Breaking Ground with Cisco's New CCSP Foundation Exam

As the replacement to the security of the examination, it requires many of the same knowledge and operational experience, but with a new focus.

by Andy barkl November 29, 2005 - Cisco Certified Safety Professionals (ccsp) certification, which are the cause by Cisco Systems in 2001 in response to a growing need network security professionals capacity configuration, maintenance and troubleshooting complex network security.

Many of its popularity has emerged recently, there are many other vendors and vendor-neutral security certification. Although many professionals, as long as has been commissioned to network security that such a personal focus is new.

Examinations # 160 # 642-502: ensure that the network and Cisco routers and switches (snrs) seller Cisco system status live. Pearson users can exchange and Prometric testing centres the rest of the world.

reviewer evaluation "You will need to have a solid grasp of how to configure and exclude Cisco routers, switches and firewalls to reduce common network attacks by the use of technologies such as cbac, IPSec, VPN, assessment and SDM is. " Test Information 60 -- 70, 90 minutes. Fee: $ 125 (United States).

Who should take this test ? candidates ccsp.

test objectives Click Here ccsp need you to the test through five years with the existing Cisco certified network associate (ccna) certification. These examinations have been updated More recently, and generally known as: snrs, snpa including IPS, Suzhou high-tech, hip or csvpn. Recertification by examination through ccsp 642-541 initiatives: the implementation of security Cisco, Cisco certification or Internet experts (ccie) written examination. Cisco certification valid for a period of three years.

This is not necessarily a matter (in my opinion), one of five examinations you must first or in what order. They do not necessarily establish a another, but this kind of examination easily lead to the foundation. Together they make a well-off rounded ccsp. And you will also receive information in the letter recognized from the National Security Agency and the Social Insurance Fund. (Very cool, if you ask me!) For more information, please here.

I completed my ccnp and Cisco Certified Design Professionals (ccdp) years back, but not yet to resolve a Cisco security certification. At this time, I also power, and vendor-neutral review of the safety of + CISSP examination, I have to say that vendor specific security examinations, are vastly different in many ways. Earlier This year, I passed, and to review the outgoing cspfa (PIX firewall) examinations ( plan to review its replacement, snpa, in the coming months). Vendor-specific security examinations, as cspfa examination is that all manufacturers understand security concept and how sales, marketing and products that are suited field.

New snrs examination, I found that a lot of very specific issues how to configure and exclude Cisco routers, switches and firewalls, so as to mitigate common network attack on the technology used, such as cbac, IPSec, VPN, assessment and mining. I received 63, and given 90 minutes to complete the examination, which included three simulation problems. Passing score was 860 pairs in size from 300 to 1,000 points possible. Like all Cisco examination I ever taken, you can not move through Back to the question set or mark or review your answers, you can Comment on "br> most other certification exams. However, I think that Ciscos overall test more easily, and they most of the problems in the form of one or two of only a correct answers to choose from.

I really think that simulation is where the real test will be the recipient "Red," and these issues are now a hypothetical company network circumstances, topology and usually local configuration. You need complete the remaining configuration by navigating Cisco equipment command line environment. Based on the opening of the screen to remind you of mock examinations spend too much time on any one simulator based on the issues, it recommends no 10 minutes. Running in a short period of time on a test can be a problem If you do not attach importance to. The last thing you want to do is find 2 minutes, and the remaining 24 hours on and 10, left to, or even # 160 If they are multiple-choice questions. Outstanding issues, it is to deal with you! Course, someone asked: Do you received some credit? If you do not save your configuration, it will be marked incorrect? I simulation approach As I said in the real world: I execute the required commands to configure routers, switches or firewalls, display configurations, preservation and verify my work.

Many question marks command is available and limited help, is the link "br> if you need it. Simulation, are generally more difficult than more common multiple-choice questions, but let us face it, you really can not braindump Sims! Recommended Reading at the time of the article, although the official Cisco instructor-led courses snrs offer is not self-study guide has been published. Including Cisco network links Recommended Reading found near the bottom of formal examinations target page for each examination. I discovered that almost all I need to learn and differences Cisco news three books: Management Cisco Network Security (ISBN 1578701031) network security principals and practices (ISBN 1587050250) Network Design # 160 Security (ISBN 1587051176) is scheduled news Cisco announced a new study guide specific to the examination in early 2006.

There was some overlap between the first two books, and the second, which 1 ccie series research guide, but I love reading, more than I needed the ultimate through a special examination. For the self-study, I like the books, from Cisco news, although not make better resources for the more popular ccna examination self-study guide written by Todd lammle and publishing sybex.

