Cisco CCNA Cybersecurity (200-201) Complete Course + Exams

Explore the attack surface and attack vectors across network, software, physical, and social engineering domains, including tcp/ip vulnerabilities like ip spoofing, sequence prediction, port scanning, and dos.

Analyze the inherent vulnerabilities of the TCP/IP protocol suite, including IP, TCP, UDP, and ICMP. Learn attack methods such as spoofing, the man-in-the-middle, session hijacking, and DoS.

Discover how next-generation firewalls deliver granular application visibility and control, IPS, reputation-based filtering, SSL-TLS decryption, and intelligent security automation to defend against modern, sophisticated attacks.

Explore application visibility and control (AVC) using NetFlow, NBAR, and DPI to understand traffic, verify QoS, and monitor for DDoS threats.

Explore how email content filtering blocks new email-based threats, encrypts sensitive outbound data, enforces authentication, and handles cloud and on-site mail via the email security pipeline.

Examine encryption's security benefits and dual-use risks, regulatory efforts like Wesson Arrangement, and how investigators rely on metadata such as NetFlow and logs to detect encrypted traffic without full decryption.

Examine peer-to-peer networks, a distributed architecture with equal-privilege nodes where each peer both supplies and consumes resources, and review Napster and Spotify as examples.

A load balancer acts as a traffic cop routing requests across tiered servers to maximize speed and availability; misconfigurations and dns tunneling can expose data and create security risks.

Explore full packet capture (pcap) and how Security Onion with NetSniffNG records complete packets for NSM analysis using tools like Wireshark, Tshark, and tcpdump.

Learn how session data captures conversations with 5-tuple timestamps, total bytes, and packets, using BRO and PRETS with ELSA to analyze network activity and detect lateral movement.

Track transaction data as audit trails from client requests to server responses across DHCP, DNS, mail, proxies, and web servers, in logs, decoded by NSM tools and visualized in ELSA.

Explore metadata as data about data in network security, including TCP ports, protocol decodes, and NSM tools that add IP geolocation, ownership, reputation, and CNC activity or malware distribution.

Identify how alert data from IDS and IPS signals malicious activity; analyze using Snort, Suricata, and NSM data like full packet capture and transaction data.

Describe denial of service and distributed denial of service attacks, including botnets, spoofed sources, and reflection and amplification methods like DNS and NTP amplification, with cloud-based mitigation providers.

Explore how MITM attacks intercept and relay communications, leveraging spoofed ARP and weak wireless security, and learn defenses like VPNs, SSH, TLS, digital certificates, and network controls.

Explore common web application attacks, including SQL injection, authentication bypass, and information disclosure, and learn practical mitigations using input validation, encryption, and IDS signatures.

Cross-site scripting is a web-based command-injection attack that injects malicious scripts into trusted sites, executed in the user’s browser. Stored and reflective XSS arise from unsanitized input or malicious links.

Learn how social engineering manipulates people to access networks, distinguishing physical and remote attacks, exploring examples like tailgating, phishing, dumpster diving, and road apples, and identifying six indicators of compromise.

detect and respond to social engineering attacks by recognizing phishing and related tactics, monitoring logs and artifacts, and applying security awareness and incident response best practices.

Identify malware types: virus, worm, trojan, ransomware, spyware, rootkit, backdoor, adware, and keylogger, and how they spread via email or files. Learn defense basics and Cisco AMP for endpoints.

Ransomware encrypts files and demands bitcoin to decrypt them, often delivered by phishing and social engineering. Explore targets, prevention through patching, anti-malware, whitelisting, and backups, and notable ransomware flavors.

Explore cryptanalysis by examining brute force, ciphertext-only, known plaintext, chosen plaintext, chosen ciphertext, birthday, and meet-in-the-middle attacks, and understand their practical limitations.

This lecture explains how PKI secures public key distribution with certificates signed by a certificate authority, a trusted third party. It covers enrollment, validation, and revocation via CRLs and OCSP.

Explore host-based security technologies, including host-based firewalls, intrusion prevention systems, antivirus, application whitelisting, and sandboxing, and learn how personal firewalls enable distributed protection across devices.

Explore host-based intrusion prevention system, a package that combines antivirus, antispyware, and firewall to monitor processes and decrypt traffic, blocking known and unknown attacks with signature-based, anomaly-based, and policy-based IPS.

Explore host-based antivirus and anti-spyware as telemetry sources, including signature, heuristic, and behavior-based detection, real-time protection, and the evolving malware landscape with keystroke loggers, rootkits, and ransomware.

Protect endpoints with host-based anti-malware that goes beyond traditional antivirus by using cloud-based telemetry, history, and retrospective alerts to detect, trace, and block malware.

Trace the evolution of endpoint security from signature-based antivirus to ngav, epp, edr, and xdr, and learn how host-based analysis enables effective threat detection and response.

Explore how predictive ai enhances endpoint security through host-based analysis, detailing supervised and unsupervised learning, deep learning, ai-powered static and dynamic detection, and behavior analytics insights.

Explore how Windows threads execute within a process and how multi-threaded apps use multiple cores, with Sysinternals tools and VirusTotal for monitoring and verification.

Understand how Windows handles represent objects as resources and how processes use handles to access files, registry keys, and threads; Process Explorer helps view these handles.

Learn how Windows services are managed by the service control manager, run outside the current user context, auto-start on boot, and troubleshoot via registry and dependencies.

