Computer certification: Cisco Books

Book SynopsisAnthony Bruno, CCIE No. 2738, is an architect and technical resource manager with British Telecom (BT) with more than 27 years of experience in the internetworking field. Previously, he worked for International Network Services (INS) and Lucent Technologies, and he was a captain in the U.S. Air Force. He has consulted for many enterprise and service provider customers in the design, implementation, and optimization of large scale networks. Anthony leads architecture and design teams in building next-generation networks for customers. Anthony completed a master of science degree in electrical engineering at the University of MissouriRolla in 1994 and a bachelor of science in electrical engineering at the University of Puerto RicoMayaguez in 1990. For the past 20 years, he has coauthored five editions of the CCDA Official Cert Guide for Cisco Press. Outside work, Anthony enjoys running marathons and Spartan obstacle races, and he has finished seven Ironman distance triathlons. He is also an avid genealogist and ancestry tree researcher. Anthony also enjoys piloting his Mavic Pro drone during trips. Steve Jordan, CCIE No. 11293, is a Principal Architect with J. Network Architects and has 23 years of experience in the field of internetworking. For the last 13 years, Steve has specialized in data center and network security architectures involving compute, network, security,storage, and virtualization. Over the years, Steve has consulted with many enterprise and service provider customers in both pre-sales and post-sales engineering and architecture roles, along with working at several Cisco Gold Partners. He has extensive experience in data center and security architecture design and has implemented solutions in many financial, energy, retail, healthcare,education, and telecommunications industries. Steve is a 15-Year triple CCIE in the tracks of Routing & Switching, Storage Networking, and Data Center. His other certifications include CCNA, CCNP Enterprise, VMware VCIX6-NV, and VCP6-NV. Steve lives in Houston, Texas; and when he is not working on technology, Steve can be found traveling to new places, home brewing, and trading stocks. For the past 14 years, Steve was also the coauthor for three editions of the CCDA Official Cert Guide.

Read more less

Book SynopsisCisco Networking Academy teaches hundreds of thousands of students annually the skills needed to build, design, and maintain networks, improving their career prospects while filling the global demand for networking professionals. With 10,000 academies in 165 countries, it helps individuals prepare for industry-recognized certifications and entry-level information and communication technology careers in virtually every industrydeveloping foundational technical skills while acquiring vital 21st-century career skills in problem solving, collaboration, and critical thinking. Cisco Networking Academy uses a public-private partnership model to create the world's largest classroom.

Read more less

Book SynopsisAllan Johnson entered the academic world in 1999 after 10 years as a business owner/operator to dedicate his efforts to his passion for teaching. He holds both an MBA and an M.Ed in occupational training and development. He taught a variety of technology courses to high school students and is an adjunct instructor at Del Mar College. Since 2006, Allan has worked full time for Cisco Networking Academy in several roles. He is currently engaged as Curriculum Lead. Cisco Networking Academy isan innovative Cisco education initiative that delivers information andcommunication technology skills to improve career and economic opportunitiesaround the world. The Academy provides online courses, interactive tools, andlab activities to prepare individuals for information technology and networkingcareers in virtually every industry.Table of Contents Introduction xxx Chapter 1 Networking Today 1 Networks Affect Our Lives 2 Network Components 2 Network Representations and Topologies 4 Common Types of Networks 5 Internet Connections 6 Reliable Networks 8 Network Trends 9 Network Security 11 The IT Professional 12 1.5.7 Packet Tracer—Network Representation 13 1.9.3 Lab—Research IT and Networking Job Opportunities 16 Chapter 2 Basic Switch and End Device Configuration 19 Cisco IOS Access 20 IOS Navigation 21 The Command Structure 23 Basic Device Configuration 25 Save Configurations 27 Ports and Addresses 27 Configure IP Addressing 28 Verify Connectivity 30 Command Reference 32 2.3.7 Packet Tracer—Navigate the IOS 33 2.3.8 Lab—Navigate the IOS by Using Tera Term for Console Connectivity 38 2.5.5 Packet Tracer—Configure Initial Switch Settings 45 2.7.6 Packet Tracer—Implement Basic Connectivity 50 2.9.1 Packet Tracer—Basic Switch and End Device Configuration 53 2.9.2 Lab—Basic Switch and End Device Configuration 55 Chapter 3 Protocols and Models 59 The Rules 60 Protocols 61 Protocol Suites 63 Standards Organizations 66 Reference Models 68 Data Encapsulation 69 Data Access 71 3.0.3 Class Activity—Design a Communications System 73 3.4.4 Lab—Research Networking Standards 74 3.5.5 Packet Tracer—Investigate the TCP/IP and OSI Models in Action 77 3.7.9 Lab—Install Wireshark 82 3.7.10 Lab—Use Wireshark to View Network Traffic 84 Chapter 4 Physical Layer 91 Purpose of the Physical Layer 92 Physical Layer Characteristics 92 Copper Cabling 94 UTP Cabling 96 Fiber-Optic Cabling 97 Wireless Media 99 4.6.5 Packet Tracer—Connect a Wired and Wireless LAN 101 4.6.6 Lab—View Wired and Wireless NIC Information 105 4.7.1 Packet Tracer—Connect the Physical Layer 109 Chapter 5 Number Systems 115 Binary Number System 116 Hexadecimal Number System 118 Chapter 6 Data Link Layer 123 Purpose of the Data Link Layer 124 Topologies 126 Data Link Frame 128 Chapter 7 Ethernet Switching 131 Ethernet Frames 132 Ethernet MAC Address 134 The MAC Address Table 135 Switch Speeds and Forwarding Methods 140 7.1.6 Lab—Use Wireshark to Examine Ethernet Frames 142 7.2.7 Lab—View Network Device MAC Addresses 149 7.3.7 Lab—View the Switch MAC Address Table 155 Chapter 8 Network Layer 159 Network Layer Characteristics 160 IPv4 Packet 161 IPv6 Packet 163 How a Host Routes 164 Introduction to Routing 166 Chapter 9 Address Resolution 171 MAC and IP 172 ARP 173 IPv6 Neighbor Discovery 175 9.1.3 Packet Tracer—Identify MAC and IP Addresses 177 9.2.9 Packet Tracer—Examine the ARP Table 181 9.3.4 Packet Tracer—IPv6 Neighbor Discovery 185 Chapter 10 Basic Router Configuration 191 Configure Initial Router Settings 192 Configure Interfaces 194 Configure the Default Gateway 196 Command Reference 197 10.1.4 Packet Tracer—Configure Initial Router Settings 198 10.3.4 Packet Tracer—Connect a Router to a LAN 202 10.3.5 Packet Tracer—Troubleshoot Default Gateway Issues 207 10.4.3 Packet Tracer—Basic Device Configuration 210 10.4.4 Lab—Build a Switch and Router Network 212 Chapter 11 IPv4 Addressing 219 IPv4 Address Structure 220 IPv4 Unicast, Broadcast, and Multicast 224 Types of IPv4 Addresses 224 Network Segmentation 226 Subnet an IPv4 Network 227 VLSM Addressing Schemes 231 11.5.5 Packet Tracer—Subnet an IPv4 Network 236 11.6.6 Lab—Calculate IPv4 Subnets 241 11.7.5 Packet Tracer—Subnetting Scenario 245 11.9.3 Packet Tracer—VLSM Design and Implementation Practice 249 11.10.1 Packet Tracer—Design and Implement a VLSM Addressing Scheme 253 11.10.2 Lab—Design and Implement a VLSM Addressing Scheme 255 Chapter 12 IPv6 Addressing 261 IPv4 Issues 262 IPv6 Address Representation 263 IPv6 Address Types 263 GUA and LLA Static Configuration 265 Dynamic Addressing for IPv6 GUAs 267 Dynamic Addressing for IPv6 LLAs 272 IPv6 Multicast Addresses 272 Subnet an IPv6 Network 272 12.6.6 Packet Tracer—Configure IPv6 Addressing 276 12.7.4 Lab—Identify IPv6 Addresses 280 12.9.1 Packet Tracer—Implement a Subnetted IPv6 Addressing Scheme 284 12.9.2 Lab—Configure IPv6 Addresses on Network Devices 286 Chapter 13 ICMP 291 ICMP Messages 292 Ping and Traceroute Tests 296 Command Reference 297 13.2.6 Packet Tracer—Verify IPv4 and IPv6 Addressing 297 13.2.7 Packet Tracer—Use Ping and Traceroute to Test Network Connectivity 301 13.3.1 Packet Tracer—Use ICMP to Test and Correct Network Connectivity 305 13.3.2 Lab—Use Ping and Traceroute to Test Network Connectivity 307 Chapter 14 Transport Layer 319 Transportation of Data 320 TCP Overview 322 UDP Overview 325 Port Numbers 327 TCP Communication Process 329 Reliability and Flow Control 332 UDP Communication 334 Command Reference 336 14.8.1 Packet Tracer—TCP and UDP Communications 336 Chapter 15 Application Layer 343 Application, Presentation, and Session 344 Application Layer 344 Peer-to-Peer 346 Web and Email Protocols 347 IP Addressing Services 349 File Sharing Services 353 Command Reference 355 15.4.8 Lab—Observe DNS Resolution 355 Chapter 16 Network Security Fundamentals 359 Security Threats and Vulnerabilities 360 Network Attacks 361 Network Attack Mitigation 364 Device Security 366 Command Reference 368 16.2.6 Lab—Research Network Security Threats 368 16.4.6 Packet Tracer—Configure Secure Passwords and SSH 372 16.4.7 Lab—Configure Network Devices with SSH 375 16.5.1 Packet Tracer—Secure Network Devices 381 16.5.1 Lab—Secure Network Devices 383 Chapter 17 Build a Small Network 389 Devices in a Small Network 390 Small Network Applications and Protocols 392 Scale to Larger Networks 394 Verify Connectivity 395 Host and IOS Commands 397 Troubleshooting Methodologies 402 Troubleshooting Scenarios 403 Command Reference 405 17.4.6 Lab—Test Network Latency with Ping and Traceroute 406 17.5.9 Packet Tracer—Interpret show Command Output 411 17.7.6 Lab—Troubleshoot Connectivity Issues 413 17.7.7 Packet Tracer—Troubleshoot Connectivity Issues 418 17.8.1 Lab—Design and Build a Small Network 422 17.8.2 Packet Tracer—Skills Integration Challenge 423 17.8.3 Packet Tracer—Troubleshooting Challenge 426

