CCNP,CCIE Security SCOR (350-701) Training Part-2/2

Configure the initial working lab for Cisco FTD and FMC, including objects, security zones, and inside/outside interfaces. Deploy policies, test internet access, and review logs and dashboards on FMC.

Configure and verify access control policies from layer 3 to 7, using ACPs to allow, deny, or monitor traffic, with top-to-bottom rule evaluation and application-based controls.

Configure and verify a pre filter policy in FTD to bypass or fast path traffic before deep packet inspection, linking it to the access control policy.

Configure and verify intrusion policy in FTD by selecting the built-in ips policies, understanding balance security and connectivity, and attaching the intrusion policy to access control rules for deployment.

Configure and verify SSL policy in Cisco FTD to decrypt TLS traffic, deploy self-signed or CA certificates, and integrate with access control policy for monitoring and logging.

Configure malware and file policy in FTD to inspect all uploads and downloads. Use a three-type policy—clean, unknown, and malware—and cloud lookup to block malicious files.

Configure and verify Cisco FTD's DNS policy using security intelligence feeds, whitelists, blacklists, and sinkhole actions, then attach to access control rules and test.

Security intelligence is a threat intelligence database used by Cisco firepower to block malicious domains, IPs, and URLs before access control. It supports blacklists, whitelists, and DNS-based blocking.

Explore the differences between intrusion detection and prevention systems, deployment modes like inline, promiscuous, span, and tape, and host-based versus network-based IPS with Cisco firepower.

Deploy Cisco firepower next generation IPS 6.2.3-83 on an Eve-NG lab, using winscp to transfer and unzip the image, rename the files correctly, set permissions, and boot to verify operation.

configure and register Cisco firepower ngips for first-time setup, including admin login, password change, ipv4 settings, hostname and dns, deployment mode (inline or passive), and FMC registration for centralized management.

Explore basic terminologies, including proxy concepts and forward, reverse, and full proxy with SSL offloading. Review TCP three-way handshake, HTTP/HTTPS, and the role of TCP/UDP ports and well-known ports.

Introduce Cisco Web Security Appliance (WSA), formerly Ironport, a web proxy and security appliance that secures http/https traffic, blocks threats, and provides URL filtering, malware protection, DLP, and cloud intelligence.

learn the two Cisco Ironport wsa deployment modes—explicit and transparent—and how to configure browsers or gateways to forward http, https, and ftp traffic to the proxy.

Learn to install Cisco Ironport WSA version 10 in the Eve NG lab, configure SFTP access, prepare and import the ready image, then boot and login with default credentials.

Configure a basic Cisco WSA topology in an Eve-NG lab, linking a DMZ, internal network, and internet through NAT, DNS, and routing, with management and internet clouds.

Configure the Cisco Web Security Appliance for first-time access, set the management IPv4 address, hostname, enable ssh and http/https, then commit and verify http-to-https redirection.

Learn to license the Cisco Ironport WSA Version 10 by connecting over SSH, loading the license via CLI, pasting the license content, pressing Ctrl-D, and accepting the agreement.

Configure the Cisco WSA on first login with the setup wizard, setting DNS, hostname, http server, proxy, security features, and then change administrator password and select explicit or transparent mode.

Explore explicit mode for Cisco WSA, configuring each client's proxy settings, routing http and https traffic through the proxy, and validating with logs, dashboards, and policy testing.

Explore access policies and identification profiles in Cisco WSA, including how to define IP-based identification, apply URL filtering, and test policies with policy trace and decryption requirements.

Configure a custom url category in Cisco WSA, block BBC.com via a dedicated policy, commit changes, and verify with policy tracer and logs.

Explore application visibility and control by configuring global and object policies to block specific apps like Facebook and Messenger, set bandwidth limits, and apply https decryption and anti-malware checks.

Learn how to deploy transparent mode with Cisco devices using policy-based routing and WCCP to redirect http and https traffic to a proxy, without client-side configuration.

Explore Cisco Ironport ESA features and functions, including email security, spam and malware protection, reputation filtering, data loss prevention, encryption, and cloud-based threat intelligence for inbound and outbound email.

Learn core email security terminology, including SMTP for sending, IMAP/POP3 for receiving, MX records, MTA and MUA roles, MIME, and common threats like spam, phishing, spoofing, and worms.

Install Cisco Ironport ESA version 10 on EVE-NG by downloading, unzipping, and dragging the ready-made images into EVE-NG, then applying the setup command to boot the appliance.

Configure a Cisco ESA topology in EVE-NG with a management-connected core, edge router, DMZ ESR, abc.com, and DNS, routing email per policies.

