Cybersecurity from zero for network engineers

What you will learn in this module. This is the first module of the CCNP Security track. By the end of it you will think like a defender: you will be able to name what an organisation must protect, explain how a real attack moves from a phishing email to stolen data, place every security product (firewall, IPS, DNS security, email security, EDR, NAC, MFA, SIEM, XDR) on one picture, and walk through a first incident from alert to lessons learned. You will also know exactly how the two exams of this track are built, so every later module has a place on your map.

Prerequisites. CCNA-level networking: IP addressing and subnetting, VLANs, routing, TCP and UDP ports, ACLs, NAT and the basic CCNA security ideas. You do not need any previous security job, tool or certificate. Where a CCNA idea matters, this module reminds you in one or two lines and moves on.

Start with an analogy: a network is an airport

Think of a big international airport. Passengers and luggage (packets) flow in and out all day. The airport does not trust anyone just because they arrived: there is a perimeter fence, an entry gate that checks tickets (a firewall), a scanner that looks inside bags for dangerous items (an intrusion prevention system), an identity check at the counter with passport and boarding pass (authentication and MFA), staff badges that open only the doors a person needs (least privilege), CCTV cameras everywhere (logging and NetFlow), and a control room where people watch all the cameras and react when something looks wrong (the security operations centre, or SOC).

No single control makes the airport safe. The fence can be climbed, a bag can slip past the scanner, a passport can be forged. Safety comes from layers that each catch what the others miss, and from people in the control room who notice and respond. That is the whole idea of network security, and of this track.

Why network engineers move into security

Every attack travels over a network. The firewall is a routed or bridged device with interfaces and NAT. The VPN is a tunnel with routing and MTU problems. 802.1X runs on switch ports. DNS security works because every connection starts with a DNS query. Engineers who already understand packets have a huge head start, because most security problems in production are really "why is this flow blocked or allowed" problems. What you add in this track is the attacker's view, the defender's tools and the discipline of evidence.

The track map: two exams, one skill set

The CCNP Security certification needs two exams: the core exam SCOR 350-701 v2.0 (Implementing and Operating Cisco Security Core Technologies, 120 minutes) and one concentration exam. This track uses SNCF 300-710 v1.2 (Securing Networks with Cisco Firewalls, 90 minutes). Passing SCOR alone also earns a Specialist certification, and SCOR is the qualifying exam for the CCIE Security lab.

SCOR 350-701 v2.0 domain	Weight	Where you study it
1.0 Security Concepts	20%	This module, threats and firewalls, modern threats, cryptography
2.0 Network Security	25%	Layer 2 security, AAA and device management, ASA, Threat Defense, VPN
3.0 Cloud Security	15%	Cloud and workload security, DevSecOps
4.0 Secure Service Edge	10%	Cisco Secure Access (SSE)
5.0 Endpoint Protection and Detection	15%	Secure Endpoint, EDR/XDR and email security
6.0 Network Access, Visibility and Enforcement	15%	802.1X and ISE, Duo, XDR and Splunk

SNCF 300-710 v1.2 domain	Weight
1.0 Deployment (modes, IPS deployment, high availability, virtual appliances)	30%
2.0 Configuration (policies, NAT, objects, Snort, VPN on the firewall)	30%
3.0 Management and Troubleshooting	25%
4.0 Integration (malware defence, threat intelligence, pxGrid, XDR, Splunk)	15%

Careers: where this track can take you

Role	What a normal day looks like	Most used skills from this track
SOC analyst (L1/L2)	Watches alerts in the SIEM or XDR, triages them, decides true or false positive, escalates or contains	Kill chain, logs, NetFlow, incident response
Firewall / network security engineer	Builds and changes firewall rules, NAT and VPNs, troubleshoots blocked flows, runs change windows	ASA, Threat Defense, FMC, packet-tracer, captures
Security engineer (NAC, identity, endpoint)	Rolls out 802.1X and ISE policies, MFA, EDR agents and email security	ISE, Duo, Secure Endpoint, Secure Access
Incident responder / threat hunter	Investigates confirmed incidents, scopes them, drives containment and recovery	XDR, Splunk, ATT&CK, forensics basics
Security architect	Designs zero trust, segmentation and SASE for the whole company	All domains, design trade-offs

Most people start as a SOC analyst or a network engineer who owns the firewalls, then specialise. The CCNP Security skill set is valued because it joins both worlds: you can read a packet capture and a SIEM alert with equal confidence.

Imagine you are asked to protect a house. Before buying cameras or a stronger lock, a sensible person asks: what is valuable inside (jewellery, documents, the family), who might want it (a burglar, a curious neighbour), where are the weak points (a broken back window), and how bad would a loss be. Only then do you decide where to spend money. Security professionals think in exactly this order, and the words they use have precise meanings.

The vocabulary, one term at a time

Asset

Anything of value to the organisation: customer data, the payroll database, the website, a firewall, the CEO's mailbox, even the company's reputation.

Threat

Anything that can cause harm to an asset: a ransomware group, a careless employee, a flood in the server room.

Threat actor

The person or group behind a threat, with a motivation (money, espionage, activism, revenge).

Vulnerability

A weakness that a threat can use: an unpatched VPN appliance, a weak password, an open SMB port on the internet, a user who clicks links.

Exploit

The method or code that takes advantage of a vulnerability. A vulnerability without a known exploit is still a risk, just usually a smaller one.

Risk

The chance that a threat uses a vulnerability, multiplied by the impact if it happens. Often written as risk = likelihood x impact.

Control (countermeasure)

Anything that reduces risk: a firewall rule, MFA, a patch, a backup, training, a policy.

These terms come up in SCOR domain 1.2 (vulnerabilities and exploits) and in almost every interview. Say them precisely: "the vulnerability is the unpatched appliance, the threat is the ransomware group, the exploit is their public tool, the risk is high because it faces the internet and holds VPN credentials".

CIA: what we are protecting about each asset

You met the CIA triad in CCNA; here is the defender's use of it. For every asset, ask which property matters most:

• Confidentiality: only the right people can read it. Controls: encryption, access control, least privilege, data loss prevention.
• Integrity: nobody can change it without being noticed. Controls: hashes, digital signatures, change control, file integrity monitoring.
• Availability: it works when needed. Controls: redundancy, DDoS protection, backups, capacity planning.

A payroll database cares about all three. A public marketing website cares most about integrity (no defacement) and availability. A ransomware attack is interesting because it hits availability (files encrypted) and, with modern double extortion, confidentiality too (data stolen before encryption).

Risk treatment: four choices

Once a risk is known, management picks one of four responses: mitigate (add controls), transfer (cyber insurance, outsourcing), avoid (stop the risky activity, for example switch off an unused internet-facing service) or accept (document it and live with it because the cost of control is higher than the loss). As an engineer you mostly mitigate, but you must know that accepting a risk is a valid, signed business decision, not negligence.

Defence in depth

Defence in depth (SCOR topic 1.9) means several independent layers of control, so that one failure does not lead straight to the asset. Each layer should be different in kind: a network control, an identity control, an endpoint control and a detection control. If an attacker gets past the firewall with a phishing email, the email filter may catch it; if not, the EDR may stop the payload; if not, MFA may block the stolen password; if not, the SIEM may spot the unusual login. Cisco's reference architecture for this idea is SAFE (Secure Architecture for Everyone): it divides the business into places in the network (branch, campus, data center, edge, cloud, WAN) and lists the threats and capabilities for each, so designs are layered consistently.

