CCIE Security

CCIE Security

Course Description

CCIE Security is highest level certification offered by Cisco Systems in Network Security track. One ought to have in-depth data of CCNA Security and CCNP Security before starting making ready for CCIE Security certification.

Before sitting for CCIE Security laboratory test, candidates are expected to be CCIE Security written test certified.

Physical Devices available for CCIE Security Training.

  • Routers: 1841, 2621, 2811, 2911,3800 Series
  • Switches: 2950,2960, 3750, 7200Series
  • ASA-firewall 5510, 5515x ,5525x Series

Modes of Training Available.

  • Online Training
  • Classroom Training

Course outline for CCIE Security:

Exam Description: The CCIE Security Version 5.0 exam unifies written and practical exam topics documents into a unique curriculum, while explicitly disclosing which domains pertain to which exam, and the relative weight of each domain.

The Cisco CCIE Security Written Exam (400-251) version 5.0 is a two-hour test with 90–110 questions that validate professionals who have the expertise to describe, design, implement, operate, and troubleshoot complex security technologies and solutions. Candidates must understand the requirements of network security, how different components interoperate, and translate it into the device configurations. The exam is closed book and no outside reference materials are allowed.

Secure Connectivity and Segmentation

  • Compare and contrast cryptographic and hash algorithms such as AES, DES, 3DES, ECC, SHA, and MD5
  • Compare and contrast security protocols such as ISAKMP/IKEv1, IKEv2, SSL, TLS/DTLS, ESP, AH, SAP, and MKA
  • Describe, implementc and troubleshoot remote access VPN using technologies such as FLEXVPN, SSL-VPN between Cisco firewalls, routers, and end hosts
  • Describe, implement, and troubleshoot the Cisco IOS CA for VPN authentication
  • Describe, implement, and troubleshoot clientless SSL VPN technologies with DAP and smart tunnels on Cisco ASA and Cisco FTD
  • Describe, implement, and troubleshoot site-to-site VPNs such as GETVPN, DMVPN and IPsec
  • Describe, implement, and troubleshoot uplink and downlink MACsec (802.1AE)
  • Describe, implement, and troubleshoot VPN high availability using Cisco ASA VPN clustering and dual-hub DMVPN deployments
  • Describe the functions and security implications of cryptographic protocols such as AES, DES, 3DES, ECC, SHA, MD5, ISAKMP/IKEv1, IKEv2, SSL, TLS/DTLS, ESP, AH, SAP, MKA, RSA, SCEP/EST, GDOI, X.509, WPA, WPA2, WEP, and TKIP
  • Describe the security benefits of network segmentation andisolation
  • Describe, implement, and troubleshoot VRF-Lite and VRF-AwareVPN
  • Describe, implement, and troubleshoot microsegmentation with TrustSec using SGT and SXP
  • Describe, implement, and troubleshoot infrastructure segmentation methods such as VLAN, PVLAN, and GRE
  • Describe the functionality of Cisco VSG used to secure virtual environments
  • Describe the security benefits of data center segmentation using ACI, EVPN, VXLAN, and NVGRE

Identity Management, Information Exchange, and Access Control

  • Describe, implement, and troubleshoot various personas of ISE in a multinode deployment
  • Describe, implement, and troubleshoot network access device (NAD), ISE, and ACS configuration for AAA
  • Describe, implement, and troubleshoot AAA for administrative access to Cisco network devices using ISE and ACS
  • Describe, implement, verify, and troubleshoot AAA for network access with 1X and MAB using ISE.
  • Describe, implement, verify, and troubleshoot cut-through proxy/auth-proxy using ISE as the AAA server
  • Describe, implement, verify, and troubleshoot guest life cycle management using ISE and Cisco network infrastructure
  • Describe, implement, verify, and troubleshoot BYOD on-boarding and network access flows with an internal or external CA
  • Describe, implement, verify, and troubleshoot ISE and ACS integration with external identity sources such as LDAP, AD, and external RADIUS
  • Describe ISE and ACS integration with external identity sources such as RADIUS Token, RSA SecurID, and SAML
  • Describe, implement, verify, and troubleshoot provisioning of AnyConnect with ISE and ASA
  • Describe, implement, verify, and troubleshoot posture assessment with ISE
  • Describe, implement, verify, and troubleshoot endpoint profiling using ISE and Cisco network infrastructure including device sensor
  • Describe, implement, verify, and troubleshoot integration of MDM with ISE
  • Describe, implement, verify, and troubleshoot certificate based authentication using ISE
  • Describe, implement, verify, and troubleshoot authentication methods such as EAP Chaining and Machine Access Restriction (MAR)
  • Describe the functions and security implications of AAA protocols such as RADIUS, TACACS+, LDAP/LDAPS, EAP (EAP-PEAP, EAP-TLS, EAP-TTLS, EAP-FAST, EAP-TEAP, EAP- MD5, EAP-GTC), PAP, CHAP, and MS-CHAPv2
  • Describe, implement, and troubleshoot identity mapping on ASA, ISE, WSA and FirePOWER
  • Describe, implement, and troubleshoot pxGrid between security devices such as WSA, ISE, and Cisco FMC

Infrastructure Security, Virtualization, and Automation

  • Identify common attacks such as Smurf, VLAN hopping, and SYNful knock, and their mitigation techniques
  • Describe, implement, and troubleshoot device hardening techniques and control plane protection methods, such as CoPP and IP Source
  • Describe, implement, and troubleshoot management plane protection techniques such as CPU and memory thresholding and securing device access
  • Describe, implement, and troubleshoot data plane protection techniques such as iACLs, uRPF, QoS, and RTBH
  • Describe, implement, and troubleshoot IPv4/v6 routing protocols security
  • Describe, implement, and troubleshoot Layer 2 security techniques such as DAI, IPDT, STP security, port security, DHCP snooping, and VACL
  • Describe, implement, and troubleshoot wireless security technologies such as WPA, WPA2, TKIP, and AES
  • Describe wireless security concepts such as FLEX Connect, wIPS, ANCHOR, Rogue AP, and Management Frame Protection (MFP)
  • Describe, implement, and troubleshoot monitoring protocols such as NETFLOW/IPFIX, SNMP, SYSLOG, RMON, NSEL, and eSTREAMER
  • Describe the functions and security implications of application protocols such as SSH, TELNET, TFTP, HTTP/HTTPS, SCP, SFTP/FTP, PGP, DNS/DNSSEC, NTP, and DHCP
  • Describe the functions and security implications of network protocols such as VTP, 802.1Q, TCP/UDP, CDP, LACP/PAgP, BGP, EIGRP, OSPF/OSPFv3, RIP/RIPng, IGMP/CGMP, PIM, IPv6, and WCCP
  • Describe the benefits of virtualizing security functions in the data center using ASAv, WSAv, ESAv, and NGIPSv
  • Describe the security principles of ACI such as object models, endpoint groups, policy enforcement, application network profiles, and contracts
  • Describe the northbound and southbound APIs of SDN controllers such as APIC-EM
  • Identify and implement security features to comply with organizational security policies, procedures, and standards such as BCP 38, ISO 27001, RFC 2827, and PCI-DSS