Muutke küpsiste eelistusi

CCNA Cybersecurity Operations Lab Manual [Pehme köide]

  • Formaat: Paperback / softback, 400 pages, kõrgus x laius x paksus: 270x210x18 mm, kaal: 910 g
  • Sari: Lab Companion
  • Ilmumisaeg: 02-May-2018
  • Kirjastus: Cisco Press
  • ISBN-10: 1587134381
  • ISBN-13: 9781587134388
Teised raamatud teemal:
  • Formaat: Paperback / softback, 400 pages, kõrgus x laius x paksus: 270x210x18 mm, kaal: 910 g
  • Sari: Lab Companion
  • Ilmumisaeg: 02-May-2018
  • Kirjastus: Cisco Press
  • ISBN-10: 1587134381
  • ISBN-13: 9781587134388
Teised raamatud teemal:

The only authorized Lab Manual for the Cisco Networking Academy CCNA Cybersecurity Operations course Curriculum Objectives


CCNA Cybersecurity Operations 1.0 covers knowledge and skills needed to successfully handle the tasks, duties, and responsibilities of an associate-level Security Analyst working in a Security Operations Center (SOC).


Upon completion of the CCNA Cybersecurity Operations 1.0 course, students will be able to perform the following tasks:

  • Install virtual machines to create a safe environment for implementing and analyzing cybersecurity threat events.
  • Explain the role of the Cybersecurity Operations Analyst in the enterprise.
  • Explain the Windows Operating System features and characteristics needed to support cybersecurity analyses.
  • Explain the features and characteristics of the Linux Operating System.
  • Analyze the operation of network protocols and services.
  • Explain the operation of the network infrastructure.
  • Classify the various types of network attacks.
  • Use network monitoring tools to identify attacks against network protocols and services.
  • Use various methods to prevent malicious access to computer networks, hosts, and data.
  • Explain the impacts of cryptography on network security monitoring.
  • Explain how to investigate endpoint vulnerabilities and attacks.
  • Analyze network intrusion data to verify potential exploits.
  • Apply incident response models to manage network security incidents.
Chapter 1 Cybersecurity and the Security Operations Center 1(16)
1.0.1.2 Class Activity-Top Hacker Shows Us How It is Done
1(2)
Objectives
1(1)
Background/Scenario
1(1)
Required Resources
1(2)
1.1.1.4 Lab-Installing the CyberOps Workstation Virtual Machine
3(4)
Objectives
3(1)
Background/Scenario
3(1)
Required Resources
3(1)
Part 1: Prepare a Host Computer for Virtualization
3(1)
Part 2: Import the Virtual Machine into the VirtualBox Inventory
4(2)
Reflection
6(1)
1.1.1.5 Lab-Cybersecurity Case Studies
7(2)
Objectives
7(1)
Background/Scenario
7(1)
Required Resources
7(2)
1.1.2.6 Lab-Learning the Details of Attacks
9(2)
Objectives
9(1)
Background/Scenario
9(1)
Required Resources
9(1)
Conduct a Search of IoT Application Vulnerabilities
9(2)
1.1.3.4 Lab-Visualizing the Black Hats
11(3)
Objectives
11(1)
Background/Scenario
11(1)
Required Resources
11(3)
1.2.2.5 Lab-Becoming a Defender
14(3)
Objectives
14(1)
Background/Scenario
14(1)
Required Resources
14(3)
Chapter 2 Windows Operating System 17(54)
2.0.1.2 Class Activity-Identify Running Processes
17(3)
Objectives
17(1)
Background/Scenario
17(1)
Required Resources
17(3)
2.1.2.10 Lab-Exploring Processes, Threads, Handles, and Windows Registry
20(8)
Objectives
20(1)
Required Resources
20(1)
Part 1: Exploring Processes
20(3)
Part 2: Exploring Threads and Handles
23(2)
Part 3: Exploring Windows Registry
25(3)
2.2.1.10 Lab-Create User Accounts
28(9)
Objectives
28(1)
Required Resources
28(1)
Part 1: Creating a New Local User Account
28(5)
Part 2: Reviewing User Account Properties
33(1)
Part 3: Modifying Local User Accounts
34(2)
Reflection
36(1)
2.2.1.11 Lab-Using Windows PowerShell
37(6)
Objectives
37(1)
Background/Scenario
37(1)
Required Resources
37(5)
Reflection
42(1)
2.2.1.12 Lab-Windows Task Manager
