思科认证CCIE安全考试大纲.docx
《思科认证CCIE安全考试大纲.docx》由会员分享,可在线阅读,更多相关《思科认证CCIE安全考试大纲.docx(8页珍藏版)》请在冰豆网上搜索。
思科认证CCIE安全考试大纲
思科认证CCIE平安考试大纲
CCIE平安v5.0将笔试及实验考试考纲合二为一,并明确指出了每项考试主题的权重。
思科CCIE平安笔试考试(400-251)v5.0,考试时间为2小时,考试题目90-110道,验证专业人士是否具备阐释,设计,实施,操作和故障排除的复合网络平安技能及解决方案。
考生必须理解网络平安所需,以及网络平安部件之间如何互相操作,并将其翻译成设备配置语言。
闭卷考试,考场中不允许带任何参考资料。
思科CCIE平安实验考试v5.0,考试时间为8个小时,需要考生在给定的场景中方案,设计,执行,操作并故障排除复合网络平安完成动手实验考试。
故障排除的知识是一项重要的技能,在实验考试生需要诊断并解决网络问题。
以下考纲列出了CCIE平安考试中可能出现的考试内容。
但是,其他相关要点也可能会出现在考试中。
下面的大纲可能会在未提前通知的情况下发生改变,这是为了更好地反映考试内容及更加透明化。
1.1Describe,implement,andtroubleshootHAfeaturesonCiscoASAandCiscoFirePOWERThreatDefense(FTD)
1.2Describe,implement,andtroubleshootclusteringonCiscoASAandCiscoFTD
1.3Describe,implement,troubleshoot,andsecureroutingprotocolsonCiscoASAandCiscoFTD
1.4Describe,implement,andtroubleshootdifferentdeploymentmodessuchasrouted,transparent,single,andmulticontextonCiscoASAandCiscoFTD
1.5Describe,implement,andtroubleshootfirewallfeaturessuchasNAT(v4,v6),PAT,applicationinspection,trafficzones,policy-basedrouting,trafficredirectiontoservicemodules,andidentityfirewallonCiscoASAandCiscoFTD
1.6Describe,implement,andtroubleshootIOSsecurityfeaturessuchasZone-BasedFirewall(ZBF),applicationlayerinspection,NAT(v4,v6),PATandTCPinterceptonCiscoIOS/IOS-XE
1.7Describe,implement,optimize,andtroubleshootpoliciesandrulesfortrafficcontrolonCiscoASA,CiscoFirePOWERandCiscoFTD
1.8Describe,implement,andtroubleshootCiscoFirepowerManagementCenter(FMC)featuressuchasalerting,logging,andreporting
1.9Describe,implement,andtroubleshootcorrelationandremediationrulesonCiscoFMC
1.10Describe,implement,andtroubleshootCiscoFirePOWERandCiscoFTDdeploymentsuchasin-line,passive,andTAPmodes
1.11Describe,implement,andtroubleshootNextGenerationFirewall(NGFW)featuressuchasSSLinspection,useridentity,geolocation,andAVC(Firepowerappliance)
1.12Describe,detect,andmitigatemontypesofattackssuchasDoS/DDoS,evasiontechniques,spoofing,man-in-the-middle,andbot
2.1CompareandcontrastdifferentAMPsolutionsincludingpublicandprivateclouddeploymentmodels
2.2Describe,implement,andtroubleshootAMPforworks,AMPforendpoints,andAMPforcontentsecurity(CWS,ESA,andWSA)
2.3Detect,analyze,andmitigatemalwareincidents
2.4DescribethebenefitofthreatintelligenceprovidedbyAMPThreatGRID
2.5PerformpacketcaptureandanalysisusingWireshark,tcpdump,SPAN,andRSPAN
2.6Describe,implement,andtroubleshootwebfiltering,useridentification,andApplicationVisibilityandControl(AVC)
2.7Describe,implement,andtroubleshootmailpolicies,DLP,emailquarantines,andSenderBaseonESA
2.8Describe,implement,andtroubleshootSMTPauthenticationsuchasSPFandDKIMonESA
2.9Describe,implement,andtroubleshootSMTPencryptiononESA
2.10CompareandcontrastdifferentLDAPquerytypesonESA
2.11Describe,implement,andtroubleshootWCCPredirection
2.12CompareandcontrastdifferentproxymethodssuchasSOCKS,Autoproxy/WPAD,andtransparent
2.13Describe,implement,andtroubleshootSdecryptionandDLP
2.14Describe,implement,andtroubleshootCWSconnectorsonCiscoIOSrouters,CiscoASA,CiscoAnyConnect,andWSA
2.15DescribethesecuritybenefitsofleveragingtheOpenDNSsolution.
