CCNP,CCIE Security SCOR (350-701) Training Part-1/2

Explore the CCNP Security SCORE core 350-701 and its concentration options, detailing exam structure, prerequisites, pricing, and a range of topics from security concepts to VPN, cloud, Firepower, and ISE.

Explain the CIA goals: confidentiality, integrity, and availability, in network security, detailing data in storage and in motion, encryption, hashing, and redundancy like backups and multiple links.

discover common network security terms—assets, vulnerabilities, exploits, threats, attacks, risks, and countermeasures—and see how vulnerabilities enable exploits and how countermeasures protect assets.

Explore on-premises vs cloud models and malware theory, including virus, worm, ransomware, trojan, spyware, rootkit, and keylogger, plus SQL injection and phishing threats.

Learn how SQL injection manipulates backend databases and bypasses login by exploiting vulnerable websites. The lab guides you to test locally with vulnerable applications to observe queries and security measures.

Explore cross-site scripting attack theory and lab, showing how scripts hijack cookies and session IDs to impersonate users, with a practical look at vulnerable web applications.

Explore how social engineering drives phishing attacks by using fake websites and cloned sites to steal credentials, employing Kali Linux and the social engineering toolkit.

Demonstrates a man in the middle attack theory and lab using kali linux and ethercat to perform mac address spoofing and traffic interception between two devices.

Explore the theory and lab of denial of service attacks, including DoS and DDoS, ping of death, smurf, and tcp syn flooding, with Wireshark and Kali Linux demonstrations.

Explore path traversal attack theory and lab exercises to understand how attackers guess directory paths, bypass permissions, and how to prevent directory traversal vulnerabilities.

Explore how a buffer overflow occurs when a memory buffer is exceeded, leading to data leakage and control of a system, disrupting confidentiality, integrity, and availability in a lab demonstration.

Explore vulnerabilities as weaknesses in protocols, apps, or devices, including hardcoded default credentials, sql injection, cross-site scripting forgery, missing encryption, and weak https ssl version 1.1.

VLANs create logical switches inside a single switch, enabling data, voice, and management segmentation. Standard VLANs 1–1005 are stored in vlan.dat in flash; extended VLANs 1006–4094 reside in running config.

Discover layer 2 attacks on access layer switches and how dhcp snooping mitigates dhcp starvation and rogue dhcp servers. Learn to configure trusted and untrusted ports for protection.

Explore ARP theory and ARP poisoning, revealing how MAC spoofing alters IP-to-MAC mappings, and examine ARP table aging, dynamic versus static entries, and gratuitous ARP.

Demonstrate arp poisoning and arp spoofing in a lab, showing a man-in-the-middle attack between the dhcp server and client, and how dhcp snooping and dynamic arp inspection defend it.

Understand mac address theory: 48-bit hexadecimal addresses, oui-based vendor IDs, and how switches learn and forward traffic by mac, with mac flooding as a potential attack.

Explore mac flooding attacks on layer two switches that fill the mac address table, cause broadcasts, and enable packet capture, with port security using static, dynamic, and sticky options.

Master port security theory and lab techniques to defend against mac flooding and dhcp starvation, using static, dynamic, and sticky mac addresses with violation modes and automatic recovery.

Explore how STP enables redundancy on layer 2 networks by electing a root bridge, using BPDU exchange, and selecting port roles and states to prevent loops.

Explore two STP attacks—becoming the root bridge and claiming the root port—and apply defenses using bpdu guard, portfast, and root guard to protect the topology.

The VLAN hopping attack lab demonstrates switch spoofing and double tagging, and shows how changing the native VLAN and disabling negotiation with static access ports protects switches.

Storm control on Cisco switches uses threshold-based limits for unicast, multicast, and broadcast traffic to protect against DDoS attacks by shutting down interfaces or sending logs.

Explore private VLAN theory and lab setup, detailing primary and secondary VLANs (community and isolated), promiscuous ports, transparent mode, and step-by-step configuration and verification.

Learn vrf and vrf lite concepts, including logically partitioning routing tables, assigning interfaces to vrf contexts, and implementing static routes, rip, and ospf for isolated customer networks.

Configure and verify the management plane security for Cisco devices by securing console access, implementing AAA with Cisco ISE, and using SSH, HTTPS, SNMPv3, logging, and out-of-band management.

Configure management plane access with ssh version two, rsa keys, domain name, and vty security; restrict ssh via acl and enable http/https management.

Explain how control plane traffic is protected with policing and protection, using class map and policy map in lab demos of UDP and ICMP floods.

Explore the data plane, its role in user-to-user traffic, and layer two to layer three protection strategies using firewalls, ips, vpns, and cisco security tools.

Compare in-band and out-of-band management, showing that in-band relies on IP reachability for device configuration, while out-of-band uses a separate management path via console ports when data network is down.