43(9)
Objectives
43(1)
Background/Scenario
43(1)
Required Resources
43(1)
Part 1: Working in the Processes Tab
43(4)
Part 2: Working in the Services Tab
47(1)
Part 3: Working in the Performance Tab
48(3)
Reflection
51(1)
2.2.1.13 Lab-Monitor and Manage System Resources in Windows
52(19)
Objectives
52(1)
Recommended Equipment
52(1)
Part 1: Starting and Stopping the Routing and Remote Access Service
52(7)
Part 2: Working in the Computer Management Utility
59(2)
Part 3: Configuring Administrative Tools
61(10)
Chapter 3 Linux Operating System 71(54)
3.1.2.6 Lab-Working with Text Files in the CLI
71(11)
Objectives
71(1)
Required Resources
71(1)
Part 1: Graphical Text Editors
71(1)
Part 2: Command Line Text Editors
72(2)
Part 3: Working with Configuration Files
74(7)
Reflection
81(1)
3.1.2.7 Lab-Getting Familiar with the Linux Shell
82(8)
Introduction
82(1)
Recommended Equipment
82(1)
Part 1: Shell Basics
82(5)
Part 2: Copying, Deleting, and Moving Files
87(2)
Reflection
89(1)
3.1.3.4 Lab-Linux Servers
90(7)
Introduction
90(1)
Recommended Equipment
90(1)
Part 1: Servers
90(4)
Part 2: Using Telnet to Test TCP Services
94(2)
Reflection
96(1)
3.2.1.4 Lab-Locating Log Files
97(17)
Introduction
97(1)
Required Resources
97(1)
Part 1: Log File Overview
97(2)
Part 2: Locating Log Files in Unknown Systems
99(5)
Part 3: Monitoring Log Files in Real Time
104(9)
Reflection
113(1)
3.2.2.4 Lab-Navigating the Linux Filesystem and Permission Settings
114(11)
Objectives
114(1)
Required Resources
114(1)
Part 1: Exploring File systems in Linux
114(3)
Part 2: File Permissions
117(3)
Part 3: Symbolic Links and other Special File Types
120(3)
Reflection
123(2)
Chapter 4 Network Protocols and Services 125(58)
4.1.1.7 Lab-Tracing a Route
125(4)
Objectives
125(1)
Background
125(1)
Scenario
125(1)
Required Resources
126(1)
Part 1: Verifying Network Connectivity Using Ping
126(1)
Part 2: Tracing a Route to a Remote Server Using Traceroute
126(1)
Part 3: Trace a Route to a Remote Server Using Web-Based Traceroute Tool
127(1)
Reflection
128(1)
4.1.2.10 Lab-Introduction to Wireshark
129(7)
Mininet Topology
129(1)
Objectives
129(1)
Background/Scenario
129(1)
Required Resources
130(1)
Part 1: Install and Verify the Mininet Topology
130(1)
Part 2: Capture and Analyze ICMP Data in Wireshark
131(5)
4.4.2.8 Lab-Using Wireshark to Examine Ethernet Frames
136(7)
Mininet Topology
136(1)
Objectives
136(1)
Background/Scenario
136(1)
Required Resources
137(1)
Part 1: Examine the Header Fields in an Ethernet II Frame
137(2)
Part 2: Use Wireshark to Capture and Analyze Ethernet Frames
139(3)
Reflection
142(1)
4.5.2.4 Lab-Using Wireshark to Observe the TCP 3-Way Handshake
143(6)
Mininet Topology
143(1)
Objectives
143(1)
Background/Scenario
143(1)
Required Resources
143(1)
Part 1: Prepare the Hosts to Capture the Traffic
144(1)
Part 2: Analyze the Packets Using Wireshark
144(3)
Part 3: View the Packets Using tcpdump
147(1)
Reflection
148(1)
4.5.2.10 Lab-Exploring Nmap
149(7)
Topology
149(1)
Objectives
149(1)
Background/Scenario
149(1)
Required Resources
149(1)
Part 1: Exploring Nmap
149(3)
Part 2: Scanning for Open Ports
152(3)
Reflection
155(1)
4.6.2.7 Lab-Using Wireshark to Examine a UDP DNS Capture
156(7)
Topology
156(1)
Objectives
156(1)
Background/Scenario
156(1)
Required Resources
156(1)
Part 1: Record VM's IP Configuration Information
156(1)
Part 2: Use Wireshark to Capture DNS Queries and Responses
157(1)
Part 3: Analyze Captured DNS or UDP Packets
158(4)
Reflection
162(1)
4.6.4.3 Lab-Using Wireshark to Examine TCP and UDP Captures
163(12)
Topology-Part 1 (FTP)
163(1)
Mininet Topology-Part 2 (TFTP)
163(1)
Objectives
164(1)
Background/Scenario
164(1)
Required Resources
164(1)
Part 1: Identify TCP Header Fields and Operation Using a Wireshark FTP Session Capture
164(7)
Part 2: Identify UDP Header Fields and Operation Using a Wireshark TFTP Session Capture
