CCNA Cyber Ops SECOPS 210-255 Official Cert Guide

CCNA Cyber Ops SECOPS 210-255 Official Cert Guide

by Omar Santos, Joseph Muniz, Stefano De Crescenzo
Released June 2017
Publisher(s): Cisco Press
ISBN: 9780134608938

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

This is the eBook version of the print title. Note that the eBook does not provide access to the practice test software that accompanies the print book.

Learn, prepare, and practice for CCNA Cyber Ops SECOPS #210-255 exam success with this Official Cert Guide from Pearson IT Certification, a leader in IT Certification learning.

  • Master CCNA Cyber Ops SECOPS #210-255 exam topics

  • Assess your knowledge with chapter-ending quizzes

  • Review key concepts with exam preparation tasks

CCNA Cyber Ops SECOPS 210-255 Official Cert Guide is a best-of-breed exam study guide. Best-selling authors and internationally respected cybersecurity experts Omar Santos and Joseph Muniz share preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics.

The book presents you with an organized test preparation routine through the use of proven series elements and techniques. Exam topic lists make referencing easy. Chapter-ending Exam Preparation Tasks help you drill on key concepts you must know thoroughly. Review questions help you assess your knowledge, and a final preparation chapter guides you through tools and resources to help you craft your final study plan.

Well-regarded for its level of detail, assessment features, and challenging review questions and exercises, this study guide helps you master the concepts and techniques that will allow you to succeed on the exam the first time.

The study guide helps you master all the topics on the SECOPS #210-255 exam, including:

  • Threat analysis

  • Forensics

  • Intrusion analysis

  • NetFlow for cybersecurity

  • Incident response and the incident handling process

  • Incident response teams

  • Compliance frameworks

  • Network and host profiling

  • Data and event analysis

  • Intrusion event categories

.

