CCNA 200-301 services and security explained
Network Services and Security is 20% of the v2.0 CCNA. It covers securing management access with local users and AAA, copying files securely, NAT and PAT, DNS record types, IPsec VPN concepts, IPv4 ACLs and Layer 2 protections. It is the most configuration-oriented domain, so the exam expects you to recognise correct command syntax and to predict what a configuration will allow or block.
Management access and file transfer
| Topic | What to know |
|---|---|
| Local users | username with a secret; login local on the lines |
| AAA | The device is the AAA client; the server is TACACS+ or RADIUS |
| TACACS+ | TCP port 49, encrypts the full payload, separates authentication, authorization and accounting |
| RADIUS | UDP, encrypts only the password, combines authentication and authorization |
| Secure file transfer | SFTP and SCP run over SSH; TFTP and FTP send data in clear text |
Choose TACACS+ when the question is about per-command authorization for administrators, and RADIUS when it is about network access such as wireless or 802.1X.
NAT and PAT
NAT translates addresses between inside and outside. Terms to keep straight:
| Term | Meaning |
|---|---|
| Inside local | The private address of an inside host |
| Inside global | The public address representing it |
| Static NAT | One-to-one fixed mapping |
| Dynamic NAT | A pool of public addresses |
| PAT (overload) | Many inside hosts share one public address, distinguished by port numbers |
A typical PAT configuration marks interfaces with ip nat inside and ip nat outside, defines an ACL for inside traffic, and uses ip nat inside source list 1 interface g0/0 overload. Verify with show ip nat translations and show ip nat statistics.
DNS record types
| Record | Purpose |
|---|---|
| A | Name to IPv4 address |
| AAAA | Name to IPv6 address |
| CNAME | Alias to another name |
| MX | Mail servers for a domain |
| NS | Authoritative name servers |
| PTR | Address to name (reverse lookup) |
Troubleshooting questions describe a symptom, such as mail not delivered or a name resolving to the wrong address, and ask which record to check.
IPsec
IPsec secures traffic with ESP (encryption plus integrity) or AH (integrity only). Tunnel mode wraps the whole original packet in a new IP header and is typical for site-to-site VPNs between gateways. Transport mode protects only the payload and is used host to host. Remote access VPNs connect a single user to a gateway; site-to-site connects two networks permanently.
Access control lists
| Type | Matches | Placement |
|---|---|---|
| Standard (1-99) | Source address only | Close to the destination |
| Extended (100-199) | Protocol, source, destination, ports | Close to the source |
| Named | Either, editable by sequence number | As above |
ACL entries use wildcard masks, the inverse of the subnet mask: 0.0.0.255 for a /24. The list is processed top-down with an implicit deny at the end. Apply it with ip access-group name in|out on an interface, or access-class on VTY lines.
Layer 2 security
| Feature | Defends against |
|---|---|
| Port security | Unknown MAC addresses; violation mode shutdown, restrict or protect |
| DHCP snooping | Rogue DHCP servers; trusted ports only toward legitimate servers |
| Dynamic ARP inspection | ARP spoofing, using the snooping binding table |
| Storm control | Broadcast, multicast or unicast floods |
| RA guard | Rogue IPv6 router advertisements |
Example questions
Question 1. A branch router must let 200 inside hosts reach the internet through the single public address on its outside interface g0/0. Which keyword on the ip nat inside source command achieves this?
- A. static
- B. pool
- C. overload
- D. extendable
Show answer
Answer: C
The overload keyword enables PAT, translating many inside addresses to one public address by tracking port numbers. Static maps one inside address to one outside address. The pool keyword refers to a range of public addresses but without overload each address serves only one host. The extendable keyword is not what allows address sharing.
Want more questions like this? Full 200-301 practice tests →
Question 2. You enable port security on an access port and want frames from unknown MAC addresses to be dropped and logged, while the port stays up for authorized devices. Which violation mode should you configure?
- A. shutdown
- B. restrict
- C. protect
- D. off
Show answer
Answer: B
Restrict drops frames from unknown MAC addresses, increments the violation counter and sends a log message while keeping the port up. Shutdown, the default, puts the port in err-disabled. Protect drops frames silently without logging. Off is not a violation mode.
Want more questions like this? Full 200-301 practice tests →
Question 3. A web alias, www.example.com, should always resolve to whatever address the host srv1.example.com has, including after that address changes. Which record type should you create for www?
- A. A
- B. AAAA
- C. MX
- D. CNAME
Show answer
Answer: D
A CNAME maps one name to another, so www follows srv1 when its address changes. An A record would hold a fixed IPv4 address that you must update manually. AAAA does the same for IPv6, and MX is used to locate mail servers rather than web hosts.
Want more questions like this? Full 200-301 practice tests →
If you sit v1.1 before February 3, 2027
This page follows the v2.0 outline. The v1.1 exam, which Cisco lists as bookable until February 2, 2027, has a Security Fundamentals domain (15%) with an objective that v2.0 drops. v2.0 candidates can skip this section.
Password policy and alternatives (v1.1 objective 5.4)
Objective 5.4 asks you to describe the elements of a security password policy: password management, complexity, and alternatives to passwords, naming multifactor authentication, certificates and biometrics. It is descriptive, so questions present a scenario and ask which control or factor it is.
Management and complexity. A password policy sets rules for how passwords are created, stored and changed. Typical elements are a minimum length, restrictions on reusing old passwords, lockout or delay after repeated failures, and storing passwords only as hashes. Complexity rules (mixing character types) are the element the objective names, but current NIST guidance (SP 800-63B) favours length and checking new passwords against lists of known compromised ones over arbitrary composition rules and forced periodic changes. Know both views: the exam objective asks you to describe complexity as a policy element, not to argue against it. Password managers help users keep long, unique passwords for every system.
Alternatives. Each alternative removes or reduces reliance on something a user can share, guess or reuse:
| Alternative | How it works |
|---|---|
| Multifactor authentication | Requires factors from two or more different categories: something you know (password, PIN), something you have (phone app, hardware token, smart card) and something you are (fingerprint, face) |
| Certificates | A digital certificate issued by a certificate authority binds an identity to a public key; the user or device proves possession of the matching private key, which never crosses the network |
| Biometrics | Uses a physical trait as the “something you are” factor, often to unlock a key or token held on the device |
On network devices, the same ideas appear as SSH with public-key authentication instead of a password, and AAA servers (RADIUS or TACACS+) that can enforce a second factor centrally rather than relying on local passwords on each router.
Exam-style pitfall: MFA means different categories, not more steps. A password followed by a security question, or a password plus a PIN, is two things you know and therefore single-factor. A password plus a code from an authenticator app on the user’s phone is genuine MFA.
For phishing-resistant options such as passkeys and the full ladder of sign-in strength, see MFA, passwordless and passkeys.
Question 4. (v1.1) A company wants VPN logins to use multifactor authentication. Which combination meets that requirement?
- A. A password plus a one-time code from an authenticator app on the user’s phone
- B. A password plus a four-digit PIN
- C. A password plus the answer to a security question
- D. Two different passwords entered in sequence
Show answer
Answer: A
A password is something you know and a one-time code from an app on a registered phone is something you have, so two different factor categories are used. A password with a PIN, or a password with a security question, combines two things you know and is still single-factor. Two passwords are also one category.
Want more questions like this? Full 200-301 practice tests →
Revision tips
For ACLs, write the wildcard mask out from the prefix length every time and remember the implicit deny. For NAT, practise reading the translation table. For Layer 2 security, link each feature to its attack in one line, and you will answer most scenario questions by elimination.
Last domain: AI and network operations.