Cisco CCNA Associate & CyberOps Associate Training Boot Camp

Lesson 1

1. Cisco CCNA (200-301)
1. Network Fundamentals
   1. Role and function of network components
   2. Characteristics of network topology architectures
   3. Compare and contrast network topologies
   4. Physical interface and cabling types
   5. Interface and cable issues (collisions, errors, mismatch duplex, and/or speed)
   6. TCP and UDP
   7. Configuring and verifying IPv4 addressing and subnetting
   8. The need for private IPv4 addressing
   9. Configuring and verifying IPv6 addressing and prefix
   10. IPv6 address types
   11. Verifying IP parameters for client OS (Windows, Mac OS, Linux)
   12. Wireless principles
   13. Virtualization fundamentals (virtual machines)
   14. Switching concepts
2. Network Access
   1. Configuring and verifying VLANs (normal range) spanning multiple switches
   2. Configuring and verifying interswitch connectivity
   3. Configuring and verifying Layer 2 discovery protocols (Cisco Discovery Protocol and LLDP)
   4. Configuring and verifying (Layer 2/Layer 3) EtherChannel (LACP)
   5. The need for and basic operations of Rapid PVST+ Spanning Tree Protocol
   6. Cisco Wireless Architectures and AP modes
   7. Physical infrastructure connections of WLAN
   8. Components (AP, WLC, access/trunk ports, and LAG)
   9. AP and WLC management access connections (Telnet, SSH, HTTP, HTTPS, console and TACACS+/RADIUS)
   10. Configuring the components of a wireless LAN access for client connectivity using GUI only such as WLAN creation, security settings, QoS profiles and advanced WLAN settings
3. IP Connectivity
   1. Components of routing table
   2. Determining how a router makes a forwarding decision by default
   3. Configuring and verifying IPv4 and IPv6 static routing
   4. Configuring and verifying single area OSPFv2
   5. The purpose of first hop redundancy protocol
4. IP Services
   1. Configuring and verifying inside source NAT using static and pools
   2. Configuring and verifying NTP operating in a client and server mode
   3. Role of DHCP and DNS within the network
   4. Function of SNMP in network operations
   5. Use of syslog features including facilities and levels
   6. Configuring and verifying DHCP client and relay
   7. Understanding the forwarding per-hop behavior (PHB) for QoS such as classification, marking, queuing, congestion, policing, shaping
   8. Configuring network devices for remote access using SSH
   9. Capabilities and function of TFTP/FTP in the network
5. Security Fundamentals
   1. Key security concepts (threats, vulnerabilities, exploits and mitigation techniques)
   2. Security program elements (user awareness, training, and physical access control)
   3. Configuring device access control using local passwords
   4. Security password policies elements: management, complexity, and password alternatives (multifactor authentication, certificates, and biometrics)
   5. Remote access and site-to-site VPNs
   6. Configuring and verifying access control lists
   7. Configuring Layer 2 security features (DHCP snooping, dynamic ARP inspection and port security)
   8. Authentication, authorization, and accounting
   9. Wireless security protocols (WPA, WPA2 and WPA3)
   10. Configuring WLAN using WPA2 PSK using the GUI
6. Automation and Programmability
   1. How automation impacts network management
   2. Traditional networks vs. controller-based networking
   3. Controller-based and software defined architectures (overlay, underlay and fabric)
   4. Traditional campus device management vs. Cisco DNA Center enabled device management
   5. Characteristics of REST-based APIs (CRUD, HTTP verbs and data encoding)
   6. Capabilities of configuration management mechanisms Puppet, Chef and Ansible
   7. Interpreting JSON encoded data
2. Cisco Certified CyberOps Associate (200-201)
1. Security Concepts
   1. Describe the CIA triad
   2. Compare security deployments
   3. Describe security terms
   4. Compare security concepts
   5. Describe the principles of the defense-in-depth strategy
   6. Compare access control models
   7. Describe terms as defined in CVSS
   8. Identify the challenges of data visibility (network, host, and cloud) in detection
   9. Identify potential data loss from provided traffic profiles
   10. Interpret the 5-tuple approach to isolate a compromised host in a grouped set of logs
   11. Compare rule-based detection vs. behavioral and statistical detection
2. Security Monitoring
   1. Compare attack surface and vulnerability
   2. Identify the types of data provided by these technologies
   3. Describe the impact of these technologies on data visibility
   4. Describe the uses of these data types in security monitoring
   5. Describe network attacks, such as protocol based, denial of service, distributed denial of service and man-in-the-middle
   6. Describe web application attacks, such as SQL injection, command injections and crosssite scripting
   7. Describe social engineering attacks
   8. Describe endpoint-based attacks, such as buffer overflows, command and control (C2), malware and ransomware
   9. Describe evasion and obfuscation techniques, such as tunneling, encryption and proxies
   10. Describe the impact of certificates on security (includes PKI, public/private crossing the network, asymmetric/symmetric)
   11. Identify the certificate components in a given scenario
   12. Cipher-suite
3. Host-Based Analysis
   1. Describe the functionality of these endpoint technologies in regard to security monitoring
   2. Identify components of an operating system (such as Windows and Linux) in a given scenario
   3. Describe the role of attribution in an investigation
   4. Identify type of evidence used based on provided logs
   5. Compare tampered and untampered disk image
   6. Interpret operating system, application, or command line logs to identify an event
   7. Interpret the output report of a malware analysis tool (such as a detonation chamber or sandbox)
4. Network Intrusion Analysis
   1. UMap the provided events to source technologies
   2. Compare impact and no impact
   3. Compare deep packet inspection with packet filtering and stateful firewall operation
   4. Compare inline traffic interrogation and taps or traffic monitoring
   5. Compare the characteristics of data obtained from taps or traffic monitoring and transactional data (NetFlow) in the analysis of network traffic
   6. Extract files from a TCP stream when given a PCAP file and Wireshark
   7. Identify key elements in an intrusion from a given PCAP file
   8. Interpret the fields in protocol headers as related to intrusion analysis
   9. Interpret common artifact elements from an event to identify an alert
   10. Interpret basic regular expressions
5. Security Policies and Procedures
   1. Describe management concepts
   2. Describe the elements in an incident response plan as stated in NIST.SP800-61
   3. Apply the incident handling process (such as NIST.SP800-61) to an event
   4. Map elements to these steps of analysis based on the NIST.SP800-61
   5. Map the organization stakeholders against the NIST IR categories (CMMC, NIST.SP800-61)
   6. Describe concepts as documented in NIST.SP800-86
   7. Identify these elements used for network profiling
   8. Identify these elements used for server profiling
   9. Identify protected data in a network
   10. Classify intrusion events into categories as defined by security models, such as Cyber Kill Chain
   11. Model and Diamond Model of Intrusion
   12. Describe the relationship of SOC metrics to scope analysis (time to detect, time to contain, time to respond, time to control)