Cisco CyberOps Associate CBROPS 200-201: Part 1 Course

Learn how networks use TCP/IP and OSI models to move data from application protocols like HTTP through TCP/UDP with ports, IP and MAC addresses, and Ethernet frames.

Explore how ICMP supports network monitoring and discovery, and how ping requests and replies expose vulnerabilities and denial of service risks, underscoring the need to block ICMP at internet edge.

Explore how the address resolution protocol maps IP addresses to MAC addresses with ARP requests and replies, broadcasts, and ARP table updates shown in Wireshark captures.

Explore how DHCP dynamically assigns IP addresses to devices, replacing manual configuration. See a real-world workflow with ipconfig, release, renew, and the DHCP discover–offer–request–ack exchange.

Explore how DNS resolves domain names to IP addresses, tracing queries from root servers through top-level domain servers to domain owners, illustrated by a DNS request example and Wireshark capture.

Learn how network devices like hubs, switches, routers, VLANs, and wireless access points forward and secure traffic, including MAC address tables, broadcast domains, and firewalls and IPS.

Firewalls form the core of network security, creating borders between trusted and untrusted zones and blocking unwanted traffic with stateful inspection and access lists.

Discover how intrusion prevention systems inspect traffic, match IPS signatures, and block activity. Configure IPS and AMP policies in Firepower Management Center, and explore file trajectory and malware cloud lookups.

Learn to implement Cisco email security and Cisco web security appliances to mitigate email and web threats with antispam, antivirus, malware protection, and data loss prevention, including cloud-based options.

Explore how SIEM collects and analyzes logs to alert on incidents, and how SOAR automates response with playbooks.

Compare inline traffic interrogation with tap mode and NetFlow for security visibility. Explain how port mirroring with span redirects traffic and how NetFlow collects and analyzes IP traffic.

This lecture traces the shift from physical servers to virtualization and containers, explains hypervisors and virtual machines and containers basics, and outlines security practices for virtual machines and container environments.

Secure cloud perimeters with firewalls and a web application firewall; minimize misconfigurations and enforce zero trust in identity and access management. Centralize siem-based log management for multi-cloud visibility.

Explore the CIA triad of confidentiality, integrity, and availability. Learn how encryption, authorization, and VPN tunnels protect data and maintain uptime against denial of service attacks.

Explore defense in depth by implementing multiple security layers, from network firewalls to endpoint protections, using an onion diagram to map risks and policies.

Identify and mitigate network vulnerabilities by using vulnerability scanning with Nmap, interpreting severity and CVE details, and reviewing exploit packs to inform up-to-date software defense.

Learn how exploits target vulnerabilities, distinguishing remote and local exploits, and use tools like Metasploit, Kali, Armitage, and Nmap to discover, analyze, and assess exploitability for defensive security.

Assess risk by evaluating likelihood and impact, reduce it with defense in depth. Third-party risk assessments identify vulnerabilities in equipment, inventory, software versions, and vulnerability scans to guide prioritized fixes.

Learn key security terms for the ccnA Cyber Ops exam, including threat actors, runbook automation, chain of custody, reverse engineering, and the principle of least privilege.

Threat modeling uses hypothetical situations, system schematics, and testing to bolster security by identifying vulnerabilities and proposing corrective measures.

Enforce least privilege through access control models: discretionary access control, mandatory access control, and RBAC, illustrated by admin SharePoint site permissions and sales vs marketing role-based access.

Explore attribute-based access control (abac), an authorization framework that uses attributes rather than roles to grant access. See real-world AWS tagging examples where user and resource tags determine policy access.

Threat hunting is a proactive technique to detect undetected threats in your environment before they compromise endpoints. It uses log checks, unusual network activity, and automated scans, with scheduled routines.

Adopt zero trust security by default denying communications and allowing only necessary traffic. Cisco data center solutions use a whitelist policy to enforce explicit rules and clarify traffic flows.

Learn how threat intelligence platforms act as a single pane of glass that ingest security intel from SIMs, firewalls, IPS, and third-party feeds, unifying diverse security products.

Explore authentication, authorization, and accounting (AAA) using Tacacs and Radius, with a Cisco ISE lab demonstrating switch login via SSH, privilege level authorization, and Active Directory integration for access control.

Explore rule-based, time-based, and role-based access control with firewall rules based on IP addresses and layer four port numbers, and role-based access for accounting vs admins during business hours.

Analyze cvss terms and version 3.0 scoring, translating base metrics like attack vector, complexity, privileges required, user interaction, and scope into a final vulnerability score; review cia triad and examples.