Principles you will apply every day

• Least privilege: every user, device and rule gets only the access it needs, for only as long as it needs it. A rule "permit tcp any host 10.1.50.10 eq 443" follows it; "permit ip any any" does not.
• Default deny: block everything, then allow what is needed. Firewalls and ACLs end with an implicit deny for this reason.
• Separation of duties: the person who requests a firewall change should not be the only person who approves it.
• Assume breach: design as if an attacker is already inside, so internal traffic is also segmented and logged. This is the heart of zero trust (chapter 9).
• Security vs usability: a control that stops people working will be bypassed. Good defenders design controls people can live with.

A burglary is not one moment. The burglar watches the house for days, buys tools, picks a night, opens a window, looks for the safe, carries the valuables out and drives away. At every step there is a chance to stop them: a neighbour notices the watching, a sensor catches the window, a camera sees the car. Cyber attacks work the same way. Defenders use models of these steps so that they can place a control and a detection at each one.

The Cyber Kill Chain in seven stages

The Cyber Kill Chain, published by Lockheed Martin, splits an intrusion into seven stages. The important idea is that the attacker must succeed at every stage, while the defender needs to break the chain at only one.

Stage	What happens (defender's view)	What you can see or stop
1 Reconnaissance	The attacker learns about you: public staff names, exposed services, DNS records	Reduce what is exposed; watch for scans in firewall logs
2 Weaponisation	A lure is prepared, for example a document or a fake login page	Happens on the attacker's side; threat intelligence may warn you
3 Delivery	The lure reaches a user: email, malicious website, USB, exposed service	Email security, secure web gateway, DNS security, user training
4 Exploitation	A vulnerability or a human mistake lets code run or a password be captured	Patching, IPS signatures, EDR, MFA
5 Installation	The attacker makes the foothold survive reboots (persistence)	EDR behaviour detection, application control
6 Command and control (C2)	The infected host calls out to the attacker's server for instructions	DNS security, NGFW Security Intelligence, NetFlow anomalies
7 Actions on objectives	Data theft, ransomware encryption, fraud, lateral movement to more hosts	Segmentation, DLP, SIEM correlation, backups

MITRE ATT&CK: the detailed dictionary

The kill chain is a simple story. MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge) is a free, detailed knowledge base built from real intrusions. It is organised in three levels:

• Tactics: the attacker's goal at that moment, the "why". The Enterprise matrix has 14 tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact.
• Techniques and sub-techniques: the "how", each with an ID such as T1566 (Phishing) or T1071 (Application Layer Protocol, used for C2).
• Procedures: how a specific group actually did it in the wild.

Together these are called TTPs. SOC tools, including Cisco XDR and Splunk detections, tag their alerts with ATT&CK technique IDs so analysts immediately know where in an attack they are looking.

ATT&CK is not a stage-by-stage sequence. Real attackers loop: discovery, credential access and lateral movement repeat many times inside a network. That is why ATT&CK is a matrix, not a line.

Indicators: IOC versus IOA

An indicator of compromise (IOC) is evidence that something bad already happened: a known malicious file hash, a C2 domain, an attacker IP. An indicator of attack (IOA) describes behaviour in progress: an office program launching a script interpreter, a workstation logging in to fifty servers in a minute. IOCs are easy to share and block but easy for attackers to change; behaviour is much harder for them to change. The higher you detect on this "pyramid", from hashes and IPs up to TTPs, the more it costs the attacker to evade you.

A good doctor does not need to know how to make a virus to recognise the flu: the symptoms, the test and the treatment are enough. A defender is the same. You need to recognise an attack from its symptoms, know why it works, know the indicators in your logs and know which control stops it. This chapter is a field guide at exactly that level. The CCNA covered the basic names; here we add the defender's view and the modern attacks that SCOR v2.0 expects.

Who attacks, and why

Actor	Motivation	Typical behaviour
Cybercriminals and ransomware groups	Money	Phishing, stolen credentials, ransomware with data theft, business email compromise; often buy access from "initial access brokers"
Nation-state groups (APTs)	Espionage, disruption	Patient, well funded, custom tools, long dwell time; target government, defence, telecom, critical infrastructure
Hacktivists	Ideology, publicity	DDoS, website defacement, leaking data
Insiders	Revenge, money, or simple mistakes	Misuse of legitimate access; careless insiders cause many incidents without any bad intent
Unskilled attackers	Curiosity, reputation	Run public tools and scanners against anything exposed

An APT (advanced persistent threat) is a group that stays hidden inside a network for a long time. The time between the first compromise and detection is called dwell time; reducing it is one of the main goals of a SOC.

The ransomware economy. Ransomware today is an industry with specialised roles. Initial access brokers break in (often with stolen VPN or RDP credentials) and sell that access. Ransomware as a service (RaaS) operators build the malware, the leak site and the payment system, and rent them to affiliates, who run the intrusion and share the ransom. Double extortion adds data theft before encryption, so the victim is threatened with a leak even if backups work. For defenders this means the attack usually takes days, not minutes: there are many chances to detect the stolen login, the lateral movement and the large upload before encryption starts.

Social engineering and phishing

Most breaches start with a human, not a zero-day. Phishing is a fraudulent message that tricks a user into clicking, opening or giving away credentials. Variants: spear phishing (targeted at one person), whaling (executives), smishing (SMS), vishing (voice calls, now sometimes with AI-cloned voices), quishing (QR codes). Business email compromise (BEC) uses a real or look-alike mailbox to request a payment or bank-detail change, often with no malware at all. SCOR topic 1.4 asks for the controls: email authentication (SPF, DKIM, DMARC), email security gateways with URL rewriting and sandboxing, DNS security, MFA, awareness training and a simple way to report suspicious mail.

Malware families

Virus / worm

A virus needs a user or host program to spread; a worm spreads by itself across the network through a vulnerability. Segmentation and patching limit worms.

Trojan

Looks legitimate (a "free codec", a cracked tool) but carries a malicious payload.

Ransomware

Encrypts files and demands payment; modern groups steal data first (double extortion). Offline backups and EDR are the key controls.

Spyware, keyloggers, infostealers

Collect data and saved passwords from the endpoint.

Rootkit

Hides deep in the operating system to avoid detection.

Botnet

Many infected hosts controlled through C2, used for DDoS, spam or credential attacks.

Fileless malware

Runs in memory using built-in tools, leaving few files; detected by behaviour (EDR), not signatures.

Credential and web attacks

Brute force tries many passwords against one account. Password spraying tries one common password against many accounts, staying below lockout thresholds. Credential stuffing replays username and password pairs leaked from other sites. All three are stopped mostly by MFA, lockout and rate limits, and banned-password lists.

Web application attacks appear in the OWASP Top 10. At recognition level: SQL injection (input changes a database query), cross-site scripting (XSS) (a page returns attacker-supplied script to other users), broken access control and security misconfiguration. Controls: secure coding, input validation, a web application firewall (WAF) and IPS signatures. The later "modern threats" module covers OWASP and CVSS scoring in more depth.