2.16Describe,implement,andtroubleshootSMAforcentralizedcontentsecuritymanagement
2.17DescribethesecuritybenefitsofleveragingLancope
3.1CompareandcontrastcryptographicandhashalgorithmssuchasAES,DES,3DES,ECC,SHA,andMD5
3.2CompareandcontrastsecurityprotocolssuchasISAKMP/IKEv1,IKEv2,SSL,TLS/DTLS,ESP,AH,SAP,andMKA
3.3Describe,implementcandtroubleshootremoteaessusingtechnologiessuchasFLEX,SSL-betweenCiscofirewalls,routers,andendhosts
3.4Describe,implement,andtroubleshoottheCiscoIOSCAforauthentication
3.5Describe,implement,andtroubleshootclientlessSSLtechnologieswithDAPandsmarttunnelsonCiscoASAandCiscoFTD
3.6Describe,implement,andtroubleshootsite-to-sitessuchasGET,DMandIPsec
3.7Describe,implement,andtroubleshootuplinkanddownlinkMACsec(802.1AE)
3.8Describe,implement,andtroubleshoothighavailabilityusingCiscoASAclusteringanddual-hubDMdeployments
3.9DescribethefunctionsandsecurityimplicationsofcryptographicprotocolssuchasAES,DES,3DES,ECC,SHA,MD5,ISAKMP/IKEv1,IKEv2,SSL,TLS/DTLS,ESP,AH,SAP,MKA,RSA,SCEP/EST,GDOI,X.509,WPA,WPA2,WEP,andTKIP
3.10Describethesecuritybenefitsofworksegmentationandisolation
3.11Describe,implement,andtroubleshootVRF-LiteandVRF-Aware
3.12Describe,implement,andtroubleshootmicrosegmentationwithTrustSecusingSGTandSXP
3.13Describe,implement,andtroubleshootinfrastructuresegmentationmethodssuchasVLAN,PVLAN,andGRE
3.14DescribethefunctionalityofCiscoVSGusedtosecurevirtualenvironments
3.15DescribethesecuritybenefitsofdatacentersegmentationusingACI,E,VXLAN,andNVGRE
4.1Describe,implement,andtroubleshootvariouspersonasofISEinamultinodedeployment
4.2Describe,implement,andtroubleshootworkaessdevice(NAD),ISE,andACSconfigurationforAAA
4.3Describe,implement,andtroubleshootAAAforadministrativeaesstoCiscoworkdevicesusingISEandACS
4.4Describe,implement,verify,andtroubleshootAAAforworkaesswith802.1XandMABusingISE.
