Introduction |
|
xxi | |
Assessment Test |
|
xxxi | |
Chapter 1 Understanding Security Fundamentals |
|
1 | (24) |
|
|
2 | (13) |
|
|
2 | (1) |
|
|
3 | (1) |
|
|
3 | (1) |
|
|
3 | (3) |
|
|
6 | (1) |
|
|
7 | (8) |
|
|
15 | (2) |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
Common Network Security Zones |
|
|
17 | (2) |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
18 | (1) |
|
|
18 | (1) |
|
|
19 | (1) |
|
|
19 | (1) |
|
|
20 | (5) |
Chapter 2 Understanding Security Threats |
|
25 | (20) |
|
|
26 | (12) |
|
|
26 | (1) |
|
Classifying Attack Vectors |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
29 | (1) |
|
|
30 | (4) |
|
|
34 | (1) |
|
|
34 | (2) |
|
|
36 | (1) |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
38 | (2) |
|
|
38 | (1) |
|
|
38 | (1) |
|
|
39 | (1) |
|
Data Loss and Exfiltration |
|
|
39 | (1) |
|
|
40 | (1) |
|
|
40 | (2) |
|
|
42 | (3) |
Chapter 3 Understanding Cryptography |
|
45 | (28) |
|
Symmetric and Asymmetric Encryption |
|
|
46 | (7) |
|
|
46 | (2) |
|
|
48 | (5) |
|
|
53 | (4) |
|
|
54 | (1) |
|
|
54 | (1) |
|
|
54 | (1) |
|
|
55 | (1) |
|
|
55 | (2) |
|
|
57 | (1) |
|
|
57 | (1) |
|
Public Key Infrastructure |
|
|
57 | (11) |
|
|
58 | (2) |
|
|
60 | (1) |
|
|
61 | (2) |
|
|
63 | (1) |
|
|
64 | (1) |
|
|
65 | (2) |
|
|
67 | (1) |
|
|
68 | (1) |
|
|
68 | (1) |
|
|
69 | (4) |
Chapter 4 Securing the Routing Process |
|
73 | (18) |
|
|
74 | (6) |
|
|
74 | (2) |
|
Configuring Privilege Levels in IOS |
|
|
76 | (1) |
|
Configuring IOS Role-Based CLI |
|
|
77 | (2) |
|
Implementing Cisco IOS Resilient Configuration |
|
|
79 | (1) |
|
Implementing OSPF Routing Update Authentication |
|
|
80 | (2) |
|
Implementing OSPF Routing Update Authentication |
|
|
80 | (2) |
|
Implementing EIGRP Routing Update Authentication |
|
|
82 | (1) |
|
Securing the Control Plane |
|
|
82 | (2) |
|
|
83 | (1) |
|
|
84 | (1) |
|
|
85 | (1) |
|
|
86 | (5) |
Chapter 5 Understanding Layer 2 Attacks |
|
91 | (16) |
|
Understanding STP Attacks |
|
|
92 | (1) |
|
Understanding ARP Attacks |
|
|
93 | (2) |
|
Understanding MAC Attacks |
|
|
95 | (1) |
|
Understanding CAM Overflows |
|
|
96 | (1) |
|
Understanding CDP/LLDP Reconnaissance |
|
|
97 | (1) |
|
Understanding VLAN Hopping |
|
|
98 | (1) |
|
|
98 | (1) |
|
|
99 | (1) |
|
Understanding DHCP Spoofing |
|
|
99 | (2) |
|
|
101 | (1) |
|
|
101 | (1) |
|
|
102 | (5) |
Chapter 6 Preventing Layer 2 Attacks |
|
107 | (20) |
|
Configuring DHCP Snooping |
|
|
108 | (2) |
|
Configuring Dynamic ARP Inspection |
|
|
110 | (2) |
|
Configuring Port Security |
|
|
112 | (2) |
|
Configuring STP Security Features |
|
|
114 | (2) |
|
|
114 | (1) |
|
|
115 | (1) |
|
|
115 | (1) |
|
|
116 | (1) |
|
|
116 | (4) |
|
|
116 | (1) |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
118 | (2) |
|
|
120 | (1) |
|
|
120 | (1) |
|
|
121 | (1) |
|
|
122 | (5) |
Chapter 7 VLAN Security |
|
127 | (14) |
|
|
128 | (1) |
|
|
128 | (1) |
|
|
128 | (5) |
|
|
131 | (1) |
|
|
132 | (1) |
|
|
133 | (1) |
|
|
133 | (1) |
|
|
133 | (1) |
|
|
134 | (1) |
|
|
134 | (2) |
|
|
136 | (5) |
