Introduction

Congratulations! If you are reading this, you have in your possession a powerful tool that can help you to:

Improve your awareness and knowledge of cyber security fundamentals

Increase your skill level related to the implementation of that security

Prepare for the CCNA Cyber Ops SECFND certification exam

Whether you are preparing for the CCNA Cyber Ops certification or just changing careers to cyber security, this book will help you gain the knowledge you need to get started and prepared. When writing this book, we did so with you in mind, and together we will discover the critical ingredients that make up the recipe for a secure network and how to succeed in cyber security operations. By focusing on covering the objectives for the CCNA Cyber Ops SECFND exam and integrating that with real-world best practices and examples, we created this content with the intention of being your personal tour guides as we take you on a journey through the world of network security.

The CCNA Cyber Ops: Understanding Cisco Cybersecurity Fundamentals (SECFND) 210-250 exam is required for the CCNA Cyber Ops certification. This book covers all the topics listed in Cisco’s exam blueprint, and each chapter includes key topics and preparation tasks to assist you in mastering this information. Reviewing tables and practicing test questions will help you practice your knowledge in all subject areas.

About the 210-250 CCNA Cyber Ops SECFND Exam

The CCNA Cyber Ops: Understanding Cisco Cybersecurity Fundamentals (SECFND) 210-250 exam is the first of the two required exams to achieve the CCNA Cyber Ops certification and is aligned with the job role of associate-level security operations center (SOC) security analyst. The SECFND exam tests candidates’ understanding of cyber security’s basic principles, foundational knowledge, and core skills needed to grasp the more advanced associate-level materials in the second required exam: Implementing Cisco Cybersecurity Operations (SECOPS).

The CCNA Cyber Ops: Understanding Cisco Cybersecurity Fundamentals (SECFND) 210-250 exam is a computer-based test that has 55 to 60 questions and a 90-minute time limit. Because all exam information is managed by Cisco Systems and is therefore subject to change, candidates should continually monitor the Cisco Systems site for exam updates at http://www.cisco.com/c/en/us/training-events/training-certifications/exams/current-list/secfnd.xhtml.

You can take the exam at Pearson VUE testing centers. You can register with VUE at www.vue.com/cisco.

210-250 CCNA Cyber Ops SECFNC Exam Topics

Table I-1 lists the topics of the 210-250 SECFND exam and indicates the chapter in the book where they are covered.