Explore Windows user and group concepts, permissions, and access control in enterprise environments. Learn how to manage local users with lusrmgr.msc, set password changes, and assign to the Administrators group.

Monitor Windows network activity using netstat and tasklist from the command prompt, filter results with find, view open ports and established connections, and correlate process IDs for troubleshooting.

Use TCP View from the Sysinternals suite for real-time network monitoring on Windows. It shows processes, PID, protocol, port, remote address, and state, like netstat and tasklist.

Learn Bash, the born-again shell in Linux, and master directory structure, file manipulation, piping and redirection, permissions, and shell scripting with grep, netstat, and processes.

learn linux basic file manipulation: create directories with mkdir, files with touch, inspect with ls -l, copy/move with cp and mv, delete with rm, and use wildcards and symbolic links.

Explore linux file system permissions, including owner, group, and others with read, write, and execute; view with ls -l and configure access using chown and chmod in a hands-on lab.

Explore piping and redirection of standard input and output in a Linux shell, using echo, cat, and file redirection to create and verify files like username.txt and user home.txt.

Learn to use grep to search authentication logs in linux, view /var/log/auth.log or /var/log/audit.log with cat, check size with wc, and detect root activity by grepping sudo.

Learn how linux processes are identified by pids, including daemons and forking, and view their parent-child relationships using ps with forest options.

Explore netstat for examining network sockets, connections, and ports, showing listening states, routing tables, and multicast statistics across Linux, Windows, and macOS. Learn to investigate anomalies and apply firewall policies.

Explore how attribution guides investigations by identifying assets, threat actors, and indicators of compromise and indicators of attack, while preserving evidence through a rigorous chain of custody and forensic practices.

Interpret Windows event logs with Event Viewer and Linux logs via syslogd or rsyslogd to identify events like failed logons (4625), reboots, hangs, and faults.

Interpret OS, application, and command-line logs across Windows and Linux to detect security events and indicators of compromise. Understand Windows event log architecture, PowerShell logging, Sysmon, and Linux log systems.

Interpret malware analysis tool reports to identify threats, quarantine files, and trace malware activity on endpoints using Threat Grid and AMP for Endpoints.

Explore how siem serves as the central nervous system of the soc, enabling log collection, normalization, correlation, and real-time alerting, with dashboards and incident workflows.

Map security event types to source technologies, including IDS, IPS, and firewalls, and cover anomaly detection, malware analysis, full packet capture, and protocol metadata.

Explore span and tap technologies for network monitoring, detailing port mirroring (span), source and destination ports, and remote span (r-span), then compare traffic impact, reliability, and security implications.

Analyze malicious traffic by examining protocols and the infected host IP 192.168.204.150, identify unusual port 16471, redirects, and extracted payloads like calc.exe, info.exe, and readme.exe from the blackhole kit.

Analyze Ethernet frame headers, including preamble, SFD, destination and source MAC addresses, Ether type, data, and FCS, and how size limits and padding govern delivery.

Explore how UDP, a connectionless and unreliable transport protocol, enables real-time services with an 8-byte header and four fields: source port, destination port, length, and checksum.

Learn icmp as a layer 3 protocol encapsulated in ip packets, with codes like echo request/reply, destination unreachable, redirect, and time exceeded, noting payload as a potential data exfiltration vector.

Explore how ARP maps MAC addresses to IP addresses using ARP cache and interpret header fields such as hardware type, protocol type, protocol length, and opcode, sender and target addresses.

Interpret security event artifacts such as IP addresses, hostnames, domain names, URI and URL, port identities, processes, system API calls, and hashes to analyze events and use DNS intelligence.

Learn to interpret regular expressions by exploring symbols such as *, ?, +, ., (), [], |, {}, ^ and $. Compare POSIX and PERL standards and practice on regex1.com.

Describe management concepts such as asset management, configuration management, mobile device management, patch management, and vulnerability management, including practices, tools, and life cycle steps.

Map incident analysis steps to NIST SP 800-61 preparation. Explore CSIRT roles, preparation actions, and the incident response lifecycle from preparation to post-incident activities.

Coordinate incident response with stakeholders including management, information assurance, IT support, legal, public affairs, human resources, business continuity, and physical security to ensure cooperation, rapid containment, and effective recovery.

Identify network profiling elements such as throughput, session duration, ports used, and address space. Explore how data quality and detectors shape baselines, and compare packet capture and NetFlow for analysis.

Profile network usage by measuring session duration of devices, detecting anomalies and security threats, enforcing access restricted to work hours, and monitoring critical systems using SNMP, NetFlow, and port logs.

Explore network access control by profiling devices and enforcing port security with NAC technologies like 802.1x, MAC addresses, and posture checks to secure switch ports.

Identify running processes on a host by viewing processes with task manager, cmd tasklist, or ps -e, and verify services by inspecting traffic and ports with port scanners and nmap-sv.

Identify protected data in a network by examining pai, phi, psi, and ip as information assets, and learn how cyber threats target these assets.

Explain the diamond model as an incident response framework, linking adversary, capability, infrastructure, and victim, with meta features and analytic firewooding to map attack paths and the kill chain.

Explore how SOC metrics measure security operations effectiveness, including mean time to detect, contain, and mitigate incidents, incident counts, false positive rates, playbook usage, and SOC cost.