| Term<\/th> | What it is<\/th> | Example<\/th><\/tr><\/thead>\n | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Vulnerability<\/td> | A weakness in a system that could be abused<\/td> | Unpatched software, a default password, an open management port<\/td><\/tr>\n | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Threat<\/td> | The potential danger: the who or what that could act on a weakness<\/td> | A ransomware crew, a worm, a careless insider<\/td><\/tr>\n | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Exploit<\/td> | The specific code or technique that takes advantage of a vulnerability<\/td> | A script that triggers a known buffer overflow on that unpatched service<\/td><\/tr>\n | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Risk<\/td> | The chance a threat acts on a vulnerability, times the damage if it does<\/td> | High when a critical, internet-facing server is left unpatched<\/td><\/tr>\n<\/tbody>\n<\/table>\n\n One sentence ties them together. An unpatched file-sharing service is the vulnerability, a ransomware group is the threat, the exploit is the code that abuses that unpatched service to run, and the risk is high because the impact is encrypted, unrecoverable data. Remove any one piece, patch the service, and the risk drops sharply even though the threat still exists.<\/p>\n\n The CIA triad: what security actually protects<\/h2>\n\nEvery control you will configure exists to protect one of three goals. The CIA triad is the shorthand for them, and it is worth knowing because it tells you why<\/em> a given control matters.<\/p>\n\n A useful habit: when you meet a new security feature, ask which leg of the triad it holds up. Encryption protects confidentiality. A first hop redundancy protocol protects availability. Dynamic ARP inspection<\/a> protects integrity by stopping traffic from being silently redirected. The control makes more sense once you know the goal behind it.<\/p>\n\n You are not expected to launch these, only to recognize what each one does and name the control that stops it. The pattern to learn is attack to mitigation, because that mapping is exactly how the rest of Domain 5 is organized.<\/p>\n\n Notice how many of the bottom rows are Layer 2 attacks that hit the access switch: MAC flooding, VLAN hopping, DHCP spoofing, ARP spoofing. Those are exactly what port security, DHCP snooping, and dynamic ARP inspection exist to stop, and they get their own hands-on guides later in this domain.<\/p>\n\n No single control is enough, because no single control sees everything. A firewall does not stop a poisoned ARP cache inside the LAN, and dynamic ARP inspection does nothing about a phishing email. The answer is defense in depth: layer independent controls so traffic has to pass several of them, and a gap in one is covered by the next.<\/p>\n\n The diagram below shows where each control from this domain sits, from the untrusted internet down to a user and a server on segmented VLANs:<\/p>\n\n\n Reading it top to bottom, each layer adds a control the one above cannot provide. The firewall and IPS filter and inspect traffic at the perimeter. The edge router applies access control lists and forces administrators to authenticate before they can manage it. The access switch enforces the Layer 2 protections that defend the part of the network closest to users. Splitting users and servers into separate VLANs limits how far an attacker can move if a single host is compromised, and a remote worker reaches all of this only through an encrypted IPsec VPN.<\/p>\n\n Two ideas run through every layer. Least privilege<\/strong> means each user, device, and service gets only the access it needs and nothing more, so a compromised account cannot reach the whole network. Hardening<\/strong> means shrinking the attack surface: patch software, disable unused services and ports, change default credentials, and turn off protocols you do not use. Firewalls, an IPS, ACLs, AAA, VPNs, 802.1X, VLAN segmentation, and encryption are the tools; least privilege and hardening are the mindset that decides how you apply them.<\/p>\n\n Most breaches start with a person, not a protocol, so the CCNA also expects you to know the non-technical side of a security program. Three elements come up, and the distinction between the first two matters.<\/p>\n\n Awareness is the steady drip that keeps people alert; training is the scheduled, measurable instruction that teaches them what to do. Physical access control matters because most of the device protections fall away once someone can touch the hardware. A person with console access to a switch in an unlocked closet can perform password recovery and own it, which is why a locked wiring closet is a security control every bit as real as an ACL.<\/p>\n\n Everything here turns into configuration in the guides that follow. Locking down management access starts with SSH for device access<\/a> instead of clear-text Telnet, and grows into centralized AAA with RADIUS or TACACS+<\/a>. The mitigations in the attack table become real commands: access control lists<\/a> to filter traffic, port security<\/a>, DHCP snooping<\/a>, and dynamic ARP inspection for the Layer 2 attacks, and an IPsec VPN<\/a> for the remote worker in the diagram. The wireless side carries its own encryption, which the wireless networking fundamentals<\/a> guide introduces with WPA2 and WPA3. The firewalls and intrusion prevention systems<\/a> from Domain 1 are the perimeter those controls sit behind, and VLAN segmentation<\/a> is what keeps a single compromise from spreading.<\/p>\n\n Run through the questions to lock in the threat-versus-vulnerability distinction, the attack-to-mitigation mappings, and the security program elements, then use the flashcards for quick recall before exam day.<\/p>\n\n Flip through the deck to drill the definitions until they are automatic, or download the Anki pack to review them anywhere:<\/p>\n\n |
![\"Network](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2026\/06\/security-defense-in-depth.png\" "\\"\\"")
<\/figure>\n\n\n