Examination goal because you must hold a valid ccna ccsp access, which is that you should start access to basic knowledge of how to configure Difficult and Cisco equipment. Ccna will also introduce the LAN, WAN, acls, many other fundamentals is a necessity, and then only for such examinations. This examination objectives are broken down into six main areas: the second safety.

Configuration of Cisco IOS firewall capabilities to meet safety requirements.

Configuration of Cisco IOS-based IPS to identify and mitigate the threat of network resources .

Basic configuration of the security IPSec VPN site-to-site and remote access network resources.

Configuration authentication, authorization and accounting provide the basis Network security access control.

Use management applications to configure and control the IOS security features.

1 ccsp need the knowledge and hands-on experience with many Cisco network security technology. The examination covered these snrs from a high-level implementation, configuration and troubleshooting perspective. Ccsp four other examinations required for certification is quite specific. I suggest that you begin a ccsp pursuit of this examination.

In this article, I will address some of the main areas to study this new examination by mapping to the official purpose of the examination, that is, you will find here.

The second safety core issues, including the Examinations Section: advantage of Cisco IOS commands and the CAT OS Orders to reduce Layer 2 attacks.

Implementation of Cisco identity-based Web services.

Implementation of the port Cisco 802.1 x certification.

Identify and describe the second tier security best practices.

As you may already know, network security, usually starts in the physical layer, or personal safety. Ensure that the data center and wiring closets as inevitable, as a barrier to prevent those who might be physical network attacks from or simply stealing the equipment connected to a console port. There are many methods and theories to implement physical No safety tests on the test, but you should be very familiar with the lock down console port , and configuration register settings, in order to prevent password recovery If physical access is made attacker. Specific to the test, you will also would like to know how to configure virtual terminal lines (vty), a privileged mode password and password service orders: online password password situation 0 Login line vty 0 4 Password login password Let secret password services cryptographic Note: the default configuration register settings 0 x2102 must be changed to 0 x2142, password recovery. It can also be changed to prevent crtl off function and password recovery.

Layer 2 security, is a typical internal network switches.

Here you can use MAC address filtering, authentication and 802.1x configuration, in order to prevent cam table overflow and MAC address spoofing. You most certainly would like to read and study this Cisco Security White Paper for the past two years, with particular emphasis Requirements for you may be required on the test configuration switches, in a simulated environment.

The same in this White Paper, you will want to learn 802.1 x agreement, in particular, to pay attention to IOS and CAT OS order to complete configuration. You will also wanted to know about the communication and interaction between the supplicant and Jiandingzhe. And do not forget to study and understand the layer 2 security best practices, to the end of the document. Sewage treatment plants, or the CDP VLAN Road, targets or victims of the two attacks, but not necessarily tested on this examinations. Most of this is that in the general sense of identity-based Network Services (ibns).

Configuration of Cisco IOS firewall capabilities to meet the security requirements core issues, Examinations Section include: identify and describe the ability of the Office of Internal Oversight firewall feature set.

Configuration, verification and dynamic way to reduce cbac difficult to identify threat to the network.

Configuration, verification and authentication agent for safety problems policies on the basis of each user on.

I am very lucky to have a cbac based on the router in my laboratory network. By combining router and firewall features, Cisco provides a lot of small office, home office and branch office router and There are many built-in firewall security professionals sneer at, in this type of configuration, and only recommended a separate routers and firewalls, If Cisco PIX. They have a very effective, because if cbac router / firewall compromised in the slightest may not have other layers of security at the local, in order to protect the network. Most enterprise networks are using different devices routing and firewall. However, because of the expectations of the examination, you know that these two! The Cisco IOS Firewall feature set does not provide all the same functionality The PIX, and command sets and configuration can be completely different .

Experience is the best, but if you do not have a laboratory, including This router / firewall combination, you should first read this document, As you may be required to configure routers on the examination, in a simulated environment.

Note: List configuration access and use cbac eigrp using extended visit List and route permit any eigrp any.

You must also be familiar with and able to spot an incorrect cbac router configuration. I suggest that you consider the White Paper document.

For certification agency, to see the document.

Tip: IOS AAA command of the new model, authentication, authorization and accounting Cisco routers.

Configuration of Cisco IOS-based IPS to identify and mitigate the threat of network resources examination topic located here, including : ability to identify and describe the relevant IOS IPS feature set.