Read more less

Book SynopsisCisco Networking Academy teaches hundreds of thousands of students annually the skills needed to build, design, and maintain networks, improving their career prospects while filling the global demand for networking professionals. With 10,000 academies in 165 countries, it helps individuals prepare for industry-recognized certifications and entry-level information and communication technology careers in virtually every industrydeveloping foundational technical skills while acquiring vital 21st-century career skills in problem solving, collaboration, and critical thinking. Cisco Networking Academy uses a public-private partnership model to create the world's largest classroom.Table of ContentsIntroduction xxx Chapter 1 Single-Area OSPFv2 Concepts 1 Introduction - 1.0 1 Why should I take this module? - 1.0.1 1 What will I learn to do in this module? - 1.0.2 1 OSPF Features and Characteristics - 1.1 1 Introduction to OSPF - 1.1.1 1 Components of OSPF - 1.1.2 2 Link-State Operation - 1.1.3 3 Single-Area and Multiarea OSPF - 1.1.4 4 Multiarea OSPF - 1.1.5 4 OSPFv3 - 1.1.6 5 Check Your Understanding - OSPF Features and Characteristics - 1.1.7 6 OSPF Packets - 1.2 6 Video - OSPF Packets - 1.2.1 6 Types of OSPF Packets - 1.2.2 6 Link-State Updates - 1.2.3 7 Hello Packet - 1.2.4 7 Check Your Understanding - OSPF Packets - 1.2.5 7 OSPF Operation - 1.3 7 Video - OSPF Operation - 1.3.1 7 OSPF Operational States - 1.3.2 7 Establish Neighbor Adjacencies - 1.3.3 8 Synchronizing OSPF Databases - 1.3.4 9 The Need for a DR - 1.3.5 10 LSA Flooding With a DR - 1.3.6 11 Check Your Understanding - OPSF Operation - 1.3.7 11 Module Practice and Quiz - 1.4 11 What did I learn in this module? - 1.4.1 11 Chapter Quiz - Single-Area OSPFv2 Concepts 14 Your Chapter Notes 14 Chapter 2 Single-Area OSPFv2 Configuration 15 Introduction - 2.0 15 Why should I take this module? - 2.0.1 15 What will I learn to do in this module? - 2.0.2 15 OSPF Router ID - 2.1 15 OSPF Reference Topology - 2.1.1 15 Router Configuration Mode for OSPF - 2.1.2 16 Router IDs - 2.1.3 16 Router ID Order of Precedence - 2.1.4 17 Configure a Loopback Interface as the Router ID - 2.1.5 17 Explicitly Configure a Router ID - 2.1.6 18 Modify a Router ID - 2.1.7 18 Syntax Checker - Configure R2 and R3 Router IDs - 2.1.8 19 Check Your Understanding - OSPF Router ID - 2.1.9 19 Point-to-Point OSPF Networks - 2.2 20 The network Command Syntax - 2.2.1 20 The Wildcard Mask - 2.2.2 20 Check Your Understanding - The Wildcard Masks - 2.2.3 20 Configure OSPF Using the network Command - 2.2.4 20 Syntax Checker - Configure R2 and R3 Using the network Command - 2.2.5 21 Configure OSPF Using the ip ospf Command - 2.2.6 21 Syntax Checker - Configure R2 and R3 Using the ip ospf Command - 2.2.7 22 Passive Interface - 2.2.8 22 Configure Passive Interfaces - 2.2.9 23 Syntax Checker - Configure R2 and R3 Passive Interfaces - 2.2.10 24 OSPF Point-to-Point Networks - 2.2.11 24 Loopbacks and Point-to-Point Networks - 2.2.12 26 Packet Tracer - Point-to-Point Single-Area OSPFv2 Configuration - 2.2.13 26 Multiaccess OSPF Networks - 2.3 27 OSPF Network Types - 2.3.1 27 OSPF Designated Router - 2.3.2 27 OSPF Multiaccess Reference Topology - 2.3.3 27 Verify OSPF Router Roles - 2.3.4 28 Verify DR/BDR Adjacencies - 2.3.5 30 Default DR/BDR Election Process - 2.3.6 32 DR Failure and Recovery - 2.3.7 33 The ip ospf priority Command - 2.3.8 33 Configure OSPF Priority - 2.3.9 34 Syntax Checker - Configure OSPF Priority - 2.3.10 35 Packet Tracer - Determine the DR and BDR - 2.3.11 35 Modify Single-Area OSPFv2 - 2.4 36 Cisco OSPF Cost Metric - 2.4.1 36 Adjust the Reference Bandwidth - 2.4.2 36 OSPF Accumulates Costs - 2.4.3 38 Manually Set OSPF Cost Value - 2.4.4 38 Test Failover to Backup Route - 2.4.5 39 Syntax Checker - Modify the Cost Values for R2 and R3 - 2.4.6 40 Hello Packet Intervals - 2.4.7 40 Verify Hello and Dead Intervals - 2.4.8 40 Modify OSPFv2 Intervals - 2.4.9 42 Syntax Checker - Modifying Hello and Dead Intervals on R3 - 2.4.10 43 Packet Tracer - Modify Single-Area OSPFv2 - 2.4.11 43 Default Route Propagation - 2.5 43 Propagate a Default Static Route in OSPFv2 - 2.5.1 43 Verify the Propagated Default Route - 2.5.2 44 Packet Tracer - Propagate a Default Route in OSPFv2 - 2.5.3 46 Verify Single-Area OSPFv2 - 2.6 46 Verify OSPF Neighbors - 2.6.1 46 Verify OSPF Protocol Settings - 2.6.2 48 Verify OSPF Process Information - 2.6.3 48 Verify OSPF Interface Settings - 2.6.4 50 Syntax Checker - Verify Single-Area OSPFv2 - 2.6.5 51 Packet Tracer - Verify Single-Area OSPFv2 - 2.6.6 51 Module Practice and Quiz - 2.7 51 Packet Tracer - Single-Area OSPFv2 Configuration - 2.7.1 51 Lab - Single-Area OSPFv2 Configuration - 2.7.2 51 What did I learn in this module? - 2.7.3 52 Chapter Quiz - Single-Area OSPFv2 Configuration 56 Your Chapter Notes 56 Chapter 3 Network Security Concepts 57 Introduction - 3.0 57 Why should I take this module? - 3.0.1 57 What will I learn in this module? - 3.0.2 57 Ethical Hacking Statement - 3.0.3 57 Current State of Cybersecurity - 3.1 58 Current State of Affairs - 3.1.1 58 Vectors of Network Attacks - 3.1.2 58 Data Loss - 3.1.3 59 Check Your Understanding - Current State of Cybersecurity - 3.1.4 60 Threat Actors - 3.2 60 The Hacker - 3.2.1 60 Evolution of Hackers - 3.2.2 61 Cyber Criminals - 3.2.3 61 Hacktivists - 3.2.4 61 State-Sponsored Hackers - 3.2.5 61 Check Your Understanding - Threat Actors - 3.2.6 62 Threat Actor Tools - 3.3 62 Video - Threat Actor Tools - 3.3.1 62 Introduction to Attack Tools - 3.3.2 62 Evolution of Security Tools - 3.3.3 62 Attack Types - 3.3.4 63 Check Your Understanding - Threat Actor Tools - 3.3.5 64 Malware - 3.4 64 Overview of Malware - 3.4.1 64 Viruses and Trojan Horses - 3.4.2 64 Other Types of Malware - 3.4.3 65 Check Your Understanding - Malware - 3.4.4 66 Common Network Attacks - 3.5 66 Overview of Network Attacks - 3.5.1 66 Video - Reconnaissance Attacks - 3.5.2 67 Reconnaissance Attacks - 3.5.3 67 Video - Access and Social Engineering Attacks - 3.5.4 68 Access Attacks - 3.5.5 68 Social Engineering Attacks - 3.5.6 69 Lab - Social Engineering - 3.5.7 70 Video - Denial of Service Attacks - 3.5.8 70 DoS and DDoS Attacks - 3.5.9 70 Check Your Understanding - Common Network Attacks - 3.5.10 71 IP Vulnerabilities and Threats - 3.6 71 Video - Common IP and ICMP Attacks - 3.6.1 71 IPv4 and IPv6 - 3.6.2 71 ICMP Attacks - 3.6.3 71 Video - Amplification, Reflection, and Spoofing Attacks - 3.6.4 72 Amplification and Reflection Attacks - 3.6.5 72 Address Spoofing Attacks - 3.6.6 72 Check Your Understanding - IP Vulnerabilities and Threats - 3.6.7 73 TCP and UDP Vulnerabilities - 3.7 73 TCP Segment Header - 3.7.1 73 TCP Services - 3.7.2 73 TCP Attacks - 3.7.3 74 UDP Segment Header and Operation - 3.7.4 74 UDP Attacks - 3.7.5 75 Check Your Understanding - TCP and UDP Vulnerabilities - 3.7.6 75 IP Services - 3.8 75 ARP Vulnerabilities - 3.8.1 75 ARP Cache Poisoning - 3.8.2 76 Video - ARP Spoofing - 3.8.3 76 DNS Attacks - 3.8.4 76 DNS Tunneling - 3.8.5 78 DHCP - 3.8.6 78 DHCP Attacks - 3.8.7 78 Lab - Explore DNS Traffic - 3.8.8 79 Network Security Best Practices - 3.9 80 Confidentiality, Integrity, and Availability - 3.9.1 80 The Defense-in-Depth Approach - 3.9.2 80 Firewalls - 3.9.3 80 IPS - 3.9.4 81 Content Security Appliances - 3.9.5 81 Check Your Understanding - Network Security Best Practices - 3.9.6 82 Cryptography - 3.10 82 Video - Cryptography - 3.10.1 82 Securing Communications - 3.10.2 82 Data Integrity - 3.10.3 83 Hash Functions - 3.10.4 83 Origin Authentication - 3.10.5 84 Data Confidentiality - 3.10.6 85 Symmetric Encryption - 3.10.7 85 Asymmetric Encryption - 3.10.8 86 Diffie-Hellman - 3.10.9 87 Check Your Understanding - Cryptography - 3.10.10 88 Module Practice and Quiz - 3.11 88 What did I learn in this module? - 3.11.1 88 Chapter Quiz - Network Security Concepts 91 Your Chapter Notes 91 Chapter 4 ACL Concepts 93 Introduction - 4.0 93 Why should I take this module? - 4.0.1 93 What will I learn to do in this module? - 4.0.2 93 Purpose of ACLs - 4.1 93 What is an ACL? - 4.1.1 93 Packet Filtering - 4.1.2 95 ACL Operation - 4.1.3 95 Packet Tracer - ACL Demonstration - 4.1.4 96 Check Your Understanding - Purpose of ACLs - 4.1.5 96 Wildcard Masks in ACLs - 4.2 96 Wildcard Mask Overview - 4.2.1 96 Wildcard Mask Types - 4.2.2 97 Wildcard Mask Calculation - 4.2.3 97 Wildcard Mask Keywords - 4.2.4 98 Check Your Understanding - Wildcard Masks in ACLs - 4.2.5 99 Guidelines for ACL Creation - 4.3 99 Limited Number of ACLs per Interface - 4.3.1 99 ACL Best Practices - 4.3.2 99 Check Your Understanding - Guidelines for ACL Creation - 4.3.3 100 Types of IPv4 ACLs - 4.4 100 Standard and Extended ACLs - 4.4.1 100 Numbered and Named ACLs - 4.4.2 101 Where to Place ACLs - 4.4.3 102 Standard ACL Placement Example - 4.4.4 102 Extended ACL Placement Example - 4.4.5 103 Check Your Understanding - Guidelines for ACL Placement - 4.4.6 103 Module Practice and Quiz - 4.5 103 What did I learn in this module? - 4.5.1 103 Chapter Quiz - ACL Concepts 106 Your Chapter Notes 106 Chapter 5 ACLs for IPv4 Configuration 107 Introduction - 5.0 107 Why should I take this module? - 5.0.1 107 What will I learn to do in this module? - 5.0.2 107 Configure Standard IPv4 ACLs - 5.1 107 Create an ACL - 5.1.1 107 Numbered Standard IPv4 ACL Syntax - 5.1.2 108 Named Standard IPv4 ACL Syntax - 5.1.3 109 Apply a Standard IPv4 ACL - 5.1.4 109 Numbered Standard IPv4 ACL Example - 5.1.5 110 Named Standard IPv4 ACL Example - 5.1.6 111 Syntax Check - Configure Standard IPv4 ACLs - 5.1.7 112 Packet Tracer - Configure Numbered Standard IPv4 ACLs - 5.1.8 113 Packet Tracer - Configure Named Standard