CCNA Security Interview Questions and Answers for the 200-301 Era

Key takeaways

• CCNA Security no longer exists; its topics now sit in CCNA 200-301, CyberOps Associate and CCNP Security.
• For each answer give a definition, an example and the show command you would use to verify.
• ACLs, port security, NAT, SSH hardening and Layer 2 protections (DHCP snooping, DAI, BPDU Guard) are the most tested areas.
• Practise the configurations in Packet Tracer or GNS3 until you can type them without notes.

The CCNA Security exam no longer exists, so what do interviewers ask?

Cisco retired CCNA Security, along with CCNA Voice, Wireless, Routing and Switching and Data Center, in February 2020. Their content was folded into one exam, CCNA 200-301, and into later tracks such as CyberOps Associate and the CCNP Security path (350-701 SCOR). A job description that says "CCNA Security" today usually means: can you secure a Cisco network and explain why. Interviewers ask about the topics below. The exact exam weights change, so check the current 200-301 blueprint on Cisco's certification pages.

This guide focuses on security: device hardening, AAA and Layer 2 attacks. Questions on BGP, OSPF and generic "show" commands belong to routing, so practise those from a routing guide.

How to use these answers

Do not memorise them. In an interview, give the one-sentence definition, one example, and one command or configuration you would use to verify it. Practise the configurations in Cisco Packet Tracer or GNS3 until you can type them without notes.

Part 1: Security fundamentals

1. What is the CIA triad?

Confidentiality, integrity and availability. Confidentiality means only authorised people read data (encryption, access control). Integrity means data is not altered undetected (hashing, digital signatures). Availability means systems work when needed (redundancy, DoS protection).

2. What is the difference between a threat, a vulnerability and an exploit?

A vulnerability is a weakness, such as an unpatched router or a default password. A threat is something that could use it, such as an attacker or malware. An exploit is the specific method or code that takes advantage of the weakness. Risk is the likelihood and impact of a threat using a vulnerability.

3. What is a security policy, and why does it matter?

A security policy is a written set of rules for how an organisation protects its assets: acceptable use, passwords, remote access, incident handling. Technical controls such as ACLs and firewalls enforce it. Without a policy you do not know what you are trying to enforce.

4. What is multi-factor authentication?

MFA requires two or more kinds of proof: something you know (password), something you have (phone or hardware token) or something you are (fingerprint). A stolen password alone is not enough to log in.

5. What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is automated and lists known weaknesses. A penetration test is a manual, authorised attempt to exploit weaknesses and shows what an attacker could actually reach. Both need written permission.

6. What is a SIEM, and what does a SOC do?

A SIEM collects and correlates logs from many devices and raises alerts. A SOC is the team and process that watches those alerts, investigates and responds. Splunk is a widely used SIEM.

7. What is a security incident response plan?

It is the agreed procedure for handling an incident: preparation, detection and analysis, containment, eradication and recovery, and lessons learned. It names who decides what, so people do not improvise under pressure.

Part 2: Securing Cisco devices

8. How do you secure remote access to a router or switch?

Use SSH, not Telnet, because Telnet sends credentials in clear text. Restrict who can connect with an ACL on the VTY lines, and use a local or AAA login.

hostname R1
ip domain-name lab.local
crypto key generate rsa modulus 2048
ip ssh version 2
username admin secret <strong-password>
ip access-list standard MGMT
 permit 192.168.1.0 0.0.0.255
line vty 0 4
 login local
 transport input ssh
 access-class MGMT in

Verify with show ip ssh, which shows the SSH version and settings, and show ssh for active sessions.

9. What is the difference between enable password and enable secret?

The enable secret is stored as a hash and is the one to use. The older enable password is stored in a form that is easy to reverse, and is ignored when an enable secret exists. service password-encryption applies weak type 7 obfuscation to plain-text passwords; it is not strong protection.

10. What is AAA? How do RADIUS and TACACS+ differ?

AAA is authentication (who are you), authorisation (what may you do) and accounting (what did you do). RADIUS is an open standard commonly used for network access such as Wi-Fi and VPN; it combines authentication and authorisation. TACACS+ is Cisco-developed, encrypts the full payload and separates the three functions, which makes it popular for controlling administrator commands on devices.

