Network+ exam prep: network security
You learn network security in the lab by seeing attacks and stopping them, from central authentication and access lists to layer 2 attacks and device hardening.
Level 201 · 14 lessons · 12 practice labs
Lessons
Concepts and authentication
- Confidentiality, integrity, availability and AAA
- Central authentication: RADIUS and TACACS+
- Segmentation and the zero trust approach
- Certificates and keys on network devices
- Short task: authenticate management access from one central point
Attacks and defence
- Layer 2 attacks: ARP spoofing and MAC flooding
- Catching a rogue DHCP server
- DNS attacks and countermeasures
- Filtering traffic with access control lists
- Hardening a network device: defaults, services, passwords
- Short task: detect the attacker on the LAN and cut off their access
Physical and wireless security
- Physical security: locks, cameras, access cards
- Wireless attacks: evil twins and deauthentication
- Capstone: run a security audit on a small campus network
Practice labs
- Authenticate management logins with RADIUS: You point the lab router's SSH login at the RADIUS server and log in with a central account instead of a local one.
- Set a fallback login for when RADIUS is down: You set a fallback so that, while RADIUS is unreachable, only an emergency account can log in, and test it.
- Renew a device's expiring certificate: You reissue the management interface's expiring certificate from the internal CA, install it and verify the chain.
- Spot ARP poisoning in a capture: In a packet capture you find the device announcing two different MACs for one IP and report the attacker's MAC.
- Find and silence a rogue DHCP server: You find a second DHCP server handing out a wrong gateway through captures and lease records and shut its port.
- Put a port limit against MAC flooding: You detect a client flooding the bridge table, cap learned MACs per port and measure the effect by repeating the attack.
- Block Telnet and allow SSH: You write an access list that blocks Telnet to the management network and allows SSH and test both.
- Fix an access list in the wrong order: You reorder a list where a broad permit shadows a more specific deny and show that the unwanted traffic now stops.
- Harden and audit a network device: You harden a router with a default password, needless open services and cleartext management against a checklist and produce a report.
- Catch a spoofed DNS answer: In a capture you find two different answers to the same query and identify the source of the spoofed one.
- Prove a deauthentication attack: In pre-captured wireless traffic you count the burst of deauthentication frames and report the target client and time window.
- Tell an evil twin access point apart: You tell apart two access points broadcasting the same SSID by BSSID, channel and security settings and prove which is fake.
About this course
You learn network security in the lab by seeing attacks and stopping them, from central authentication and access lists to layer 2 attacks and device hardening.
What you will learn
- Concepts and authentication
- Attacks and defence
- Physical and wireless security
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.