IPv4 ACLs - 5.1.9 113 Modify IPv4 ACLs - 5.2 113 Two Methods to Modify an ACL - 5.2.1 113 Text Editor Method - 5.2.2 113 Sequence Numbers Method - 5.2.3 114 Modify a Named ACL Example - 5.2.4 115 ACL Statistics - 5.2.5 116 Syntax Checker - Modify IPv4 ACLs - 5.2.6 116 Packet Tracer - Configure and Modify Standard IPv4 ACLs - 5.2.7 116 Secure VTY Ports with a Standard IPv4 ACL - 5.3 116 The access-class Command - 5.3.1 116 Secure VTY Access Example - 5.3.2 117 Verify the VTY Port is Secured - 5.3.3 118 Syntax Checker - Secure the VTY Ports - 5.3.4 118 Configure Extended IPv4 ACLs - 5.4 119 Extended ACLs - 5.4.1 119 Numbered Extended IPv4 ACL Syntax - 5.4.2 119 Protocols and Ports - 5.4.3 120 Protocols and Port Numbers Configuration Examples - 5.4.4 123 Apply a Numbered Extended IPv4 ACL - 5.4.5 123 TCP Established Extended ACL - 5.4.6 123 Named Extended IPv4 ACL Syntax - 5.4.7 124 Named Extended IPv4 ACL Example - 5.4.8 125 Edit Extended ACLs - 5.4.9 126 Another Named Extended IPv4 ACL Example - 5.4.10 127 Verify Extended ACLs - 5.4.11 128 Packet Tracer - Configure Extended IPv4 ACLs - Scenario 1 - 5.4.12 130 Packet Tracer - Configure Extended IPv4 ACLs - Scenario 2 - 5.4.13 130 Module Practice and Quiz - 5.5 130 Packet Tracer - IPv4 ACL Implementation Challenge - 5.5.1 130 Lab - Configure and Verify Extended IPv4 ACLs - 5.5.2 131 What did I learn in this module? - 5.5.3 131 Chapter Quiz - ACLs for IPv4 Implementation 133 Your Chapter Notes 133 Chapter 6 NAT for IPv4 135 Introduction - 6.0 135 Why should I take this module? - 6.0.1 135 What will I learn to do in this module? - 6.0.2 135 NAT Characteristics - 6.1 135 IPv4 Private Address Space - 6.1.1 135 What is NAT - 6.1.2 136 How NAT Works - 6.1.3 137 NAT Terminology - 6.1.4 137 Check Your Understanding - NAT Characteristics - 6.1.5 138 Types of NAT - 6.2 139 Static NAT - 6.2.1 139 Dynamic NAT - 6.2.2 139 Port Address Translation - 6.2.3 139 Next Available Port - 6.2.4 140 NAT and PAT Comparison - 6.2.5 140 Packets without a Layer 4 Segment - 6.2.6 141 Packet Tracer - Investigate NAT Operations - 6.2.7 141 NAT Advantages and Disadvantages - 6.3 142 Advantages of NAT - 6.3.1 142 Disadvantages of NAT - 6.3.2 142 Check Your Understanding - NAT Advantages and Disadvantages - 6.3.3 143 Static NAT - 6.4 143 Static NAT Scenario - 6.4.1 143 Configure Static NAT - 6.4.2 143 Analyze Static NAT - 6.4.3 144 Verify Static NAT - 6.4.4 144 Packet Tracer - Configure Static NAT - 6.4.5 145 Dynamic NAT - 6.5 146 Dynamic NAT Scenario - 6.5.1 146 Configure Dynamic NAT - 6.5.2 146 Analyze Dynamic NAT - Inside to Outside - 6.5.3 147 Analyze Dynamic NAT - Outside to Inside - 6.5.4 147 Verify Dynamic NAT - 6.5.5 148 Packet Tracer - Configure Dynamic NAT - 6.5.6 150 PAT - 6.6 150 PAT Scenario - 6.6.1 150 Configure PAT to Use a Single IPv4 Address - 6.6.2 150 Configure PAT to Use an Address Pool - 6.6.3 151 Analyze PAT - PC to Server - 6.6.4 151 Analyze PAT - Server to PC - 6.6.5 151 Verify PAT - 6.6.6 151 Packet Tracer - Configure PAT - 6.6.7 152 NAT64 - 6.7 153 NAT for IPv6? - 6.7.1 153 NAT64 - 6.7.2 153 Module Practice and Quiz - 6.8 153 Packet Tracer - Configure NAT for IPv4 - 6.8.1 153 Lab - Configure NAT for IPv4 - 6.8.2 154 What did I learn in this module? - 6.8.3 154 Chapter Quiz - NAT for IPv4 158 Your Chapter Notes 158 Chapter 7 WAN Concepts 159 Introduction - 7.0 159 Why should I take this module? - 7.0.1 159 What will I learn to do in this module? - 7.0.2 159 Purpose of WANs - 7.1 159 LANs and WANs - 7.1.1 159 Private and Public WANs - 7.1.2 160 WAN Topologies - 7.1.3 160 Carrier Connections - 7.1.4 162 Evolving Networks - 7.1.5 162 Check Your Understanding - Purpose of WANs - 7.1.6 164 WAN Operations - 7.2 164 WAN Standards - 7.2.1 164 WANs in the OSI Model - 7.2.2 164 Common WAN Terminology - 7.2.3 165 WAN Devices - 7.2.4 166 Serial Communication - 7.2.5 167 Circuit-Switched Communication - 7.2.6 168 Packet-Switched Communications - 7.2.7 168 SDH, SONET, and DWDM - 7.2.8 169 Check Your Understanding - WAN Operations - 7.2.9 169 Traditional WAN Connectivity - 7.3 169 Traditional WAN Connectivity Options - 7.3.1 169 Common WAN Terminology - 7.3.2 169 Circuit-Switched Options - 7.3.3 170 Packet-Switched Options - 7.3.4 171 Check Your Understanding - Traditional WAN Connectivity - 7.3.5 172 Modern WAN Connectivity - 7.4 172 Modern WANs - 7.4.1 172 Modern WAN Connectivity Options - 7.4.2 172 Ethernet WAN - 7.4.3 173 MPLS - 7.4.4 174 Check Your Understanding - Modern WAN Connectivity - 7.4.5 174 Internet-Based Connectivity - 7.5 174 Internet-Based Connectivity Options - 7.5.1 174 DSL Technology - 7.5.2 175 DSL Connections - 7.5.3 175 DSL and PPP - 7.5.4 176 Cable Technology - 7.5.5 176 Optical Fiber - 7.5.6 177 Wireless Internet-Based Broadband - 7.5.7 177 VPN Technology - 7.5.8 179 ISP Connectivity Options - 7.5.9 179 Broadband Solution Comparison - 7.5.10 180 Lab - Research Broadband Internet Access Options - 7.5.11 181 Module Practice and Quiz - 7.6 181 Packet Tracer - WAN Concepts - 7.6.1 181 What did I learn in this module? - 7.6.2 181 Chapter Quiz - WAN Concepts 184 Your Chapter Notes 184 Chapter 8 VPN and IPsec Concepts 185 Introduction - 8.0 185 Why should I take this module? - 8.0.1 185 What will I learn in this module? - 8.0.2 185 VPN Technology - 8.1 185 Virtual Private Networks - 8.1.1 185 VPN Benefits - 8.1.2 186 Site-to-Site and Remote-Access VPNs - 8.1.3 186 Enterprise and Service Provider VPNs - 8.1.4 186 Check Your Understanding - VPN Technology - 8.1.5 187 Types of VPNs - 8.2 187 Remote-Access VPNs - 8.2.1 187 SSL VPNs - 8.2.2 187 Site-to-Site IPsec VPNs - 8.2.3 188 GRE over IPsec - 8.2.4 188 Dynamic Multipoint VPNs - 8.2.5 189 IPsec Virtual Tunnel Interface - 8.2.6 189 Service Provider MPLS VPNs - 8.2.7 190 Check Your Understanding - Types of VPNs - 8.2.8 190 IPsec - 8.3 190 Video - IPsec Concepts - 8.3.1 190 IPsec Technologies - 8.3.2 190 IPsec Protocol Encapsulation - 8.3.3 191 Confidentiality - 8.3.4 192 Integrity - 8.3.5 192 Authentication - 8.3.6 192 Secure Key Exchange with Diffie-Hellman - 8.3.7 193 Video - IPsec Transport and Tunnel Mode - 8.3.8 193 Check Your Understanding - IPsec - 8.3.9 193 Module Practice and Quiz - 8.4 193 What did I learn in this module? - 8.4.1 193 Chapter Quiz - VPN and IPsec Concepts 195 Your Chapter Notes 195 Chapter 9 QoS Concepts 197 Introduction - 9.0 197 Why should I take this module? - 9.0.1 197 What will I learn to do in this module? - 9.0.2 197 Network Transmission Quality - 9.1 197 Video Tutorial - The Purpose of QoS - 9.1.1 197 Prioritizing Traffic - 9.1.2 197 Bandwidth, Congestion, Delay, and Jitter - 9.1.3 198 Packet Loss - 9.1.4 199 Check Your Understanding - Network Transmission Quality - 9.1.5 199 Traffic Characteristics - 9.2 199 Video Tutorial - Traffic Characteristics - 9.2.1 199 Network Traffic Trends - 9.2.2 199 Voice - 9.2.3 200 Video - 9.2.4 200 Data - 9.2.5 201 Check Your Understanding - Traffic Characteristics - 9.2.6 202 Queuing Algorithms - 9.3 202 Video Tutorial - QoS Algorithms - 9.3.1 202 Queuing Overview - 9.3.2 202 First In First Out - 9.3.3 202 Weighted Fair Queuing (WFQ) - 9.3.4 203 Class-Based Weighted Fair Queuing (CBWFQ) - 9.3.5 203 Low Latency Queuing (LLQ) - 9.3.6 204 Check Your Understanding - Queuing Algorithms - 9.3.7 204 QoS Models - 9.4 204 Video Tutorial - QoS Models - 9.4.1 204 Selecting an Appropriate QoS Policy Model - 9.4.2 204 Best Effort - 9.4.3 205 Integrated Services - 9.4.4 206 Differentiated Services - 9.4.5 206 Check Your Understanding - QoS Models - 9.4.6 208 QoS Implementation Techniques - 9.5 208 Video Tutorial - QoS Implementation Techniques - 9.5.1 208 Avoiding Packet Loss - 9.5.2 208 QoS Tools - 9.5.3 208 Classification and Marking - 9.5.4 209 Marking at Layer 2 - 9.5.5 210 Marking at Layer 3 - 9.5.6 210 Type of Service and Traffic Class Field - 9.5.7 211 DSCP Values - 9.5.8 211 Class Selector Bits - 9.5.9 211 Trust Boundaries - 9.5.10 211 Congestion Avoidance - 9.5.11 212 Shaping and Policing - 9.5.12 212 QoS Policy Guidelines - 9.5.13 213 Check Your Understanding - QoS Implementation Techniques - 9.5.14 213 Module Practice and Quiz - 9.6 213 What did I learn in this module? - 9.6.1 213 Chapter Quiz - QoS Concepts 216 Your Chapter Notes 216 Chapter 10 Network Management 217 Introduction - 10.0 217 Why should I take this module? - 10.0.1 217 What will I learn to do in this module? - 10.0.2 217 Device Discovery with CDP - 10.1 217 CDP Overview - 10.1.1 217 Configure and Verify CDP - 10.1.2 218 Discover Devices by Using CDP - 10.1.3 220 Syntax Checker - Configure and Verify CDP - 10.1.4 222 Packet Tracer - Use CDP to Map a Network - 10.1.5 222 Device Discovery with LLDP - 10.2 222 LLDP Overview - 10.2.1 222 Configure and Verify LLDP - 10.2.2 222 Discover Devices by Using LLDP - 10.2.3 223 Syntax Checker - Configure and Verify LLDP - 10.2.4 225 Check Your Understanding - Compare CDP and LLDP - 10.2.5 225 Packet Tracer - Use LLDP to Map a Network - 10.2.6 225 NTP - 10.3 225 Time and Calendar Services - 10.3.1 225 NTP Operation - 10.3.2 226 Configure and Verify NTP - 10.3.3 227 Packet Tracer - Configure and Verify NTP - 10.3.4 229 SNMP - 10.4 229 Introduction to SNMP - 10.4.1 229 SNMP Operation - 10.4.2 230 SNMP Agent Traps - 10.4.3 230 SNMP Versions - 10.4.4 231 Check Your Understanding - SNMP Versions - 10.4.5 232 Community Strings - 10.4.6 232 MIB Object ID - 10.4.7 233 SNMP Polling Scenario - 10.4.8 233 SNMP Object Navigator - 10.4.9 233 Lab - Research Network Monitoring Software - 10.4.10 234 Syslog - 10.5 234 Introduction to Syslog - 10.5.1 234 Syslog Operation - 10.5.2 234 Syslog Message Format - 10.5.3 235 Syslog Facilities - 10.5.4 236 Configure Syslog Timestamp - 10.5.5 236 