Configuration IPS capabilities to identify threats and dynamic can stop from entering the network .

Verify row barrier, maintain and update identity card and signature.

I suggest you begin by reviewing the document.

News agency, or intrusion prevention system, which is the latest Cisco Arsenal detection and reaction to network and device-based attacks. Similar invasion Detection System (IDS), the news agency, using the same attack signature database and the ability to send an alarm drop packets or reset When connected to an active attack is detected. A signature definition files (SDF) to download router flash memory, and used to make real-time comparison and examination, and all vehicles access router.

Note: based on the atomic attacks, can be found in a single IP packet, , but the complexity of Web-based attacks can be embedded into many packages.

You should read this document As you may be asked to review the examination to configure the router for active or Signed loaded, and in the use of a simulated environment.

Basic configuration of the security IPSec VPN site-to-site and remote access to the network resources examination topic located here, including: to choose the correct implementation of IPSec based on the specific requirements.

Configuration, verification and troubleshooting IPSec encryption using pre-shared key and certificate.

Configuration and troubleshooting, both hardware and software, the EZ-VPN server, .

The examination only covers the fundamentals IPSec configuration. To this end, the link "br> csvpn new 642-511 (Cisco Security Virtual Private Network) examinations, including VPN more detailed. IPSec configuration can be an arduous task. Link "br> usually using multiple telephone lines configuration requirements, you will need to understand the basic IPSec the design and implementation of sinners.

Tip: IPSec the operation of the network layer in the OSI model, and provide traffic and Tunnel mode configuration.

One of the best resources, I found that the Internet is cisco.com, providing a large number of document, you should read and review: security Virtual Private Network (PDF format) deployment IPSec VPN, site-to-site Finally, two in the real world would be very easy to VPN Configuration Wizard in the located here: Cisco easy VPN client for the Cisco 1700 series routing Cisco--VPN remote to pay special attention to the allocation of tasks, examples and the on-screen product If you can not fortunate to have Cisco router or PIX copy of the support VPN and client software! Tip: split tunneling that customers have the ability to use network both IPSec security / encryption into the company network and connected The non-IPSec connections, such as those for Web surfing.

The DES, Triple DES, AES, MD5 and the Diffie - Hermann you are abbreviations and technical should be familiar with the examination. The first three encryption algorithms confidentiality of information MD5 hash algorithm is a message integrity the Diffie - Hermann is IPSec for peer authentication. These make what is often referred to as the CIA.

IPSec configuration involving four major steps: identify prepared to use encryption strategies for mainframe and network, through a review of existing access lists and packet filtering. IKE configuration created by the policy and verify configuration.

Configure IPSec transform the definition set to create encrypted channel list map works, and use their interface.

Tested and validated the use of IPSec operation and debugging orders.

Note: password to access the list of permit-extension statements control over vehicles will be encrypted, and should be a mirror of each other between IPSec configuration peer.

Configuration authentication, authorization and accounting provide basic security for network access control Examination topic located here, including: administrative entered the Cisco security ACS server.

Configuration, the Cisco ACS AAA security routers.

Configuration users, groups, and permissions.

Router configuration so that the learning ability assessment to the use of RADIUS and TACACS +.

Verification and troubleshooting of AAA operation.

I found that a lot of questions on the examination of the authentication, authorization and accounting . Ensure a secure server, such as csacs imperative its settings for local access only to ensure data communications and may even Firewall.

Tip: csacs running on Windows, Unix and NetWares.

If you only need to download a 90-day trial version csacs (a cisco.com registered account), you should up to experience it as possible. You should also read and review of the following documents: configuration AAA access to a basic server configuration IPSec the road between the Cisco IOS for the client and Cisco VPN 3. for Windows using x sample radius configurations: the local user authentication for HTTP server user Cisco ACS guidelines for safety Windows Server version 3.3 use management applications to configure and control the IOS security features examination topic located here, including: initialization SDM communications using Cisco routers and LAN interface performances configuration.

Use SDM is the identification and establishment of a site-to-site VPN.

The safety equipment managers, found that many of Cisco router is a Web-based interface can definitely help with the complex VPN configuration. Its also available as a free download and install to almost all Cisco routers.

I also suggest that you read this real-world case studies and configuration guide (PDF format), to pay particular attention to screen For example, Product navigation and configuration.

III This parcel, for the examination of the review. Next month I will review the new 642-522 ccsp examinations to ensure that Cisco networking equipment (Suzhou high). Good luck and research worked hard!