200-201: Cisco Certified Cybersecurity Associate

Foundations

• CIA triad
• Security deployments: network, endpoint, application
• Agentless and agent-based protection
• SIEM and SOAR concepts

Risk and access

• Threat, vulnerability, exploit and risk
• Access control models
• Threat intelligence and threat hunting

Frameworks

• Attack frameworks and kill chains
• CVSS terminology
• Security metrics

• Lab: Map an attack scenario to a framework · 35 min

Data and visibility

• Data types: full packet, session, transaction, statistical, alert
• Impact of encryption, NAT and tunnelling
• Network telemetry

Attack types

• Network attacks
• Web application attacks
• Social engineering
• Evasion and obfuscation techniques

Log analysis

• Log sources and formats
• Correlating events

• Lab: Investigate suspicious activity in SIEM-style logs · 60 min

Endpoint technologies

• Host firewalls and antimalware
• HIDS and EDR
• Application allow-listing and sandboxing

Operating system artefacts

• Windows processes, registry and event logs
• Linux processes and logs
• Interpreting host evidence

• Lab: Examine host artefacts after a compromise · 50 min

Evidence and malware

• Evidence types and chain of custody
• Malware analysis tool output
• Indicators of compromise

Packet analysis

• Protocol headers
• Reading PCAP files
• Extracting files and indicators

• Lab: Analyse a packet capture to reconstruct an attack · 60 min

Alerts and flows

• IDS/IPS alerts and true and false positives
• NetFlow analysis
• Regular expressions for searching

• Lab: Triage IDS alerts and classify them · 40 min

Incident handling

• Incident response life cycle
• Roles in a SOC
• Evidence and reporting

• Lab: Work a mock incident from detection to report · 60 min

Profiling and metrics

• Network and server profiling
• Data classification
• SOC metrics

Exam readiness

• Domain review
• Mock exam and review