171(3)
Reflection
174(1)
4.6.6.5 Lab-Using Wireshark to Examine HTTP and HTTPS
175(8)
Objectives
175(1)
Background/Scenario
175(1)
Required Resources
175(1)
Part 1: Capture and Vview HTTP Traffic
175(3)
Part 2: Capture and View HTTPS Traffic
178(3)
Reflection
181(2)
Chapter 5 Network Infrastructure 183(8)
5.2.2.4 Packet Tracer-Access Control List Demonstration
183(3)
Topology
183(1)
Objectives
183(1)
Background
183(1)
Part 1: Verify Local Connectivity and Test Access Control List
183(1)
Part 2: Remove ACL and Repeat Test
184(1)
Suggested Scoring Rubric
185(1)
5.3.1.10 Packet Tracer-Identify Packet Flow
186(5)
Topology
186(1)
Objectives
186(1)
Background/Scenario
186(1)
Required Resources
186(1)
Part 1: Verifying Connectivity
187(1)
Part 2: Remote LAN Network Topology
187(1)
Part 3: WAN Network Topology
188(3)
Chapter 6 Principles of Network Security 191(4)
6.2.1.11 Lab-Anatomy of Malware
191(1)
Objectives
191(1)
Background/Scenario
191(1)
Required Resources
191(1)
Conduct a Search of Recent Malware
191(1)
6.2.2.9 Lab-Social Engineering
192(3)
Objectives
192(1)
Background/Scenario
192(1)
Required Resources
192(3)
Chapter 7 Network Attacks: A Deeper Look 195(38)
7.0.1.2 Class Activity-What's Going On?
195(3)
Objectives
195(1)
Background/Scenario
195(1)
Required Resources
195(3)
7.1.2.7 Packet Tracer-Logging Network Activity
198(3)
Topology
198(1)
Addressing Table
198(1)
Objectives
198(1)
Background
198(1)
Part 1: Create FTP Traffic
198(1)
Part 2: Investigate the FTP Traffic
199(1)
Part 3: View syslog Messages
199(1)
Suggested Scoring Rubric
200(1)
7.3.1.6 Lab-Exploring DNS Traffic
201(11)
Objectives
201(1)
Background/Scenario
201(1)
Required Resources
201(1)
Part 1: Capture DNS Traffic
201(3)
Part 2: Explore DNS Query Traffic
204(5)
Part 3: Explore DNS Response Traffic
209(2)
Reflection
211(1)
7.3.2.4 Lab-Attacking a mySQL Database
212(14)
Objectives
212(1)
Background/Scenario
212(1)
Required Resources
212(1)
Part 1: Open the PCAP File and Follow the SQL Database Attacker
212(13)
Reflection
225(1)
7.3.2.5 Lab-Reading Server Logs
226(9)
Objectives
226(1)
Background/Scenario
226(1)
Required Resources
226(1)
Part 1: Reading Log Files with Cat, More, Less, and Tail
226(4)
Part 2: Log Files and Syslog
230(1)
Part 3: Log Files and Journalctl
231(1)
Reflection
232(1)
Chapter 8 Protecting the Network 233(2)
There are no labs in this chapter.
Chapter 9 Cryptography and the Public Key Infrastructure 235(28)
9.0.1.2 Class Activity-Creating Codes
235(3)
Objectives
235(1)
Background/Scenario
235(1)
Required Resources
235(3)
9.1.1.6 Lab-Encrypting and Decrypting Data Using OpenSSL
238(3)
Objectives
238(1)
Background/Scenario
238(1)
Required Resources
238(1)
Part 1: Encrypting Messages with OpenSSL
238(2)
Part 2: Decrypting Messages with OpenSSL
240(1)
9.1.1.7 Lab-Encrypting and Decrypting Data Using a Hacker Tool
241(6)
Objectives
241(1)
Background/Scenario
241(1)
Required Resources
241(1)
Part 1: Create and Encrypt Files
242(1)
Part 2: Recover Encrypted Zip File Passwords
243(4)
9.1.1.8 Lab-Examining Telnet and SSH in Wireshark
247(4)
Objectives
247(1)
Background/Scenario
247(1)
Required Resources
247(1)
Part 1: Examining a Telnet Session with Wireshark
247(2)
Part 2: Examine an SSH Session with Wireshark
249(1)
Reflection
250(1)
9.1.2.5 Lab-Hashing Things Out
251(3)
Objectives
251(1)
Background/Scenario
251(1)
Required Resources
251(1)
Part 1: Creating Hashes with OpenSSL
251(2)
Part 2: Verifying Hashes
253(1)
9.2.2.7 Lab-Certificate Authority Stores
254(11)
Objectives
254(1)
Background/Scenario
254(1)
Required Resources
254(1)
Part 1: Certificates Trusted by Your Browser
254(4)
Part 2: Checking for Man-In-Middle
258(4)
Part 3: Challenges (Optional)
262(1)
Reflection
262(1)
Chapter 10 Endpoint Security and Analysis 263(2)
There are no labs in this chapter.