Explore the CVSS temporal metrics, including exploit code maturity, remediation level, and report confidence, and see how these factors shift a vulnerability's score from base to temporal.

Apply environmental metrics as modifiers to base vulnerability scores, reflecting enterprise confidentiality, integrity, and availability needs and demonstrating how controls can lower the CVSS.

Navigate end-to-end data visibility challenges across data centers, cloud services, and branches by adopting a SIM to centralize telemetry from switches, routers, and endpoints for a single pane of glass.

Learn how to identify security events using the five tuple—source and destination IP addresses and ports, and the protocol—through examples in Wireshark and Cisco firewall logs.

Learn the difference between rule-based (signature) detection and behavioral (statistical) detection, see Cisco Firepower IPS rules and Stealthwatch behavior flags, and why both provide layered security.

Analyze the attack surface to identify entry points and data exits, guiding secure development and vulnerability testing by security architects or pen testers.

Analyze network attacks, from reconnaissance with Nmap and Sparta to DNS amplification, ICMP and SYN floods, ARP poisoning, DHCP spoofing, and sid injection, using Cisco switch protections.

Learn about web application attacks such as SQL injection and cross-site scripting, and discover defenses like vulnerability scans, strong passwords, and firewall hardening in a Cisco Firepower lab.

Explore endpoint based attacks like buffer overflows, command and control, ransomware such as WannaCry, and rootkits, and learn how anti-malware tools protect endpoints.

Explore social engineering and phishing attacks, including cloning a website to harvest credentials from a fake login page. Emphasize user awareness and cybersecurity notices to prevent these attacks.

Explore evasion methods attackers use to hide actions and exhaust security resources, including encryption and tunneling with VPN and SSH, traffic fragmentation, protocol manipulation, and pivoting with network segmentation.

Explore network logs from routers, switches, and firewalls to support security investigations and troubleshooting, emphasizing accurate time with NTP and external log servers for auditing.

Learn how to capture raw network data with Tcpdump and Wireshark, create pcap files, and apply filters to inspect IP traffic for troubleshooting, security investigations, and encryption considerations.

See how NetFlow enables security monitoring with Stealthwatch, correlating flow data to identify exfiltration and anomalous activity, drill down from host alarms to IP addresses and user involved for containment.

Explore monitoring challenges by examining how encryption, https inspection, nat and nat stitching, dns tunneling, Tor, and peer-to-peer traffic enable attackers to evade security and complicate source tracing.

Explore next generation IPS events in Cisco Firepower Management Centers, viewing intrusions and events and using the context explorer to translate data into readable graphics.

Explore how encryption provides data confidentiality between network devices using symmetric or asymmetric keys, with des, 3des, aes, and rsa. Hashing ensures integrity with md5, sha-1, sha-2, and hmac.

Learn PKI basics, including certificate authorities and root and intermediate certificates, certificate signing requests, and how identity certificates enable authentication and encryption for https web services.

Explore how Windows and Linux operating systems work, focusing on defense in depth with updates, Windows Firewall, Windows Defender, antivirus tools, and command line basics like ipconfig and Resource Monitor.

Explore Windows components, including processes and threads, and use Sysinternals Process Explorer to inspect CPU usage and threads. Learn to view memory, registry, WMI, and services to reduce attack vectors.

Compare Linux to Windows, highlighting price, reliability, and security for enterprise servers and desktops. Learn Linux basics through the terminal, including ifconfig and ping, with Kali or Ubuntu options.

Explore Linux process concepts, including parent and child processes, forks, and process IDs, and use ps and ps tree to view relationships, then manage permissions, sudo, symlinks, daemons, commands.

Learn how whitelisting and blacklisting protect endpoints by blocking malicious destinations using Cisco security intelligence feeds in Firepower, with customizable lists and dynamic updates to block or allow traffic.

Utilize sandboxing to isolate applications from secure resources and test software, including file analysis in Cisco AMP and system-based browser sandboxing that protects each tab.

Learn how detailed logs enable security, auditing, and troubleshooting across Windows and Linux, using Event Viewer, Windows security logs, DHCP server logs, authentication logs, and Apache access logs.

Analyze malware reports with AMP Threat Grid and Cuckoo Sandbox to extract behavioral indicators, network activity, and registry and file system changes, revealing the root cause and defense implications.

Explore indicators of compromise as tags security systems attach to users or hosts to flag potential compromises, and indicators of attack as a newer method to identify attacker intent.

Collect evidence after a security incident, prioritizing original-form material like disk images. Label with investigator name and number, preserve with write protection, use write blockers, and maintain chain of custody.

Finish part one of the Cisco CyberOps associate exam prep modules and access the part two course through the resources link to cover the remaining exam topics.