Table I-1 210-250 SECFND Exam Topics

Exam Topic	Chapter
1.0 Network Concepts
1.1 Describe the function of the network layers as specified by the OSI and the TCP/IP network models	Chapter 1
1.2 Describe the operation of the following:
1.2.a IP	Chapter 1
1.2.b TCP	Chapter 1
1.2.c UDP	Chapter 1
1.2.d ICMP	Chapter 1
1.3 Describe the operation of these network services:
1.3.a ARP	Chapter 1
1.3.b DNS	Chapter 1
1.3.c DHCP	Chapter 1
1.4 Describe the basic operation of these network device types:
1.4.a Router	Chapter 1
1.4.b Switch	Chapter 1
1.4.c Hub	Chapter 1
1.4.d Bridge	Chapter 1
1.4.e Wireless access point (WAP)	Chapter 1
1.4.f Wireless LAN controller (WLC)	Chapter 1
1.5 Describe the functions of these network security systems as deployed on the host, network, or the cloud:
1.5.a Firewall	Chapter 2
1.5.b Cisco Intrusion Prevention System (IPS)	Chapter 2
1.5.c Cisco Advanced Malware Protection (AMP)	Chapter 2
1.5.d Web Security Appliance (WSA) / Cisco Cloud Web Security (CWS)	Chapter 2
1.5.e Email Security Appliance (ESA) / Cisco Cloud Email Security (CES)	Chapter 2
1.6 Describe IP subnets and communication within an IP subnet and between IP subnets	Chapter 1
1.7 Describe the relationship between VLANs and data visibility	Chapter 1
1.8 Describe the operation of ACLs applied as packet filters on the interfaces of network devices	Chapter 2
1.9 Compare and contrast deep packet inspection with packet filtering and stateful firewall operation	Chapter 2
1.10 Compare and contrast inline traffic interrogation and taps or traffic mirroring	Chapter 2
1.11 Compare and contrast the characteristics of data obtained from taps or traffic mirroring and NetFlow in the analysis of network traffic	Chapter 2
1.12 Identify potential data loss from provided traffic profiles	Chapter 2
2.0 Security Concepts
2.1 Describe the principles of the defense-in-depth strategy	Chapter 3
2.2 Compare and contrast these concepts:
2.2.a Risk	Chapter 3
2.2.b Threat	Chapter 3
2.2.c Vulnerability	Chapter 3
2.2.d Exploit	Chapter 3
2.3 Describe these terms:
2.3.a Threat actor	Chapter 3
2.3.b Runbook automation (RBA)	Chapter 3
2.3.c Chain of custody (evidentiary)	Chapter 3
2.3.d Reverse engineering	Chapter 3
2.3.e Sliding window anomaly detection	Chapter 3
2.3.f PII	Chapter 3
2.3.g PHI	Chapter 3
2.4 Describe these security terms:
2.4.a Principle of least privilege	Chapter 3
2.4.b Risk scoring/risk weighting	Chapter 3
2.4.c Risk reduction	Chapter 3
2.4.d Risk assessment	Chapter 3
2.5 Compare and contrast these access control models:
2.5.a Discretionary access control	Chapter 4
2.5.b Mandatory access control	Chapter 4
2.5.c Nondiscretionary access control	Chapter 4
2.6 Compare and contrast these terms:
2.6.a Network and host antivirus	Chapter 4
2.6.b Agentless and agent-based protections	Chapter 4
2.6.c SIEM and log collection	Chapter 5
2.7 Describe these concepts:
2.7.a Asset management	Chapter 5
2.7.b Configuration management	Chapter 5
2.7.c Mobile device management	Chapter 5
2.7.d Patch management	Chapter 5
2.7.e Vulnerability management	Chapter 5
3.0 Cryptography
3.1 Describe the uses of a hash algorithm	Chapter 6
3.2 Describe the uses of encryption algorithms	Chapter 6
3.3 Compare and contrast symmetric and asymmetric encryption algorithms	Chapter 6
3.4 Describe the processes of digital signature creation and verification	Chapter 6
3.5 Describe the operation of a PKI	Chapter 6
3.6 Describe the security impact of these commonly used hash algorithms:
3.6.a MD5	Chapter 6
3.6.b SHA-1	Chapter 6
3.6.c SHA-256	Chapter 6
3.6.d SHA-512	Chapter 6
3.7 Describe the security impact of these commonly used encryption algorithms and secure communications protocols:
3.7.a DES	Chapter 6
3.7.b 3DES	Chapter 6
3.7.c AES	Chapter 6
3.7.d AES256-CTR	Chapter 6
3.7.e RSA	Chapter 6
3.7.f DSA	Chapter 6
