CCNP Security Bootcamp

• Threat types across on-prem, hybrid and cloud [1.1]
• Common exploits and the OWASP Top 10 [1.2]
• Prioritizing with CVE and CVSS [1.2]
• Defense in depth with SAFE [1.9]

LAB Rank CVEs by CVSS and place each in the SAFE model

• AI as an attack threat [1.1]
• Prompt injection and system prompt leakage [1.3]
• Vector, embedding and supply chain weaknesses [1.3]
• Phishing and social engineering controls [1.4]

LAB Classify emails and chatbot prompts as safe, phishing or injection

• Hashing, symmetric and asymmetric encryption [1.5]
• PKI and certificate-based authorization [1.5]
• TLS, QUIC and MASQUE [1.5]
• Post-quantum cryptography [1.5]

LAB Inspect a certificate chain and a TLS handshake capture

• IPsec, IKEv2 and NAT-T [1.5]
• VTI and standards-based IPsec [1.6]
• DMVPN, FlexVPN and GETVPN compared [1.6]
• SSL VPN, preshared keys and certificates [1.6]

LAB Build an IKEv2 VTI tunnel between two routers

• Zero trust architecture [1.8]
• Authoring, sharing and consuming intelligence [1.7]
• Reading Python scripts that call security APIs [1.10]
• Security monitoring and telemetry [2.2]

LAB Trace a Python script that pulls indicators from a REST API

• Port security, DHCP snooping and DAI [2.3]
• Storm control, VLAN hopping and STP defenses [2.3]
• Segmentation with VLANs and SGTs [2.3]
• CIS benchmarks for IOS XE [2.5]

LAB Harden an access switch against rogue DHCP and ARP spoofing

• SNMPv3 [2.7]
• Secure syslog and authenticated NTP [2.7]
• NETCONF, RESTCONF and APIs [2.7]
• In-band vs out-of-band management [2.4]

LAB Move a router to SNMPv3, authenticated NTP and secure syslog

• AAA concepts and protocol differences [2.6]
• Device administration with TACACS+ [2.6]
• Network access with RADIUS [2.6]
• Troubleshooting failed AAA [2.6]

LAB Find and fix a broken TACACS+ login

• Single vs multidevice managers [2.4]
• On-prem vs cloud with Security Cloud Control [2.4]
• IPS and firewall deployment models [2.1]
• CIS benchmarks for Secure Firewall [2.5]

LAB Pick a manager and deployment model for three branches

• FTD, FMC, FDM and Security Cloud Control [SNCF 3.5]
• Virtual appliances on-prem and in the cloud [SNCF 1.4]
• Snort inside Threat Defense [SNCF 2.6]
• Firewall and IPS deployment models [2.1]

LAB Register an FTD to FMC and confirm its health

• Routed mode [SNCF 1.1.a]
• Transparent mode [SNCF 1.1.b]
• Passive and inline NGIPS [SNCF 1.2.a, 1.2.b]

LAB Convert a firewall between routed and transparent mode

• System settings [SNCF 2.1]
• Certificates, platform settings and health policy [SNCF 2.5.a]
• Object management [SNCF 2.4.a]

LAB Build reusable objects and a health policy

• NAT on FTD [SNCF 2.5.b]
• Routing and QoS [SNCF 2.5.b]
• ECMP routing [SNCF 1.3.c]
• Static route tracking [SNCF 1.3.d]

LAB Configure PAT and a tracked backup default route

• Port channels [SNCF 1.3.a]
• Active/standby failover [SNCF 1.3.b]
• Clustering [SNCF 1.3.e]

LAB Build a failover pair and test a failover

• Access control and prefilter rules [SNCF 2.2]
• DNS and identity policies [SNCF 2.2]
• Application visibility and URL filtering [2.8]

LAB Block a URL category for one user group

• Intrusion rules and policies [SNCF 2.4.b]
• Network analysis policy [SNCF 2.2]
• Applying IPS on Threat Defense [2.8]

