ACLs, Layer 2 Security, AAA and Wireless Security
This topic covers standard and extended ACLs, placement, DHCP snooping, dynamic ARP inspection, port security, AAA, WPA, WPA2, WPA3, and WLAN security.
How to study for CCNA
Treat every CCNA item as a verification task: identify the layer, device role, address, configuration, command output, and safest change.
Core concepts
Concept 1
ACLs, Layer 2 Security, AAA and Wireless Security questions reward command-aware network reasoning rather than memorizing one isolated fact.
Exam cue: Name the device role, layer, protocol, address, and path before selecting a fix.
Concept 2
The best answer identifies the layer, protocol, device role, configuration state, and verification command.
Exam cue: Separate switching, routing, services, security, and automation symptoms.
Concept 3
Eliminate answers that skip verification, ignore longest match, weaken security, or make a broad change before isolating scope.
Exam cue: Prefer configuration plus verification over one-step assumptions.
Risk pitfalls and guardrails
Treating every reachability issue as a cable problem.
Guardrail: Avoid answers that skip verification, weaken access controls, ignore longest prefix match, or change a broad setting before isolating scope.
Forgetting that longest prefix match comes before administrative distance and metric in forwarding decisions.
Guardrail: Avoid answers that skip verification, weaken access controls, ignore longest prefix match, or change a broad setting before isolating scope.
Changing production access or security settings before confirming the fault domain.
Guardrail: Avoid answers that skip verification, weaken access controls, ignore longest prefix match, or change a broad setting before isolating scope.
Memory anchors
Standard ACL
A standard ACL filters traffic primarily by source IPv4 address.
Extended ACL
An extended ACL can filter by source, destination, protocol, and ports.
ACL Direction
ACL direction determines whether filtering is applied inbound or outbound on an interface.
DHCP Snooping
DHCP snooping blocks untrusted DHCP server messages and builds a binding table.
Dynamic ARP Inspection
Dynamic ARP inspection helps block spoofed ARP messages using trusted bindings.
Port Security
Port security restricts which MAC addresses may use a switch port.
AAA
AAA provides authentication, authorization, and accounting for access control.
WPA2
WPA2 is a common wireless security protocol using stronger protection than WPA.
WPA3
WPA3 improves wireless security where clients and infrastructure support it.
WLAN PSK
A WLAN pre-shared key authenticates clients that know the configured shared secret.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
Which packet field can a standard IPv4 ACL evaluate?
An ACL must permit TCP from one source subnet to a specific web server on port 443. Which ACL type is required?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”