Chapter 8 Securing Management Traffic |
|
141 | (16) |
|
In-Band and Out-of-Band Management |
|
|
142 | (4) |
|
|
142 | (1) |
|
|
143 | (1) |
|
|
144 | (1) |
|
|
144 | (1) |
|
|
145 | (1) |
|
Securing Network Management |
|
|
146 | (3) |
|
|
146 | (1) |
|
|
146 | (1) |
|
|
146 | (1) |
|
|
147 | (2) |
|
Securing Access through SNMP v3 |
|
|
149 | (1) |
|
|
150 | (1) |
|
Using SCP for File Transfer |
|
|
151 | (1) |
|
|
151 | (1) |
|
|
152 | (1) |
|
|
153 | (4) |
Chapter 9 Understanding 802.1x and AAA |
|
157 | (14) |
|
|
158 | (1) |
|
RADIUS and TACACS+ Technologies |
|
|
159 | (1) |
|
Configuring Administrative Access with TACACS+ |
|
|
160 | (1) |
|
Local AAA Authentication and Accounting |
|
|
160 | (1) |
|
|
161 | (1) |
|
Understanding Authentication and Authorization Using ACS and ISE |
|
|
161 | (1) |
|
Understanding the Integration of Active Directory with AAA |
|
|
162 | (2) |
|
|
162 | (2) |
|
Verify Router Connectivity to TACACS+ |
|
|
164 | (1) |
|
|
164 | (1) |
|
|
165 | (1) |
|
|
166 | (5) |
Chapter 10 Securing a BYOD Initiative |
|
171 | (14) |
|
The BYOD Architecture Framework |
|
|
172 | (5) |
|
|
172 | (2) |
|
|
174 | (3) |
|
The Function of Mobile Device Management |
|
|
177 | (1) |
|
Integration with ISE Authorization Policies |
|
|
177 | (1) |
|
|
178 | (1) |
|
|
179 | (1) |
|
|
180 | (5) |
Chapter 11 Understanding VPNs |
|
185 | (18) |
|
|
186 | (9) |
|
|
186 | (3) |
|
|
189 | (3) |
|
|
192 | (2) |
|
|
194 | (1) |
|
Understanding Advanced VPN Concepts |
|
|
195 | (4) |
|
|
195 | (1) |
|
|
196 | (1) |
|
|
197 | (1) |
|
|
198 | (1) |
|
|
199 | (1) |
|
|
199 | (1) |
|
|
200 | (3) |
Chapter 12 Configuring VPNs |
|
203 | (16) |
|
Configuring Remote Access VPNs |
|
|
204 | (5) |
|
Basic Clientless SSL VPN Using ASDM |
|
|
204 | (3) |
|
Verify a Clientless Connection |
|
|
207 | (1) |
|
Basic AnyConnect SSL VPN Using ASDM |
|
|
207 | (2) |
|
Verify an AnyConnect Connection |
|
|
209 | (1) |
|
Endpoint Posture Assessment |
|
|
209 | (1) |
|
Configuring Site-to-Site VPNs |
|
|
209 | (3) |
|
Implement an IPsec Site-to-Site VPN with Preshared Key Authentication |
|
|
209 | (3) |
|
Verify an IPsec Site-to-Site VPN |
|
|
212 | (1) |
|
|
212 | (1) |
|
|
213 | (1) |
|
|
214 | (5) |
Chapter 13 Understanding Firewalls |
|
219 | (10) |
|
Understanding Firewall Technologies |
|
|
220 | (2) |
|
|
220 | (1) |
|
|
220 | (1) |
|
|
221 | (1) |
|
|
221 | (1) |
|
Stateful vs. Stateless Firewalls |
|
|
222 | (2) |
|
|
222 | (1) |
|
|
223 | (1) |
|
|
224 | (1) |
|
|
224 | (1) |
|
|
225 | (4) |
Chapter 14 Configuring NAT and Zone-Based Firewalls |
|
229 | (16) |
|
Implementing NAT on ASA 9.x |
|
|
230 | (6) |
|
|
231 | (1) |
|
|
232 | (1) |
|
|
233 | (1) |
|
|
233 | (2) |
|
|
235 | (1) |
|
Configuring Zone-Based Firewalls |
|
|
236 | (4) |
|
|
237 | (1) |
|
|
237 | (2) |
|
Configuring Zone-to-Zone Access |
|
|
239 | (1) |
|
|
240 | (1) |
|
|
240 | (1) |
|
|
241 | (4) |
Chapter 15 Configuring the Firewall on an ASA |
|
245 | (18) |
|
Understanding Firewall Services |
|
|
246 | (1) |
|
Understanding Modes of Deployment |
|
|
