CCNP Cybersecurity Bootcamp

• Risk analysis: asset, vulnerability, threat [1.6]
• Which industry each compliance standard covers [1.4]
• Cyber risk insurance [1.5]
• Threat model components [3.1]

LAB Score three assets and match each to its standard

• The IR workflow [1.7]
• IR metrics [1.8]
• Goals of incident response [CBRFIR 5.1]
• Playbook elements [CBRFIR 5.2]

LAB Sort a real incident timeline into IR phases

• Playbook components [1.1]
• Choosing tools from a playbook [1.2]
• Running a DDoS or defacement playbook [1.3]
• Investigation steps by case type [3.2]

LAB Run a website defacement playbook against an alert

• Cloud environment types [1.9]
• SecOps in IaaS and PaaS [1.10]
• Evidence from cloud and virtual platforms [CBRFIR 1.7]
• DevSecOps recommendations [2.10]

LAB Decide what evidence you can collect in IaaS vs PaaS

• Evaluating security posture [2.3]
• Hardened images and standards sources [2.2, 2.5]
• Patching and services to disable [2.6, 2.7]
• Finding control gaps [2.4]

LAB Audit a server build and write the fixes

• Segmentation [2.8]
• Network hardening controls [2.9]
• Tuning rules and filters [2.15]
• Troubleshooting detection rules [2.24]

LAB Fix a noisy IDS rule without losing real detections

• Data states and leakage [2.13]
• DLP on host, network, application and cloud [2.14]
• Investigating data loss [3.8]

LAB Trace a leaked file across endpoint and cloud logs

• Network analysis tools and their limits [2.22]
• Artifacts and streams in a pcap [2.23]
• NetFlow and Wireshark filters [CBRFIR 4.3]
• tcpdump [CBRFIR 2.6]

LAB Extract a file and the C2 host from a capture

• SIEM, IDS/IPS and syslog alerts [CBRFIR 3.1]
• Apache and NGINX logs [CBRFIR 4.2]
• Cloud-native application logs [CBRFIR 2.3.b]

LAB Find the attacker requests in a web server log

• Security data management [2.16]
• SIEM analytics [2.17]
• UEBA and next actions [2.20, 2.21]
• Dashboards for stakeholders [2.19]

LAB Build a SIEM search for impossible-travel logins

• Threat intelligence platforms [2.11]
• AI-driven threat intelligence [2.12]
• STIX and TAXII [CBRFIR 5.5]
• IOCs and IOAs from feeds [CBRFIR 3.9]

LAB Parse a STIX bundle and load its indicators

• Known IOCs and IOAs [3.6]
• TTPs from an attack [2.25]
• MITRE ATT&CK for fileless malware [CBRFIR 2.1]
• Threat actor profiles [CBRFIR 3.10]

LAB Map an intrusion to ATT&CK techniques

• AI-powered data analytics [2.1]
• Predictive AI traffic analysis [3.4]
• 0-day response and predictive vulnerability management [CBRFIR 3.6]

LAB Decide whether an AI-flagged anomaly is real

• Threat intel in Cisco solutions [CBRFIR 3.11]
• Choosing the right Cisco solution [CBRFIR 3.8]
• Mitigating firewall, IPS, SIEM and XDR alerts [CBRFIR 3.5]
• Acting on intelligence artifacts [CBRFIR 3.7]

LAB Choose and justify a control for five alerts

• Root cause analysis reports [CBRFIR 1.1]
• Network device forensics [CBRFIR 1.2]
• Key host files and their locations [CBRFIR 2.2]
• Process analysis [CBRFIR 2.3.a]

LAB Collect evidence from a compromised router and host

• Investigating endpoint intrusion [3.5]
• Memory forensics tools [CBRFIR 1.6.d]
• Volatility, Sysinternals and SIFT [CBRFIR 2.6]
• Endpoint files and ad-hoc scans [CBRFIR 5.4]

LAB Find an injected process in a memory image

• Base64, hex, polymorphic and metamorphic code [CBRFIR 1.4]
• Identifying code from a snippet [CBRFIR 2.4]
• Deobfuscation tools [CBRFIR 1.6.c]

LAB Decode an obfuscated PowerShell launcher

• Antiforensic TTPs [CBRFIR 1.3]
• Evasion, data destruction and geolocation [CBRFIR 4.1]
• Traffic anomaly detection [CBRFIR 2.3.c]

LAB Spot cleared logs and timestomping on a host

• Extracting samples [3.3.a]
• Sandbox analysis [3.3.c]
• Sandbox IOCs [3.7]
• Reading a ThreatGrid report [CBRFIR 5.3]

LAB Pull and summarize IOCs from a sandbox report

• When static analysis is needed [3.3.d]
• Static analysis and reverse engineering [3.3.b, 3.3.e]
• Hex editors [CBRFIR 1.6.a]
• Disassemblers and debuggers [CBRFIR 1.6.b]

LAB Find the C2 address inside a sample

• YARA rules [CBRFIR 1.5]
• Next steps from file characteristics [CBRFIR 4.4]
• objdump and CLI binary tools [CBRFIR 4.5]

LAB Write a YARA rule for a malware family

• Data to correlate by incident type [CBRFIR 3.2]
• Attack vectors and mitigation [CBRFIR 3.3]
• Post-incident actions [CBRFIR 3.4]

LAB Correlate host and network evidence for one intrusion

• Vulnerability mitigation steps [3.9]
• Triage with CVSS [3.10]
• Risk analysis revisited [1.6]

LAB Prioritize a vulnerability scan for a patch window

• The IR workflow end to end [1.7]
• Applying a playbook [1.3]
• Writing the root cause report [CBRFIR 1.1]

LAB Work a ransomware case from first alert to report

• Bash files, navigation and variables [4.10]
• JSON, CSV, XML and HTML [4.4]

LAB Filter a large log file with Bash

• Reading Python scripts [4.2]
• Modifying a script for a SecOps task [4.3]
• Log parsing in Python, PowerShell and Bash [CBRFIR 2.5]

LAB Extend a script to pull Secure Endpoint events

• HTTP response codes [4.7]
• Parts of a response [4.8]
• API authentication [4.9]
• Rate limits, timeouts and payloads [4.6]

LAB Debug a failing API call from its status codes

• SOAR concepts [4.1]
• Automation and ML opportunities [4.5]
• Escalation workflows [2.18]

LAB Design a phishing triage workflow

• CI/CD components [4.11]
• DevOps practices [4.12]
• Infrastructure as code [4.13]

LAB Add a security check stage to a pipeline

• Techniques domain review (2.0)
• Processes domain review (3.0)
• CBRFIR forensics and IR review (2.0, 3.0)

LAB Mixed-scenario case study

• Weak-domain review (CBRCOR 1.0 to 4.0)
• CBRFIR domain review (1.0 to 5.0)
• Exam timing strategy
• Full-length practice exams

LAB Timed CBRCOR and CBRFIR practice exams