Secure routing protocols by enabling authentication on rip, using keychains, and choosing plaintext or md5; version 2 supports md5, version 1 lacks authentication.

Explore the risks of Cisco Discovery Protocol (CDP), its troubleshooting benefits, and how CDP reconnaissance and flooding attacks expose device details, with interface-level disablement as mitigation.

Explore how the domain name system translates names to IPs, the role of root servers A to M and forwarders, DNS records and caching, and how DNSSEC defends against spoofing.

Configure and verify snmp version 2 and version 3 for network monitoring with a manager and agent. Explore get, get next, get bulk, trap messages, and v3 security options.

Learn how Cisco routers generate and categorize syslog messages, interpret severity levels, and configure console, buffer, terminal monitor, and centralized syslog server logging for troubleshooting and security auditing.

Explore the network time protocol (NTP) to synchronize devices via a centralized clock, covering stratum levels, master/server/client/peer modes, and security for syslog, SNMP, and authentication.

Configure and verify network time protocol across routers using DHCP, NTP master, and external sources; implement security with authentication, access control lists, and peer mode to ensure trusted time sources.

Explore the fundamentals of cryptography, defining encryption, decryption, plaintext, and ciphertext, and illustrate with Caesar cipher and vinegar cipher examples.

Compare symmetric and asymmetric encryption, showing how plaintext becomes ciphertext and is decrypted, and explain public-key RSA versus same-key methods with AES and DES examples.

Explore cryptography basics, hash functions like MD5 and SHA, and how hashes ensure data integrity. Learn symmetric encryption with DES, 3DES, and AES, including HMAC concepts.

Explore how a vpn creates a secure channel over the public internet to connect branches and remote users, using ipsec and ssl vpn to ensure confidentiality, integrity, and availability.

Explore IPsec, an open standard that provides confidentiality, integrity, and authentication for site-to-site and remote access VPNs, with ESP and AH modes, NAT-T, and anti-replay.

explore diffie-hellman key exchange and its group parameters used to securely establish vpn encryption keys for ipsec, enabling secure key exchange without transmitting the secret.

Explore how SSL and TLS provide authentication and confidentiality via certificates and public keys, with client hello, server hello, and key exchange establishing an encrypted session.

Explore internet key exchange (IKE) within IPsec site-to-site VPN, covering IKE versions, phase one and phase two, main and aggressive modes, and quick mode negotiation.

Explore ike phase 1 with main mode and aggressive mode in a lab, observing six packets in main mode, three in aggressive mode, with isakmp/ike version 1 and pre-shared key.

Configure and verify site-to-site ipsec vpn between routers and firewalls using isakmp, pre-shared keys, transform sets, and crypto maps, then validate with show commands.

Troubleshoot site-to-site IPsec VPN on Cisco routers with hands-on configuration, verification of phase one and phase two, and diagnosis of ACL and transform-set mismatches using debug commands.

Configure site-to-site vpn by defining phase one policy and encryption domain with an acl, then bind them with a crypto map for the vpn tunnel.

Explore nat-t traversal for site-to-site virtual private network on routers behind firewalls, where nat detects devices, translates ports (500 to 4500), and esp is supported while ah is not.

Enable dynamic multipoint virtual private network for scalable hub-and-spoke and spoke-to-spoke topologies with zero-configuration. Implement phase one as hub-to-spoke, phase two and three enable spoke-to-spoke dynamic tunnels with registration.

Learn to configure dynamic multipoint VPN phase-1 in a hub-and-spoke lab with three routers, including tunnel, public IP, and LAN addressing, and dynamic vs static NHRP mappings.

Configure remote access VPN for mobile and laptop users with client-based and clientless methods, using SSL/IPsec and Cisco AnyConnect, and implement split tunnel for internal traffic.

Explore Cisco's flexible VPN, an umbrella that covers remote access, site-to-site, and any VPN with IKEv2 support, featuring smart defaults and single-policy versatility that outperforms traditional VPN configurations.

Configure a site-to-site flex vpn using svti with ikev2 and pre-shared keys. Verify tunnel establishment and ipsec encryption between routers with test connectivity.

Explore how public key infrastructure (PKI) enables authentication and secure communications through digital certificates, certificate authorities, and key management, including SSH public key authentication using RSA keys.

Explore firewall fundamentals, from stateful and stateless designs to traditional and next generation protections. Learn how UTM, App ID, User ID, Content ID, and deep packet inspection shape modern security.

Get introduced to Cisco and its adaptive security appliance, the ASA firewall, and explore its features, including stateful inspection, VPNs, IDS/IPS, malware protection, URL filtering, and modular policy.

Install Cisco ASA in GNS3, enable clustering, and compare licensed versus unlicensed images to access full security features, VPN, and security context for hands-on CCNP and CCIE Security labs.

Learn to deploy a fully licensed Cisco ASA firewall in Eve-ng with clustering enabled, using a simple drag-and-drop workflow: create a versioned folder, upload the image, and boot.