Network attacks

• DoS and DDoS: exhaust bandwidth, state tables or application resources. Controls: upstream scrubbing, rate limits, firewall connection limits, SYN cookies.
• Man-in-the-middle and spoofing: ARP spoofing, rogue DHCP, rogue access points. Controls: DAI, DHCP snooping, 802.1X, encryption (the Layer 2 security module).
• DNS abuse: DNS tunnelling to hide data inside queries, domain generation algorithms (DGA) with random-looking names, typosquatting domains such as nwkings-payro11.example.
• Exploiting exposed services: unpatched VPN gateways, RDP or management interfaces on the internet.

AI and LLM threats (SCOR 1.3)

Companies now connect large language models to their data and tools, which creates new weaknesses: prompt injection (instructions hidden in input or in a document make the model ignore its rules), sensitive information disclosure (the model reveals confidential data it can access), training data poisoning, insecure output handling (model output used without validation) and excessive agency (the model can take actions it should not). Attackers also use AI to write better phishing. Controls include AI guardrails and DLP in Secure Access, least privilege for AI tools and human approval for risky actions.

Sep 30 02:14:07 jump1 sshd[2211]: Failed password for invalid user admin from 203.0.113.45 port 51122 ssh2
Sep 30 02:14:09 jump1 sshd[2213]: Failed password for invalid user test from 203.0.113.45 port 51130 ssh2
Sep 30 02:14:12 jump1 sshd[2215]: Failed password for ravi from 203.0.113.45 port 51141 ssh2
Sep 30 02:14:15 jump1 sshd[2217]: Failed password for priya from 203.0.113.45 port 51150 ssh2
Sep 30 02:14:18 jump1 sshd[2219]: Failed password for anita from 203.0.113.45 port 51163 ssh2

One source, many different usernames, one attempt each, a few seconds apart: the signature of password spraying, not a user who forgot a password. The fix is not only blocking 203.0.113.45 (the attacker will change IP); it is removing SSH exposure to the internet and enforcing key-based login or MFA.

Picture a house. A burglar does not care how strong the front door is if the kitchen window is open, the garage remote is on the default code and the spare key is under the flowerpot. Every door, window, vent and key is part of the house's attack surface: the full set of places where an outsider can try to get in. Security starts by knowing that list, then closing what is not needed and guarding what must stay open.

What an attack surface is

The attack surface of a network is every point where an attacker can send input or touch something: an open port, a login page, a switch port in a meeting room, a Wi-Fi network, an API key in a code repository, a user who reads email. Two ideas follow from it:

• Attack surface reduction: remove what is not needed (disable Telnet, close unused ports, shut unused switch ports, delete old test servers). A service that does not exist cannot be exploited.
• Guard what remains: every exposed service that the business needs gets a control in front of it, and logging behind it.

As a CCNA-level engineer you already know the layers. Now walk them with an attacker's eye.

Layer 2: the access switch

Anyone who plugs into a live port is already inside the broadcast domain. Classic attacks: MAC flooding (fill the CAM table so the switch floods frames everywhere), ARP spoofing (claim to be the gateway and sit in the middle), rogue DHCP (hand out a fake gateway or DNS server), VLAN hopping (abuse DTP or the native VLAN) and STP manipulation (claim to be root bridge). Controls: port security, DHCP snooping, Dynamic ARP Inspection, IP Source Guard, disabling DTP and unused ports, BPDU guard and root guard, storm control. The Layer 2 security module labs every one of them.

Layer 3: addressing and routing

Attackers forge source addresses (IP spoofing) to hide or to reflect traffic at a victim, flood links and state tables (DoS and DDoS), or inject false routes into an unauthenticated routing protocol. Controls: infrastructure ACLs, uRPF (drop packets whose source could not be reached back through the arriving interface), routing protocol authentication, control plane policing, and upstream DDoS scrubbing.

Services and applications

This is where most real breaches start: an internet-facing RDP server, an unpatched VPN or firewall appliance, a web application with SQL injection, an API without authentication. Controls: expose only what the business needs, put it in a DMZ behind a stateful firewall and IPS, patch by risk (CVSS score plus exploit status), use a web application firewall for web apps, and require MFA on every remote login.

The management plane

The management plane is how you log into and control devices: SSH, HTTPS GUIs, SNMP, APIs, console. If an attacker owns it, they own the network. Typical gaps: Telnet still enabled, SNMP v2c with the community public, default passwords, management interfaces reachable from user VLANs. Look at what a router is actually listening on:

EDGE-R1# show control-plane host open-ports
Active internet connections (servers and established)
Prot        Local Address      Foreign Address        Service    State
 tcp                 *:22                  *:0     SSH-Server   LISTEN
 tcp                 *:23                  *:0         Telnet   LISTEN
 tcp                 *:80                  *:0      HTTP CORE   LISTEN
 udp                *:161                  *:0        IP SNMP   LISTEN

Telnet sends passwords in clear text and the HTTP server is not needed. A first hardening pass:

! Allow management only from the admin subnet
ip access-list standard MGMT-ONLY
 permit 10.1.99.0 0.0.0.255
! SSH only on the VTY lines, and only from MGMT-ONLY
line vty 0 15
 transport input ssh
 access-class MGMT-ONLY in
! Remove services nobody uses
no ip http server
no snmp-server community public

SNMPv3 with authentication and privacy, TACACS+ with command authorisation, authenticated NTP and secure syslog come in the AAA and secure device management module.

Wireless, cloud and users

Wireless reaches through walls: rogue access points plugged into the LAN, evil twin networks with the same SSID, weak pre-shared keys. Controls: WPA3 or WPA2-Enterprise with 802.1X, rogue AP detection (wireless IPS), separate guest networks. Cloud adds a surface you cannot see from your switches: public storage buckets, security groups open to 0.0.0.0/0, access keys leaked in code, too-powerful identities. Controls: cloud posture management, least-privilege identities, logging into the SIEM. Users are the largest surface of all: phishing, reused passwords, MFA fatigue. Controls: email security, DNS security, MFA with number matching, training.

A modern bank branch has a guard at the door, a metal detector, cameras, a vault with a time lock, staff ID cards, a manager who approves large withdrawals and a head office that watches all branches at once. Each serves a different purpose, and together they form a system. An enterprise network has its own "security stack". This chapter walks it from the internet edge down to the user and the SOC, so that every product in this track has a clear place.

Layer 1: the perimeter firewall and NGFW

The firewall sits between trust zones: inside, DMZ, outside. A classic stateful firewall decides by addresses, ports and connection state. A next-generation firewall (NGFW) adds application identification, user identity, URL categories, intrusion prevention, file and malware inspection and threat intelligence feeds (called Security Intelligence on Cisco Secure Firewall). In this track: Cisco ASA and Secure Firewall Threat Defense managed by Management Center. Chapter 7 builds the basics.

Layer 2: intrusion prevention (IPS)

An IDS (intrusion detection system) watches a copy of traffic and alerts. An IPS sits inline and can drop the malicious packets. Both use signatures (rules) and some anomaly detection. On Threat Defense the engine is Snort 3. An IPS must be tuned: too loose and it misses attacks, too strict and it breaks business traffic.

