Cisco CCNP Cybersecurity

Security work must justify itself in terms the business accepts. You assess risk qualitatively and quantitatively, map controls to compliance standards, and show what an incident means against each requirement.

• Qualitative and quantitative risk analysis
• Risk registers and treatment decisions
• Common frameworks: NIST CSF and ISO 27001
• Sector standards such as PCI DSS and HIPAA
• Mapping controls to requirements
• Reporting residual risk

You build A risk analysis for one system with controls mapped to a framework.

Cloud changes what evidence you have and who holds it. You investigate identity misuse, misconfiguration and workload compromise in cloud platforms, and plan responses that respect the provider’s limits.

• Cloud logs and where they live
• Identity and access misuse in the cloud
• Misconfigured storage and exposed services
• Container and serverless incidents
• Responding within provider boundaries
• Preserving cloud evidence

You build An investigation of a simulated cloud account compromise, from log to containment.

Rules catch what you already know; analytics catch what you do not. You build baselines, use statistical and behavior-based detection, and judge whether a user or entity anomaly is a threat or a quirk.

• Baselines and what normal looks like
• Rule-based against behavior-based detection
• User and entity behavior analytics
• Tuning alerts to cut noise
• Validating an anomaly before escalating

You build A set of detections with baselines and tuning notes, tested on sample logs.

Intelligence is only worth what you do with it. You evaluate sources, work with indicators and structured formats, use MITRE ATT&CK and the kill chain to describe adversary behavior, and feed findings back into detection.

• Types and sources of threat intelligence
• Judging reliability and relevance
• STIX and TAXII for sharing indicators
• MITRE ATT&CK for describing behavior
• Kill chain and diamond model analysis
• Turning intelligence into detections

You build An intelligence brief on one actor with indicators converted into detections.

Prevention and forensics share the same data. You choose hardening measures and DLP controls for a stated risk, then read packet captures to confirm what actually left the network.

• Hardening servers, endpoints and network devices
• Configuration baselines and drift
• Data loss prevention for endpoints, email and network
• Capturing and filtering packets
• Tracing an attack from traffic patterns
• Choosing the right technique for a given question

You build A hardening and DLP plan plus a capture analysis that traces one attack.

Modeling a system before it is attacked shows where it will break. You draw data flows, apply STRIDE, build attack trees and rank the threats you find so controls go where they matter.

• Data flow diagrams and trust boundaries
• STRIDE threat categories
• Attack trees and attack paths
• Rating and prioritizing threats
• Turning a model into security requirements

You build A threat model for a real web application, with prioritized mitigations.

Understanding malware turns one infection into protection for many machines. You triage a sample with static and dynamic analysis, run it in a sandbox, and extract indicators of compromise and of attack to hunt for elsewhere.

• Safe handling of a malware sample
• Static analysis: strings, headers and hashes
• Dynamic analysis in a sandbox
• Persistence and command-and-control behavior
• Indicators of compromise against indicators of attack
• Writing YARA rules

You build A malware analysis report with extracted indicators and a working detection rule.

Teams cannot patch everything at once. You follow an intrusion on an endpoint through processes, persistence and lateral movement, and triage vulnerabilities with CVSS and business context to decide what is fixed first.

• Reconstructing an endpoint intrusion
• Process, persistence and credential artifacts
• Lateral movement evidence
• CVSS base, temporal and environmental scoring
• Adding exploit and asset context to triage
• Communicating priorities to system owners

You build An endpoint intrusion timeline and a triaged list of vulnerabilities with reasons.

Manual triage does not scale. You read and modify Python scripts, call REST APIs, use Bash for quick tasks, and describe how CI/CD and infrastructure as code apply to security tooling and its configuration.

• Reading and changing a Python script
• Calling a security tool’s REST API
• Bash for log and file handling
• Enriching alerts automatically
• CI/CD pipelines for detection content
• Infrastructure as code for security tooling

You build A script that enriches alerts through an API and writes a triage summary.

Run one incident the way a senior analyst would. You apply the playbook, gather intelligence, analyze traffic and endpoints, assess the risk, automate the repetitive parts and report to technical and business readers.

• Selecting and adapting a playbook
• Gathering and using intelligence
• Investigating network and endpoint evidence
• Automating enrichment and containment steps
• Reporting and lessons learned

You build A complete case file for a simulated intrusion, with timeline, indicators and recommendations.