Check Your Understanding - Syslog Operation - 10.5.6 237 Router and Switch File Maintenance - 10.6 237 Router File Systems - 10.6.1 237 Switch File Systems - 10.6.2 240 Use a Text File to Back Up a Configuration - 10.6.3 241 Use a Text File to Restore a Configuration - 10.6.4 241 Use TFTP to Back Up and Restore a Configuration - 10.6.5 242 USB Ports on a Cisco Router - 10.6.6 242 Use USB to Back Up and Restore a Configuration - 10.6.7 243 Password Recovery Procedures - 10.6.8 245 Password Recovery Example - 10.6.9 245 Packet Tracer - Back Up Configuration Files - 10.6.10 247 Lab - Use Tera Term to Manage Router Configuration Files - 10.6.11 248 Lab - Use TFTP, Flash, and USB to Manage Configuration Files - 10.6.12 248 Lab - Research Password Recovery Procedures - 10.6.13 248 IOS Image Management - 10.7 248 Video - Managing Cisco IOS Images - 10.7.1 248 TFTP Servers as a Backup Location - 10.7.2 248 Backup IOS Image to TFTP Server Example - 10.7.3 249 Copy an IOS Image to a Device Example - 10.7.4 250 The boot system Command - 10.7.5 251 Packet Tracer - Use a TFTP Server to Upgrade a Cisco IOS Image - 10.7.6 252 Module Practice and Quiz - 10.8 253 Packet Tracer - Configure CDP, LLDP, and NTP - 10.8.1 253 Lab - Configure CDP, LLDP, and NTP - 10.8.2 253 What did I learn in this module? - 10.8.3 253 Chapter Quiz - Network Management 257 Your Chapter Notes 257 Chapter 11 Network Design 259 Introduction - 11.0 259 Why should I take this module? - 11.0.1 259 What will I learn to do in this module? - 11.0.2 259 Hierarchical Networks - 11.1 259 Video - Three-Layer Network Design - 11.1.1 259 The Need to Scale the Network - 11.1.2 259 Borderless Switched Networks - 11.1.3 260 Hierarchy in the Borderless Switched Network - 11.1.4 261 Access, Distribution, and Core Layer Functions - 11.1.5 262 Three-Tier and Two-Tier Examples - 11.1.6 262 Role of Switched Networks - 11.1.7 263 Check Your Understanding - Hierarchical Networks - 11.1.8 263 Scalable Networks - 11.2 263 Design for Scalability - 11.2.1 263 Plan for Redundancy - 11.2.2 264 Reduce Failure Domain Size - 11.2.3 265 Increase Bandwidth - 11.2.4 265 Expand the Access Layer - 11.2.5 266 Tune Routing Protocols - 11.2.6 266 Check Your Understanding - Scalable Networks - 11.2.7 266 Switch Hardware - 11.3 266 Switch Platforms - 11.3.1 266 Switch Form Factors - 11.3.2 267 Port Density - 11.3.3 268 Forwarding Rates - 11.3.4 268 Power over Ethernet - 11.3.5 269 Multilayer Switching - 11.3.6 269 Business Considerations for Switch Selection - 11.3.7 270 Check Your Understanding - Switch Hardware - 11.3.8 270 Router Hardware - 11.4 270 Router Requirements - 11.4.1 270 Cisco Routers - 11.4.2 271 Router Form Factors - 11.4.3 271 Check Your Understanding - Router Hardware - 11.4.4 272 Module Practice and Quiz - 11.5 272 Packet Tracer - Compare Layer 2 and Layer 3 Devices - 11.5.1 272 What did I learn in this module? - 11.5.2 273 Chapter Quiz - Network Design 275 Your Chapter Notes 275 Chapter 12 Network Troubleshooting 277 Introduction - 12.0 277 Why should I take this module? - 12.0.1 277 What will I learn to do in this module? - 12.0.2 277 Network Documentation - 12.1 277 Documentation Overview - 12.1.1 277 Network Topology Diagrams - 12.1.2 278 Network Device Documentation - 12.1.3 279 Establish a Network Baseline - 12.1.4 279 Step 1 - Determine What Types of Data to Collect - 12.1.5 280 Step 2 - Identify Devices and Ports of Interest - 12.1.6 280 Step 3 - Determine the Baseline Duration - 12.1.7 280 Data Measurement - 12.1.8 281 Check Your Understanding - Network Documentation - 12.1.9 282 Troubleshooting Process - 12.2 282 General Troubleshooting Procedures - 12.2.1 282 Seven-Step Troubleshooting Process - 12.2.2 282 Question End Users - 12.2.3 284 Gather Information - 12.2.4 285 Troubleshooting with Layered Models - 12.2.5 286 Structured Troubleshooting Methods - 12.2.6 286 Guidelines for Selecting a Troubleshooting Method - 12.2.7 288 Check Your Understanding - Troubleshooting Process - 12.2.8 288 Troubleshooting Tools - 12.3 288 Software Troubleshooting Tools - 12.3.1 288 Protocol Analyzers - 12.3.2 289 Hardware Troubleshooting Tools - 12.3.3 289 Syslog Server as a Troubleshooting Tool - 12.3.4 290 Check Your Understanding - Troubleshooting Tools - 12.3.5 292 Symptoms and Causes of Network Problems - 12.4 292 Physical Layer Troubleshooting - 12.4.1 292 Data Link Layer Troubleshooting - 12.4.2 294 Network Layer Troubleshooting - 12.4.3 295 Transport Layer Troubleshooting - ACLs - 12.4.4 297 Transport Layer Troubleshooting - NAT for IPv4 - 12.4.5 298 Application Layer Troubleshooting - 12.4.6 299 Check Your Understanding - Symptoms and Causes of Network Problems - 12.4.7 300 Troubleshooting IP Connectivity - 12.5 300 Components of Troubleshooting End-to-End Connectivity - 12.5.1 300 End-to-End Connectivity Problem Initiates Troubleshooting - 12.5.2 301 Step 1 - Verify the Physical Layer - 12.5.3 303 Step 2 - Check for Duplex Mismatches - 12.5.4 304 Step 3 - Verify Addressing on the Local Network - 12.5.5 306 Step 4 - Verify Default Gateway - 12.5.7 310 Troubleshoot IPv6 Default Gateway Example - 12.5.8 311 Step 5 - Verify Correct Path - 12.5.9 314 Step 6 - Verify the Transport Layer - 12.5.10 315 Step 7 - Verify ACLs - 12.5.11 317 Step 8 - Verify DNS - 12.5.12 318 Packet Tracer - Troubleshoot Enterprise Networks - 12.5.13 319 Module Practice and Quiz - 12.6 319 Packet Tracer - Troubleshooting Challenge - Document the Network - 12.6.1 319 Packet Tracer - Troubleshooting Challenge - Use Documentation to Solve Issues - 12.6.2 319 What did I learn in this module? - 12.6.3 320 Chapter Quiz - Network Troubleshooting 324 Your Chapter Notes 324 Chapter 13 Network Virtualization 325 Introduction - 13.0 325 Why should I take this module? - 13.0.1 325 What will I learn to do in this module? - 13.0.2 325 Cloud Computing - 13.1 325 Video - Cloud and Virtualization - 13.1.1 325 Cloud Overview - 13.1.2 325 Cloud Services - 13.1.3 326 Cloud Models - 13.1.4 326 Cloud Computing versus Data Center - 13.1.5 327 Check Your Understanding - Cloud Computing - 13.1.6 327 Virtualization - 13.2 327 Cloud Computing and Virtualization - 13.2.1 327 Dedicated Servers - 13.2.2 328 Server Virtualization - 13.2.3 328 Advantages of Virtualization - 13.2.4 328 Abstraction Layers - 13.2.5 329 Type 2 Hypervisors - 13.2.6 330 Check Your Understanding - Virtualization - 13.2.7 330 Virtual Network Infrastructure - 13.3 330 Type 1 Hypervisors - 13.3.1 330 Installing a VM on a Hypervisor - 13.3.2 330 The Complexity of Network Virtualization - 13.3.3 331 Check Your Understanding - Virtual Network Infrastructure - 13.3.4 332 Software-Defined Networking - 13.4 332 Video - Software-Defined Networking - 13.4.1 332 Control Plane and Data Plane - 13.4.2 332 Network Virtualization Technologies - 13.4.3 333 Traditional and SDN Architectures - 13.4.4 334 Check Your Understanding - Software-Defined Networking - 13.4.5 334 Controllers - 13.5 334 SDN Controller and Operations - 13.5.1 334 Video - Cisco ACI - 13.5.2 335 Core Components of ACI - 13.5.3 335 Spine-Leaf Topology - 13.5.4 335 SDN Types - 13.5.5 336 APIC-EM Features - 13.5.6 336 APIC-EM Path Trace - 13.5.7 336 Check Your Understanding - Controllers - 13.5.8 337 Module Practice and Quiz - 13.6 337 Lab - Install Linux in a Virtual Machine and Explore the GUI - 13.6.1 337 What did I learn in this module? - 13.6.2 337 Chapter Quiz - Network Virtualization 341 Your Chapter Notes 341 Chapter 14 Network Automation 343 Introduction - 14.0 343 Why should I take this module? - 14.0.1 343 What will I learn in this module? - 14.0.2 343 Automation Overview - 14.1 343 Video - Automation Everywhere - 14.1.1 343 The Increase in Automation - 14.1.2 344 Thinking Devices - 14.1.3 344 Check Your Understanding - Benefits of Automation - 14.1.4 344 Data Formats - 14.2 344 Video - Data Formats - 14.2.1 344 The Data Formats Concept - 14.2.2 345 Data Format Rules - 14.2.3 345 Compare Data Formats - 14.2.4 346 JSON Data Format - 14.2.5 347 JSON Syntax Rules - 14.2.6 348 YAML Data Format - 14.2.7 349 XML Data Format - 14.2.8 350 Check Your Understanding - Data Formats - 14.2.9 351 APIs - 14.3 351 Video - APIs - 14.3.1 351 The API Concept - 14.3.2 352 An API Example - 14.3.3 352 Open, Internal, and Partner APIs - 14.3.4 352 Types of Web Service APIs - 14.3.5 353 Check Your Understanding - APIs - 14.3.6 354 REST - 14.4 354 Video - REST - 14.4.1 354 REST and RESTful API - 14.4.2 354 RESTful Implementation - 14.4.3 354 URI, URN, and URL - 14.4.4 355 Anatomy of a RESTful Request - 14.4.5 355 RESTful API Applications - 14.4.6 356 Check Your Understanding - REST - 14.4.7 357 Configuration Management Tools - 14.5 357 Video - Configuration Management Tools - 14.5.1 357 Traditional Network Configuration - 14.5.2 358 Network Automation - 14.5.3 358 Configuration Management Tools - 14.5.4 358 Compare Ansible, Chef, Puppet, and SaltStack - 14.5.5 359 Check Your Understanding - Configuration Management - 14.5.6 360 IBN and Cisco DNA Center - 14.6 360 Video - Intent-Based Networking - 14.6.1 360 Intent-Based Networking Overview - 14.6.2 360 Network Infrastructure as Fabric - 14.6.3 360 Cisco Digital Network Architecture (DNA) - 14.6.4 361 Cisco DNA Center - 14.6.5 362 Video - DNA Center Overview and Platform APIs - 14.6.6 362 Video - DNA Center Design and Provision - 14.6.7 363 Video - DNA Center Policy and Assurance - 14.6.8 363 Video - DNA Center Troubleshooting User Connectivity - 14.6.9 363 Check Your Understanding - IBN and Cisco DNA Center - 14.6.10 363 Module Practice and Quiz - 14.7 363 What did I learn in this module? - 14.7.1 363 Chapter Quiz - Network Automation 365 Your Chapter Notes 365 9780136634737 TOC 6/18/2020