Layer 3: secure web and DNS

Every connection begins with a DNS lookup, so DNS-layer security can block malicious and newly seen domains before a TCP session even starts, for every port and protocol. A secure web gateway (SWG) or web proxy then inspects web traffic itself: URL filtering, file inspection, application controls. Today these usually run in the cloud as part of Secure Service Edge (SSE), which also includes a cloud access security broker (CASB, visibility and control of SaaS apps), zero trust network access (ZTNA) and firewall as a service. Cisco's SSE is Secure Access; when SSE is combined with SD-WAN networking the whole design is called SASE.

Layer 4: email security

Email is still the number one delivery channel. Email security checks sender reputation, SPF/DKIM/DMARC, attachments (sandboxing), URLs (rewriting and click-time checks) and impersonation. It can also remediate: pull a malicious message from every mailbox after delivery. Cisco products: Secure Email Gateway and Secure Email Threat Defense for cloud mailboxes.

Layer 5: endpoint protection (EPP and EDR)

EPP (endpoint protection platform) prevents known threats, like modern antivirus. EDR (endpoint detection and response) records process, file and network behaviour on each laptop and server, detects suspicious activity, lets the analyst see the full trajectory of a file and isolate the host with one click. Cisco Secure Endpoint provides both.

Layer 6: network access control and identity

NAC decides who and what may connect to the network. With 802.1X the switch or wireless controller asks a RADIUS server, such as Cisco ISE, to authenticate the user or device and return an authorisation: VLAN, downloadable ACL or security group tag. Identity controls such as MFA (Cisco Duo) and single sign-on protect applications. Chapter 9 covers this.

Layer 7: visibility and response

Every layer produces events. A SIEM (security information and event management, for example Splunk) collects, normalises and correlates them. SOAR (security orchestration, automation and response) runs playbooks such as "block domain, isolate host, open ticket". XDR (extended detection and response, Cisco XDR) correlates detections across endpoint, network, email and cloud into one incident. Chapter 10 covers this.

Layer 8: cloud workloads

Servers in public cloud need the same thinking: security groups as firewalls, cloud posture management (CSPM) to find misconfigurations such as public storage, workload protection (CWPP) and cloud logs into the SIEM. The shared responsibility model says the provider secures the cloud itself; you secure what you put in it.

Layer	Main question it answers	Track module
NGFW and IPS	Should this flow pass, and is its content malicious?	ASA and Threat Defense modules
DNS, web, SSE	Is this destination or web content safe?	Secure Service Edge
Email	Is this message genuine and safe?	Endpoint and email security
EDR	What is this process doing on the host?	Endpoint and email security
NAC and identity	Who or what is this, and what may it reach?	802.1X and ISE, Duo
SIEM, SOAR, XDR	What is happening across all of it?	Visibility, Duo, XDR and Splunk

Picture the security desk of an office tower. A basic guard checks only the badge colour of everyone walking in and out, and has no memory. A better guard writes down every visitor who goes up, so when that visitor comes back down the guard knows they belong. The best guard also knows who the person is, which floor they are allowed on and checks what is inside their bag. These three guards are the three generations of firewall. The ASA and Threat Defense modules go deep; this chapter gives you the model they build on.

Generation 1: the stateless packet filter

A router ACL is a stateless packet filter. It looks at each packet alone: source and destination IP, protocol and ports. It has no memory of connections, so for every flow you must permit both directions. That makes rules long and open: to let inside users browse, you must also allow many return packets from the internet to high ports. It is fast and still useful on routers and switches (infrastructure ACLs), but it cannot tell a genuine reply from an unsolicited packet crafted to look like one.

Generation 2: the stateful firewall

A stateful firewall keeps a connection table (state table). When an allowed packet starts a connection (for TCP, the SYN), the firewall records the 5-tuple: source IP, source port, destination IP, destination port and protocol. Return packets that match an existing entry are allowed automatically; anything else must match a rule. It also checks that TCP flags and sequence numbers make sense and times out idle connections. Cisco ASA is the classic stateful firewall. Many protocols also need inspection (application awareness) to open secondary channels safely, for example FTP data or SIP media.

Generation 3: the next-generation firewall (NGFW)

An NGFW is a stateful firewall plus deep inspection: application identification (it recognises a messaging app on port 443, not just "HTTPS"), user identity (rules by AD group, learned from ISE or other identity sources), URL filtering by category and reputation, IPS, file and malware inspection, Security Intelligence feeds of known bad IPs, URLs and domains, and TLS decryption so it can see inside encrypted traffic. Cisco Secure Firewall Threat Defense (FTD) is Cisco's NGFW, configured through Management Center (FMC) or, for a single device, Device Manager.

	Packet filter	Stateful	NGFW
Decides on	IP, protocol, port	+ connection state	+ app, user, URL, content, reputation
Return traffic	Needs its own rule	Automatic from state table	Automatic from state table
Sees threats in payload	No	Limited (protocol inspection)	Yes (IPS, file, malware)
Cisco example	IOS ACL	ASA	Threat Defense with FMC

Zones and trust

Firewalls group interfaces into zones of similar trust. Typical design: inside (users, high trust), DMZ (public-facing servers, medium trust), outside (internet, no trust). On the ASA every interface has a nameif and a security level from 0 to 100: by default traffic from a higher level to a lower level is allowed, lower to higher is denied unless an ACL permits it, and traffic between two interfaces of the same level is denied unless explicitly enabled. On Threat Defense you create security zones and write access control rules from zone to zone.

Rules: top-down, first match, implicit deny

A firewall rule base is read top to bottom; the first match wins and processing stops. Every ACL ends with an implicit deny. So: specific rules first, broad rules later, and never a "permit any any" to fix a ticket. Good rules name a source, a destination, a service and an owner, and they log.

NAT in one paragraph

Internal networks use private addresses, so the firewall translates them. Dynamic PAT lets many inside hosts share one public address (the outside interface) by using different source ports. Static NAT maps one private server to one public address so the internet can reach it. On ASA software 8.3 and later, ACLs are written with the real (untranslated) IP of the server, not the public one: a favourite exam and troubleshooting point.

! Preview only: the ASA modules build this step by step
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 203.0.113.2 255.255.255.240
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 10.1.10.1 255.255.255.0
interface GigabitEthernet0/2
 nameif dmz
 security-level 50
 ip address 10.1.50.1 255.255.255.0
! Inside users share the outside address (dynamic PAT)
object network INSIDE-NET
 subnet 10.1.10.0 255.255.255.0
 nat (inside,outside) dynamic interface
! Publish the DMZ web server (static NAT)
object network WEB-SRV
 host 10.1.50.10
 nat (dmz,outside) static 203.0.113.10
! ACL uses the REAL address (object WEB-SRV = 10.1.50.10)
access-list OUTSIDE_IN extended permit tcp any object WEB-SRV eq 443
access-group OUTSIDE_IN in interface outside
route outside 0.0.0.0 0.0.0.0 203.0.113.1

FW1# show conn address 10.1.50.10
1 in use, 118 most used
TCP outside  198.51.100.7:51000 dmz  10.1.50.10:443, idle 0:00:03, bytes 48213, flags UIO

FW1# show xlate
2 in use, 4 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
       s - static, T - twice, N - net-to-net
NAT from dmz:10.1.50.10 to outside:203.0.113.10
    flags s idle 0:00:03 timeout 0:00:00
TCP PAT from inside:10.1.10.25/53112 to outside:203.0.113.2/53112 flags ri idle 0:00:04 timeout 0:00:30

The connection entry proves the stateful table: an internet client 198.51.100.7 talks to the real server 10.1.50.10 on 443, flags U (up), I and O (data in both directions). The xlate table shows one static and one PAT translation.