Chapter 11 Security Monitoring 265(18)
11.2.3.10 Packet Tracer-Explore a NetFlow Implementation
265(7)
Topology
265(1)
Objectives
265(1)
Background
265(1)
Part 1: Observe NetFlow Flow Records-One Direction
265(4)
Part 2: Observe NetFlow Records for a Session that Enters and Leaves the Collector
269(2)
Suggested Scoring Rubric
271(1)
11.2.3.11 Packet Tracer-Logging from Multiple Sources
272(4)
Topology
272(1)
Objectives
272(1)
Background/Scenario
272(1)
Part 1: View Log Entries with Syslog
272(1)
Part 2: Log User Access
273(1)
Part 3: NetFlow and Visualization
274(1)
Reflection
275(1)
11.3.1.1 Lab-Setup a Multi-VM Environment
276(7)
Topology
276(1)
Objectives
276(1)
Background/Scenario
276(1)
Required Resources
276(7)
Chapter 12 Intrusion Data Analysis 283(90)
12.1.1.7 Lab-Snort and Firewall Rules
283(9)
Topology
283(1)
Objectives
283(1)
Background/Scenario
283(1)
Required Resources
284(1)
Part 1: Preparing the Virtual Environment
284(1)
Part 2: Firewall and IDS Logs
284(8)
12.2.1.5 Lab-Convert Data into a Universal Format
292(12)
Objectives
292(1)
Background/Scenario
292(1)
Required Resources
292(1)
Part 1: Normalize Timestamps in a Log File
292(3)
Part 2: Normalize Timestamps in an Apache Log File
295(2)
Part 3: Log File Preparation in Security Onion
297(6)
Part 4: Reflection
303(1)
12.2.2.9 Lab-Regular Expression Tutorial
304(3)
Objectives
304(1)
Background/Scenario
304(1)
Required Resources
304(3)
12.2.2.10 Lab-Extract an Executable from a PCAP
307(8)
Objectives
307(1)
Background/Scenario
307(1)
Required Resources
307(1)
Part 1: Prepare the Virtual Environment
307(1)
Part 2: Analyze Pre-Captured Logs and Traffic Captures
307(4)
Part 3: Extract Downloaded Files From PCAPS
311(4)
12.4.1.1 Alt Lab-Interpret HTTP and DNS Data to Isolate Threat Actor
315(10)
Objectives
315(1)
Background/Scenario
315(1)
Required Resources
315(1)
Part 1: Prepare the Virtual Environment
315(1)
Part 2: Investigate an SQL Injection Attack
316(7)
Part 3: Analyze a Data Exfiltration
323(2)
12.4.1.1 Lab-Interpret HTTP and DNS Data to Isolate Threat Actor
325(17)
Topology
325(1)
Objectives
325(1)
Background/Scenario
325(1)
Required Resources
326(1)
Part 1: Prepare the Virtual Environment
326(1)
Part 2: Investigate an SQL Injection Attack
327(9)
Part 3: Data Exfiltration Using DNS
336(6)
12.4.1.2 Alt Lab-Isolated Compromised Host Using 5-Tuple
342(10)
Objectives
342(1)
Background/Scenario
342(1)
Required Resources
342(1)
Part 1: Prepare the Virtual Environment
342(1)
Part 2: Review the Logs
343(8)
Reflection
351(1)
12.4.1.2 Lab-Isolated Compromised Host Using 5-Tuple
352(21)
Topology
352(1)
Objectives
352(1)
Background/Scenario
352(1)
Required Resources
353(1)
Part 1: Prepare the Virtual Environment
353(2)
Part 2: Reconnaissance
355(1)
Part 3: Exploitation
356(4)
Part 4: Infiltration
360(3)
Part 5: Review the Logs
363(8)
Reflection
371(2)
Chapter 13 Incident Response and Handling 373
13.2.2.13 Lab-Incident Handling
373
Objectives
373(1)
Background/Scenario
373(1)
Scenario 1: Worm and Distributed Denial of Service (DDoS) Agent
Infestation
373(1)
Scenario 2: Unauthorized Access to Payroll Records
374
Cisco Networking Academy teaches hundreds of thousands of students annually the skills needed to build, design, and maintain, networks, improving their career prospects while filling the global demand for networking professionals. With 10,000 academies in 165 countries, it helps individuals prepare for industry-recognized certifications and entry-level information and communication technology careers in virtually every industrydeveloping foundational technical skills while acquiring vital 21st-century career skills in problem solving, collaboration, and critical thinking.