Read more less

Book SynopsisAllan Johnson entered the academic world in 1999 after 10 years as a business owner/operator to dedicate his efforts to his passion for teaching. He holds both an MBA and an MEd in training and development. He taught CCNA courses at the high school level for 7 years and has taught both CCNA and CCNP courses at Del Mar College in Corpus Christi, Texas. In 2003, Allan began to commit much of his time and energy to the CCNA Instructional Support Team, providing services to Networking Academy instructors worldwide and creating training materials. He now splits his time between working as a Curriculum Lead for Cisco Networking Academy and as Account Lead for Unicon (unicon.net), supporting Cisco's educational efforts.

Read more less

Book Synopsis

Read more less

Book Synopsis

Read more less

Book Synopsis

Read more less

Book Synopsis

Read more less

Book Synopsis

Read more less

Book Synopsis

Read more less

Book SynopsisYour Cisco Networking Academy Course Booklet is designed as a study resource you can easily read, highlight, and review on the go, wherever the Internet is not available or practical: · The text is extracted directly, word-for-word, from the online course so you can highlight important points and take notes in the “Your Chapter Notes” section. · Headings with the exact page correlations provide a quick reference to the online course for your classroom discussions and exam preparation. · An icon system directs you to the online curriculum to take full advantage of the images embedded within the Networking Academy online course interface and reminds you to perform the labs, Class Activities, interactive activities, Packet Tracer activities, watch videos, and take the chapter quizzes and exams. The Course Booklet is a basic, economical paper-based resource to help you succeed with the Cisco Networking Academy online course. Table of ContentsChapter 0 Course Introduction 1 0.0 Welcome to CCNA: Cybersecurity Operations 1 0.0.1 Message to the Student 1 Chapter 1 Cybersecurity and the Security Operations Center 5 1.0 Introduction 5 1.1 The Danger 5 1.1.1 War Stories 5 1.1.1.1 Hijacked People 5 1.1.1.2 Ransomed Companies 5 1.1.1.3 Targeted Nations 6 1.1.1.4 Lab - Installing the CyberOps Workstation Virtual Machine 6 1.1.1.5 Lab - Cybersecurity Case Studies 6 1.1.2 Threat Actors 6 1.1.2.1 Amateurs 6 1.1.2.2 Hacktivists 7 1.1.2.3 Financial Gain 7 1.1.2.4 Trade Secrets and Global Politics 7 1.1.2.5 How Secure is the Internet of Things? 7 1.1.2.6 Lab - Learning the Details of Attacks 7 1.1.3 Threat Impact 8 1.1.3.1 PII and PHI 8 1.1.3.2 Lost Competitive Advantage 8 1.1.3.3 Politics and National Security 8 1.1.3.4 Lab - Visualizing the Black Hats 9 1.2 Fighters in the War Against Cybercrime 9 1.2.1 The Modern Security Operations Center 9 1.2.1.1 Elements of a SOC 9 1.2.1.2 People in the SOC 9 1.2.1.3 Process in the SOC 10 1.2.1.4 Technologies in the SOC 10 1.2.1.5 Enterprise and Managed Security 10 1.2.1.6 Security vs. Availability 11 1.2.1.7 Activity - Identify the SOC Terminology 11 1.2.2 Becoming a Defender 11 1.2.2.1 Certifications 11 1.2.2.2 Further Education 12 1.2.2.3 Sources of Career Information 12 1.2.2.4 Getting Experience 13 1.2.2.5 Lab - Becoming a Defender 13 1.3 Summary 13 Chapter 2 Windows Operating System 17 2.0 Introduction 17 2.1 Windows Overview 17 2.1.1 Windows History 17 2.1.1.1 Disk Operating System 17 2.1.1.2 Windows Versions 18 2.1.1.3 Windows GUI 19 2.1.1.4 Operating System Vulnerabilities 19 2.1.2 Windows Architecture and Operations 20 2.1.2.1 Hardware Abstraction Layer 20 2.1.2.2 User Mode and Kernel Mode 21 2.1.2.3 Windows File Systems 21 2.1.2.4 Windows Boot Process 23 2.1.2.5 Windows Startup and Shutdown 24 2.1.2.6 Processes, Threads, and Services 25 2.1.2.7 Memory Allocation and Handles 25 2.1.2.8 The Windows Registry 26 2.1.2.9 Activity - Identify the Windows Registry Hive 27 2.1.2.10 Lab - Exploring Processes, Threads, Handles, and Windows Registry 27 2.2 Windows Administration 27 2.2.1 Windows Configuration and Monitoring 27 2.2.1.1 Run as Administrator 27 2.2.1.2 Local Users and Domains 27 2.2.1.3 CLI and PowerShell 28 2.2.1.4 Windows Management Instrumentation 29 2.2.1.5 The net Command 30 2.2.1.6 Task Manager and Resource Monitor 30 2.2.1.7 Networking 31 2.2.1.8 Accessing Network Resources 33 2.2.1.9 Windows Server 33 2.2.1.10 Lab - Create User Accounts 34 2.2.1.11 Lab - Using Windows PowerShell 34 2.2.1.12 Lab - Windows Task Manager 34 2.2.1.13 Lab - Monitor and Manage System Resources in Windows 34 2.2.2 Windows Security 34 2.2.2.1 The netstat Command 34 2.2.2.2 Event Viewer 35 2.2.2.3 Windows Update Management 35 2.2.2.4 Local Security Policy 35 2.2.2.5 Windows Defender 36 2.2.2.6 Windows Firewall 37 2.2.2.7 Activity - Identify the Windows Command 37 2.2.2.8 Activity - Identify the Windows Tool 37 2.3 Summary 37 Chapter 3 Linux Operating System 41 3.0 Introduction 41 3.1 Linux Overview 41 3.1.1 Linux Basics 41 3.1.1.1 What is Linux? 41 3.1.1.2 The Value of Linux 42 3.1.1.3 Linux in the SOC 42 3.1.1.4 Linux Tools 43 3.1.2 Working in the Linux Shell 43 3.1.2.1 The Linux Shell 43 3.1.2.2 Basic Commands 43 3.1.2.3 File and Directory Commands 44 3.1.2.4 Working with Text Files 44 3.1.2.5 The Importance of Text Files in Linux 44 3.1.2.6 Lab - Working with Text Files in the CLI 45 3.1.2.7 Lab - Getting Familiar with the Linux Shell 45 3.1.3 Linux Servers and Clients 45 3.1.3.1 An Introduction to Client-Server Communications 45 3.1.3.2 Servers, Services, and Their Ports 45 3.1.3.3 Clients 45 3.1.3.4 Lab - Linux Servers 45 3.2 Linux Administration 46 3.2.1 Basic Server Administration 46 3.2.1.1 Service Configuration Files 46 3.2.1.2 Hardening Devices 46 3.2.1.3 Monitoring Service Logs 47 3.2.1.4 Lab - Locating Log Files 48 3.2.2 The Linux File System 48 3.2.2.1 The File System Types in Linux 48 3.2.2.2 Linux Roles and File Permissions 49 3.2.2.3 Hard Links and Symbolic Links 50 3.2.2.4 Lab - Navigating the Linux Filesystem and Permission Settings 50 3.3 Linux Hosts 51 3.3.1 Working with the Linux GUI 51 3.3.1.1 X Window System 51 3.3.1.2 The Linux GUI 51 3.3.2 Working on a Linux Host 52 3.3.2.1 Installing and Running Applications on a Linux Host 52 3.3.2.2 Keeping the System Up To Date 52 3.3.2.3 Processes and Forks 52 3.3.2.4 Malware on a Linux Host 53 3.3.2.5 Rootkit Check 54 3.3.2.6 Piping Commands 54 3.3.2.7 Video Demonstration - Applications, Rootkits, and Piping Commands 55 3.4 Summary 55 Chapter 4 Network Protocols and Services 59 4.0 Introduction 59 4.1 Network Protocols 59 4.1.1 Network Communications Process 59 4.1.1.1 Views of the Network 59 4.1.1.2 Client-Server Communications 60 4.1.1.3 A Typical Session: Student 60 4.1.1.4 A Typical Session: Gamer 61 4.1.1.5 A Typical Session: Surgeon 61 4.1.1.6 Tracing the Path 62 4.1.1.7 Lab - Tracing a Route 62 4.1.2 Communications Protocols 62 4.1.2.1 What are Protocols? 62 4.1.2.2 Network Protocol Suites 63 4.1.2.3 The TCP/IP Protocol Suite 63 4.1.2.4 Format, Size, and Timing 64 4.1.2.5 Unicast, Multicast, and Broadcast 64 4.1.2.6 Reference Models 65 4.1.2.7 Three Addresses 65 4.1.2.8 Encapsulation 65 4.1.2.9 Scenario: Sending and Receiving a Web Page 66 4.1.2.10 Lab - Introduction to Wireshark 67 4.2 Ethernet and Internet Protocol (IP) 67 4.2.1 Ethernet 67 4.2.1.1 The Ethernet Protocol 67 4.2.1.2 The Ethernet Frame 68 4.2.1.3 MAC Address Format 68 4.2.1.4 Activity - Ethernet Frame Fields 68 4.2.2 IPv4 68 4.2.2.1 IPv4 Encapsulation 68 4.2.2.2 IPv4 Characteristics 69 4.2.2.3 Activity - IPv4 Characteristics 70 4.2.2.4 The IPv4 Packet 70 4.2.2.5 Video Demonstration - Sample IPv4 Headers in Wireshark 70 4.2.3 IPv4 Addressing Basics 70 4.2.3.1 IPv4 Address Notation 70 4.2.3.2 IPv4 Host Address Structure 70 4.2.3.3 IPv4 Subnet Mask and Network Address 71 4.2.3.4 Subnetting Broadcast Domains 71 4.2.3.5 Video Demonstration - Network, Host, and Broadcast Addresses 72 4.2.4 Types of IPv4 Addresses 72 4.2.4.1 IPv4 Address Classes and Default Subnet Masks 72 4.2.4.2 Reserved Private Addresses 73 4.2.5 The Default Gateway 73 4.2.5.1 Host Forwarding Decision 73 4.2.5.2 Default Gateway 74 4.2.5.3 Using the Default Gateway 74 4.2.6 IPv6 75 4.2.6.1 Need for IPv6 75 4.2.6.2 IPv6 Size and Representation 75 4.2.6.3 IPv6 Address Formatting 75 4.2.6.4 IPv6 Prefix Length 76 4.2.6.5 Activity - IPv6 Address Notation 76 4.2.6.6 Video Tutorial - Layer 2 and Layer 3 Addressing 76 4.3 Connectivity Verification 76 4.3.1 ICMP 76 4.3.1.1 ICMPv4 Messages 76 4.3.1.2 ICMPv6 RS and RA Messages 77 4.3.2 Ping and Traceroute Utilities 78 4.3.2.1 Ping - Testing the Local Stack 78 4.3.2.2 Ping - Testing Connectivity to the Local LAN 79 4.3.2.3 Ping - Testing Connectivity to Remote Host 79 4.3.2.4 Traceroute - Testing the Path 80 4.3.2.5 ICMP Packet Format 80 4.4 Address Resolution Protocol 81 4.4.1 MAC and IP 81 4.4.1.1 Destination on Same Network 81 4.4.1.2 Destination on Remote Network 82 4.4.2 ARP 82 4.4.2.1 Introduction to ARP 82 4.4.2.2 ARP Functions 82 4.4.2.3 Video - ARP Operation - ARP Request 83 4.4.2.4 Video - ARP Operation - ARP Reply 84 4.4.2.5 Video - ARP Role in Remote Communication 84 4.4.2.6 Removing Entries from an ARP Table 85 4.4.2.7 ARP Tables on Networking Devices 85 4.4.2.8 Lab - Using Wireshark to Examine Ethernet Frames 85 4.4.3 ARP Issues 85 4.4.3.1 ARP Broadcasts 85 4.4.3.2 