Deployment modes

In routed mode the firewall is a Layer 3 hop with an IP on each interface. In transparent mode it acts as a "bump in the wire" bridge, so you can insert it without re-addressing. Threat Defense can also run interfaces as inline sets or passive (IDS) interfaces. SNCF domain 1 tests these modes in detail.

Think about sending a valuable parcel. You want nobody to open it on the way (confidentiality), nobody to swap the contents (integrity) and the receiver to be sure it really came from you (authentication). In the physical world you use a locked box, a tamper seal and a signature. Cryptography gives us digital versions of all three. This chapter builds the vocabulary; the cryptography and VPN modules go deeper into IKE, IPsec, PKI and post-quantum algorithms.

Hashes: a fingerprint of data

A hash function turns any input into a fixed-size value, the digest. SHA-256 always produces 256 bits, whether the input is one word or a 4 GB file. Good hashes are one-way (you cannot get the input back) and collision resistant (you cannot find two inputs with the same digest). Change one bit of the file and the digest changes completely. Uses: checking that a downloaded image is intact, storing passwords (with a salt and a slow algorithm), identifying malware by file hash in EDR and threat intelligence. MD5 and SHA-1 are broken for collision resistance; use the SHA-2 family (SHA-256, SHA-384) or SHA-3.

A hash alone proves nothing about who sent the data, because anybody can compute it. An HMAC mixes a secret key into the hash, so only someone with the key can produce the right value. IPsec and TLS use HMAC or authenticated encryption for integrity.

Symmetric encryption: one shared key

In symmetric encryption the same key encrypts and decrypts. It is very fast, so it protects bulk data. The standard is AES with 128 or 256-bit keys, today usually in GCM mode, which encrypts and authenticates in one step. Older algorithms such as DES and 3DES are obsolete. The big problem is key distribution: how do two parties that have never met agree on a secret key over an untrusted network?

Asymmetric encryption: a key pair

Asymmetric (public key) cryptography gives each party a key pair. The public key can be shared with anyone; the private key never leaves its owner. What one key does, only the other can undo. Algorithms: RSA (2048 bits or more) and elliptic curve cryptography (ECDSA for signatures, ECDH for key agreement), which gives the same strength with much smaller keys. Asymmetric operations are slow, so they are used for two jobs only: agreeing on a symmetric key and creating digital signatures.

Diffie-Hellman (DH) lets two parties derive the same secret over a public channel without ever sending it. When fresh DH values are used for every session, stealing a long-term private key later does not reveal old sessions; this is perfect forward secrecy (PFS).

Digital signatures and certificates

A digital signature is a hash of the data encrypted (signed) with the sender's private key. Anyone with the public key can verify it, proving integrity, origin and non-repudiation (the signer cannot deny it). But how do you know a public key really belongs to portal.nwkings.example? A certificate (X.509) binds a name to a public key, and a certificate authority (CA) signs it. Your device trusts a small set of root CAs; roots sign intermediate CAs; intermediates sign server certificates. This hierarchy is PKI (public key infrastructure). Certificates expire, and they can be revoked early through a CRL (revocation list) or checked live with OCSP.

$ openssl x509 -in portal.crt -noout -subject -issuer -dates -ext subjectAltName
subject=CN = portal.nwkings.example
issuer=C = IN, O = NK Sim, CN = NK Sim Issuing CA 1
notBefore=Jan 10 00:00:00 2026 GMT
notAfter=Jan 10 23:59:59 2027 GMT
X509v3 Subject Alternative Name:
    DNS:portal.nwkings.example, DNS:vpn.nwkings.example

Check the name users type is in the SAN list, the issuer chains to a trusted root and the validity dates include today. Expired certificates are one of the most common causes of VPN and portal outages.

TLS: how HTTPS and many VPNs protect data

TLS 1.3, the current version, completes its handshake in one round trip: the client and server exchange ECDHE key shares, the server proves its identity with its certificate and a signature, both derive session keys, and the data flows under AES-GCM or ChaCha20-Poly1305. TLS 1.3 always gives forward secrecy. TLS 1.0 and 1.1 are deprecated. Because TLS hides content, an NGFW needs decryption to inspect it, and that has privacy and performance costs.

VPNs in one view

• Site-to-site VPN: two gateways (firewalls or routers) build an IPsec tunnel. IKEv2 authenticates the peers (pre-shared key or certificates) and negotiates keys; ESP encrypts and authenticates the traffic. AH gives integrity only and does not work through NAT.
• Remote access VPN: a user's laptop connects with Cisco Secure Client (formerly AnyConnect) to an ASA or Threat Defense, using TLS/DTLS or IKEv2, usually with MFA. Split tunnelling decides which traffic goes into the tunnel.
• ZTNA is the modern alternative: access per application instead of a full network tunnel (chapter 9).

At a hotel, the reception checks your ID (who are you?), gives you a key card that opens only your room, the gym and the lift (what may you do?), and the card system records every door you open (what did you do?). If you lose the card, they cancel it and issue a new one. That is identity and access management. Attackers today prefer logging in to breaking in, which is why identity is often called the new perimeter.

AAA: three separate questions

Authentication

Who are you? Proven with a password, certificate, token or biometric.

Authorisation

What are you allowed to do? A VLAN, an ACL, a privilege level, a list of permitted commands, an application.

Accounting

What did you do and when? Session start and stop, commands typed, bytes used. Essential for investigations and audits.

Authentication factors come in three kinds: something you know (password, PIN), something you have (phone app, hardware key, smart card), something you are (fingerprint, face). Multi-factor authentication (MFA) needs two or more different kinds; two passwords are still one factor.

RADIUS and TACACS+

Network devices do not keep thousands of user accounts. They ask a central AAA server, such as Cisco ISE, using one of two protocols:

	RADIUS	TACACS+
Transport	UDP 1812 (auth), 1813 (accounting)	TCP 49
Encryption	Only the password attribute is hidden	The whole packet body is encrypted
AAA functions	Authentication and authorisation combined	All three separated
Per-command authorisation	No	Yes
Main use	Network access: 802.1X, MAB, VPN, wireless	Device administration: who may log in to routers, switches, firewalls and which commands they may run

Remember the pair: RADIUS for users onto the network, TACACS+ for admins onto the devices.