Perform first-time cli setup of Cisco ironport esa: login with admin/ironport, set management ip 192.168.1.100, hostname esa.abc.com, enable ssh and https, save, commit, and ping the address.

License the Cisco Ironport ESA by connecting via ssh—through the console—loading and pasting the license, and pressing ctrl-d to apply; then log in with admin and ironport credentials.

Walks through the Cisco ESA first time configuration using the system setup wizard, configuring host name, email alerts, gateway, DNS, and inbound domain abc.com.

Install and configure Windows dns server, set static ips, create forward and reverse zones for abc.com and xyz.com, and add imap, smtp, and mx records.

Install, set up, and configure hmailserver for test labs, create abc.com and xyz.com domains, add admin and user accounts, and configure IP addresses and firewall adjustments.

Explore Cisco ESA incoming content filters and email policies in a hands-on lab, configuring DNS SMTP routing, Exchange server delivery, and content filters to block hackers and bomb keywords.

Configure outbound email protection with Cisco ESA, including outgoing content filters, mail flow policies, relay groups, sender rules, and logs to test and monitor.

Trace the origins of OpenDNS and Cisco Umbrella, and learn how cloud-based DNS protection blocks phishing and malicious sites by routing queries through two secure DNS servers.

Learn how endpoint protection platform and endpoint detection and response secure end devices, monitor behavior, prevent known and unknown threats, and provide visibility and rapid response.

Multi-factor authentication requires more than one method to log in, combining something you know with something you are, plus a second factor such as a code sent to mobile.

Explore mobile device management (MDM) to secure BYOD with Meraki by enrolling devices, enabling encryption, remote lock and wipe, GPS tracing, and managing apps, profiles, and email access.

Protect endpoints with antivirus, anti-spyware, and endpoint protection agents, firewalls, and email filtering; keep OS, apps, and firmware updated, and enforce MFA to defend against phishing.

Explore advanced malware protection with Cisco AMP, a cloud-based endpoint security using static and dynamic analysis, threat intelligence, and sandboxing to monitor endpoints from a central dashboard.

Explore the endpoint patching strategy, citing WannaCry, and emphasize keeping all endpoints—Windows, Mac, Linux, servers, printers, laptops, tablets—up to date with patch management.

Explore network automation with Python scripts that automate configuration, management, testing, and deployment across switches, routers, and firewalls, with basics of Python versions 2 and 3 and VLAN lab demos.

Discover how an application programming interface (API) acts as a middleman between applications and devices, enabling services like maps, weather, and payments using XML or JSON.

Explore netconf and restconf as network configuration apis, showing how netconf uses ssh and port 830 to configure, retrieve, and monitor devices as a southbound api through get-config and edit-config.

Explore restconf as a lightweight api alternative to netconf, using http/https and json messages to retrieve and configure devices with get, post, put, patch, and delete.

Explore software defined networking concepts, including central controller architecture, three planes (application, control, data), and how a controller centralizes routing decisions for all devices.

Explain northbound api and southbound api roles in a network stack, showing how rest-based api links applications to the controller and netconf/restconf links the controller to devices.

Cisco DNA Center serves as a central device and cloud-based platform that unites all network devices for design, provisioning, policy, and health assurance from a single dashboard.

Explore cloud concepts by contrasting on premises with cloud and define private, public, hybrid, and community clouds. Assess pay-as-you-go models, scalability, and security implications for organizations.

Explore cloud service models—software as a service, platform as a service, and infrastructure as a service—where providers host apps like Google Docs and Google Drive.

Understand cloud patch management, updating end devices, servers, OS, and applications to prevent vulnerabilities, and explore IaaS, PaaS, and SaaS responsibilities with practical update steps.

Learn to perform security assessment in the cloud by evaluating documentation, access controls, MFA, disaster recovery, and SLAs, just as you assess a house before buying.

Explore how a cloud access security broker (casb) sits between users and cloud services to provide visibility, compliance, data security, data loss prevention, and threat protection.

Define how devops unites development and operations to speed delivery through continuous development, testing, integration, deployment, and monitoring, and how devsecops embeds security across every stage with ten practices.

Learn about ci cd in devops, including continuous integration, continuous delivery, and continuous deployment, and how a ci cd pipeline automates build, test, and production deployment.

Explore Docker, containers, and container orchestration, explaining how containers replace virtual machines for lightweight, portable applications, and how Kubernetes orchestrates deployment, scaling, and networking.

Explore cloud logging and monitoring with Cisco Secure Cloud Analytics, aka steel watch cloud, using NetFlow, telemetry, and VPC flow logs to detect threats in real time across public clouds.