ARP Spoofing 86 4.5 The Transport Layer 86 4.5.1 Transport Layer Characteristics 86 4.5.1.1 Transport Layer Protocol Role in Network Communication 86 4.5.1.2 Transport Layer Mechanisms 87 4.5.1.3 TCP Local and Remote Ports 87 4.5.1.4 Socket Pairs 88 4.5.1.5 TCP vs UDP 88 4.5.1.6 TCP and UDP Headers 89 4.5.1.7 Activity - Compare TCP and UDP Characteristics 90 4.5.2 Transport Layer Operation 90 4.5.2.1 TCP Port Allocation 90 4.5.2.2 A TCP Session Part I: Connection Establishment and Termination 91 4.5.2.3 Video Demonstration - TCP 3-Way Handshake 92 4.5.2.4 Lab - Using Wireshark to Observe the TCP 3-Way Handshake 92 4.5.2.5 Activity - TCP Connection and Termination Process 92 4.5.2.6 A TCP Session Part II: Data Transfer 92 4.5.2.7 Video Demonstration - Sequence Numbers and Acknowledgments 94 4.5.2.8 Video Demonstration - Data Loss and Retransmission 94 4.5.2.9 A UDP Session 94 4.5.2.10 Lab - Exploring Nmap 95 4.6 Network Services 95 4.6.1 DHCP 95 4.6.1.1 DHCP Overview 95 4.6.1.2 DHCPv4 Message Format 96 4.6.2 DNS 97 4.6.2.1 DNS Overview 97 4.6.2.2 The DNS Domain Hierarchy 97 4.6.2.3 The DNS Lookup Process 97 4.6.2.4 DNS Message Format 98 4.6.2.5 Dynamic DNS 99 4.6.2.6 The WHOIS Protocol 99 4.6.2.7 Lab - Using Wireshark to Examine a UDP DNS Capture 100 4.6.3 NAT 100 4.6.3.1 NAT Overview 100 4.6.3.2 NAT-Enabled Routers 100 4.6.3.3 Port Address Translation 100 4.6.4 File Transfer and Sharing Services 101 4.6.4.1 FTP and TFTP 101 4.6.4.2 SMB 102 4.6.4.3 Lab - Using Wireshark to Examine TCP and UDP Captures 102 4.6.5 Email 102 4.6.5.1 Email Overview 102 4.6.5.2 SMTP 102 4.6.5.3 POP3 103 4.6.5.4 IMAP 103 4.6.6 HTTP 103 4.6.6.1 HTTP Overview 103 4.6.6.2 The HTTP URL 104 4.6.6.3 The HTTP Protocol 104 4.6.6.4 HTTP Status Codes 105 4.6.6.5 Lab - Using Wireshark to Examine HTTP and HTTPS Traffic 105 4.7 Summary 105 Chapter 5 Network Infrastructure 109 5.0 Introduction 109 5.1 Network Communication Devices 109 5.1.1 Network Devices 109 5.1.1.1 End Devices 109 5.1.1.2 Video Tutorial - End Devices 109 5.1.1.3 Routers 110 5.1.1.4 Activity - Match Layer 2 and Layer 3 Addressing 110 5.1.1.5 Router Operation 110 5.1.1.6 Routing Information 111 5.1.1.7 Video Tutorial - Static and Dynamic Routing 112 5.1.1.8 Hubs, Bridges, LAN Switches 112 5.1.1.9 Switching Operation 113 5.1.1.10 Video Tutorial - MAC Address Tables on Connected Switches 114 5.1.1.11 VLANs 114 5.1.1.12 STP 114 5.1.1.13 Multilayer Switching 115 5.1.2 Wireless Communications 116 5.1.2.1 Video Tutorial - Wireless Communications 116 5.1.2.2 Protocols and Features 116 5.1.2.3 Wireless Network Operations 117 5.1.2.4 The Client to AP Association Process 118 5.1.2.5 Activity - Order the Steps in the Client and AP Association Process 119 5.1.2.6 Wireless Devices - AP, LWAP, WLC 119 5.1.2.7 Activity - Identify the LAN Device 119 5.2 Network Security Infrastructure 120 5.2.1 Security Devices 120 5.2.1.1 Video Tutorial - Security Devices 120 5.2.1.2 Firewalls 120 5.2.1.3 Firewall Type Descriptions 120 5.2.1.4 Packet Filtering Firewalls 121 5.2.1.5 Stateful Firewalls 121 5.2.1.6 Next-Generation Firewalls 121 5.2.1.7 Activity - Identify the Type of Firewall 122 5.2.1.8 Intrusion Protection and Detection Devices 122 5.2.1.9 Advantages and Disadvantages of IDS and IPS 122 5.2.1.10 Types of IPS 123 5.2.1.11 Specialized Security Appliances 124 5.2.1.12 Activity - Compare IDS and IPS Characteristics 125 5.2.2 Security Services 125 5.2.2.1 Video Tutorial - Security Services 125 5.2.2.2 Traffic Control with ACLs 125 5.2.2.3 ACLs: Important Features 126 5.2.2.4 Packet Tracer - ACL Demonstration 126 5.2.2.5 SNMP 126 5.2.2.6 NetFlow 127 5.2.2.7 Port Mirroring 127 5.2.2.8 Syslog Servers 128 5.2.2.9 NTP 128 5.2.2.10 AAA Servers 129 5.2.2.11 VPN 130 5.2.2.12 Activity - Identify the Network Security Device or Service 130 5.3 Network Representations 130 5.3.1 Network Topologies 130 5.3.1.1 Overview of Network Components 130 5.3.1.2 Physical and Logical Topologies 131 5.3.1.3 WAN Topologies 131 5.3.1.4 LAN Topologies 131 5.3.1.5 The Three-Layer Network Design Model 132 5.3.1.6 Video Tutorial - Three-Layer Network Design 132 5.3.1.7 Common Security Architectures 133 5.3.1.8 Activity - Identify the Network Topology 134 5.3.1.9 Activity - Identify the Network Design Terminology 134 5.3.1.10 Packet Tracer - Identify Packet Flow 134 5.4 Summary 134 Chapter 6 Principles of Network Security 137 6.0 Introduction 137 6.1 Attackers and Their Tools 137 6.1.1 Who is Attacking Our Network? 137 6.1.1.1 Threat, Vulnerability, and Risk 137 6.1.1.2 Hacker vs. Threat Actor 138 6.1.1.3 Evolution of Threat Actors 138 6.1.1.4 Cybercriminals 139 6.1.1.5 Cybersecurity Tasks 139 6.1.1.6 Cyber Threat Indicators 139 6.1.1.7 Activity - What Color is my Hat? 140 6.1.2 Threat Actor Tools 140 6.1.2.1 Introduction of Attack Tools 140 6.1.2.2 Evolution of Security Tools 140 6.1.2.3 Categories of Attacks 141 6.1.2.4 Activity - Classify Hacking Tools 141 6.2 Common Threats and Attacks 141 6.2.1 Malware 141 6.2.1.1 Types of Malware 141 6.2.1.2 Viruses 141 6.2.1.3 Trojan Horses 141 6.2.1.4 Trojan Horse Classification 142 6.2.1.5 Worms 142 6.2.1.6 Worm Components 143 6.2.1.7 Ransomware 143 6.2.1.8 Other Malware 144 6.2.1.9 Common Malware Behaviors 144 6.2.1.10 Activity - Identify the Malware Type 145 6.2.1.11 Lab - Anatomy of Malware 145 6.2.2 Common Network Attacks 145 6.2.2.1 Types of Network Attacks 145 6.2.2.2 Reconnaissance Attacks 145 6.2.2.3 Sample Reconnaissance Attacks 146 6.2.2.4 Access Attacks 146 6.2.2.5 Types of Access Attacks 147 6.2.2.6 Social Engineering Attacks 147 6.2.2.7 Phishing Social Engineering Attacks 148 6.2.2.8 Strengthening the Weakest Link 149 6.2.2.9 Lab - Social Engineering 149 6.2.2.10 Denial of Service Attacks 149 6.2.2.11 DDoS Attacks 149 6.2.2.12 Example DDoS Attack 150 6.2.2.13 Buffer Overflow Attack 150 6.2.2.14 Evasion Methods 151 6.2.2.15 Activity - Identify the Types of Network Attack 151 6.2.2.16 Activity - Components of a DDoS Attack 151 6.3 Summary 152 Chapter 7 Network Attacks: A Deeper Look 155 7.0 Introduction 155 7.1 Attackers and Their Tools 155 7.1.1 Who is Attacking Our Network? 155 7.1.1.1 Network Security Topology 155 7.1.1.2 Monitoring the Network 156 7.1.1.3 Network Taps 156 7.1.1.4 Traffic Mirroring and SPAN 156 7.1.2 Introduction to Network Monitoring Tools 157 7.1.2.1 Network Security Monitoring Tools 157 7.1.2.2 Network Protocol Analyzers 157 7.1.2.3 NetFlow 158 7.1.2.4 SIEM 159 7.1.2.5 SIEM Systems 159 7.1.2.6 Activity - Identify the Network Monitoring Tool 159 7.1.2.7 Packet Tracer - Logging Network Activity 159 7.2 Attacking the Foundation 160 7.2.1 IP Vulnerabilities and Threats 160 7.2.1.1 IPv4 and IPv6 160 7.2.1.2 The IPv4 Packet Header 160 7.2.1.3 The IPv6 Packet Header 161 7.2.1.4 IP Vulnerabilities 161 7.2.1.5 ICMP Attacks 162 7.2.1.6 DoS Attacks 163 7.2.1.7 Amplification and Reflection Attacks 163 7.2.1.8 DDoS Attacks 163 7.2.1.9 Address Spoofing Attacks 164 7.2.1.10 Activity - Identify the IP Vulnerability 164 7.2.1.11 Lab - Observing a DDoS Attack 164 7.2.2 TCP and UDP Vulnerabilities 165 7.2.2.1 TCP 165 7.2.2.2 TCP Attacks 165 7.2.2.3 UDP and UDP Attacks 166 7.2.2.4 Lab - Observing TCP Anomalies 166 7.3 Attacking What We Do 167 7.3.1 IP Services 167 7.3.1.1 ARP Vulnerabilities 167 7.3.1.2 ARP Cache Poisoning 167 7.3.1.3 DNS Attacks 168 7.3.1.4 DNS Tunneling 169 7.3.1.5 DHCP 169 7.3.1.6 Lab - Exploring DNS Traffic 170 7.3.2 Enterprise Services 170 7.3.2.1 HTTP and HTTPS 170 7.3.2.2 Email 173 7.3.2.3 Web-Exposed Databases 174 7.3.2.4 Lab - Attacking a MySQL Database 176 7.3.2.5 Lab - Reading Server Logs 176 7.3.2.6 Lab - Reading Server Logs 176 7.4 Summary 176 Chapter 8 Protecting the Network 179 8.0 Introduction 179 8.1 Understanding Defense 179 8.1.1 Defense-in-Depth 179 8.1.1.1 Assets, Vulnerabilities, Threats 179 8.1.1.2 Identify Assets 179 8.1.1.3 Identify Vulnerabilities 180 8.1.1.4 Identify Threats 181 8.1.1.5 Security Onion and Security Artichoke Approaches 181 8.1.2 Security Policies 182 8.1.2.1 Business Policies 182 8.1.2.2 Security Policy 182 8.1.2.3 BYOD Policies 183 8.1.2.4 Regulatory and Standard Compliance 184 8.2 Access Control 184 8.2.1 Access Control Concepts 184 8.2.1.1 Communications Security: CIA 184 8.2.1.2 Access Control Models 185 8.2.1.3 Activity - Identify the Access Control Model 185 8.2.2 AAA Usage and Operation 185 8.2.2.1 AAA Operation 185 8.2.2.2 AAA Authentication 186 8.2.2.3 AAA Accounting Logs 187 8.2.2.4 Activity - Identify the Characteristic of AAA 187 8.3 Threat Intelligence 187 8.3.1 Information Sources 187 8.3.1.1 Network Intelligence Communities 187 8.3.1.2 Cisco Cybersecurity Reports 188 8.3.1.3 Security Blogs and Podcasts 188 8.3.2 Threat Intelligence Services 188 8.3.2.1 Cisco Talos 188 8.3.2.2 FireEye 189 8.3.2.3 Automated Indicator Sharing 189 8.3.2.4 Common Vulnerabilities and Exposures Database 189 8.3.2.5 Threat Intelligence Communication Standards 189 8.3.2.6 Activity - Identify the Threat Intelligence Information Source 190 8.4 Summary 190 Chapter 9 Cryptography and the Public Key Infrastructure 193 9.0 Introduction 193 9.1 Cryptography 193 9.1.1 What is Cryptography? 