! Preview: device administration with TACACS+ (full lab in the AAA module)
aaa new-model
tacacs server ISE-1
 address ipv4 10.1.99.20
 key NkSim-Tacacs-Key
aaa group server tacacs+ ISE-GRP
 server name ISE-1
! Try ISE first, fall back to the local account only if ISE is unreachable
aaa authentication login VTY-AUTH group ISE-GRP local
aaa authorization exec VTY-AUTH group ISE-GRP local
aaa authorization commands 15 VTY-AUTH group ISE-GRP local
aaa accounting commands 15 VTY-AUTH start-stop group ISE-GRP
username breakglass privilege 15 algorithm-type scrypt secret NkSim-Local-Only
line vty 0 4
 login authentication VTY-AUTH
 authorization exec VTY-AUTH
 authorization commands 15 VTY-AUTH
 accounting commands 15 VTY-AUTH
 transport input ssh

802.1X and MAB: who is plugged into this port?

802.1X controls access at the switch port or Wi-Fi SSID. Three roles: the supplicant (software on the laptop), the authenticator (the switch or wireless controller) and the authentication server (ISE, via RADIUS). Until authentication succeeds, the port passes only EAP traffic. Devices without a supplicant, such as printers and cameras, use MAB (MAC Authentication Bypass), which is weaker because MAC addresses can be copied. ISE then returns an authorisation: a VLAN, a downloadable ACL or a Security Group Tag.

SW1# show authentication sessions interface GigabitEthernet1/0/5 details
            Interface:  GigabitEthernet1/0/5
          MAC Address:  0050.56aa.1b2c
         IPv4 Address:  10.1.10.55
            User-Name:  priya@corp.example
               Status:  Authorized
               Domain:  DATA
       Oper host mode:  multi-auth
Server Policies:
              Vlan Group:  Vlan: 10
Method status list:
       Method           State
          dot1x          Authc Success

This port shows a user authenticated by 802.1X and placed in VLAN 10 by the policy ISE returned.

MFA done well

Not all MFA is equal. SMS codes can be intercepted or SIM-swapped. Simple push approvals invite MFA fatigue: the attacker who already has the password sends push after push until the tired user taps Approve. Better: verified push (the user types a number shown on the login screen), device health checks, and phishing-resistant methods such as FIDO2/WebAuthn security keys or platform passkeys, which are bound to the real website and cannot be replayed on a fake one. Cisco Duo provides these and can block logins from unhealthy or unknown devices.

Single sign-on

SSO lets a user authenticate once to an identity provider (IdP) and then reach many applications (service providers) without new passwords. SAML 2.0 passes signed XML assertions and is common for enterprise web apps; OpenID Connect, built on OAuth 2.0, is common for modern and mobile apps. SSO reduces password reuse and gives one place to enforce MFA and to disable a leaver's access, but the IdP becomes a high-value target that must be protected very carefully.

Zero trust

The old model trusted anything inside the network. Zero trust (SCOR topic 1.8) removes implicit trust based on location. Its principles: verify explicitly (user, device and context for every request), least privilege access, and assume breach (segment and monitor everything). In practice that means strong identity with MFA, device posture checks, micro-segmentation, continuous monitoring and ZTNA, which gives a user access to one application rather than a whole network through a VPN.

A shopping mall with cameras that record to tapes nobody watches is not safe; it is just well documented. Security becomes real when somebody looks at the recordings, notices the person trying every car door, and sends a guard. In networks the cameras are logs, flow records and endpoint telemetry; the control room is the SOC; and the guard's playbook is the incident response process. SCOR domain 6 and the integration part of SNCF test exactly this.

Source 1: logs (syslog)

Every firewall, router, switch, server and security tool writes logs. Network devices use syslog with eight severity levels: 0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications, 6 informational, 7 debugging. Lower number means more severe. On the ASA each message has an ID: 106023 is a packet denied by an access-group, 302013/302014 are TCP connections built and torn down, 113004/113005 are AAA successes and failures. Logs need correct time (NTP) on every device, or events from different systems cannot be put in order.

! Send ASA logs with timestamps to the SIEM collector
logging enable
logging timestamp
logging trap informational
logging host inside 10.1.99.30

Sep 30 2026 10:42:17: %ASA-4-106023: Deny tcp src outside:198.51.100.23/44120 dst dmz:10.1.50.10/22 by access-group "OUTSIDE_IN" [0x0, 0x0]
Sep 30 2026 10:42:18: %ASA-6-302013: Built inbound TCP connection 18842 for outside:198.51.100.7/51000 (198.51.100.7/51000) to dmz:10.1.50.10/443 (203.0.113.10/443)
Sep 30 2026 10:42:25: %ASA-6-302014: Teardown TCP connection 18842 for outside:198.51.100.7/51000 to dmz:10.1.50.10/443 duration 0:00:07 bytes 48213 TCP FINs

The first line is a blocked SSH attempt from the internet to the DMZ web server, severity 4. The next two show a normal HTTPS session: built, then torn down after 7 seconds and 48 KB. Notice that the ASA prints both the real address 10.1.50.10 and the mapped address 203.0.113.10.

Source 2: NetFlow and IPFIX

NetFlow (and its standard form IPFIX) records metadata about every conversation instead of the full packets: source and destination IP and port, protocol, bytes, packets, start and end time, the interface. A router or firewall (the exporter) sends these records to a collector. Flow data is small, covers the whole network and is perfect for questions such as "who talked to this IP last week?", "which host suddenly uploaded 4 GB at 3 a.m.?" or "which workstation is scanning the subnet?". Cisco Secure Network Analytics builds behaviour baselines on top of flows. Flows show that something happened, not what was inside; for content you need a packet capture.

Source 3: endpoint and cloud telemetry

EDR agents report processes, file hashes, network connections and user activity from each host. Cloud platforms produce audit logs of every API call. DNS security logs every lookup. Together with firewall logs and flows these make up the full picture.

SIEM, SOAR and XDR

A SIEM collects all these sources, parses and normalises them into common fields (source IP, user, action), correlates events across tools and time, raises alerts, and retains data for investigation and compliance. SOAR automates the response steps with playbooks. XDR takes detections from endpoint, network, email, identity and cloud, groups them into incidents and offers one-click response actions. In this track the Splunk and XDR consoles are simulated so you can practise searching and containing.

index=netfw sourcetype="cisco:asa" message_id=106023 earliest=-24h
| stats count by src_ip, dest_port | sort - count | head 3

src_ip           dest_port    count
198.51.100.23    22           1840
198.51.100.23    3389         1612
203.0.113.77     23           412

One search turns thousands of deny lines into an answer: 198.51.100.23 is scanning SSH and RDP on the DMZ. Because the firewall already blocks it, this is information, not an incident, unless an allowed connection from the same source appears.

Alert quality

	Attack really happened	No attack
Alert raised	True positive	False positive (noise)
No alert	False negative (the dangerous one)	True negative

Too many false positives cause alert fatigue, and analysts start ignoring alerts. Tuning is a permanent job. SOC teams measure MTTD (mean time to detect) and MTTR (mean time to respond or recover).

The incident response lifecycle (NIST SP 800-61)

1. Preparation: an IR plan, contacts, tools, logging in place, backups tested, playbooks written.
2. Detection and analysis: an alert arrives; confirm it, decide severity, scope which hosts and users are affected, preserve evidence.
3. Containment, eradication and recovery: isolate the host or block the domain (short-term containment), remove the cause (malware, attacker accounts, the vulnerability), restore from clean sources and monitor closely.
4. Post-incident activity: a blameless review; what worked, what failed, which control or detection to add.