Table of contents

  1. About This E-Book
  2. Title Page
  3. Copyright Page
  4. About the Authors
  5. About the Technical Reviewers
  6. Dedications
  7. Acknowledgments
  8. Command Syntax Conventions
  9. Introduction
    1. About the 210-255 CCNA Cyber Ops SECOPS Exam
      1. 210-255 CCNA Cyber Ops SECOPS Exam Topics
    2. About the CCNA Cyber Ops SECOPS #210-255 Official Cert Guide
      1. Objectives and Methods
      2. Book Features
      3. How This Book Is Organized
    3. Companion Website
    4. Pearson Test Prep Practice Test Software
      1. Accessing the Pearson Test Prep Software Online
      2. Accessing the Pearson Test Prep Software Offline
      3. Customizing Your Exams
      4. Updating Your Exams
  10. Part I. Threat Analysis and Computer Forensics
    1. Chapter 1. Threat Analysis
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. What Is the CIA Triad: Confidentiality, Integrity, and Availability?
        2. Confidentiality
        3. Integrity
        4. Availability
      3. Threat Modeling
      4. Defining and Analyzing the Attack Vector
      5. Understanding the Attack Complexity
      6. Privileges and User Interaction
      7. The Attack Scope
      8. Exam Preparation Tasks
        1. Review All Key Topics
      9. Complete Tables and Lists from Memory
      10. Define Key Terms
      11. Q&A
    2. Chapter 2. Forensics
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. Introduction to Cybersecurity Forensics
      3. The Role of Attribution in a Cybersecurity Investigation
      4. The Use of Digital Evidence
        1. Defining Digital Forensic Evidence
        2. Understanding Best, Corroborating, and Indirect or Circumstantial Evidence
        3. Collecting Evidence from Endpoints and Servers
        4. Collecting Evidence from Mobile Devices
        5. Collecting Evidence from Network Infrastructure Devices
        6. Chain of Custody
      5. Fundamentals of Microsoft Windows Forensics
        1. Processes, Threads, and Services
        2. Memory Management
        3. Windows Registry
        4. The Windows File System
        5. FAT
        6. NTFS
      6. Fundamentals of Linux Forensics
        1. Linux Processes
        2. Ext4
        3. Journaling
        4. Linux MBR and Swap File System
      7. Exam Preparation Tasks
        1. Review All Key Topics
      8. Define Key Terms
      9. Q&A
  11. Part II. Network Intrusion Analysis
    1. Chapter 3. Fundamentals of Intrusion Analysis
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. Common Artifact Elements and Sources of Security Events
        2. False Positives, False Negatives, True Positives, and True Negatives
      3. Understanding Regular Expressions
      4. Protocols, Protocol Headers, and Intrusion Analysis
      5. Using Packet Captures for Intrusion Analysis
        1. Mapping Security Event Types to Source Technologies
      6. Exam Preparation Tasks
        1. Review All Key Topics
      7. Complete Tables and Lists from Memory
      8. Define Key Terms
      9. Q&A
    2. Chapter 4. NetFlow for Cybersecurity
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. Introduction to NetFlow
        2. What Is a Flow in NetFlow?
        3. The NetFlow Cache
      3. NetFlow Versions
        1. Cisco Flexible NetFlow
        2. Flexible NetFlow Records
        3. Flow Monitors
        4. Flow Exporters
        5. Flow Samplers
        6. Flexible NetFlow Configuration
        7. Configure a Flow Record
        8. Configuring a Flow Monitor for IPv4 or IPv6
        9. Configuring a Flow Exporter for the Flow Monitor
        10. Applying a Flow Monitor to an Interface
      4. IPFIX
        1. IPFIX Architecture
        2. IPFIX Mediators
        3. IPFIX Templates
        4. Option Templates
        5. Introduction to the Stream Control Transmission Protocol (SCTP)
        6. NetFlow and IPFIX Comparison
      5. NetFlow for Cybersecurity and Incident Response
        1. NetFlow as an Anomaly Detection Tool
        2. Incident Response and Network Security Forensics
        3. Using NetFlow for Data Leak Detection and Prevention
      6. NetFlow Analysis Tools
        1. Commercial NetFlow Analysis Tools
        2. Cisco’s Lancope StealthWatch Solution
        3. Plixer’s Scrutinizer
        4. Open Source NetFlow Monitoring and Analysis Software Packages
      7. Exam Preparation Tasks
        1. Review All Key Topics
      8. Define Key Terms
      9. Q&A
  12. Part III. Incident Response
    1. Chapter 5. Introduction to Incident Response and the Incident Handling Process
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. Introduction to Incident Response
        2. What Are Events and Incidents?
      3. The Incident Response Plan
      4. The Incident Response Process
        1. The Preparation Phase
        2. The Detection and Analysis Phase
        3. Containment, Eradication, and Recovery
        4. Post-Incident Activity (Postmortem)
      5. Information Sharing and Coordination
      6. Incident Response Team Structure
      7. The Vocabulary for Event Recording and Incident Sharing (VERIS)
      8. Exam Preparation Tasks
        1. Review All Key Topics
      9. Complete Tables and Lists from Memory
      10. Define Key Terms
      11. Q&A
    2. Chapter 6. Incident Response Teams
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. Computer Security Incident Response Teams (CSIRTs)
      3. Product Security Incident Response Teams (PSIRTs)
        1. Security Vulnerabilities and Their Severity
        2. Vulnerability Chaining Role in Fixing Prioritization
        3. Fixing Theoretical Vulnerabilities
        4. Internally Versus Externally Found Vulnerabilities
      4. National CSIRTs and Computer Emergency Response Teams (CERTs)
      5. Coordination Centers
      6. Incident Response Providers and Managed Security Service Providers (MSSPs)
      7. Exam Preparation Tasks
        1. Review All Key Topics
      8. Define Key Terms
      9. Q&A
    3. Chapter 7. Compliance Frameworks
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. Payment Card Industry Data Security Standard (PCI DSS)
        2. PCI DSS Data
      3. Health Insurance Portability and Accountability Act (HIPAA)
        1. HIPAA Security Rule
        2. HIPAA Safeguards
      4. Sarbanes-Oxley (SOX)
        1. Section 302
        2. Section 404
        3. Section 409
      5. Summary
      6. References
      7. Exam Preparation Tasks
        1. Review All Key Topics
      8. Complete Tables and Lists from Memory
      9. Define Key Terms
      10. Review Questions
    4. Chapter 8. Network and Host Profiling
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. Network Profiling
        2. Throughput
        3. Used Ports
        4. Session Duration
        5. Critical Asset Address Space
      3. Host Profiling
        1. Listening Ports
        2. Logged-in Users/Service Accounts
        3. Running Processes
        4. Applications
      4. Summary
      5. References
      6. Exam Preparation Tasks
        1. Review All Key Topics
      7. Define Key Terms
      8. Q&A
  13. Part IV. Data and Event Analysis
    1. Chapter 9. The Art of Data and Event Analysis
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. Normalizing Data
        2. Interpreting Common Data Values into a Universal Format
      3. Using the 5-Tuple Correlation to Respond to Security Incidents
      4. Retrospective Analysis and Identifying Malicious Files
        1. Identifying a Malicious File
      5. Mapping Threat Intelligence with DNS and Other Artifacts
      6. Deterministic Versus Probabilistic Analysis
      7. Exam Preparation Tasks
        1. Review All Key Topics
      8. Complete Tables and Lists from Memory
      9. Define Key Terms
      10. Q&A
  14. Part V. Incident Handling
    1. Chapter 10. Intrusion Event Categories
      1. “Do I Know This Already?” Quiz
      2. Foundation Topics
        1. Diamond Model of Intrusion
      3. Cyber Kill Chain Model
        1. Reconnaissance
        2. Weaponization
        3. Delivery
        4. Exploitation
        5. Installation
        6. Command and Control
        7. Action and Objectives
      4. Summary
      5. References
      6. Exam Preparation Tasks
        1. Review All Key Topics
      7. Define Key Terms
      8. Q&A
  15. Part VI. Final Preparation
    1. Chapter 11. Final Preparation
      1. Tools for Final Preparation
        1. Pearson Cert Practice Test Engine and Questions on the Website
        2. Customizing Your Exams
        3. Updating Your Exams
        4. The Cisco Learning Network
        5. Memory Tables and Lists
        6. Chapter-Ending Review Tools
      2. Suggested Plan for Final Review/Study
      3. Summary
  16. Part VII. Appendix
    1. Appendix A. Answers to the “Do I Know This Already?” Quizzes and Q&A
    2. Glossary
    3. Index
    4. Appendix B. Memory Tables and Lists
    5. Appendix C. Memory Tables and Lists Answers
    6. Appendix D. Study Planner
  17. Inside Front Cover
  18. Inside Back Cover
  19. Where are the companion content files?
  20. Where are the companion content files?
  21. Access Card
  22. Code Snippets

Product information

  • Title: CCNA Cyber Ops SECOPS 210-255 Official Cert Guide
  • Author(s): Omar Santos, Joseph Muniz, Stefano De Crescenzo
  • Release date: June 2017
  • Publisher(s): Cisco Press
  • ISBN: 9780134608938