Master Cisco ASA firewall basics by building a Gns3 lab, configuring a small topology, IP addresses, inside/outside interfaces, and essential commands for show, startup, and configuration management.

Configure devices securely via out-of-band console management, using a console cable and serial/usb adapters with tools like Putty or SecureCRT, and protect access with AAA.

Demonstrate configuring ssh on a Cisco firewall and router, enabling ssh version 2 with RSA keys and login local, while noting telnet is insecure and uses port 22.

Discover how tftp stores and restores device configurations on Cisco ASA firewalls, using UDP port 69 to back up running and startup configurations and to upgrade or downgrade operating system.

Explore ftp and tftp differences on Cisco devices, including ports and connection methods, and learn Cisco copy commands using ftp with username and password, plus scp as a secure alternative.

Explore zone based security with Cisco firewall, using security zones and levels, default permit rules, ACLs, and hairpinning to understand traffic between inside, outside, and DMZ.

Explore how access control lists on Cisco ASA firewalls filter traffic using top-to-bottom extended and standard ACLs, with permit and deny rules, interfaces inbound and outbound, and the implicit deny.

Learn to configure and verify extended ACLs on Cisco ASA firewall, using permit and deny rules, inbound and global application, with IPv4/IPv6 and top-to-bottom evaluation.

Configure and verify infrastructure ACLs on the Cisco ASA edge router. Block private IP ranges and ICMP flooding to protect the enterprise edge.

Configure time-based ACLs on Cisco ASA by creating time ranges (periodic or absolute), then attach the time range to ACLs to permit or deny traffic during defined hours.

Explains how standard acLs differ on Cisco asa firewalls from router acLs, showing use in route maps, vpn filtering, and redistribution to filter routes rather than traffic.

Learn to simplify ACL management with Cisco ASA object groups, reusing network and service objects to build scalable, readable ACLs for large data center firewalls.

Discover how NAT and PAT operate on Cisco ASA firewall, covering static and dynamic NAT, static and dynamic PAT, policy NAT, and identity NAT using network and service objects.

Explore Cisco ASA NAT and PAT concepts, including static and dynamic NAT, policy NAT, and identity NAT, with lab topology and real vs mapped IP and port terminology.

Configure and verify static nat on Cisco ASA firewall using 1-to-1 inside to outside translation. Compare auto net (alternate) and manual net and verify with show net and show nat.

Learn to configure static pat with port translation on a Cisco ASA, including static net, static paired, and port translation using object networks and service objects.

Learn dynamic NAT on a Cisco ASA firewall using a public IP pool for one-to-many translation from inside to outside, with lab verification.

Configure dynamic pat on Cisco ASA firewall to translate inside subnet addresses to a single public IP with port translation, using interface or object-based methods, and verify connections.

Configure identity NAT in Cisco ASA to keep the same private IP for VPN traffic. Explore object networks and inside to outside translation using static or dynamic NAT.

Configure and verify policy NAT on Cisco ASA by creating source-destination based translations (policy nets), defining LAN objects, and testing translations with Telnet.

Compare routed and transparent Cisco ASA firewall modes, using bridge virtual interfaces for same-subnet deployment, noting limitations such as no MPLS, VPN, IPv6, or DHCP relay in transparent mode.

Trace the evolution from Snort to Sourcefire to Cisco Firepower, and discover how FTD and FMC enable a next generation firewall with IPS/IDS and centralized management.

Install and configure FTD and FMC on eve-ng, download and prepare images via torrent, unzip and rename qcow2 files, upload with WinSCP, and start the devices while noting startup time.

install and add Cisco FMC 6.2.3-83 on eve-ng by downloading from torrent, extracting with seven-zip, transferring with winSCP, and applying permissions to run FMC and ftd images.

Configure firepower threat defense (FTD) and firepower management center (FMC) in a simple topology, assign management IPs, register FTD to FMC, and verify connectivity with show network and ping.

Register each FTD with the FMC by configuring a manager, entering the FMC IP and a registration key. Verify with show manager to confirm FMC-based management instead of local configuration.

Perform first time configuration of the Firepower management center, including admin login, elevate to superuser, set ipv4 (ip, subnet, gateway), and verify reachability by ping to ftd, fmc, and pc.

Configure the first FMC login by setting IP and changing the admin password. Enter network details, set the time zone, accept the license, and wait for the dashboard to appear.

Enable a 90-day evaluation smart license in Cisco FMC to support lab testing. Navigate to system, licenses, smart licenses, select evaluation mode, and confirm activation to maintain the license.

Register FTDs with FMC, configure hostnames and IPs, apply a default policy, and activate smart licenses for malware, threat, and URL; then deploy unified policies from FMC to all FTDs.

Learn to install and configure Eve-ng next-generation virtualization for network labs, compare it with Gns3, set up images, and build labs with community edition.