NIST published Rev. 3 in 2025, which maps incident response onto the six Cybersecurity Framework 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) instead of a separate cycle. The ideas are the same; know both names.

When you join a new hospital as a doctor, the first week is about learning where everything is: the emergency room, the lab, the pharmacy, the records office, and which machine does what. Cisco security has many products, several of which were renamed in recent years, and exam questions use the current names. This chapter is your floor plan: each product, its old name, the layer it serves (from chapter 6) and the module where you will operate it.

Firewalls and their managers

Cisco Secure Firewall ASA

The Adaptive Security Appliance: stateful firewall, NAT, site-to-site and remote access VPN, failover and clustering. Managed by CLI or the ASDM GUI. Four ASA modules in this track.

Cisco Secure Firewall Threat Defense (FTD)

Cisco's NGFW software (formerly Firepower Threat Defense): access control, application and URL control, Snort 3 IPS, file and malware policy, Security Intelligence, decryption, VPN. Runs on Secure Firewall hardware, as a virtual appliance and in public clouds.

Secure Firewall Management Center (FMC)

The central manager for many Threat Defense devices (formerly Firepower Management Center): policies, objects, deploy, events and reports. Most SNCF questions happen here.

Device Manager (FDM) and Security Cloud Control

FDM is the on-box GUI for a single Threat Defense. Security Cloud Control (formerly CDO) is the cloud management platform, including a cloud-delivered FMC.

You register a Threat Defense device to its manager from the device CLI, then finish in the FMC GUI:

! On the Threat Defense CLI: point the device at its Management Center
> configure manager add 10.1.99.40 NkSimRegKey1

> show managers
Type                      : Manager
Host                      : 10.1.99.40
Display name              : 10.1.99.40
Registration              : Completed
Management type           : Configuration and analytics

"Pending" instead of "Completed" usually means the device has not yet been added in FMC with the same registration key, or TCP 8305 between them is blocked.

Identity, access and endpoints

Cisco ISE

Identity Services Engine: RADIUS and TACACS+ server, 802.1X and MAB policy, profiling, posture, guest, TrustSec, and pxGrid to share user and device context with other products.

Cisco Duo

MFA, device trust and SSO for applications and VPN.

Cisco Secure Client

The endpoint agent formerly called AnyConnect: remote access VPN plus modules for posture, zero trust access, roaming DNS protection and network visibility.

Cisco Secure Endpoint

EPP and EDR (formerly AMP for Endpoints): file reputation, behaviour protection, device trajectory, isolation and outbreak control.

Cloud-delivered security and content

Cisco Secure Access

Cisco's SSE: DNS-layer security, secure web gateway, CASB, DLP, ZTNA, firewall as a service and AI guardrails, built on the Umbrella cloud.

Cisco Umbrella

DNS-layer security and secure internet gateway; its DNS protection is part of Secure Access today.

Secure Email Gateway, Secure Email Threat Defense

On-premises or cloud email security (formerly ESA), and API-based protection for cloud mailboxes.

Secure Web Appliance

The web proxy formerly called WSA.

Visibility, intelligence and response

Cisco Talos

One of the largest commercial threat intelligence teams. Talos research feeds the IPS rules, Security Intelligence lists, file reputation and URL categories used by the other products.

Cisco XDR

Correlates detections from endpoint, network, email, identity and cloud into incidents, with response actions such as isolate host or block domain.

Splunk

SIEM and analytics platform, part of Cisco since 2024; Splunk Enterprise Security for SOC use cases, SOAR for automation.

Secure Network Analytics

Flow-based behaviour analytics (formerly Stealthwatch).

Integration is the point

The products become much stronger together. Examples you will build: ISE shares the user name behind an IP with Threat Defense over pxGrid, so firewall rules can name AD groups; Threat Defense detects malware and asks ISE to quarantine the host (Rapid Threat Containment); Secure Endpoint and Secure Access send detections to XDR, which isolates the host and blocks the domain in one incident; firewall events stream to Splunk. SCOR topic 1.10 also asks you to read simple scripts that call these products' REST APIs.

How the labs in this track work

The labs run in your browser on simulated consoles: an ASA and Threat Defense CLI, an FMC-style GUI with policies and a Deploy button, and consoles modelled on ISE, Secure Access, Secure Endpoint, Duo, XDR and Splunk. They behave like the real products for everything the exam and the job need: show commands, packet-tracer, connection tables, deploy workflow, event views and searches. Each lab has a kind: C configure (build something from a task list), T troubleshoot (a ticket with a hidden fault), N NOC ticket (an operations scenario with evidence to read) and P packet capture.

All threats are simulated. Malicious domains use the reserved .example suffix (for example cdn-stats.example), addresses come from the documentation ranges, and fake payloads carry an nk-sim marker such as cdn-stats.example/nk-sim/beacon. Nothing harmful ever runs, which is exactly why you can safely practise blocking, detecting and containing.

A fire drill is boring until the day of a real fire, when everyone already knows the stairs, the meeting point and who calls whom. Security teams practise in the same way. This chapter runs two drills with everything from this module: a simulated malware beacon from alert to lessons learned, and the most common daily ticket for a security engineer, "the security stuff is blocking my application". Both follow one habit: evidence first, smallest safe action, verify, document.

Drill 1: the beaconing laptop

Topology from chapter 7: users in 10.1.10.0/24 behind FW1, DNS security for all users, EDR on every laptop, logs into the SIEM. At 10:05 the SOC console shows an alert: DNS request blocked, category Command and Control, host 10.1.10.77, domain cdn-stats.example.

Step 1: triage (is it real?)

Questions: is the domain really malicious (category, age, reputation), is the host real and whose is it, and is this repeated? The analyst searches the DNS logs in the SIEM:

index=dns query="cdn-stats.example" earliest=-7d | table _time src_ip query action category

_time                  src_ip        query               action    category
2026-09-30 10:05:12    10.1.10.77    cdn-stats.example   blocked   Command and Control
2026-09-30 10:10:12    10.1.10.77    cdn-stats.example   blocked   Command and Control
2026-09-30 10:15:12    10.1.10.77    cdn-stats.example   blocked   Command and Control

Exactly every five minutes, from one host, to a newly registered C2 domain: the regular rhythm of a beacon. Humans do not browse on a timer. Verdict: true positive, severity high (C2 means code is running on the laptop), but not yet critical because every lookup was blocked.

Step 2: scope (how big is it?)

• Other hosts? The same search without the IP filter returns only 10.1.10.77. One host.
• Did anything get through? The firewall connection logs and NetFlow show no connections from 10.1.10.77 to unknown external IPs on unusual ports, and no large uploads. The C2 was blocked at DNS before any session.
• What started it? The EDR console's trajectory for the host shows a browser downloading codec-pack-setup.exe from free-codec-update.example at 09:58, the file creating a scheduled task (persistence), then the periodic DNS lookups. The file hash is new: no antivirus signature yet.
• Who? The DHCP and ISE session logs map 10.1.10.77 to laptop MKT-LT-077 and user ravi@corp.example.