11. What other basic hardening steps should every device get?

• Disable unused interfaces and put them in an unused VLAN.
• Set login banners with a legal warning.
• Limit login attempts, for example login block-for 120 attempts 3 within 60.
• Set timeouts with exec-timeout.
• Keep the IOS image patched and send logs to a central server.

Part 3: Access control lists

12. What is an ACL?

An ACL is an ordered list of permit and deny rules that a router, switch or firewall checks against packets. Rules are read top to bottom, the first match wins, and every ACL ends with an invisible implicit deny.

13. What is the difference between standard and extended ACLs?

Placement matters because a standard ACL cannot tell destinations apart, so placing it near the source would block too much.

ip access-list extended WEB-ONLY
 permit tcp 192.168.10.0 0.0.0.255 host 203.0.113.10 eq 443
 deny ip any any log
interface g0/1
 ip access-group WEB-ONLY in

14. What is a wildcard mask?

It is the inverse of a subnet mask. A 0 bit means "must match" and a 1 bit means "ignore". For the /24 network 192.168.10.0 the wildcard is 0.0.0.255.

15. How do you verify and troubleshoot ACLs?

show access-lists displays every ACL with hit counters per rule. show ip interface g0/1 shows which ACL is applied and in which direction. A common fault is applying the ACL in the wrong direction, or forgetting the implicit deny.

Part 4: NAT

16. What is NAT, and what are its types?

NAT rewrites IP addresses in packet headers so private addresses can reach the internet. Static NAT maps one private address to one public address, useful for a server. Dynamic NAT maps private addresses to a pool of public ones. PAT, also called NAT overload, maps many private addresses to one public address using different port numbers.

access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface g0/0 overload
interface g0/1
 ip nat inside
interface g0/0
 ip nat outside

Verify with show ip nat translations and show ip nat statistics.

Part 5: Layer 2 security

17. What is port security?

Port security limits which MAC addresses may use a switch port, and how many. It stops someone plugging in an unknown device or flooding the MAC table.

interface g0/5
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation shutdown

Violation modes are protect (drop silently), restrict (drop and log) and shutdown (err-disable the port). Check with show port-security interface g0/5.

18. What is VLAN hopping, and how do you prevent it?

VLAN hopping lets an attacker reach VLANs they should not, either by tricking a switch port into trunking (switch spoofing) or by double-tagging frames. Prevent it by setting access ports explicitly to access mode, disabling DTP negotiation, not using VLAN 1 as the native VLAN, and shutting unused ports.

19. How do DHCP snooping and Dynamic ARP Inspection help?

DHCP snooping marks ports as trusted or untrusted and drops DHCP server replies from untrusted ports, which stops rogue DHCP servers. It also builds a binding table of IP, MAC and port. Dynamic ARP Inspection uses that table to reject forged ARP replies, which blocks ARP spoofing and many man-in-the-middle attempts.

ip dhcp snooping
ip dhcp snooping vlan 10
interface g0/1
 ip dhcp snooping trust

20. How do you protect Spanning Tree?

Enable PortFast on access ports with BPDU Guard, so a port that receives a BPDU is shut down. This stops someone attaching a switch and becoming root bridge. Root Guard protects the intended root.

21. How are VLANs used for security?

VLANs separate traffic into broadcast domains, for example staff, guests and servers. Traffic between VLANs must pass through a router or firewall, where ACLs apply. VLANs reduce exposure but are not a replacement for a firewall.

Part 6: Firewalls, DMZ and zones

22. What is the difference between stateful and stateless filtering?

A stateless filter, such as a basic ACL, judges every packet on its own. A stateful firewall keeps a table of connections and allows return traffic for sessions that started inside. Stateful inspection is more secure and easier to manage.

23. What is a DMZ?

A DMZ is a separate network segment for public-facing servers like web or mail. If a server there is compromised, the attacker is still outside the internal network, because traffic from the DMZ to the inside is blocked or tightly limited.