Explore Cisco ISE as a centralized policy control point that uses identity and context to authenticate, posture, profile, and authorize access across wired, wireless, and VPN networks.

Install and configure Cisco ISE on VMware Workstation by importing the virtual evaluation package, adjusting network interfaces, and setting IP, DNS, and admin credentials to access the GUI.

Install Cisco ISE on Eve-ng or VMware, set RAM to 8 to 10 gb, add a 200 gb drive, import the 16 gb image, and configure gig0 IP.

Explore Cisco identity services engine (ISE) cli commands and navigation, mirroring Cisco ios router and switch syntax, including config mode, show commands, backups, and basic management tasks.

Explore the Cisco Identity Services Engine dashboard after login, featuring widgets for system summary, alarms, authentication, and endpoint details, with admin, monitoring, and policy services personas.

Explore Cisco ISE terminology: identity and identity store (local or external such as Active Directory or LDAP), nodes as virtual appliances, plus admin, policy, and monitoring personas.

Explore Cisco ISE three personas—monitoring node, policy administration node, and policy service node—and how each handles logs, reporting, administration, and policy provisioning, with the work center consolidating related tasks.

Explore Cisco ISE deployment options, from stand-alone to fully distributed, dividing administration, monitoring, and policy services across devices to ensure redundancy and high availability.

Configure network devices from a centralized Cisco ISE platform to manage device administration and enforce network access through authentication and authorization for multiple devices and users.

Compare tacacs+ and radius for aaa, detailing tcp vs udp transport, encryption of communications, and the differences in authentication, authorization, and accounting; explain use for network access versus device administration.

Explain 802.1x dot1x port-based authentication, its EAPOL flow, and the roles of supplicant, authenticator, and authentication server in wired and wireless networks with Cisco ISE.

Discover 802.1x port states auto, force authorized, and unauthorized on Cisco switches, and learn host modes single host, multi-host, multi-domain, and multi-authentication.

Configure and verify a dot1x 802.1X lab using a Cisco switch as authenticator, Windows 7 as supplicant, and Cisco ISE with radius for authentication, authorization, and accounting.

Explore media access control authentication bypass, using mac addresses stored in a database as username and password to authenticate devices without 802.1x via Cisco ISE.

Learn how to implement mac address authentication bypass using the map command with 802.1x and radius on Cisco ISE, configure the interface map, register endpoints, and verify sessions.

Learn how downloadable ACLs (decal) simplify policy management across hundreds of switches by centralizing dynamic ACLs in Cisco ISE and automatically downloading them to network devices.

Configure and verify downloadable ACLs (DACL) with policy sets and authorization profiles, delivering dynamic per-user access controls downloaded to Cisco switches to restrict access to a server.

Learn how dynamic vlan automatically assigns interfaces to vlans based on identity, mac address, or authentication via mab and ise, contrasting with static vlan configuration.

Learn central web authentication (CWA) that redirects users to a web portal for login, enabling guest access, temporary credentials, and automatic guest vlan assignment via Cisco ISE.

Explore configuring central web authentication in a Cisco switch and ISE lab, creating authentication and authorization policies and downloadable ACLs for web portal redirection.

Learn how Cisco ISE implements guest services, including hotspot and sponsor portals, self-register and lobby ambassador options, diverse guest types, and central or local web authentication to isolate guest networks.

Learn how BYOD integrates with Cisco ISE, registering personal devices via a portal, applying MDM policies, and enforcing authentication and authorization to access corporate resources securely.

Change of authorization (CoA) lets Cisco ISE re-authenticate an authenticated endpoint when policies change. Configure globally or per-profile to trigger re-authentication or port bounce.

Explore how Cisco ISE profiling uses profiler services and probes to classify endpoints with profiles, using MAC addresses, hostnames, and network data to differentiate Windows, Apple, and more.

Configure and verify endpoint profiling in Cisco ISE using multiple probes, including radius, dhcp, and snmp, to assign accurate endpoint profiles like Windows 7 or Apple devices.

Posture in Cisco ISE checks antivirus, service packs, OS updates, firewall, and registry keys to gauge endpoint health before network access, using web agent or Cisco AnyConnect.

Learn how endpoint compliance in Cisco ISE uses posture assessment and health checks to classify devices as compliant, non-compliant, or unknown, and govern access via client provisioning.

Explore network telemetry, a real-time push data method that replaces polling, streaming json-encoded data via yang models with netconf and restconf for live device visibility.

Data exfiltration means unauthorized copying or transferring data from a computer or network. Cyber criminals use DNS tunneling, ICMP tunneling, HTTPS, FTP, SFTP, SSH, SCP, and email to exfiltrate data.