book

Cisco Certified CyberOps Associate 200-201 Certification Guide

Name: Cisco Certified CyberOps Associate 200-201 Certification Guide
Author: Glen D. Singh
ISBN: 9781800560871

by Glen D. Singh

June 2021

Intermediate to advanced

660 pages

13h 20m

English

Packt Publishing

Read now

Unlock full access

Cisco Certified CyberOps Associate 200-201 Certification Guide
ContributorsAbout the authorAbout the reviewers
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesCode in ActionDownload the color imagesConventions usedGet in touchReviews
Section 1: Network and Security Concepts
Chapter 1: Exploring Networking Concepts
Technical requirementsThe functions of the network layersThe OSI reference modelThe TCP/IP protocol suiteUnderstanding the purpose of various network protocolsTransmission Control ProtocolUser Datagram ProtocolInternet ProtocolThe Internet Control Message ProtocolLab – inspecting ICMP messages with WiresharkSummaryQuestionsFurther reading
Chapter 2: Exploring Network Components and Security Systems
Technical requirementsExploring various network servicesAddress Resolution ProtocolDomain Name SystemDynamic Host Configuration ProtocolDiscovering the role and operations of network devicesHubsSwitchesLayer 3 switchesRoutersWireless Access Point (WAP)Wireless LAN Controller (WLC)Describing the functions of Cisco network security systemsFirewallCisco Intrusion Prevention System (IPS)Web Security ApplianceEmail Security ApplianceCisco Advanced Malware ProtectionSummaryQuestionsFurther reading
Chapter 3: Discovering Security Concepts
Introducing the principles of defense in depthConfidentialityIntegrityAvailabilityCombining the three pillarsExploring security terminologiesThreats, vulnerabilities, and exploitsIdentifying threat actorsUnderstanding runbook automationChain of custodyReverse engineeringPII and PHIUnderstanding riskExploring access control modelsDiscretionary access controlMandatory access controlRule-based access control Time-based access control Role-based access controlAuthentication, authorization, and accountingUnderstanding security deploymentSummaryQuestions
Section 2: Principles of Security Monitoring
Chapter 4: Understanding Security Principles
Technical requirementsUnderstanding a security operation centerTypes of SOCElements of an SOCUnderstanding the security tools used to inspect data types on a networkAttack surface and vulnerabilitytcpdumpNetFlowApplication visibility and controlWeb content filteringEmail content filteringUnderstanding the impact of data visibility through networking technologiesAccess control listsNAT and PATTunneling, encapsulation, and encryptionPeer-to-Peer (P2P) and TORLoad balancingNext-gen IPS event typesUnderstanding how threat actors transport malicious codeThe domain name systemThe Network Time ProtocolWeb-based trafficEmail-based trafficDelving into data types used during security monitoringSession dataTransaction dataFull packet captureStatistical dataExtracted content (metadata)Alert dataSummaryQuestionsFurther reading
Chapter 5: Identifying Attack Methods
Understanding network-based attacksDenial of ServiceProtocol-based attacksDistributed Denial of ServiceMan-in-the-middleExploring web application attacksSQL injection Command injectionCross-site scriptingCross-site request forgeryDelving into social engineering attacksKey elements of social engineeringTypes of social engineering attacksUnderstanding endpoint-based attacksBuffer overflowsCommand and control (C2)Malware and ransomware Interpreting evasion and obfuscation techniquesSummaryQuestionsFurther reading
Chapter 6: Working with Cryptography and PKI
Technical requirementsUnderstanding the need for cryptographyElements of cryptographyTypes of ciphersSubstitution cipherTransposition cipherUnderstanding cryptanalysisUnderstanding the hashing processDescribing hashing algorithmsLab – Comparing hashesExploring symmetric encryption algorithmsSymmetric algorithmsDelving into asymmetric encryption algorithmsUnderstanding PKIComponents of PKIPKI trust systemLab – Observing the exchange of digital certificates Using cryptography in wireless securitySummaryQuestionsFurther reading