3.7.g SSH	Chapter 6
3.7.h SSL/TLS	Chapter 6
3.8 Describe how the success or failure of a cryptographic exchange impacts security investigation	Chapter 6
3.9 Describe these items in regard to SSL/TLS:
3.9.a Cipher-suite	Chapter 6
3.9.b X.509 certificates	Chapter 6
3.9.c Key exchange	Chapter 6
3.9.d Protocol version	Chapter 6
3.9.e PKCS	Chapter 6
4.0 Host-based Analysis
4.1 Define these terms as they pertain to Microsoft Windows:
4.1.a Processes	Chapter 8
4.1.b Threads	Chapter 8
4.1.c Memory allocation	Chapter 8
4.1.d Windows Registry	Chapter 8
4.1.e WMI	Chapter 8
4.1.f Handles	Chapter 8
4.1.g Services	Chapter 8
4.2 Define these terms as they pertain to Linux:
4.2.a Processes	Chapter 9
4.2.b Forks	Chapter 9
4.2.c Permissions	Chapter 9
4.2.d Symlinks	Chapter 9
4.2.e Daemon	Chapter 9
4.3 Describe the functionality of these endpoint technologies in regard to security monitoring:
4.3.a Host-based intrusion detection	Chapter 10
4.3.b Antimalware and antivirus	Chapter 10
4.3.c Host-based firewall	Chapter 10
4.3.d Application-level whitelisting/blacklisting	Chapter 10
4.3.e Systems-based sandboxing (such as Chrome, Java, Adobe Reader)	Chapter 10
4.4 Interpret these operating system log data to identify an event:
4.4.a Windows security event logs	Chapter 8
4.4.b Unix-based syslog	Chapter 9
4.4.c Apache access logs	Chapter 9
4.4.d IIS access logs	Chapter 8
5.0 Security Monitoring
5.1 Identify the types of data provided by these technologies:
5.1.a TCP Dump	Chapter 11
5.1.b NetFlow	Chapter 11
5.1.c Next-gen firewall	Chapter 11
5.1.d Traditional stateful firewall	Chapter 11
5.1.e Application visibility and control	Chapter 11
5.1.f Web content filtering	Chapter 11
5.1.g Email content filtering	Chapter 11
5.2 Describe these types of data used in security monitoring:
5.2.a Full packet capture	Chapter 11
5.2.b Session data	Chapter 11
5.2.c Transaction data	Chapter 11
5.2.d Statistical data	Chapter 11
5.2.e Extracted content	Chapter 11
5.2.f Alert data	Chapter 11
5.3 Describe these concepts as they relate to security monitoring:
5.3.a Access control list	Chapter 12
5.3.b NAT/PAT	Chapter 12
5.3.c Tunneling	Chapter 12
5.3.d TOR	Chapter 12
5.3.e Encryption	Chapter 12
5.3.f P2P	Chapter 12
5.3.g Encapsulation	Chapter 12
5.3.h Load balancing	Chapter 12
5.4 Describe these NextGen IPS event types:
5.4.a Connection event	Chapter 11
5.4.b Intrusion event	Chapter 11
5.4.c Host or endpoint event	Chapter 11
5.4.d Network discovery event	Chapter 11
5.4.e NetFlow event	Chapter 11
5.5 Describe the function of these protocols in the context of security monitoring:
5.5.a DNS	Chapter 12
5.5.b NTP	Chapter 12
5.5.c SMTP/POP/IMAP	Chapter 12
5.5.d HTTP/HTTPS	Chapter 12
6.0 Attack Methods
6.1 Compare and contrast an attack surface and vulnerability	Chapter 13
6.2 Describe these network attacks:
6.2.a Denial of service	Chapter 13
6.2.b Distributed denial of service	Chapter 13
6.2.c Man-in-the-middle	Chapter 13
6.3 Describe these web application attacks:
6.3.a SQL injection	Chapter 13
6.3.b Command injections	Chapter 13
6.3.c Cross-site scripting	Chapter 13
6.4 Describe these attacks:
6.4.a Social engineering	Chapter 13
6.4.b Phishing	Chapter 13
6.4.c Evasion methods	Chapter 13
6.5 Describe these endpoint-based attacks:
6.5.a Buffer overflows	Chapter 13
6.5.b Command and control (C2)	Chapter 13
6.5.c Malware	Chapter 13
6.5.d Rootkit	Chapter 13
6.5.e Port scanning	Chapter 13
6.5.f Host profiling	Chapter 13
6.6 Describe these evasion methods:
6.6.a Encryption and tunneling	Chapter 14
6.6.b Resource exhaustion	Chapter 14
6.6.c Traffic fragmentation	Chapter 14
6.6.d Protocol-level misinterpretation	Chapter 14
6.6.e Traffic substitution and insertion	Chapter 14
6.6.f Pivot	Chapter 14
6.7 Define privilege escalation	Chapter 13
6.8 Compare and contrast a remote exploit and a local exploit	Chapter 13