4.5Describe,implement,verify,andtroubleshootcut-throughproxy/auth-proxyusingISEastheAAAserver
4.6Describe,implement,verify,andtroubleshootguestlifecyclemanagementusingISEandCiscoworkinfrastructure
4.7Describe,implement,verify,andtroubleshootBYODon-boardingandworkaessflowswithaninternalorexternalCA
4.8Describe,implement,verify,andtroubleshootISEandACSintegrationwithexternalidentitysourcessuchasLDAP,AD,andexternalRADIUS
4.9DescribeISEandACSintegrationwithexternalidentitysourcessuchasRADIUSToken,RSASecurID,andSAML
4.10Describe,implement,verify,andtroubleshootprovisioningofAnyConnectwithISEandASA
4.11Describe,implement,verify,andtroubleshootpostureassessmentwithISE
4.12Describe,implement,verify,andtroubleshootendpointprofilingusingISEandCiscoworkinfrastructureincludingdevicesensor
4.13Describe,implement,verify,andtroubleshootintegrationofMDMwithISE
4.14Describe,implement,verify,andtroubleshootcertificatebasedauthenticationusingISE
4.15Describe,implement,verify,andtroubleshootauthenticationmethodssuchasEAPChainingandMachineAessRestriction(MAR)
4.16DescribethefunctionsandsecurityimplicationsofAAAprotocolssuchasRADIUS,TACACS+,LDAP/LDAPS,EAP(EAP-PEAP,EAP-TLS,EAP-TTLS,EAP-FAST,EAP-TEAP,EAP-MD5,EAP-GTC),PAP,CHAP,andMS-CHAPv2
4.17Describe,implement,andtroubleshootidentitymappingonASA,ISE,WSAandFirePOWER
4.18Describe,implement,andtroubleshootpxGridbetweensecuritydevicessuchasWSA,ISE,andCiscoFMC
5.1IdentifymonattackssuchasSmurf,VLANhopping,andSYNfulknock,andtheirmitigationtechniques
5.2Describe,implement,andtroubleshootdevicehardeningtechniquesandcontrolplaneprotectionmethods,suchasCoPPandIPSourcerouting.
5.3Describe,implement,andtroubleshootmanagementplaneprotectiontechniquessuchasCPUandmemorythresholdingandsecuringdeviceaess
5.4Describe,implement,andtroubleshootdataplaneprotectiontechniquessuchasiACLs,uRPF,QoS,andRTBH
5.5Describe,implement,andtroubleshootIPv4/v6routingprotocolssecurity
5.6Describe,implement,andtroubleshootLayer2securitytechniquessuchasDAI,IPDT,STPsecurity,portsecurity,DHCPsnooping,andVACL
5.7Describe,implement,andtroubleshootwirelesssecuritytechnologiessuchasWPA,WPA2,TKIP,andAES
5.8DescribewirelesssecurityconceptssuchasFLEXConnect,wIPS,ANCHOR,RogueAP,andManagementFrameProtection(MFP)
5.9Describe,implement,andtroubleshootmonitoringprotocolssuchasNETFLOW/IPFIX,SNMP,SYSLOG,RMON,NSEL,andeSTREAMER
5.10DescribethefunctionsandsecurityimplicationsofapplicationprotocolssuchasSSH,TELNET,TFTP,/S,SCP,SFTP/FTP,PGP,DNS/DNSSEC,NTP,andDHCP
5.11DescribethefunctionsandsecurityimplicationsofworkprotocolssuchasVTP,802.1Q,TCP/UDP,CDP,LACP/PAgP,BGP,EIGRP,OSPF/OSPFv3,RIP/RIPng,IGMP/CGMP,PIM,IPv6,andWCCP
5.12DescribethebenefitsofvirtualizingsecurityfunctionsinthedatacenterusingASAv,WSAv,ESAv,andNGIPSv
5.13DescribethesecurityprinciplesofACIsuchasobjectmodels,endpointgroups,policyenforcement,applicationworkprofiles,andcontracts
5.14DescribethenorthboundandsouthboundAPIsofSDNcontrollerssuchasAPIC-EM
5.15Identifyandimplementsecurityfeaturestoplywithorganizationalsecuritypolicies,procedures,andstandardssuchasBCP38,ISO27001,RFC2827,andPCI-DSS
5.16Describeandidentifykeythreatstodifferentplacesinthework(campus,datacenter,core,edge)asdescribedinCiscoSAFE
5.17ValidateworksecuritydesignforadherencetoCiscoSAFEremendedpractices
5.18InterpretbasicscriptsthatcanretrieveandsenddatausingRESTfulAPIcallsinscriptinglanguagessuchasPython
5.19DescribeCiscoDigitalNetworkArchitecture(DNA)principlesandponents.
6.1Cloud
6.1.aCompareandcontrastClouddeploymentmodels
6.1.a[i]Infrastructure,platform,andsoftwareservices(XaaS)
6.1.a[ii]Performanceandreliability
6.1.a[iii]Securityandprivacy
6.1.a[iv]Scala