Section 3: Host and Network-Based Analysis
Chapter 7: Delving into Endpoint Threat Analysis
Technical requirementsUnderstanding endpoint security technologiesAnti-malware and antivirusHost-based firewallHost-based intrusion detectionApplication-level whitelisting/blacklistingSystems-based sandboxingUnderstanding Microsoft Windows componentsProcesses, threads, and servicesThe Windows paging fileWindows registryWindows Management InstrumentationMonitoring toolsExploring Linux componentsLinux TerminalViewing directoriesLog filesMonitoring resourcesSummaryQuestionsFurther reading
Chapter 8: Interpreting Endpoint Security
Technical requirementsExploring the Microsoft Windows filesystemFilesystemsAlternate data streamsDelving into the Linux filesystemUnderstanding the CVSSCVSS metrics Working with malware analysis toolsLab exercise – Building a malware analysis sandboxSummaryQuestions
Chapter 9: Exploring Computer Forensics
Technical requirementsUnderstanding the need for computer forensicsUnderstanding the process of digital forensicsUnderstanding the chain of custodyUnderstanding volatility of evidenceUnderstanding types of evidenceContrasting tampered and untampered disk imagesLab – capturing a disk image on LinuxLab – using FTK Imager to capture a disk image on Microsoft WindowsTools commonly used during a forensics investigationUnderstanding the role of attribution in an investigationSummaryQuestionsFurther reading
Chapter 10: Performing Intrusion Analysis
Technical requirementsIdentifying intrusion events based on source technologiesIDS/IPSFirewallNetwork application controlProxy logsAntivirusElements of NetFlow and transactional data Stateful and deep packet firewall operationsDPI firewallStateful firewallPacket filtering Comparing inline traffic interrogation techniquesUnderstanding impact and no impact on intrusionProtocol headers in intrusion analysisEthernet frameIPv4 and IPv6TCPUDPICMPSMTPHTTP and HTTPSARPPacket analysis using a PCAP file and WiresharkLab – packet analysis using WiresharkSummaryQuestionsFurther reading
Section 4: Security Policies and Procedures
Chapter 11: Security Management Techniques
Technical requirementsIdentifying common artifact elementsInterpreting basic regular expressionsLab – using regexes to find specific data valuesUnderstanding asset managementDelving into configuration and mobile device managementExploring patch and vulnerability managementSummaryQuestionsFurther reading
Chapter 12: Dealing with Incident Response
Understanding the incident handling processUnderstanding the phases of incident handlingExploring CSIRT teams and their responsibilitiesDelving into network and server profilingNetwork profilingServer profilingComparing compliance frameworksPCI DSSHIPAASOXSummaryQuestionsFurther reading
Chapter 13: Implementing Incident Handling
Understanding the NIST SP 800-86 componentsEvidence collection order and volatilityData acquisition and integritySharing information using VERISExploring the Cyber Kill Chain ReconnaissanceWeaponizationDeliveryExploitationInstallation Command and Control (C2)Actions on objectivesDelving into the Diamond Model of Intrusion AnalysisIdentifying protected data in a networkPersonally Identifiable Information (PII)Personal Security Information (PSI)Protected Health Information (PHI)Intellectual propertySummaryQuestionsFurther reading
Chapter 14: Implementing Cisco Security Solutions
Technical requirementsImplementing AAA in a Cisco environmentPart 1 – Configuring IP addresses on host devicesPart 2 – Configuring RADIUS and TACACS+ servicesPart 3 – Configuring local AAA on the R1 routerPart 4 – Configuring server-based AAA using RADIUSPart 5 – Configuring server-based AAA using TACACS+Part 6 – VerificationDeploying a zone-based firewallPart 1 – Configuring IP addresses on PC 1 and the web serverPart 2 – Enabling the security technology license on the HQ routerPart 3 – Configuring IP addresses and routes on HQ and ISP routersPart 4 – Creating security zonesPart 5 – Identifying trafficPart 6 – Creating a policy map to define the action