193 9.1.1.1 Securing Communications 193 9.1.1.2 Cryptology 194 9.1.1.3 Cryptography - Ciphers 195 9.1.1.4 Cryptanalysis - Code Breaking 195 9.1.1.5 Keys 196 9.1.1.6 Lab - Encrypting and Decrypting Data Using OpenSSL 197 9.1.1.7 Lab - Encrypting and Decrypting Data Using a Hacker Tool 197 9.1.1.8 Lab - Examining Telnet and SSH in Wireshark 197 9.1.2 Integrity and Authenticity 197 9.1.2.1 Cryptographic Hash Functions 197 9.1.2.2 Cryptographic Hash Operation 198 9.1.2.3 MD5 and SHA 198 9.1.2.4 Hash Message Authentication Code 199 9.1.2.5 Lab - Hashing Things Out 200 9.1.3 Confidentiality 200 9.1.3.1 Encryption 200 9.1.3.2 Symmetric Encryption 200 9.1.3.3 Symmetric Encryption Algorithms 201 9.1.3.4 Asymmetric Encryption Algorithms 202 9.1.3.5 Asymmetric Encryption - Confidentiality 202 9.1.3.6 Asymmetric Encryption - Authentication 203 9.1.3.7 Asymmetric Encryption - Integrity 203 9.1.3.8 Diffie-Hellman 204 9.1.3.9 Activity - Classify the Encryption Algorithms 204 9.2 Public Key Infrastructure 204 9.2.1 Public Key Cryptography 204 9.2.1.1 Using Digital Signatures 204 9.2.1.2 Digital Signatures for Code Signing 206 9.2.1.3 Digital Signatures for Digital Certificates 206 9.2.1.4 Lab - Create a Linux Playground 206 9.2.2 Authorities and the PKI Trust System 206 9.2.2.1 Public Key Management 206 9.2.2.2 The Public Key Infrastructure 207 9.2.2.3 The PKI Authorities System 207 9.2.2.4 The PKI Trust System 208 9.2.2.5 Interoperability of Different PKI Vendors 208 9.2.2.6 Certificate Enrollment, Authentication, and Revocation 209 9.2.2.7 Lab - Certificate Authority Stores 209 9.2.3 Applications and Impacts of Cryptography 210 9.2.3.1 PKI Applications 210 9.2.3.2 Encrypting Network Transactions 210 9.2.3.3 Encryption and Security Monitoring 211 9.3 Summary 212 Chapter 10 Endpoint Security and Analysis 215 10.0 Introduction 215 10.1 Endpoint Protection 215 10.1.1 Antimalware Protection 215 10.1.1.1 Endpoint Threats 215 10.1.1.2 Endpoint Security 216 10.1.1.3 Host-Based Malware Protection 216 10.1.1.4 Network-Based Malware Protection 217 10.1.1.5 Cisco Advanced Malware Protection (AMP) 218 10.1.1.6 Activity - Identify Antimalware Terms and Concepts 218 10.1.2 Host-Based Intrusion Protection 218 10.1.2.1 Host-Based Firewalls 218 10.1.2.2 Host-Based Intrusion Detection 219 10.1.2.3 HIDS Operation 220 10.1.2.4 HIDS Products 220 10.1.2.5 Activity - Identify the Host-Based Intrusion Protection Terminology 220 10.1.3 Application Security 221 10.1.3.1 Attack Surface 221 10.1.3.2 Application Blacklisting and Whitelisting 221 10.1.3.3 System-Based Sandboxing 222 10.1.3.4 Video Demonstration - Using a Sandbox to Launch Malware 222 10.2 Endpoint Vulnerability Assessment 222 10.2.1 Network and Server Profiling 222 10.2.1.1 Network Profiling 222 10.2.1.2 Server Profiling 223 10.2.1.3 Network Anomaly Detection 223 10.2.1.4 Network Vulnerability Testing 224 10.2.1.5 Activity - Identify the Elements of Network Profiling 225 10.2.2 Common Vulnerability Scoring System (CVSS) 225 10.2.2.1 CVSS Overview 225 10.2.2.2 CVSS Metric Groups 225 10.2.2.3 CVSS Base Metric Group 226 10.2.2.4 The CVSS Process 226 10.2.2.5 CVSS Reports 227 10.2.2.6 Other Vulnerability Information Sources 227 10.2.2.7 Activity - Identify CVSS Metrics 228 10.2.3 Compliance Frameworks 228 10.2.3.1 Compliance Regulations 228 10.2.3.2 Overview of Regulatory Standards 228 10.2.3.3 Activity - Identify Regulatory Standards 229 10.2.4 Secure Device Management 230 10.2.4.1 Risk Management 230 10.2.4.2 Activity - Identify the Risk Response 231 10.2.4.3 Vulnerability Management 231 10.2.4.4 Asset Management 231 10.2.4.5 Mobile Device Management 232 10.2.4.6 Configuration Management 232 10.2.4.7 Enterprise Patch Management 233 10.2.4.8 Patch Management Techniques 233 10.2.4.9 Activity - Identify Device Management Activities 234 10.2.5 Information Security Management Systems 234 10.2.5.1 Security Management Systems 234 10.2.5.2 ISO-27001 234 10.2.5.3 NIST Cybersecurity Framework 234 10.2.5.4 Activity - Identify the ISO 27001 Activity Cycle 235 10.2.5.5 Activity - Identify the Stages in the NIST Cybersecurity Framework 235 10.3 Summary 235 Chapter 11 Security Monitoring 239 11.0 Introduction 239 11.1 Technologies and Protocols 239 11.1.1 Monitoring Common Protocols 239 11.1.1.1 Syslog and NTP 239 11.1.1.2 NTP 240 11.1.1.3 DNS 240 11.1.1.4 HTTP and HTTPS 241 11.1.1.5 Email Protocols 241 11.1.1.6 ICMP 242 11.1.1.7 Activity - Identify the Monitored Protocol 242 11.1.2 Security Technologies 242 11.1.2.1 ACLs 242 11.1.2.2 NAT and PAT 242 11.1.2.3 Encryption, Encapsulation, and Tunneling 243 11.1.2.4 Peer-to-Peer Networking and Tor 243 11.1.2.5 Load Balancing 244 11.1.2.6 Activity - Identify the Impact of the Technology on Security and Monitoring 244 11.2 Log Files 244 11.2.1 Types of Security Data 244 11.2.1.1 Alert Data 244 11.2.1.2 Session and Transaction Data 245 11.2.1.3 Full Packet Captures 245 11.2.1.4 Statistical Data 246 11.2.1.5 Activity - Identify Types of Network Monitoring Data 246 11.2.2 End Device Logs 246 11.2.2.1 Host Logs 246 11.2.2.2 Syslog 247 11.2.2.3 Server Logs 248 11.2.2.4 Apache Webserver Access Logs 248 11.2.2.5 IIS Access Logs 249 11.2.2.6 SIEM and Log Collection 249 11.2.2.7 Activity - Identify Information in Logged Events 250 11.2.3 Network Logs 250 11.2.3.1 Tcpdump 250 11.2.3.2 NetFlow 250 11.2.3.3 Application Visibility and Control 251 11.2.3.4 Content Filter Logs 251 11.2.3.5 Logging from Cisco Devices 252 11.2.3.6 Proxy Logs 252 11.2.3.7 NextGen IPS 253 11.2.3.8 Activity - Identify the Security Technology from the Data Description 254 11.2.3.9 Activity - Identify the NextGen IPS Event Type 254 11.2.3.10 Packet Tracer - Explore a NetFlow Implementation 254 11.2.3.11 Packet Tracer - Logging from Multiple Sources 254 11.3 Summary 254 Chapter 12 Intrusion Data Analysis 257 12.0 Introduction 257 12.1 Evaluating Alerts 257 12.1.1 Sources of Alerts 257 12.1.1.1 Security Onion 257 12.1.1.2 Detection Tools for Collecting Alert Data 257 12.1.1.3 Analysis Tools 258 12.1.1.4 Alert Generation 259 12.1.1.5 Rules and Alerts 260 12.1.1.6 Snort Rule Structure 260 12.1.1.7 Lab - Snort and Firewall Rules 261 12.1.2 Overview of Alert Evaluation 262 12.1.2.1 The Need for Alert Evaluation 262 12.1.2.2 Evaluating Alerts 262 12.1.2.3 Deterministic Analysis and Probabilistic Analysis 263 12.1.2.4 Activity - Identify Deterministic and Probabilistic Scenarios 264 12.1.2.5 Activity - Identify the Alert Classification 264 12.2 Working with Network Security Data 264 12.2.1 A Common Data Platform 264 12.2.1.1 ELSA 264 12.2.1.2 Data Reduction 264 12.2.1.3 Data Normalization 265 12.2.1.4 Data Archiving 265 12.2.1.5 Lab - Convert Data into a Universal Format 266 12.2.1.6 Investigating Process or API Calls 266 12.2.2 Investigating Network Data 266 12.2.2.1 Working in Sguil 266 12.2.2.2 Sguil Queries 267 12.2.2.3 Pivoting from Sguil 267 12.2.2.4 Event Handling in Sguil 268 12.2.2.5 Working in ELSA 268 12.2.2.6 Queries in ELSA 269 12.2.2.7 Investigating Process or API Calls 269 12.2.2.8 Investigating File Details 270 12.2.2.9 Lab - Regular Expression Tutorial 270 12.2.2.10 Lab - Extract an Executable from a PCAP 270 12.2.3 Enhancing the Work of the Cybersecurity Analyst 270 12.2.3.1 Dashboards and Visualizations 270 12.2.3.2 Workflow Management 271 12.3 Digital Forensics 271 12.3.1 Evidence Handling and Attack Attribution 271 12.3.1.1 Digital Forensics 271 12.3.1.2 The Digital Forensics Process 272 12.3.1.3 Types of Evidence 272 12.3.1.4 Evidence Collection Order 273 12.3.1.5 Chain of Custody 273 12.3.1.6 Data Integrity and Preservation 274 12.3.1.7 Attack Attribution 274 12.3.1.8 Activity - Identify the Type of Evidence 275 12.3.1.9 Activity - Identify the Forensic Technique Terminology 275 12.4 Summary 275 Chapter 13 Incident Response and Handling 277 13.0 Introduction 277 13.1 Incident Response Models 277 13.1.1 The Cyber Kill Chain 277 13.1.1.1 Steps of the Cyber Kill Chain 277 13.1.1.2 Reconnaissance 278 13.1.1.3 Weaponization 278 13.1.1.4 Delivery 278 13.1.1.5 Exploitation 279 13.1.1.6 Installation 279 13.1.1.7 Command and Control 279 13.1.1.8 Actions on Objectives 279 13.1.1.9 Activity - Identify the Kill Chain Step 279 13.1.2 The Diamond Model of Intrusion 280 13.1.2.1 Diamond Model Overview 280 13.1.2.2 Pivoting Across the Diamond Model 280 13.1.2.3 The Diamond Model and the Cyber Kill Chain 281 13.1.2.4 Activity - Identify the Diamond Model Features 282 13.1.3 The VERIS Schema 282 13.1.3.1 What is the VERIS Schema? 282 13.1.3.2 Create a VERIS Record 282 13.1.3.3 Top-Level and Second-Level Elements 283 13.1.3.4 The VERIS Community Database 285 13.1.3.5 Activity - Apply the VERIS Schema to an Incident 285 13.2 Incident Handling 285 13.2.1 CSIRTs 285 13.2.1.1 CSIRT Overview 285 13.2.1.2 Types of CSIRTs 286 13.2.1.3 CERT 286 13.2.1.4 Activity - Match the CSIRT with the CSIRT Goal 287 13.2.2 NIST 800-61r2 287 13.2.2.1 Establishing an Incident Response Capability 287 13.2.2.2 Incident Response Stakeholders 288 13.2.2.3 NIST Incident Response Life Cycle 288 13.2.2.4 Preparation 289 13.2.2.5 Detection and Analysis 290 13.2.2.6 Containment, Eradication, and Recovery 291 13.2.2.7 Post-Incident Activities 293 13.2.2.8 Incident Data Collection and Retention 294 13.2.2.9 Reporting Requirements and Information Sharing 295 13.2.2.10 Activity - Identify the Incident Response Plan Elements 296 13.2.2.11 Activity - Identify the Incident Handling Term 296 13.2.2.12 Activity - Identify the Incident Handling Step 296 13.2.2.13 Lab - Incident Handling 296 13.3 Summary 296 9781587134371 TOC 3/7/2018

