CCNA 200-301 v1.1 reference — Security Fundamentals

Device access control and password policy

Local passwords and line-level access control, password policy elements, and alternatives such as MFA, certificates and biometrics.

Objective 5.3Objective 5.4v1.1 exam target

Quick Reference Handbook

Local access control

Passwords on console, vty and privileged mode — Privileged EXEC → Line + global configuration

Cisco IOS / IOS XE

configure terminal
enable secret <placeholder-enable-secret>
username admin secret <placeholder-user-secret>
line console 0
 login local
 exit
line vty 0 15
 login local
 transport input ssh
 end

Verify

show running-config | section line
show privilege

Each line needs a deliberate login method — unset behavior varies by platform (default vty often rejects a login with no password configured; a console with no login line is unguarded).
Use secret for irreversible hashing — many modern platforms default to scrypt type 9, but verify the stored type rather than assume.

enable password and password use weak reversible storage — prefer secret always.
service password-encryption only obscures type-7 passwords — it is not real protection.

Changes device configuration.

Access lines and their controls

Line	Reaches	Protect with
Console 0	Physical serial/USB port	login + user, physical security
vty 0 15	Remote SSH/Telnet sessions	login + user/AAA, transport input ssh, access-class
Aux	Modem/auxiliary port	Often disabled; secure if present
Privileged EXEC	enable mode	enable secret

Password policy and alternatives

Password policy is more than complexity: management (rotation, storage, sharing rules), complexity requirements, and alternatives — MFA (something you have/are, in addition to know), certificates (device/user identity without reusable passwords), and biometrics. The blueprint asks for the elements, not a specific product.

Authentication factors and alternatives

Mechanism	Factor type	Notes
Password/PIN	Something you know	Weakest alone — reusable and phishable
Token/app OTP, hardware key	Something you have	Classic second factor in MFA
Biometrics	Something you are	Fingerprint/face — convenience + assurance
Certificate	Something you have (key)	Strong device/user identity; no password to reuse

Layered defense and verification

Layer the controls for remote admin

Requirement: Admins manage 50 switches from a NOC

SSH-only vty + access-class to the NOC subnet — the transport layer.
AAA (TACACS+) instead of per-device local users — centralized auth + per-command authorization.
MFA at the AAA layer — the password alone is never sufficient.
enable secret as the last line — even authenticated sessions need privilege elevation control.

Each layer assumes the previous one can fail.

Common mistakes

Leaving login unset on a line — behavior differs by line and platform: a console may offer unguarded access while a vty may refuse logins without a password; configure deliberately.
Using password (type 7) believing it's hashed — it's trivially reversible.
Treating service password-encryption as security — it's obfuscation only.
Forgetting the console line — physical access deserves the same login discipline.
Confusing authentication (who you are) with authorization (what you may do) — they're separate AAA functions.

Locked out after changing vty config

Observation: After adding login local, no one can log in remotely.

Hypotheses

No local username exists for login local to check
AAA pointed at a dead server with no local fallback
access-class ACL now rejects the admin subnet

Check	Indicates
Console in and `show running-config \| include username`	Console access survives vty mistakes — verify a user exists.
`show running-config \| section vty`	Confirm login method and transport/ACL combination.

Correction: Add the local user, or add a local fallback to the global method list (aaa authentication login default group tacacs+ local); a dead server returns ERROR and falls through, an explicit REJECT does not.

SSH login succeeds and unauthorized sources are refused.

On this page

Local access control
Password policy and alternatives
Layered defense and verification

Related resources

Practise this topic Source topic 4: Intro to the CLI Practise topic 4 deck Source topic 42: SSH (Secure Shell)Practise topic 42 deck Source topic 48: Security Fundamentals Practise topic 48 deck

Sources

Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
Cisco — Authentication Authorization and Accounting Configuration Guide — reviewed 2026-11-02

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.