24. What are security zones?

Zones are logical groups of interfaces, such as inside, outside and DMZ. Policy is written between zones rather than interface by interface. Cisco Zone-Based Firewall and ASA security levels follow this idea.

25. Which Cisco firewall should I mention?

Cisco ASA was the classic answer. Cisco's current firewall family is branded Secure Firewall. Say which one you have actually used, and describe the concepts (stateful inspection, NAT, VPN, IPS) rather than model numbers. Check Cisco's pages for current product names.

26. What is an IPS, and how does it differ from an IDS?

An IDS watches a copy of traffic and alerts. An IPS sits in the path and can block malicious traffic. The cost of inline blocking is that a false positive can disrupt real users.

Part 7: VPNs and cryptography

27. What types of VPN are there?

Site-to-site VPNs join two networks, such as a branch and head office, and the users are unaware of the tunnel. Remote-access VPNs let a single user connect from outside. For 200-301 you must describe these and when to use each. Configuring IPsec in detail is more a CCNP Security topic.

28. How does IPsec work?

IPsec protects IP packets with encryption and authentication. IKE negotiates the security associations and keys. ESP encrypts and authenticates the data; AH only authenticates and is rarely used. Transport mode protects the payload between two hosts; tunnel mode wraps the entire original packet and is the mode used between gateways. Verify a tunnel with show crypto isakmp sa and show crypto ipsec sa, which show negotiation state and packet counters.

29. What are symmetric and asymmetric encryption?

Symmetric encryption uses one shared key and is fast, so it encrypts the bulk data (AES). Asymmetric encryption uses a public and private key pair and is slower, so it is used to exchange keys and prove identity (RSA). Real protocols use both.

30. What is a digital certificate, and what does a certificate authority do?

A certificate binds a public key to an identity and is signed by a certificate authority (CA) that clients trust. When a browser checks a site's certificate, it checks the CA signature, the name and the dates.

Part 8: Threats and wireless

31. What is a man-in-the-middle attack?

The attacker secretly sits between two parties, reading or changing messages. Typical Layer 2 methods are ARP spoofing and rogue access points. Defences are encryption with certificate validation (HTTPS, SSH), DHCP snooping with DAI and 802.1X.

32. What is a denial-of-service attack, and how can it be mitigated?

A DoS attack exhausts a resource so legitimate users cannot connect. A distributed version (DDoS) uses many sources. Mitigation includes rate limiting, filtering at the network edge, upstream scrubbing services and SYN flood protection. Redundancy keeps the service up while you respond.

33. How can you detect a port scan?

A scan shows as one source touching many ports or hosts in a short time. Firewall and IPS logs, NetFlow and a SIEM can flag it. Scanning your own network on a schedule is also how you find unexpected open ports.

34. Which wireless security protocols should you know?

WEP is broken. WPA2 with AES is widely deployed, and WPA3 is the newer standard with stronger protection against offline password guessing. Enterprise networks use 802.1X with a RADIUS server instead of a shared password.

35. What does a network security group do in the cloud?

Azure network security groups and AWS security groups filter traffic to cloud resources by rules on source, destination, port and protocol. They work like ACLs, and the same least-privilege thinking applies.

Common mistakes in interviews

• Describing a feature but not how to verify it. Always name the show command.
• Claiming experience you do not have. Say "in a lab" if it was a lab. Interviewers probe.
• Forgetting the implicit deny, or the direction an ACL is applied.
• Calling VLANs a firewall.
• Giving attack details with no defence. Pair every attack with its fix.

Next steps

Build every configuration above in Packet Tracer, break it on purpose and fix it. If you want guided preparation, WebAsha's CCNA 200-301 course covers the exam topics, and the Cisco Security Core (350-701 SCOR) course goes deeper into firewalls and VPNs. For more questions on single topics, see CCNA interview questions on ACLs, on NAT and on security protocols.

Related reading

• [2026] Top 50+ Cloud Networking Interview Questions and Answers
• What Is a Firewall? How Does It Work?
• Access Control List in Networking