CCNA Cyber Ops SECOPS 210-255 Official Cert Guide: (Certification Guide)

Modern organizations rely on Security Operations Center (SOC) teams to vigilantly watch security systems, rapidly detect breaches, and respond quickly and effectively. To succeed in these crucial tasks, SOCs desperately need more qualified cybersecurity professionals. Cisco's new CCNA Cyber Ops certification prepares candidates to begin a career working with associate-level cybersecurity analysts within SOCs. To earn this valuable certification, candidates must pass two exams. CCNA Cyber Ops SECOPS #210-255 Official Cert Guide is Cisco's official, comprehensive self-study resource for the second of these two exams.   Designed for all CCNA Cyber Ops candidates, it covers every SECOPS #210-255 objective concisely and logically, with extensive teaching features designed to promote retention and understanding. You'll find: Pre-chapter quizzes to assess knowledge upfront and focus your study more efficiently Foundation topics sections that explain concepts and configurations, and link theory to practice Key topics sections calling attention to every figure, table, and list you must know Exam Preparation sections with additional chapter review features Final preparation chapter providing tools and a complete final study plan A customizable practice test library This guide offers comprehensive, up-to-date coverage of all SECOPS #210-255 topics related to: Endpoint threat analysis and computer forensics Network intrusion analysis Incident response Data and event analysis Incident handling

Table of Contents:
Introduction xvii Part I Threat Analysis and Computer Forensics Chapter 1 Threat Analysis 3 “Do I Know This Already?” Quiz 3 Foundation Topics 6 What Is the CIA Triad: Confidentiality, Integrity, and Availability? 6 Confidentiality 6 Integrity 7 Availability 7 Threat Modeling 8 Defining and Analyzing the Attack Vector 10 Understanding the Attack Complexity 12 Privileges and User Interaction 12 The Attack Scope 13 Exam Preparation Tasks 14 Review All Key Topics 14 Complete Tables and Lists from Memory 14 Define Key Terms 14 Q&A 15 Chapter 2 Forensics 17 “Do I Know This Already?” Quiz 17 Foundation Topics 20 Introduction to Cybersecurity Forensics 20 The Role of Attribution in a Cybersecurity Investigation 21 The Use of Digital Evidence 21 Defining Digital Forensic Evidence 22 Understanding Best, Corroborating, and Indirect or Circumstantial Evidence 22 Collecting Evidence from Endpoints and Servers 22 Collecting Evidence from Mobile Devices 24 Collecting Evidence from Network Infrastructure Devices 24 Chain of Custody 26 Fundamentals of Microsoft Windows Forensics 28 Processes, Threads, and Services 28 Memory Management 30 Windows Registry 32 The Windows File System 34 FAT 35 NTFS 36 Fundamentals of Linux Forensics 37 Linux Processes 37 Ext4 40 Journaling 41 Linux MBR and Swap File System 41 Exam Preparation Tasks 43 Review All Key Topics 43 Define Key Terms 44 Q&A 44 Part II Network Intrusion Analysis Chapter 3 Fundamentals of Intrusion Analysis 49 “Do I Know This Already?” Quiz 49 Foundation Topics 52 Common Artifact Elements and Sources of Security Events 52 False Positives, False Negatives, True Positives, and True Negatives 58 Understanding Regular Expressions 58 Protocols, Protocol Headers, and Intrusion Analysis 61 Using Packet Captures for Intrusion Analysis 61 Mapping Security Event Types to Source Technologies 66 Exam Preparation Tasks 71 Review All Key Topics 71 Complete Tables and Lists from Memory 71 Define Key Terms 71 Q&A 72 Chapter 4 NetFlow for Cybersecurity 75 “Do I Know This Already?” Quiz 75 Foundation Topics 78 Introduction to NetFlow 78 What Is a Flow in NetFlow? 78 The NetFlow Cache 80 NetFlow Versions 81 Cisco Flexible NetFlow 96 Flexible NetFlow Records 97 Flow Monitors 102 Flow Exporters 102 Flow Samplers 102 Flexible NetFlow Configuration 102 Configure a Flow Record 103 Configuring a Flow Monitor for IPv4 or IPv6 105 Configuring a Flow Exporter for the Flow Monitor 107 Applying a Flow Monitor to an Interface 109 IPFIX 110 IPFIX Architecture 111 IPFIX Mediators 111 IPFIX Templates 111 Option Templates 112 Introduction to the Stream Control Transmission Protocol (SCTP) 112 NetFlow and IPFIX Comparison 113 NetFlow for Cybersecurity and Incident Response 113 NetFlow as an Anomaly Detection Tool 113 Incident Response and Network Security Forensics 114 Using NetFlow for Data Leak Detection and Prevention 119 NetFlow Analysis Tools 125 Commercial NetFlow Analysis Tools 125 Cisco’s Lancope StealthWatch Solution 126 Plixer’s Scrutinizer 129 Open Source NetFlow Monitoring and Analysis Software Packages 129 Exam Preparation Tasks 136 Review All Key Topics 136 Define Key Terms 136 Q&A 136 Part III Incident Response Chapter 5 Introduction to Incident Response and the Incident Handling Process 141 “Do I Know This Already?” Quiz 141 Foundation Topics 144 Introduction to Incident Response 144 What Are Events and Incidents? 144 The Incident Response Plan 145 The Incident Response Process 146 The Preparation Phase 146 The Detection and Analysis Phase 146 Containment, Eradication, and Recovery 147 Post-Incident Activity (Postmortem) 148 Information Sharing and Coordination 148 Incident Response Team Structure 148 The Vocabulary for Event Recording and Incident Sharing (VERIS) 149 Exam Preparation Tasks 153 Review All Key Topics 153 Complete Tables and Lists from Memory 153 Define Key Terms 153 Q&A 153 Chapter 6 Incident Response Teams 157 “Do I Know This Already?” Quiz 157 Foundation Topics 159 Computer Security Incident Response Teams (CSIRTs) 159 Product Security Incident Response Teams (PSIRTs) 161 Security Vulnerabilities and Their Severity 161 Vulnerability Chaining Role in Fixing Prioritization 164 Fixing Theoretical Vulnerabilities 164 Internally Versus Externally Found Vulnerabilities 165 National CSIRTs and Computer Emergency Response Teams (CERTs) 166 Coordination Centers 166 Incident Response Providers and Managed Security Service Providers (MSSPs) 167 Exam Preparation Tasks 168 Review All Key Topics 168 Define Key Terms 168 Q&A 168 Chapter 7 Compliance Frameworks 171 “Do I Know This Already?” Quiz 172 Foundation Topics 175 Payment Card Industry Data Security Standard (PCI DSS) 175 PCI DSS Data 175 Health Insurance Portability and Accountability Act (HIPAA) 185 HIPAA Security Rule 186 HIPAA Safeguards 187 Sarbanes-Oxley (SOX) 189 Section 302 190 Section 404 190 Section 409 190 Summary 192 References 192 Exam Preparation Tasks 193 Review All Key Topics 193 Complete Tables and Lists from Memory 193 Define Key Terms 193 Review Questions 194 Chapter 8 Network and Host Profiling 197 “Do I Know This Already?” Quiz 197 Foundation Topics 200 Network Profiling 200 Throughput 200 Used Ports 206 Session Duration 211 Critical Asset Address Space 212 Host Profiling 215 Listening Ports 216 Logged-in Users/Service Accounts 220 Running Processes 223 Applications 226 Summary 229 References 230 Exam Preparation Tasks 231 Review All Key Topics 231 Define Key Terms 231 Q&A 231 Part IV Data and Event Analysis Chapter 9 The Art of Data and Event Analysis 235 “Do I Know This Already?” Quiz 235 Foundation Topics 238 Normalizing Data 238 Interpreting Common Data Values into a Universal Format 238 Using the 5-Tuple Correlation to Respond to Security Incidents 239 Retrospective Analysis and Identifying Malicious Files 241 Identifying a Malicious File 241 Mapping Threat Intelligence with DNS and Other Artifacts 242 Deterministic Versus Probabilistic Analysis 242 Exam Preparation Tasks 244 Review All Key Topics 244 Complete Tables and Lists from Memory 244 Define Key Terms 244 Q&A 245 Part V Incident Handling Chapter 10 Intrusion Event Categories 247 “Do I Know This Already?” Quiz 247 Foundation Topics 250 Diamond Model of Intrusion 250 Cyber Kill Chain Model 254 Reconnaissance 256 Weaponization 259 Delivery 260 Exploitation 261 Installation 263 Command and Control 264 Action and Objectives 265 Summary 269 References 269 Exam Preparation Tasks 271 Review All Key Topics 271 Define Key Terms 271 Q&A 271 Part VI Final Preparation Chapter 11 Final Preparation 275 Tools for Final Preparation 275 Pearson Cert Practice Test Engine and Questions on the Website 275 Customizing Your Exams 277 Updating Your Exams 277 The Cisco Learning Network 278 Memory Tables and Lists 278 Chapter-Ending Review Tools 279 Suggested Plan for Final Review/Study 279 Summary 279 Part VII Appendix Appendix A Answers to the “Do I Know This Already?” Quizzes and Q&A 281 Glossary 295 Elements Available on the Book Website Appendix B Memory Tables and Lists Appendix C Memory Tables and Lists Answers Appendix D Study Planner 9781587147036, TOC, 5/4/2017

