CCNA Cybersecurity (200-201 CCNACBR) Exam Guide

1. 1.1Describe the CIA triad
2. 1.2Compare security deployments
3. 1.3Describe security terms
4. 1.4Compare security concepts
5. 1.5Describe the principles of the defense-in-depth strategy
6. 1.6Compare access control models
7. 1.7Describe terms as defined in CVSS
8. 1.8Identify the challenges of data visibility (network, host, and cloud) in detection
9. 1.9Identify potential data loss from traffic profiles
10. 1.10Interpret the 5-tuple approach to isolate a compromised host in a grouped set of logs
11. 1.11Compare rule-based detection vs. behavioral and statistical detection

Example scenario: A manager asks why the SOC needs both a SIEM and a SOAR platform. How would you explain what each one does?

1. 2.1Compare attack surface and vulnerability
2. 2.2Identify the types of data provided by these technologies
3. 2.3Describe the impact of these technologies on data visibility
4. 2.4Describe the uses of these data types in security monitoring
5. 2.5Describe network attacks, such as protocol-based, denial of service, distributed denial of service, and man-in-the-middle
6. 2.6Describe web application attacks, such as SQL injection, command injections, and cross- site scripting
7. 2.7Describe social engineering attacks (manual and generative AI)
8. 2.8Describe endpoint-based attacks, such as buffer overflows, command and control (C2), malware, and ransomware
9. 2.9Describe evasion and obfuscation techniques, such as tunneling, encryption, and proxies
10. 2.10Describe the impact of certificates on security (includes PKI, public/private crossing the network, asymmetric/symmetric)
11. 2.11Identify the certificate components in a given scenario

Example scenario: Traffic to a suspicious domain is encrypted with TLS. Which data sources could still tell you something useful about it?

1. 3.1Describe the functionality of these endpoint technologies in regard to security monitoring utilizing rules, signatures, and predictive AI
2. 3.2Identify components of an operating system (such as Windows and Linux) in a given scenario
3. 3.3Describe the role of attribution in an investigation
4. 3.4Identify type of evidence used based on provided logs
5. 3.5Interpret operating system, SIEM, SOAR platform, application, or command line logs to identify an event
6. 3.6Interpret the output report of malware analysis tools such as a detonation chamber or sandbox

Example scenario: A Windows log shows a new service installed at 3 a.m. by an account that normally only reads email. What would you check next on that host?

1. 4.1Map the provided events to source technologies
2. 4.2Compare impact and no impact for these items
3. 4.3Compare deep packet inspection with packet filtering and stateful firewall operation
4. 4.4Compare inline traffic interrogation and taps or traffic monitoring
5. 4.5Compare the characteristics of data obtained from taps or traffic monitoring and transactional data (NetFlow) in the analysis of network traffic
6. 4.6Extract files from a TCP stream when given a PCAP file and Wireshark
7. 4.7Identify key elements in an intrusion from a given PCAP file
8. 4.8Interpret the fields in protocol headers as related to intrusion analysis
9. 4.9Interpret common artifact elements from an event to identify an alert
10. 4.10Interpret basic regular expressions

Example scenario: An IDS alert fires on a SQL injection pattern, but the web server's response was a 404 error. How would you decide whether the attack succeeded?

1. 5.1Describe management concepts
2. 5.2Describe the elements in an incident response plan as stated in NIST.SP800-61
3. 5.3Apply the incident handling process such as NIST.SP800-61 to an event
4. 5.4Map elements to these steps of analysis based on the NIST.SP800-61
5. 5.5Map the organization stakeholders against the NIST IR categories (CMMC, NIST.SP800- 61)
6. 5.6Describe concepts as documented in NIST.SP800-86
7. 5.7Identify these elements used for network profiling
8. 5.8Identify these elements used for server profiling
9. 5.9Identify protected data in a network
10. 5.10Classify intrusion events into categories as defined by security models, such as Cyber Kill Chain Model and Diamond Model of Intrusion
11. 5.11Describe the relationship of SOC metrics to scope analysis (time to detect, time to contain, time to respond, time to control)

Example scenario: You find malware on a laptop that belongs to someone in HR. Which steps would you follow, and which data types make the incident more serious?