About the CCNA Cyber Ops SECFND 210-250 Official Cert Guide

This book maps to the topic areas of the 210-250 SECFND exam and uses a number of features to help you understand the topics and prepare for the exam.

Objectives and Methods

This book uses several key methodologies to help you discover the exam topics on which you need more review, to help you fully understand and remember those details, and to help you prove to yourself that you have retained your knowledge of those topics. So, this book does not try to help you pass the exams only by memorization, but by truly learning and understanding the topics. This book is designed to help you pass the SECFND exam by using the following methods:

Helping you discover which exam topics you have not mastered

Providing explanations and information to fill in your knowledge gaps

Supplying exercises that enhance your ability to recall and deduce the answers to test questions

Providing practice exercises on the topics and the testing process via test questions on the companion website

Book Features

To help you customize your study time using this book, the core chapters have several features that help you make the best use of your time:

“Do I Know This Already?” quiz: Each chapter begins with a quiz that helps you determine how much time you need to spend studying that chapter.

Foundation Topics: These are the core sections of each chapter. They explain the concepts for the topics in that chapter.

Exam Preparation Tasks: After the “Foundation Topics” section of each chapter, the “Exam Preparation Tasks” section lists a series of study activities that you should do at the end of the chapter. Each chapter includes the activities that make the most sense for studying the topics in that chapter:

Review All the Key Topics: The Key Topic icon appears next to the most important items in the “Foundation Topics” section of the chapter. The “Review All the Key Topics” activity lists the key topics from the chapter, along with their page numbers. Although the contents of the entire chapter could be on the exam, you should definitely know the information listed in each key topic, so you should review these.

Complete the Tables and Lists from Memory: To help you memorize some lists of facts, many of the more important lists and tables from the chapter are included in a document on the companion website. This document lists only partial information, allowing you to complete the table or list.

Define Key Terms: Although the exam is unlikely to ask you to define a term, the CCNA Cyber Ops exams do require that you learn and know a lot of networking terminology. This section lists the most important terms from the chapter, asking you to write a short definition and compare your answer to the glossary at the end of the book.

Q&A: Confirm that you understand the content you just covered.

Web-based practice exam: The companion website includes the Pearson Cert Practice Test engine, which allows you to take practice exam questions. Use it to prepare with a sample exam and to pinpoint topics where you need more study.

How This Book Is Organized

This book contains 14 core chapters—Chapters 1 through 14. Chapter 15 includes some preparation tips and suggestions for how to approach the exam. Each core chapter covers a subset of the topics on the CCNA Cyber Ops SECFND exam. The core chapters are organized into parts. They cover the following topics:

Part I: Network Concepts

Chapter 1: Fundamentals of Networking Protocols and Networking Devices covers the networking technology fundamentals such as the OSI model and different protocols, including IP, TCP, UDP, ICMP, DNS, DHCP, ARP, and others. It also covers the basic operations of network infrastructure devices such as routers, switches, hubs, wireless access points, and wireless LAN controllers.

Chapter 2: Network Security Devices and Cloud Services covers the fundamentals of firewalls, intrusion prevention systems (IPSs), Advance Malware Protection (AMP), and fundamentals of the Cisco Web Security Appliance (WSA), Cisco Cloud Web Security (CWS), Cisco Email Security Appliance (ESA), and the Cisco Cloud Email Security (CES) service. This chapter also describes the operation of access control lists applied as packet filters on the interfaces of network devices and compares and contrasts deep packet inspection with packet filtering and stateful firewall operations. It provides details about inline traffic interrogation and taps or traffic mirroring. This chapter compares and contrasts the characteristics of data obtained from taps or traffic mirroring and NetFlow in the analysis of network traffic.

Part II: Security Concepts

Chapter 3: Security Principles covers the principles of the defense-in-depth strategy and compares and contrasts the concepts of risks, threats, vulnerabilities, and exploits. This chapter also defines threat actor, runbook automation (RBA), chain of custody (evidentiary), reverse engineering, sliding window anomaly detection, personally identifiable information (PII), protected health information (PHI), as well as the principle of least privilege and how to perform separation of duties. It also covers the concepts of risk scoring, risk weighting, risk reduction, and how to perform overall risk assessments.

Chapter 4: Introduction to Access Controls covers the foundation of access control and management. It provides an overview of authentication, authorization, and accounting principles, and introduces some of the most used access control models, including discretionary access control (DAC), mandatory access control (MAC), role-based access control (RBAC), and attribute-based access control (ABAC). Also, this chapter covers the actual implementation of access control, such as AAA protocols, port security, 802.1x, Cisco TrustSec, intrusion prevention and detection, and antimalware.

Chapter 5: Introduction to Security Operations Management covers the foundation of security operations management. Specifically, it provides an overview of identity management, protocol and technologies, asset security management, change and configuration management, mobile device management, event and logging management, including Security Information and Event Management (SIEM) technologies, vulnerability management, and patch management.

Part III: Cryptography

Chapter 6: Fundamentals of Cryptography and Public Key Infrastructure (PKI) covers the different hashing and encryption algorithms in the industry. It provides a comparison of symmetric and asymmetric encryption algorithms and an introduction of public key infrastructure (PKI), the operations of a PKI, and an overview of the IPsec, SSL, and TLS protocols.