LAB Tune an intrusion policy and trigger a test rule

• Network discovery [SNCF 2.3.a]
• Application detectors [SNCF 2.3.b]
• Encrypted Visibility Engine [SNCF 2.3.d]
• The network map [SNCF 3.4]

LAB Build an application detector and read the network map

• Malware Defense in FMC [SNCF 4.1]
• Secure Endpoint integration [SNCF 4.2]
• Malware protection on Threat Defense [2.8]

LAB Block a test file by disposition and trace the event

• Threat Intelligence Director [SNCF 4.3]
• Correlation policies [SNCF 2.3.c]
• Rapid Threat Containment [SNCF 4.6]
• pxGrid integration [SNCF 4.5]

LAB Load a third-party feed and quarantine a host

• Site-to-site VPN on FTD [2.9]
• Remote access with Cisco Secure Client [2.9]
• ZTNA on Threat Defense [SNCF 2.5.c]
• Troubleshooting tunnel setup [2.10]

LAB Fix a site-to-site tunnel that fails in phase 1

• Connection, intrusion, malware and unified events [SNCF 3.4]
• Dashboards and reports [SNCF 3.2]
• Monitoring and telemetry [2.2]

LAB Build a dashboard and report for a simulated attack

• FMC GUI and device CLI [SNCF 3.1]
• Packet capture and Packet Tracer [SNCF 3.3.a, 3.3.b]
• Firewall engine debug [SNCF 3.3.c]
• System Support Trace [SNCF 3.3.d]

LAB Find why a flow is dropped with Packet Tracer and captures

• Cisco XDR investigations [SNCF 4.4]
• Security Analytics and Logging [SNCF 4.7]
• Splunk and AI-driven threat intelligence [SNCF 4.8]

LAB Follow one incident from firewall event to XDR

• Shared responsibility models [3.1]
• Capabilities, frameworks and policy management [3.2]
• NIST 800-145 service models and cloud types [3.3]
• CASB [3.3]

LAB Assign each control to the provider or the customer

• Multicloud Defense and Secure Workload [3.4]
• eBPF for workload protection [3.6]
• DevSecOps, IaC and CI/CD [3.7]

LAB Find the security mistakes in an IaC template

• Ingesting cloud and security logs into Splunk [3.5]
• Managing and automating events with Splunk [6.8]
• Visibility with XDR and native AI/ML [6.6]

LAB Ingest firewall and cloud logs and search for one host

• SSE vs SASE [4.1]
• Secure Internet Access [4.2]
• Secure Private Access [4.3]

LAB Publish a private app and a web policy

• DLP and AI guardrails [4.4]
• Investigate scores and indicators [4.5]
• Exfiltration techniques [6.5]

LAB Detect DNS tunneling and block an unsanctioned upload

• EPP vs EDR [5.1]
• MDM and asset inventory [5.2]
• Posture assessment [5.3]
• Secure Client and Secure Malware Analytics [5.4]

LAB Compare posture results for two laptops

• Configuring Secure Endpoint [5.5]
• Reading malware detection events [5.6]
• Email Threat Defense [5.7]

LAB Triage three endpoint events and one malicious email

• Guest, profiling, posture and BYOD [6.1]
• Compliance and application control [6.2]
• 802.1X and MAB [6.3]
• Change of Authorization [6.4]

LAB Fix a port where 802.1X falls back to MAB

• Duo MFA, SSO and Adaptive Access [6.7]
• Device Trust and Trust Monitor [6.7]
• Zero trust across the whole design [1.8]

LAB Write an adaptive access policy for contractors

• Concepts and cryptography [1.5]
• Firewall policy and VPN [2.8, 2.9]
• Cloud and SSE [3.2, 4.1]
• Threat Defense troubleshooting [SNCF 3.3]

LAB Fix a network with firewall, VPN and AAA faults

• Weak-domain review (SCOR 1.0 to 6.0)
• SNCF domain review (1.0 to 4.0)
• Exam timing strategy
• Full-length practice exams

LAB Timed SCOR and SNCF practice exams