CCNA Cybersecurity (Cisco, exam 200-201)Study guide

Covers the three pillars that measure a security objective—confidentiality, integrity, and availability (the CIA triad)—and defense-in-depth, which avoids relying on a single control, framed as the judgment of "which of the CIA properties this incident harmed" and "where an added layer would have stopped it."

Covers network, endpoint, and application security deployments, agent-based vs. agentless, legacy AV vs. NGAV, the division of roles among SIEM, SOAR, and log management, plus visibility differences in container/virtualization and cloud environments, framed as the judgment of "which deployment fills this visibility gap."

Covers core operations terms—threat intelligence, threat hunting, malware analysis, threat actor, risk-based analysis (RBA), reverse engineering, sliding window, threat modeling, and DevSecOps—framed as the judgment of "which concept or activity to use in this situation."

Rigorously distinguishes the often-confused terms threat, vulnerability, exploit, and risk and their relationships, framed as the judgment of "which of the four does this control act on?" and "which one remains?" The axis is risk = the likelihood a threat exploits a vulnerability x impact.

Covers control models—discretionary (DAC), mandatory (MAC), role-based (RBAC), attribute-based (ABAC), rule-based, and time-based—and the AAA (authentication, authorization, accounting) framework, framed as the judgment of "which model fits this requirement of who may do what, and when."

Covers the CVSS metrics that measure vulnerability severity (attack vector (AV), attack complexity (AC), privileges required (PR), user interaction (UI), scope (S) plus temporal and environmental), the 5-tuple that pinpoints a compromised host from logs, and the difference between rule/signature-based and behavioral/statistical detection, framed as SOC triage judgment.

Establishes the relationship between the attack surface and vulnerabilities, and covers what each monitoring technology reveals—tcpdump (full packets), NetFlow (flow statistics), NGFW, the stateful firewall, AVC (Application Visibility and Control), web filtering, and email filtering—framed as a SOC analyst's judgment of which data to collect.

Covers how ACLs, NAT/PAT, tunneling, TOR, encryption, P2P, encapsulation, and load balancing make monitoring and log reading harder. Assuming real cases where IP rewriting or encryption hides the 5-tuple or content, it builds the judgment of where an analyst re-correlates when visibility drops.

Covers choosing among the monitoring data types—full packet capture, session data, transaction data, statistical data, metadata, and alert data—by "which data answers which question" and "the trade-off between retention cost and investigation depth."

Covers network attacks—protocol-based attacks, DoS, DDoS, man-in-the-middle (MITM)—and web application attacks—SQL injection, command injection, cross-site scripting (XSS)—as the judgment of identifying which attack from traces in logs/pcaps/requests.

Covers social engineering that deceives people (manual and via generative AI abuse), endpoint compromises—buffer overflow, C2, malware, ransomware—and evasion via tunneling, encryption, and proxies, framed as judgment for spotting them from their signs.

Covers public-key authenticity via PKI, choosing between symmetric (fast, shared key) and asymmetric (key distribution) cryptography, and certificate elements negotiated in TLS—the cipher suite, X.509 certificate, key exchange, protocol version, and PKCS—from the monitoring perspective of judging "is this encrypted traffic safe and untampered?"

Covers the roles of host-resident HIDS (host-based IDS), antimalware/antivirus (AV), and the host firewall, and the difference between signature/rule-based and behavioral/predictive (predictive AI) based detection foundations, framed as the SOC judgment of "which technology caught this alert" and "which method works against known vs. unknown threats."

Maps the Windows components that matter in an investigation scenario (processes/services, the registry, event logs, scheduled tasks, tasklist/netstat) to the Linux components (processes/daemons, systemd, /etc config, /var/log logs, cron, ps), framed as the investigative judgment of "which OS component reveals this artifact."

Covers the role and objects of attribution in an investigation—the assets to protect, the threat actor, IoCs (indicators of compromise) that are traces of a breach that already happened, IoAs (indicators of attack) that are signs of an attack in progress, and the chain of custody that underpins evidence reliability—framed as the judgment of "is this artifact after-the-fact or in-progress" and "what must be recorded for it to hold up as evidence."

Covers distinguishing types of evidence from given logs—best evidence that most directly proves a fact, corroborative evidence that reinforces other evidence, and indirect (circumstantial) evidence that does not directly show a fact but lets one infer it from circumstances—framed as the judgment of "what, and how far, does this log prove."

Covers the ability to read events from OS, application, and command-line logs and from records that SIEM/SOAR aggregate and automate, the concept of the detonation chamber/sandbox that runs a sample in an isolated environment, and the judgment of leveraging its analysis output (hashes, URLs, system/event/networking information) as IoCs.

Builds the skill of instantly judging which sensor produced a given alert or log—an IDS/IPS, a firewall, a NAC, a proxy, an antivirus, or NetFlow—from the shape of the event (signature ID, allow/deny, authentication/posture, URL category, sample name, flow statistics), as the starting point for SOC correlation.

Builds the skill of matching whether an alert fired against whether malicious activity actually occurred, to classify it as a true positive (TP), false positive (FP), true negative (TN), false negative (FN), or benign (legitimate yet matching a signature), as the foundation for triage prioritization and detection tuning. It also fixes the operational weight that an FN is the most dangerous and an FP drives alert fatigue.

Covers the differences in inspection depth among packet filtering (stateless), stateful inspection, and deep packet inspection (DPI), plus inline vs. tap/SPAN (can it block, does it affect the live path) and full packet capture (tap) vs. transactional (NetFlow) (does it carry payload, can it be retained cheaply for the long term), framed as the design judgment of "which method fits this goal."

Covers the procedure of reassembling a TCP stream from a captured pcap to extract transferred files (Wireshark's Follow TCP Stream or Export Objects), and the elements of an intrusion read from packet data—source/destination address, source/destination port, protocol (the 5-tuple) plus payload—as the hands-on SOC work of identifying the victim host and the C2/exfiltration destination.

Covers what each header element of Ethernet/IPv4/IPv6/TCP/UDP/ICMP/DNS/SMTP, POP3, IMAP/HTTP, HTTPS/ARP reveals, the artifacts (IOCs—hashes, URLs, domains, IPs, filenames, etc.) that are the products of analysis, and basic regular expressions as the tool for searching logs/payloads, as the skill of surfacing threats and feeding the next stage of investigation.

Covers asset management to know what you protect, configuration management to keep an approved state, MDM to govern mobile devices, patch management to close known flaws, and vulnerability management to continuously assess and prioritize weaknesses—framed as the operational judgment of "which management process addresses this risk."

Covers the elements an incident response (IR) plan should contain and the NIST SP800-61 lifecycle (preparation / detection and analysis / containment, eradication, and recovery / post-incident activity), so you can map "which phase this event is in and what to do next."

Covers mapping an organization's stakeholders to NIST IR categories (and the maturity view of CMMC), and what NIST SP800-86 specifies—order of evidence collection (most volatile first), data integrity, data preservation, and volatile data collection—framed as the judgment of "how to collect evidence correctly without destroying it."

Covers profiling—establishing a normal-state baseline to spot anomalies from deviations—through the elements of network profiling (total throughput, session duration, ports used, critical asset address space) and server profiling (listening ports, logged-in users/service accounts, running processes/tasks, applications).

Covers identifying protected data in a network (PII, PHI, PSI, and intellectual property (IP)), the Cyber Kill Chain and Diamond Model for viewing intrusions by stage/element, and SOC metrics (time to detect/contain/respond/control) that measure response speed—framed as the judgment of "how to classify this event and where to improve."