of matching trafficPart 7 – Identifying the zone pair and match policyPart 8 – Assigning the security zones to the interfacePart 9 – VerificationConfiguring an IPSPart 1 – Configuring IP addresses on end devicesPart 2 – Enabling the security technology license on the HQ routerPart 4 – Configuring the IPS signature storage location and rule on HQPart 5 – Configuring the logging of IPS eventsPart 6 – Configuring IPS with signature categoriesPart 7 – Applying the IPS rule to an interfacePart 8 – Creating an alert and dropping inbound ICMP Echo Reply packetsPart 3 – Configuring IP addresses and routes on HQ and ISP routersPart 9 – VerificationSummaryFurther reading
Chapter 15: Working with Cisco Security Solutions
Technical requirementsImplementing secure protocols on Cisco devicesPart 1 – Configuring IP addresses on host devicesPart 2 – Configuring the Syslog and NTP serversPart 3 – Configuring hostnames, banners, and IP addresses on routersPart 4 – Configuring OSPFv2 routing with authenticationPart 5 – Configuring NTP with authenticationPart 6 – Configuring Syslog Part 7 – Implementing secure remote access using SSHPart 8 – VerificationDeploying Layer 2 security controlsPart 1 – Configuring end devices and the DHCP serverPart 2 – Securing STPPart 3 – Configuring DHCP snooping with ARP inspectionPart 4 – VerificationConfiguring a Cisco ASA firewallPart 1 – Configuring the ISP router and end devicesPart 2 – Performing basic ASA configurations Part 3 – Configuring security zones and interfacesPart 4 – Assigning the physical interfaces to a security zonePart 5 – Configuring routing and NATPart 6 – Configuring the Cisco MPFPart 7 – Configuring DHCP and remote accessPart 8 – Configuring the DMZPart 9 – VerificationSummary
Chapter 16: Real-World Implementation and Best Practices
Technical requirementsImplementing an open source SIEM toolPart 1 – Creating a virtual environmentPart 2 – Installing OSSIM Part 3 – Getting started with AlienVault OSSIMImplementing tools to perform the active scanning of assetsPart 1 – Setting up Kali LinuxPart 2 – Acquiring and installing NessusPart 3 – Performing a vulnerability scanUsing open source breach and attack simulation toolsPart 1 – Installing Infection MonkeyPart 2 – Setting up C2Part 3 – Breach and attack reportingImplementing an open source honeypot platformPart 1 – Creating the virtual environmentPart 2 – Installing the honeypot platformPart 3 – Initializing the honeypot and its applicationsPart 4 – Accessing the honeypot dashboardSummary
Chapter 17: Mock Exam 1
Chapter 18: Mock Exam 2
Questions
Assessment
Chapter 1Chapter 2Chapter 3Chapter 4Chapter 5Chapter 6Chapter 7Chapter 8Chapter 9Chapter 10Chapter 11Chapter 12Chapter 13Chapter 17Chapter 18
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youLeave a review - let other readers know what you think

Content preview from Cisco Certified CyberOps Associate 200-201 Certification Guide

Chapter 16: Real-World Implementation and Best Practices

In this chapter, you will take a deep dive into learning how to implement various real-world threat detection platforms on a network. Firstly, you will learn how to implement an open source Security Information and Event Management (SIEM) tool on a network to gather, correlate, and monitor security alerts. Then, you will learn how to automate the process of discovering and exploiting vulnerabilities using both a vulnerability scanner and a breach and attack automation tool. This will teach you how attackers compromise your network and system and establish communication channels between compromised systems and a centralized server. Lastly, you will learn how to implement an open source ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

CCNA Cyber Ops SECFND #210-250 Official Cert Guide

Publisher Resources

ISBN: 9781800560871

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Cisco Certified CyberOps Associate 200-201 Certification Guide

by Glen D. Singh

Chapter 16: Real-World Implementation and Best Practices

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.