Read more less

Book SynopsisThe only authorized Lab Manual for the Cisco Networking Academy CCNA Cybersecurity Operations course Curriculum Objectives CCNA Cybersecurity Operations 1.0 covers knowledge and skills needed to successfully handle the tasks, duties, and responsibilities of an associate-level Security Analyst working in a Security Operations Center (SOC). Upon completion of the CCNA Cybersecurity Operations 1.0 course, students will be able to perform the following tasks: Install virtual machines to create a safe environment for implementing and analyzing cybersecurity threat events. Explain the role of the Cybersecurity Operations Analyst in the enterprise. Explain the Windows Operating System features and characteristics needed to support cybersecurity analyses. Explain the features and characteristics of the Linux Operating System. Analyze the operation of network protocols and services. Explain the operation of the network infrastructure. Classify the various types of network attacks. Use network monitoring tools to identify attacks against network protocols and services. Use various methods to prevent malicious access to computer networks, hosts, and data. Explain the impacts of cryptography on network security monitoring. Explain how to investigate endpoint vulnerabilities and attacks. Analyze network intrusion data to verify potential exploits. Apply incident response models to manage network security incidents.Table of ContentsChapter 1. Cybersecurity and the Security Operations Center 1.1 The Danger 1.2 Fighters in the War Against Cybercrime Chapter 2. Windows Operating System 2.1 Windows Overview 2.2 Windows Administration Chapter 3. Linux Operating System 3.1 Linux Overview . 3.2 Linux Administration 3.3 Linux Hosts Chapter 4. Network Protocols and Services 4.1 Network Protocols 4.2 Ethernet and Internet Protocol 4.3 Connectivity Verification 4.4 Address Resolution Protocol 4.5 The Transport Layer 4.6 Network Services Chapter 5. Network Infrastructure 5.1 Network Communication Devices 5.2 Network Security Infrastructure 5.3 Network Representations Chapter 6. Principles of Network Security 6.1 Attackers and Their Tools 6.2 Common Threats and Attacks Chapter 7. Network Attacks: A Deeper Look 7.1 Observing Network Operation 7.2 Attacking the Foundation 7.3 Attacking What We Do Chapter 8. Protecting the Network 8.1 Understanding Defense 8.2 Access Control 8.3 Threat Intelligence Chapter 9. Cryptography and the Public Key Infrastructure 9.1 Cryptography 9.2 Public Key Cryptography Chapter 10. Endpoint Security and Analysis 10.1 Endpoint Protection 10.2 Endpoint Vulnerability Assessment Chapter 11. Security Monitoring 11.1 Technologies and Protocols 11.2 Log Files Chapter 12. Intrusion Data Analysis 12.1 Evaluating Alerts 12.2 Working with Network Security Data 12.3 Digital Forensics Chapter 13. Incident Response and Handling 13.1 Incident Response Models 13.2 CSIRTs and NIST 800-61r2

Read more less

Book SynopsisChris Jackson, CCIE No. 6256, is a Distinguished Systems Engineer working in worldwide sales training and enablement and the author of Network Security Auditing (Cisco Press, 2010). Chris is focused on all aspects of Cisco data center and cloud, not only in a technology perspective but through thought leadership in helping Cisco and customers better leverage the business transformational aspects these technologies provide. He holds dual CCIEs in security and routing and switching, CISA, CISSP, ITIL v3, seven SANS certifications, and a bachelor's degree in business administration. Residing in Franklin, Tennessee, Chris enjoys tinkering with RC drones, robotics, and anything else that can be programmed to do his bidding. In addition, he is a black belt in Taekwondo and a rabid Star Wars fan, and has a ridiculous collection of Lego. His wife, Barbara, and three children, Caleb, Sydney, and Savannah, are the true joy of his life and proof that not everything ha

Read more less

Book Synopsis

Read more less