Cisco CCNP Security

AI systems add a new attack surface. You study prompt injection, data poisoning, model extraction and unsafe output handling, and learn which controls reduce each risk.

• How prompt injection works, direct and indirect
• Training data poisoning
• Model theft and sensitive data leakage
• Insecure handling of model output
• Controls for AI applications: filtering, limits and monitoring
• Using the OWASP list for LLM applications

You build A threat model for one LLM-backed application, with mitigations for each threat.

VPNs and certificates rest on a handful of cryptographic ideas. You compare symmetric and asymmetric encryption, hashing and signatures, then see how IPsec and TLS-based VPNs negotiate keys and protect traffic.

• Symmetric and asymmetric encryption
• Hashing, HMAC and digital signatures
• Public key infrastructure and certificates
• IPsec: IKE phases and ESP
• SSL and TLS VPNs for remote access
• Choosing between site-to-site and remote access designs

You build A VPN design that states its algorithms, authentication and trust anchors.

Zero trust replaces the idea of a trusted inside with continuous checks. You learn its core principles, how identity, device health and context combine into access decisions, and how segmentation limits what a stolen credential can reach.

• Never trust, always verify
• Identity, device and application as signals
• Policy decision and enforcement points
• Micro-segmentation and least privilege
• Zero trust for workforce, workload and workplace
• Reading NIST’s zero trust architecture guidance

You build A zero trust target architecture for one business application.

The firewall is where policy becomes traffic decisions. You write access control policy on Cisco Secure Firewall, add intrusion prevention, segment zones, apply NAT and run the firewalls in high availability.

• Zones, interfaces and access control rules
• Application and URL visibility in policy
• Intrusion prevention policy and tuning
• Network address translation on the firewall
• Central management with the management center
• Failover and clustering
• Troubleshooting a blocked flow

You build A firewall policy for three zones with intrusion prevention and verified rule hits.

Infrastructure that anyone can log into is a liability. You harden devices and planes, centralize authentication with TACACS+ and RADIUS, and set up VPNs and access control on Secure Firewall.

• Hardening the management, control and data planes
• Local and centralized AAA
• TACACS+ command authorization compared with RADIUS
• Remote access VPN on the firewall
• Site-to-site VPN with redundancy
• Layer 2 and first-hop protections

You build A hardening checklist and AAA configuration applied to firewall and switch.

Cloud moves some duties to the provider and keeps the rest with you. You apply shared responsibility, choose controls for each service model, send cloud logs to Splunk, and see how DevSecOps and eBPF bring security into pipelines and workloads.

• The shared responsibility model by service type
• Choosing identity, network and data controls in the cloud
• Collecting cloud logs and forwarding them to Splunk
• Alerting on cloud activity
• DevSecOps: security checks inside the pipeline
• eBPF for observability and enforcement
• Container and workload protection

You build A cloud logging and alerting plan that routes events to a Splunk search.

Users now work anywhere, so security moves to the cloud edge. You compare SSE with SASE, learn the functions that make up a secure service edge, and configure Cisco Secure Access for private and internet-bound traffic.

• SSE and SASE: what each includes
• Secure web gateway and DNS-layer security
• Zero trust network access to private apps
• Cloud-delivered firewall and CASB functions
• Configuring Secure Access policy
• Connecting branches and roaming users

You build A Secure Access policy set for remote users, one private app and internet access.

Data now leaves through browsers and AI tools. You define DLP rules for sensitive data, apply controls to generative AI use, and weigh how strict policy should be before it blocks real work.

• Classifying sensitive data
• Writing DLP rules and tuning false positives
• Controlling use of public AI tools
• AI guardrails: prompt and response inspection
• Reporting and responding to policy hits
• Balancing protection with productivity

You build A DLP and AI usage policy tested against sample sensitive data.

Endpoints and inboxes are where most attacks begin. You compare EPP and EDR, check device posture, manage devices through MDM, deploy Cisco Secure Endpoint, and defend email against phishing and spoofing.

• EPP and EDR compared
• Cisco Secure Endpoint deployment and policy
• Device posture and compliance checks
• Mobile device management for security
• Email threat defense and attachment analysis
• SPF, DKIM and DMARC
• Investigating an endpoint detection

You build An endpoint and email protection plan with detection and response steps.

Network access should depend on who and what is connecting. You configure 802.1X and MAB on switches, build ISE policy sets with authentication and authorization rules, and change access in a live session with change of authorization.

• 802.1X roles: supplicant, authenticator and server
• MAC authentication bypass for devices that cannot authenticate
• ISE policy sets, conditions and results
• Authorization profiles and dynamic VLANs
• Change of authorization for a live session
• Troubleshooting failed authentications

You build A working 802.1X and MAB setup with ISE policy for employees and a printer.

Enforcement needs evidence. You study how attackers move data out, which telemetry reveals it, and how Cisco Duo and multi-factor policy fit into a zero trust design.

• Data exfiltration techniques
• Flow, DNS and proxy telemetry for detection
• Correlating network and identity events
• Duo multi-factor authentication and trusted devices
• Adaptive access policy
• Placing MFA in a zero trust design

You build A detection plan that links exfiltration paths to the telemetry that exposes them.

Combine identity, network, edge, endpoint and cloud controls into one design. You take a business scenario, place each control, justify it against a threat and describe how you would verify it works.

• Reading the scenario and its risks
• Selecting controls for each layer
• Placing policy enforcement points
• Planning logging and detection
• Testing and defending the design

You build A layered security design for a hybrid company, with controls justified against threats.