Cisco CCNA Cybersecurity

Monitoring depends on what you can see. You compare packet captures, flow records, firewall, proxy and DNS logs, and learn what encryption, address translation and tunneling hide from each source.

• Full packet capture and what it costs
• NetFlow and flow records
• Firewall, proxy and DNS logs
• What NAT and encryption hide
• Tunneling and its effect on visibility
• Choosing the right data for a question

You build A visibility map showing which data source answers which question for a sample network.

You cannot spot an attack you cannot name. This module covers denial of service, spoofing and reconnaissance, then web attacks such as SQL injection, cross-site scripting and command injection, and what each leaves behind in your data.

• Reconnaissance and scanning
• Denial-of-service and amplification
• Spoofing and man-in-the-middle attacks
• SQL injection and cross-site scripting
• Command injection and path traversal
• DNS tunneling and data exfiltration

You build A catalog of attacks, each with the log or traffic pattern that reveals it.

Attackers go after people and machines, then hide. You study malware families and delivery, phishing and pretexting, privilege escalation, and the encryption, obfuscation and exhaustion tricks used to slip past defenses.

• Malware types and how they spread
• Phishing and other social engineering
• Privilege escalation and persistence
• Encryption and obfuscation as evasion
• Resource exhaustion and fragmentation tricks
• Linking attacker steps to detection

You build An annotated walkthrough of one phishing-to-compromise chain with detection points.

Evidence lives inside operating systems. You learn the processes, services, registry, file systems and permissions of Windows and Linux, and which of them an attacker is likely to touch.

• Windows processes, services and the registry
• Windows file system and permissions
• Linux processes, daemons and the file tree
• Linux permissions and users
• Where each system keeps its logs
• Spotting abnormal processes and persistence

You build A triage checklist for a suspect Windows host and a suspect Linux host.

Endpoint tools produce the first alerts. You compare antimalware, host firewalls, intrusion detection and application allow lists, read host and SIEM logs, and interpret a sandbox’s malware analysis report.

• Antimalware, host firewalls and HIDS
• Application allow lists and control
• Reading Windows and Linux event logs
• Searching and correlating in a SIEM
• Reading a malware analysis report
• Judging a verdict: true or false positive

You build A triaged host alert with log evidence and a malware report summary.

Packets tell the truth that logs summarize. You read Ethernet, IP, TCP, UDP, HTTP and DNS headers, use Wireshark filters to find a conversation, and extract a file from a TCP stream.

• Ethernet, IP and transport headers
• HTTP and DNS in a capture
• Wireshark display and capture filters
• Following a TCP stream
• Extracting a transferred file
• Hashing the file and checking it

You build A packet capture analysis that recovers a transferred file and identifies its source.

Now connect events to their origin. You map IDS and firewall alerts to sources, compare stateful, deep and proxy inspection, use taps and SPAN ports to feed sensors, and pick out the key elements of an intrusion in a capture.

• Reading IDS and IPS alerts
• Stateful, deep packet and proxy inspection compared
• Network taps and SPAN ports
• Correlating alerts with flows and logs
• Key elements of an intrusion in a PCAP
• Writing down the sequence of events

You build An intrusion timeline built from an alert, flow records and a packet capture.

Findings must stand up to scrutiny. You classify evidence, keep a chain of custody, weigh what can and cannot be attributed, and build baseline profiles of networks and servers so unusual behavior stands out.

• Best, corroborative and indirect evidence
• Chain of custody
• Attribution and its limits
• Network profiling: traffic, ports and sessions
• Server profiling: processes, accounts and listening ports
• Using a baseline to spot change

You build A baseline profile of a server and a network, used to flag an anomaly.

A calm process beats improvisation. You work through the incident handling lifecycle in NIST SP 800-61, identify who must be involved at each stage, and handle protected data correctly.

• Preparation and the response team
• Detection and analysis
• Containment, eradication and recovery
• Post-incident review
• Stakeholders and their roles
• Protected data and reporting duties

You build An incident response plan mapped to the stages of the lifecycle.

AI now sits inside many SOC tools. You learn where it helps with triage, anomaly detection and summarizing alerts, where it makes mistakes, and how an analyst checks and owns what it reports.

• How AI assists alert triage
• Anomaly detection against fixed rules
• AI-written summaries and their limits
• False positives, false negatives and over-trust
• Keeping an analyst accountable for the result

You build A comparison of AI-assisted and manual triage on the same set of alerts.

Work one case from the first alert to the final report. You triage, pull the right data, analyze hosts and traffic, build a timeline, apply the response process and write up what happened for a non-specialist.

• Triaging the initial alert
• Collecting host and network evidence
• Building the timeline and finding the cause
• Applying the response process
• Reporting to technical and non-technical readers

You build A full incident report for a simulated intrusion, with evidence and recommendations.