247 | (1) |
|
|
247 | (1) |
|
|
247 | (1) |
|
Understanding Methods of Implementing High Availability |
|
|
247 | (2) |
|
|
248 | (1) |
|
|
248 | (1) |
|
|
249 | (1) |
|
Understanding Security Contexts |
|
|
249 | (1) |
|
Configuring ASA Management Access |
|
|
250 | (1) |
|
|
250 | (1) |
|
Configuring Cisco ASA Interface Security Levels |
|
|
251 | (2) |
|
|
251 | (2) |
|
Configuring Security Access Policies |
|
|
253 | (3) |
|
|
253 | (1) |
|
|
254 | (2) |
|
Configuring Default Cisco Modular Policy Framework (MPF) |
|
|
256 | (1) |
|
|
257 | (1) |
|
|
257 | (2) |
|
|
259 | (4) |
Chapter 16 Intrusion Prevention |
|
263 | (22) |
|
|
264 | (3) |
|
|
264 | (1) |
|
|
264 | (1) |
|
|
265 | (1) |
|
|
265 | (1) |
|
|
265 | (1) |
|
|
265 | (1) |
|
Network-Based IPS vs. Host-Based IPS |
|
|
266 | (1) |
|
|
266 | (1) |
|
|
266 | (1) |
|
|
266 | (1) |
|
|
267 | (1) |
|
|
267 | (4) |
|
|
267 | (3) |
|
|
270 | (1) |
|
Alternate String Expressions |
|
|
271 | (1) |
|
Introducing Cisco FireSIGHT |
|
|
271 | (2) |
|
|
271 | (1) |
|
|
272 | (1) |
|
Understanding Modes of Deployment |
|
|
273 | (2) |
|
|
275 | (1) |
|
Positioning of the IPS within the Network |
|
|
275 | (2) |
|
|
275 | (1) |
|
|
276 | (1) |
|
|
277 | (1) |
|
Understanding False Positives, False Negatives, True Positives, and True Negatives |
|
|
277 | (1) |
|
|
278 | (1) |
|
|
278 | (2) |
|
|
280 | (5) |
Chapter 17 Content and Endpoint Security |
|
285 | (16) |
|
|
286 | (6) |
|
|
286 | (1) |
|
|
287 | (1) |
|
|
287 | (1) |
|
|
287 | (1) |
|
|
288 | (1) |
|
|
288 | (1) |
|
Cisco Email Security Appliance |
|
|
288 | (2) |
|
Putting the Pieces Together |
|
|
290 | (2) |
|
Mitigating Web-Based Threats |
|
|
292 | (2) |
|
Understanding Web Proxies |
|
|
292 | (1) |
|
Cisco Web Security Appliance |
|
|
293 | (1) |
|
Mitigating Endpoint Threats |
|
|
294 | (1) |
|
Cisco Identity Services Engine (ISE) |
|
|
294 | (1) |
|
|
294 | (1) |
|
|
294 | (1) |
|
Hardware/Software Encryption of Local Data |
|
|
294 | (1) |
|
|
295 | (1) |
|
|
295 | (1) |
|
|
295 | (1) |
|
|
296 | (5) |
Appendix Answers to Review Questions |
|
301 | (30) |
|
Chapter 1 Understanding Security Fundamentals |
|
|
302 | (2) |
|
Chapter 2 Understanding Security Threats |
|
|
304 | (1) |
|
Chapter 3 Understanding Cryptography |
|
|
305 | (2) |
|
Chapter 4 Securing the Routing Process |
|
|
307 | (2) |
|
Chapter 5 Understanding Layer 2 Attacks |
|
|
309 | (2) |
|
Chapter 6 Preventing Layer 2 Attacks |
|
|
311 | (1) |
|
|
312 | (2) |
|
Chapter 8 Securing Management Traffic |
|
|
314 | (2) |
|
Chapter 9 Understanding 802.1x and AAA |
|
|
316 | (1) |
|
Chapter 10 Securing a BYOD Initiative |
|
|
317 | (2) |
|
Chapter 11 Understanding VPNs |
|
|
319 | (2) |
|
Chapter 12 Configuring VPNs |
|
|
321 | (1) |
|
Chapter 13 Understanding Firewalls |
|
|
322 | (2) |
|
Chapter 14 Configuring NAT and Zone-Based Firewalls |
|
|
324 | (1) |
|
Chapter 15 Configuring the Firewall on an ASA |
|
|
325 | (2) |
|
Chapter 16 Intrusion Prevention |
|
|
327 | (1) |
|
Chapter 17 Content and Endpoint Security |
|
|
328 | (3) |
Index |
|
331 | |