Cisco Certified CyberOps Associate (200-201) Cert Prep: 2 Security Monitoring

Course details

In this course, instructor Lisa Bock describes the various attacks that can occur on the network, along with ways malicious actors use methods such as tunneling and encryption to conceal their behavior. Learn how to recognize the importance of having application visibility and control to effectively monitor the network. Lisa shows you how to examine system data from tcpdump and NetFlow to help with analysis. Discover ways to limit data visibility from threat actors on the network, by using access control lists and network address translation. She then outlines how to assure trust on the network by using the Public Key Infrastructure (PKI). Finally, see how a trusted third party uses certificates to securely exchange session keys to all parties in a transaction. Along the way, Lisa provides practical challenges that let you put your new knowledge to the test.

Concepts

0. Introduction

01 - Active security monitoring
02 - Prepare for Cisco CBROPS exam
03 - Setting up your test environment

1. Understanding Attacks

04 - Recognizing attack surfaces
05 - Identifying vulnerability testing
06 - Attacking the network
07 - Describing web application attacks
08 - Hacking the human
09 - Investigating endpoint-based attacks
10 - Challenge - Research and identify social engineering attacks
11 - Solution - Research and identify social engineering attacks

2. Examining System Data

12 - Exploring CLI tools
13 - Analyzing data with NetFlow
14 - Monitoring traffic with a stateful firewall
15 - Deploying a next-generation firewall
16 - Having application visibility and control
17 - Filtering web and email content
18 - Challenge - Using NetFlow in Packet Tracer
19 - Solution - Using NetFlow in Packet Tracer

3. Comparing Data Types Used in Security Monitoring

20 - Obtaining a packet capture with Wireshark
21 - Understanding conversations and endpoints
22 - Visualizing session and transactional data
23 - Analyzing statistical data
24 - Sending alert data
25 - Investigating an IDS alert
26 - Challenge - Using Wireshark to examine DNS traffic
27 - Solution - Using Wireshark to examine DNS traffic

4. Limiting Data Visibility

28 - Using an access control list
29 - Concealing the network using NAT PAT
30 - Evading and hiding techniques
31 - Tunneling and encapsulation
32 - Using encryption to hide

5. Using Certificates

33 - Protecting data and networks
34 - Ensuring trust on the Internet
35 - Examining an X.509 certificate
36 - Describing certificate classes
37 - Grasping the public key cryptography standards (PKCS)
38 - Managing keys using IKE
39 - Outlining the different protocol versions
40 - Configuring the cipher suite
41 - Challenge - Certificate Authority Stores
42 - Solution - Certificate Authority Stores

Conclusion

43 - Next steps

Cisco Certified CyberOps Associate (200-201) Cert Prep: 2 Security Monitoring

Authors

Lisa Bock