CCNA domain 5 opens with a set of definitions that sound interchangeable but are not: threat, vulnerability, exploit, mitigation. The exam tests whether you can keep them straight, and the real world punishes you when you can't, because you end up patching the wrong layer. This article pins down each term, walks the attack categories the CCNA expects you to recognize, and maps every one of them to the specific Cisco technology that shuts it down. It is part of the Network Fundamentals guide, and it leans on the security tooling covered across the rest of the site rather than repeating it.
The Four Terms, Precisely
Get these exactly right, because the exam writes questions that hinge on the distinction. A vulnerability is a weakness: an unpatched IOS bug, a default password, an open switchport in a lobby, a user who clicks anything. A threat is the potential for someone or something to exploit that weakness (a threat actor is the who; a threat is the what-could-happen). An exploit is the actual tool, code, or technique that turns the vulnerability into a breach. Mitigation (also called a countermeasure) is what you put in place to reduce the likelihood or the impact.
The weakness itself. A switchport with no port security. A device still running the default enable password.
The possibility that the weakness gets used against you, and the actor who might do it.
The concrete method: a script, a crafted packet, a phishing email, a brute-force login loop.
The control that reduces likelihood or impact: a patch, an ACL, 802.1X, DHCP snooping.
A worked example ties them together. The vulnerability is a router that permits SSH from anywhere with only a password. The threat is an attacker on the internet running a credential-guessing tool. The exploit is the brute-force loop itself. The mitigation is login block-for, an ACL on the VTY lines, and moving to key-based or AAA-backed authentication. You can watch that exact attack land in the logs (more on that in Password Policies and MFA for Network Devices), and here is what the device recorded when three bad SSH logins hit it in a row:
%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: attacker] [Source: 192.168.99.100]
[localport: 22] [Reason: Login Authentication Failed]
%SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 50 secs,
[user: attacker] [Source: 192.168.99.100] [ACL: sl_def_acl]That is the whole lifecycle in two syslog lines: an exploit hitting a vulnerability, and a mitigation (quiet mode) kicking in to blunt it.
The Attack Categories CCNA Expects
You are not expected to run these attacks, only to recognize them and name the defense. Here are the categories that show up on the blueprint.
Reconnaissance
Before an attacker breaks anything, they map it: which hosts are up, which ports are open, what software answers. This is exactly what a port scanner does, and seeing it from the attacker's side makes the defensive lessons concrete. The Nmap guide shows real scans against live targets, including how a firewall changes what a scan can see. Mitigation is mostly about reducing your attack surface (close unused ports, filter at the edge) and detecting the scan itself.
Spoofing and Man-in-the-Middle
Spoofing means forging an identity: a fake source IP, a forged MAC, a rogue DHCP server handing out a malicious default gateway, or ARP replies that redirect traffic through the attacker (the classic path to a man-in-the-middle position). These are Layer 2 attacks, and Layer 2 is where you stop them. DHCP snooping drops rogue DHCP offers; Dynamic ARP Inspection (DAI) validates ARP against the snooping table; port security limits MAC addresses per port. The VLANs and Layer 2 Switching guide covers these switch hardening features in depth.
Denial of Service (DoS and DDoS)
A DoS floods a target with traffic or malformed requests until legitimate users can't get through; a DDoS does it from many sources at once, which is what makes it hard to filter by source address. On the CCNA, the defenses you name are rate limiting, ACLs to drop obvious garbage, and control-plane policing to protect the device's own CPU. A firewall like the Cisco ASA adds connection limits and inspection on top.
Password Attacks
Brute force tries every combination; a dictionary attack tries likely words; credential stuffing reuses passwords leaked from other breaches. The syslog capture above is a brute-force attempt in progress. Mitigation is strong password policy, account lockout (login block-for), multi-factor authentication, and centralized AAA so you are not defending one device at a time.
Social Engineering and Phishing
The attacker skips the technology and targets the person: a phishing email, a phone call impersonating IT, a USB drive left in a parking lot. No ACL stops this. The mitigation is a security program element, not a config line: user awareness and training. This is why the blueprint lists people-focused controls alongside the technical ones.
Malware
Viruses attach to files, worms self-propagate across the network, trojans hide inside something that looks legitimate, and ransomware encrypts data for extortion. Network-side mitigations include segmentation (so a worm can't reach everything), NGFW and endpoint protection, and keeping software patched to close the vulnerabilities malware rides in on.
Security Program Elements (Exam 5.2)
Domain 5 explicitly calls out the non-technical side of security, and it is easy points if you don't skip it. Three elements you should be able to describe:
Defense in Depth
No single control is enough, and the exam wants you to think in layers. Defense in depth means an attacker who gets past one control still faces the next: physical security, then port-based access control, then segmentation, then a firewall, then centralized authentication, then monitoring. If one layer fails, the others still stand. The practical corollary is that you match each threat to the layer that actually addresses it rather than throwing one big firewall rule at everything.
Threat-to-Mitigation Mapping
This is the table you want burned into memory for the exam. Each defense links to where it is covered in depth on the site.
DHCP snooping (trusted vs untrusted ports). See the L2 switching guide.
Dynamic ARP Inspection, built on the DHCP snooping binding table.
Port security (max MACs, violation actions) and 802.1X port-based auth.
802.1X with RADIUS: authenticate the device before the port forwards traffic.
ACLs and segmentation, plus a stateful firewall like the Cisco ASA.
Password policy, login block-for, MFA, and centralized AAA.
Notice that most of these live at Layer 2, on the access switch. That is deliberate: the CCNA blueprint puts heavy weight on securing the edge, because the edge is where untrusted devices plug in. If security is your direction of travel, the sister site Threat on the Wire goes deeper on the threat landscape and defensive tradecraft than a CCNA-framed article should.
FAQ
What is the difference between a threat and a vulnerability?
A vulnerability is a weakness that already exists in your environment. A threat is the potential for something to take advantage of it. A door with a broken lock is a vulnerability; a burglar in the neighborhood is a threat. You reduce vulnerabilities directly (fix the lock) and you reduce threats through deterrence and detection.
Is an exploit the same as an attack?
An exploit is the tool or technique; the attack is the act of using it against a target. The same exploit can be used in many attacks. On the exam, "exploit" points to the method that turns a vulnerability into a compromise.
Why does a networking exam test user training?
Because the most reliable way into a network is a person, not a packet. Phishing and social engineering bypass every technical control. The blueprint includes security program elements so you understand that people are part of the attack surface and part of the defense.
Key Takeaways
Keep the four terms distinct: vulnerability (weakness), threat (potential), exploit (method), mitigation (control). Recognize the attack categories (reconnaissance, spoofing/MITM, DoS/DDoS, password attacks, social engineering, malware) and name the specific Cisco defense for each. Remember that security is layered and that people are a layer too. When you are ready to configure the controls, the 802.1X, Layer 2 switching, and Cisco ASA guides are where the theory here becomes running config. Start from the Network Fundamentals guide to see how this fits the rest of domain 5.