About the Author :
Omar Santos is an active member of the cybersecurity community, where he leads several industry-wide initiatives and standards bodies. His active role helps businesses, academic institutions, state and local law enforcement agencies, and other participants dedicated to increasing the security of their critical infrastructures. Omar is the author of more than a dozen books and video courses, as well as numerous white papers, articles, and security configuration guidelines and best practices. Omar is a principal engineer of the Cisco Product Security Incident Response Team (PSIRT), where he mentors and leads engineers and incident managers during the investigation and resolution of cybersecurity vulnerabilities. Additional information about Omar’s current projects can be found at omarsantos.io, and you can follow Omar on Twitter @santosomar. Joseph Muniz is an architect at Cisco Systems and security researcher. He has extensive experience in designing security solutions and architectures for the top Fortune 500 corporations and the U.S. government. Joseph’s current role gives him visibility into the latest trends in cybersecurity, from both leading vendors and customers. Examples of Joseph’s research include his RSA talk titled “Social Media Deception,” which has been quoted by many sources (search for “Emily Williams Social Engineering”), as well as his articles in PenTest Magazine regarding various security topics. Joseph runs The Security Blogger website, a popular resource for security, hacking, and product implementation. He is the author and contributor of several publications covering various penetration testing and security topics. You can follow Joseph at www.thesecurityblogger.com and @SecureBlogger.