Chapter 7: Introduction to Virtual Private Networks (VPNs) provides an introduction to remote access and site-to-site VPNs, different deployment scenarios, and the VPN solutions provided by Cisco.

Part IV: Host-based Analysis

Chapter 8: Windows-Based Analysis covers the basics of how a system running Windows handles applications. This includes details about how memory is used as well as how resources are processed by the operating system. These skills are essential for maximizing performance and securing a Windows system.

Chapter 9: Linux- and Mac OS X–Based Analysis covers how things work inside a UNIX environment. This includes process execution and event logging. Learning how the environment functions will not only improve your technical skills but can also be used to build a strategy for securing these systems.

Chapter 10: Endpoint Security Technologies covers the functionality of endpoint security technologies, including host-based intrusion detection, host-based firewalls, application-level whitelisting and blacklisting, as well as systems-based sandboxing.

Part V: Security Monitoring and Attack Methods

Chapter 11: Network and Host Telemetry covers the different types of data provided by network and host-based telemetry technologies, including NetFlow, traditional and next-generation firewalls, packet captures, application visibility and control, and web and email content filtering. It also provides an overview of how full packet captures, session data, transaction logs, and security alert data are used in security operations and security monitoring.

Chapter 12: Security Monitoring Operational Challenges covers the different operational challenges, including Tor, access control lists, tunneling, peer-to-peer (P2P) communication, encapsulation, load balancing, and other technologies.

Chapter 13: Types of Attacks and Vulnerabilities covers the different types of cyber security attacks and vulnerabilities and how they are carried out by threat actors nowadays.

Chapter 14: Security Evasion Techniques covers how attackers obtain stealth as well as the tricks used to negatively impact detection and forensic technologies. Topics include encryption, exhausting resources, fragmenting traffic, manipulating protocols, and pivoting within a compromised environment.

Part VI: Final Preparation

Chapter 15: Final Preparation identifies the tools for final exam preparation and helps you develop an effective study plan. It contains tips on how to best use the web-based material to study.

Part VII: Appendixes

Appendix A: Answers to the “Do I Know This Already?” Quizzes and Q&A Questions includes the answers to all the questions from Chapters 1 through 14.

Appendix B: Memory Tables (a website-only appendix) contains the key tables and lists from each chapter, with some of the contents removed. You can print this appendix and, as a memory exercise, complete the tables and lists. The goal is to help you memorize facts that can be useful on the exam. This appendix is available in PDF format at the book website; it is not in the printed book.

Appendix C: Memory Tables Answer Key (a website-only appendix) contains the answer key for the memory tables in Appendix B. This appendix is available in PDF format at the book website; it is not in the printed book.

Appendix D: Study Planner is a spreadsheet, available from the book website, with major study milestones, where you can track your progress throughout your study.

Companion Website

Register this book to get access to the Pearson Test Prep practice test software and other study materials, plus additional bonus content. Check this site regularly for new and updated postings written by the authors that provide further insight into the more troublesome topics on the exam. Be sure to check the box that you would like to hear from us to receive updates and exclusive discounts on future editions of this product or related products.

To access this companion website, follow these steps:

1. Go to www.pearsonITcertification.com/register and log in or create a new account.

2. Enter the ISBN 9781587147029.

3. Answer the challenge question as proof of purchase.

4. Click the “Access Bonus Content” link in the Registered Products section of your account page, to be taken to the page where your downloadable content is available.

Please note that many of our companion content files can be very large, especially image and video files.

If you are unable to locate the files for this title by following the steps, please visit www.pearsonITcertification.com/contact and select the “Site Problems/Comments” option. Our customer service representatives will assist you.

Pearson Test Prep Practice Test Software

As noted previously, this book comes complete with the Pearson Test Prep practice test software containing two full exams. These practice tests are available to you either online or as an offline Windows application. To access the practice exams that were developed with this book, please see the instructions in the card inserted in the sleeve in the back of the book. This card includes a unique access code that enables you to activate your exams in the Pearson Test Prep software.