Step 3: containment

Short-term containment must stop harm without destroying evidence: the analyst uses the EDR console to isolate the laptop (it can talk only to the EDR cloud), adds the file hash to a custom block list so no other host can run it, and blocks free-codec-update.example in DNS security. The user's password is reset and active sessions revoked, in case credentials were captured. The laptop stays powered on so memory evidence is kept.

Step 4: eradication and recovery

The desktop team collects the evidence the IR plan requires, reimages the laptop from a clean build, and returns it. The SOC keeps a watch rule for the hash and both domains for 30 days. A retrospective search across all endpoints for the hash finds no other copies.

Step 5: lessons learned

Blameless review: DNS security worked; the web gateway allowed an executable download from an uncategorised site; the user could install software. Actions: block executable downloads from uncategorised and newly seen domains, remove local admin rights for marketing, and add an ATT&CK-tagged SIEM rule for "periodic DNS to one domain from one host".

Drill 2: "security is blocking my application"

Ticket: users in 10.1.10.0/24 cannot reach the new partner portal at 198.51.100.80 on TCP 8443 since this morning. Never start by disabling controls. Work the path in order, one control at a time:

1. Define the flow exactly: source, destination, protocol, port, time. Reproduce it from one test host.
2. DNS: does the name resolve, or is the domain blocked by DNS policy?
3. Firewall: packet-tracer and ACL hit counts, then a capture on both interfaces.
4. NGFW inspection: IPS, file, URL or decryption events for this flow.
5. Identity and endpoint: does ISE place this user in a VLAN or group that the rule does not cover? Is the EDR blocking the client application?
6. Fix narrowly, verify, document the change and its owner.

FW1# packet-tracer input inside tcp 10.1.10.25 51515 198.51.100.80 8443
...
Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Additional Information:
Found next-hop 203.0.113.1 using egress ifc  outside

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Routing is fine; the inside ACL (which allows only web ports) hits its implicit deny for 8443. The correct fix is one rule: permit tcp 10.1.10.0/24 to host 198.51.100.80 eq 8443, with a change record, not opening all high ports.

! Narrow fix, placed above any broader deny, with a remark for the owner
access-list INSIDE_OUT line 1 remark CHG-2026-0930 partner portal, owner: sales-ops
access-list INSIDE_OUT line 2 extended permit tcp 10.1.10.0 255.255.255.0 host 198.51.100.80 eq 8443

A pilot does not take off because they feel ready; they walk around the aircraft with a checklist and tick every item. Use this chapter the same way. It condenses the whole module into a can-do list, a glossary, the facts examiners and interviewers ask most, a study plan for the two exams, and a short command cheat-sheet. If you can tick every line honestly, you are ready for the rest of the CCNP Security track.

Can-do checklist

• Define asset, threat, vulnerability, exploit, risk and control, and give one example that links all six.
• Explain the CIA triad and AAA, and name which property an attack breaks (ransomware = availability, data theft = confidentiality, tampered records = integrity).
• Describe defence in depth, least privilege, separation of duties and assume breach.
• Walk the seven stages of the Cyber Kill Chain and name at least six MITRE ATT&CK tactics; explain IOC versus IOA.
• Name threat actor types (cybercriminals and ransomware groups, nation-states, hacktivists, insiders) and their motives; explain ransomware as a service and double extortion.
• List the attack surface layer by layer (Layer 2, Layer 3, services, management plane, wireless, cloud, users) and match each classic attack to its control.
• Place every layer of the security stack on one diagram: NGFW, IPS, DNS security, SWG, email security, EPP/EDR, NAC, MFA/SSO, SIEM, SOAR, XDR, cloud controls.
• Explain stateless versus stateful versus NGFW, zones, first-match rules and the implicit deny.
• Explain hashing, symmetric and asymmetric encryption, digital signatures, certificates and why TLS uses both key types.
• Compare RADIUS and TACACS+, explain 802.1X and MAB, MFA, SSO and the principles of zero trust.
• Walk the NIST incident response lifecycle and a first incident from alert to lessons learned.
• Map the Cisco portfolio (ASA, Threat Defense, Management Center, ISE, Duo, Secure Client, Secure Endpoint, Secure Access, Umbrella, email security, XDR, Splunk, Talos) to its layer and module.
• Troubleshoot a "security is blocking my app" ticket in order: flow, DNS, firewall, inspection, identity, endpoint.

Mini glossary

Asset / threat / vulnerability

Something of value / something that can cause harm / a weakness a threat can use.

Exploit / risk / control

The method that uses a weakness / likelihood times impact / a measure that reduces risk.

CIA / AAA

Confidentiality, integrity, availability / authentication, authorisation, accounting.

Kill chain / ATT&CK

Seven-stage model of an intrusion / MITRE's matrix of adversary tactics and techniques.

IOC / IOA

Evidence that a compromise happened (hash, domain, IP) / behaviour that shows an attack in progress.

Attack surface

Every point where an attacker can interact with your systems.

NGFW / IPS / IDS

Firewall with application, user and threat awareness / inline engine that blocks attacks / passive engine that only alerts.

SWG / CASB / ZTNA

Web proxy that filters web traffic / visibility and control of SaaS use / per-application access instead of full network access.

SSE / SASE

SWG, CASB, ZTNA and FWaaS from the cloud / SSE plus SD-WAN.

EPP / EDR / XDR

Prevents known endpoint threats / records and responds on endpoints / correlates detections across many sources.

SIEM / SOAR

Collects and correlates logs / automates response playbooks.

NAC / 802.1X / MAB

Controls who connects / port-based authentication with EAP and RADIUS / fallback authentication by MAC address.

MFA / SSO / zero trust

Two or more factor types / one login for many apps / never trust by location, verify every request.

PKI / certificate

The system of CAs that vouch for keys / a CA-signed binding of a name to a public key.

Most tested facts

Topic	Remember
SCOR 350-701 v2.0	120 minutes; Concepts 20%, Network Security 25%, Cloud 15%, SSE 10%, Endpoint 15%, Access and Visibility 15%
SNCF 300-710 v1.2	90 minutes; Deployment 30%, Configuration 30%, Management and Troubleshooting 25%, Integration 15%
IDS vs IPS	IDS on a copy of traffic, alert only; IPS inline, can drop
RADIUS vs TACACS+	RADIUS: UDP 1812/1813, encrypts only the password, network access. TACACS+: TCP 49, encrypts the whole body, separates AAA, device administration
Hash vs encryption	Hash is one-way (integrity); encryption is reversible with a key (confidentiality)
Symmetric vs asymmetric	Symmetric (AES) is fast for bulk data; asymmetric (RSA, ECDH) exchanges keys and signs
Signature	Signed with the sender's private key, verified with the public key
NIST IR lifecycle	Preparation; detection and analysis; containment, eradication and recovery; post-incident activity
Firewall rules	Top-down, first match wins, implicit deny at the end
Beaconing	Regular-interval connections from one host to one destination

Command cheat-sheet from this module

! What is this router listening on? (attack surface)
show control-plane host open-ports
! ASA: why is this flow allowed or dropped?
packet-tracer input inside tcp 10.1.10.25 51515 198.51.100.80 8443
show access-list INSIDE_OUT
show conn address 198.51.100.80
! Threat Defense: is the device registered to its Management Center?
show managers