CCNA 200-301 v1.1 reference — Security Fundamentals

Device access control and password policy

Local passwords and line-level access control, password policy elements, and alternatives such as MFA, certificates and biometrics.

Objective 5.3Objective 5.4v1.1 exam target

Quick Reference Handbook

Local access control

Passwords on console, vty and privileged mode — Privileged EXEC → Line + global configuration

Cisco IOS / IOS XE

configure terminal
enable secret <placeholder-enable-secret>
username admin secret <placeholder-user-secret>
line console 0
 login local
 exit
line vty 0 15
 login local
 transport input ssh
 end

Verify

show running-config | section line
show privilege

Each line needs a deliberate login method — unset behavior varies by platform (default vty often rejects a login with no password configured; a console with no login line is unguarded).
Use secret for irreversible hashing — many modern platforms default to scrypt type 9, but verify the stored type rather than assume.

enable password and password use weak reversible storage — prefer secret always.
service password-encryption only obscures type-7 passwords — it is not real protection.

Changes device configuration.

Access lines and their controls

Line	Reaches	Protect with
Console 0	Physical serial/USB port	login + user, physical security
vty 0 15	Remote SSH/Telnet sessions	login + user/AAA, transport input ssh, access-class
Aux	Modem/auxiliary port	Often disabled; secure if present
Privileged EXEC	enable mode	enable secret

Authentication factors and alternatives

Mechanism	Factor type	Notes
Password/PIN	Something you know	Weakest alone — reusable and phishable
Token/app OTP, hardware key	Something you have	Classic second factor in MFA
Biometrics	Something you are	Fingerprint/face — convenience + assurance
Certificate	Something you have (key)	Strong device/user identity; no password to reuse

Layer the controls for remote admin

Requirement: Admins manage 50 switches from a NOC

SSH-only vty + access-class to the NOC subnet — the transport layer.
AAA (TACACS+) instead of per-device local users — centralized auth + per-command authorization.
MFA at the AAA layer — the password alone is never sufficient.
enable secret as the last line — even authenticated sessions need privilege elevation control.

Each layer assumes the previous one can fail.

On this page

Local access control
Access lines and their controls
Authentication factors and alternatives
Layer the controls for remote admin

Handbook sections

Related resources

Practise this topic Source topic 4: Intro to the CLI Practise topic 4 deck Source topic 42: SSH (Secure Shell)Practise topic 42 deck Source topic 48: Security Fundamentals Practise topic 48 deck

Sources

Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
Cisco — Authentication Authorization and Accounting Configuration Guide — reviewed 2026-11-02

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.