Accessing the Pearson Test Prep Software Online

The online version of this software can be used on any device with a browser and connectivity to the Internet, including desktop machines, tablets, and smartphones. To start using your practice exams online, simply follow these steps:

1. Go to http://www.PearsonTestPrep.com.

2. Select Pearson IT Certification as your product group.

3. Enter your email/password for your account. If you don’t have an account on PearsonITCertification.com or CiscoPress.com, you will need to establish one by going to PearsonITCertification.com/join.

4. In the My Products tab, click the Activate New Product button.

5. Enter the access code printed on the insert card in the back of your book to activate your product.

6. The product will now be listed in your My Products page. Click the Exams button to launch the exam settings screen and start your exam.

Accessing the Pearson Test Prep Software Offline

If you wish to study offline, you can download and install the Windows version of the Pearson Test Prep software. There is a download link for this software on the book’s companion website, or you can just enter the following link in your browser:

http://www.pearsonitcertification.com/content/downloads/pcpt/engine.zip

To access the book’s companion website and the software, simply follow these steps:

1. Register your book by going to PearsonITCertification.com/register and entering the ISBN 9781587147029.

2. Respond to the challenge questions.

3. Go to your account page and select the Registered Products tab.

4. Click the Access Bonus Content link under the product listing.

5. Click the Install Pearson Test Prep Desktop Version link under the Practice Exams section of the page to download the software.

6. Once the software finishes downloading, unzip all the files on your computer.

7. Double-click the application file to start the installation, and follow the onscreen instructions to complete the registration.

8. Once the installation is complete, launch the application and select Activate Exam button on the My Products tab.

9. Click the Activate a Product button in the Activate Product Wizard.

10. Enter the unique access code found on the card in the sleeve in the back of your book and click the Activate button.

11. Click Next and then the Finish button to download the exam data to your application.

12. You can now start using the practice exams by selecting the product and clicking the Open Exam button to open the exam settings screen.

Note that the offline and online versions will synch together, so saved exams and grade results recorded on one version will be available to you on the other as well.

Customizing Your Exams

Once you are in the exam settings screen, you can choose to take exams in one of three modes:

Study mode

Practice Exam mode

Flash Card mode

Study mode allows you to fully customize your exams and review answers as you are taking the exam. This is typically the mode you would use first to assess your knowledge and identify information gaps. Practice Exam mode locks certain customization options, as it is presenting a realistic exam experience. Use this mode when you are preparing to test your exam readiness. Flash Card mode strips out the answers and presents you with only the question stem. This mode is great for late-stage preparation when you really want to challenge yourself to provide answers without the benefit of seeing multiple-choice options. This mode will not provide the detailed score reports that the other two modes will, so it should not be used if you are trying to identify knowledge gaps.

In addition to these three modes, you will be able to select the source of your questions. You can choose to take exams that cover all of the chapters or you can narrow your selection to just a single chapter or the chapters that make up a specific part in the book. All chapters are selected by default. If you want to narrow your focus to individual chapters, simply deselect all the chapters then select only those on which you wish to focus in the Objectives area.

You can also select the exam banks on which to focus. Each exam bank comes complete with a full exam of questions that cover topics in every chapter. The two exams printed in the book are available to you as well as two additional exams of unique questions. You can have the test engine serve up exams from all four banks or just from one individual bank by selecting the desired banks in the exam bank area.

There are several other customizations you can make to your exam from the exam settings screen, such as the time of the exam, the number of questions served up, whether to randomize questions and answers, whether to show the number of correct answers for multiple-answer questions, and whether to serve up only specific types of questions. You can also create custom test banks by selecting only questions that you have marked or questions on which you have added notes.

Updating Your Exams

If you are using the online version of the Pearson Test Prep software, you should always have access to the latest version of the software as well as the exam data. If you are using the Windows desktop version, every time you launch the software, it will check to see if there are any updates to your exam data and automatically download any changes that were made since the last time you used the software. This requires that you are connected to the Internet at the time you launch the software.

Sometimes, due to many factors, the exam data may not fully download when you activate your exam. If you find that figures or exhibits are missing, you may need to manually update your exam.

To update a particular exam you have already activated and downloaded, simply select the Tools tab and select the Update Products button. Again, this is only an issue with the desktop Windows application.

If you wish to check for updates to the Pearson Test Prep software, Windows desktop version, simply select the Tools tab and select the Update Application button. This will ensure you are running the latest version of the software engine.