this skill set will only continue to grow—and in an employer's eyes, a CCNA certification makes you a true professional. CCNA Security Study Guide is the ideal preparation resource for candidates looking to not only pass the exam, but also succeed in the field.

Chapter 1
Understanding Security Fundamentals

CISCO CCNA SECURITY EXAM OBJECTIVES COVERED IN THIS CHAPTER:

• 
  1.1 Common security principles
  • Describe confidentiality, integrity, availability (CIA)
  • Identify common security terms
  • Identify common network security zones
• 
  1.4 Describe network topologies
  • Campus area network (CAN)
  • Cloud, wide area network (WAN)
  • Data center
  • Small office/home office (SOHO)
  • Network security for a virtual environment

Securing a network is no easy task. Daily you probably hear about data disclosures and new network attacks. However, you are not defenseless. By properly implementing the security features available in Cisco routers, switches, and firewalls, you can reduce the risk of a security breach to a manageable level. This book is designed to help you understand the issues, identify your security options, and deploy those options in the correct manner. In the process, the book will prepare you for the Cisco CCNA Security certification, which validates the skills and knowledge required to secure a network using Cisco products.

In this chapter, you will learn the following:

• Common security principles
• Network topologies

Goals of Security

When you’re securing a network, several important security principles should guide your efforts. Every security measure you implement should contribute to the achievement of one of three goals. The three fundamentals of security are confidentiality, integrity, and availability (CIA), often referred to as the CIA triad.

Most security issues result in a violation of at least one facet of the CIA triad. Understanding these three security principles will help ensure that the security controls and mechanisms implemented protect at least one of these principles.

Every security control that is put into place by an organization fulfills at least one of the security principles of the CIA triad. Understanding how to circumvent these security principles is just as important as understanding how to provide them.

Confidentiality

To ensure confidentiality, you must prevent the disclosure of data or information to unauthorized entities. As part of confidentiality, the sensitivity level of data must be determined before putting any access controls in place. Data with a higher sensitivity level will have more access controls in place than data at a lower sensitivity level. Identification, authentication, and authorization can be used to maintain data confidentiality. Encryption is another popular example of a control that provides confidentiality.

Integrity

Integrity, the second part of the CIA triad, ensures that data is protected from unauthorized modification or data corruption. The goal of integrity is to preserve the consistency of data, including data stored in files, databases, systems, and networks.

An access control list (ACL) is an example of a control that helps to provide integrity. Another example is the generation of hash values that can be used to validate data integrity.

Availability

Availability means ensuring that data is accessible when and where it is needed. Only individuals who need access to data should be allowed access to that data. The two main areas where availability is affected are

• When attacks are carried out that disable or cripple a system.
• When service loss occurs during and after disasters. Each system should be assessed on its criticality to organizational operations. Controls are implemented based on each system’s criticality level.

Fault-tolerant technologies, such as RAID or redundant sites, are examples of controls that help to improve availability.

Guiding Principles

When managing network security and access to resources, there are some proven principles that should guide your efforts. These concepts have stood the test of time because they contribute to supporting the CIA triad.

Least Privilege/Need-to-Know

The principle of least privilege requires that a user or process is given only the minimum access privilege needed to perform a particular task. Its main purpose is to ensure that users only have access to the resources they need and are authorized to perform only the tasks they need to perform. To properly implement the least privilege principle, organizations must identify all users’ jobs and restrict users only to the identified privileges.

The need-to-know principle is closely associated with the concept of least privilege. Although least privilege seeks to reduce access to a minimum, the need-to-know principle actually defines what the minimums for each job or business function are. Excessive privileges become a problem when a user has more rights, privileges, and permissions than he needs to do his job. Excessive privileges are hard to control in large environments.

A common implementation of the least privilege and need-to-know principles is when a systems administrator is issued both an administrative-level account and a normal user account. In most day-to-day functions, the administrator should use his normal user account. When the systems administrator needs to perform administrative-level tasks, he should use the administrative-level account. If the administrator uses hi...

Table of contents

• Cover
• Title Page
• Copyright
• Dedication
• Acknowledgments
• About the Author
• Introduction
• Assessment Test
• Answers to Assessment Test
• Chapter 1 Understanding Security Fundamentals
• Chapter 2 Understanding Security Threats
• Chapter 3 Understanding Cryptography
• Chapter 4 Securing the Routing Process
• Chapter 5 Understanding Layer 2 Attacks
• Chapter 6 Preventing Layer 2 Attacks
• Chapter 7 VLAN Security
• Chapter 8 Securing Management Traffic
• Chapter 9 Understanding 802.1x and AAA
• Chapter 10 Securing a BYOD Initiative
• Chapter 11 Understanding VPNs
• Chapter 12 Configuring VPNs
• Chapter 13 Understanding Firewalls
• Chapter 14 Configuring NAT and Zone-Based Firewalls
• Chapter 15 Configuring the Firewall on an ASA
• Chapter 16 Intrusion Prevention
• Chapter 17 Content and Endpoint Security
• Appendix Answers to Review Questions
• Advert
• EULA