What is the Cybersecurity Operations Fundamentals (CBROPS) course fee at RST Forum?

The course fee is ₹15,000. There are no hidden charges - lab access and course material are included.

How long is the Cybersecurity Operations Fundamentals (CBROPS) course?

60 hours of live instructor-led training (lectures plus hands-on lab practice), running as weekday-evening or weekend batches.

Do I need prior experience to join?

None. This is a beginner-level course - it starts from fundamentals and assumes no prior experience.

Is the training classroom or online?

Both. Classroom batches run at our Mumbai campus, and the same batch streams live for online students across India. Both get identical lab access and the same instructor.

Are the labs hands-on?

Yes - the course includes 15 hands-on labs, practiced on real equipment with 24/7 remote lab access through Skillopia, our own lab platform, for practice between classes.

Can I attend a demo session before enrolling?

Yes. Sit through a live class with the instructor before you decide - call +91 91672 24466 or send an enquiry and we will schedule it.

Cyber Security

Cybersecurity Operations Fundamentals (CBROPS)

Master the essential skill to detect, analyse and respond to cyber threats and secure business continuity. Cybersecurity Operations Fundamentals (CBROPS) at RST Forum is a 60-hour instructor-led course (lectures plus hands-on lab practice) for beginners. Classroom batches run at our Mumbai campus and the same batch streams live-online across India; the fee is ₹15,000.

This course will qualify you for the CCNA Cybersecurity certification (exam 200-201 CCNACBR).

Duration: 60 hours
Training mode: Classroom & online
Course fees: ₹15,000
Level: Beginner
Certification: CCNA Cybersecurity (200-201 CCNACBR)

Course details verified 14 Oct 2026

Please note that the course fees exclude the certification cost.

Overview

Who should attend

This 60hrs (Lectures + hands-on Lab) Cisco Certified CyberOps Associate (CBROPS)- The Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) training is designed for the Cybersecurity and network engineers associated with the Security Operations Center (SOC). Candidates will learn security concepts, common network and application operations and attacks, and the types of data needed to investigate security incidents, monitor alerts and breaches. Candidates will also learn about the NSM tools, basic concepts and uses of cryptography, TCP/IP protocol Exploits usage and mitigation, understand various models for incident investigations, common attack vectors, playbook in the SOC, Computer Security Incident Response Team (CSIRT) and Vocabulary for Event Recording and Incident Sharing (VERIS).

Outcomes

Skills you'll gain

Defining the Security Operations Center.
Understanding Basic Cryptography Concepts.
Understanding Common TCP/IP Attacks.
Understanding Endpoint Security Technologies.
Identifying Common Attack Vectors.
Identifying Malicious Activity.
Identifying Patterns of Suspicious Behavior.
Conducting Security Incident Investigations.
Understanding SOC Metrics.
Understanding SOC Workflow and Automation.

Objectives

What you'll be able to do

The course objectives, as the vendor's own blueprint states them.

Explain how a SOC operates and describe the different types of services that are performed from a Tier 1 SOC analyst's perspective.
Explain Network Security Monitoring (NSM) tools that are available to the network security analyst.
Explain the data that is available to the network security analyst.
Describe the basic concepts and uses of cryptography.
Describe security flaws in the TCP/IP protocol and how they can be used to attack networks and hosts.
Understand common endpoint security technologies.
Understand the kill chain and the diamond models for incident investigations, and the use of exploit kits by threat actors.
Identify resources for hunting cyber threats.
Explain the need for event data normalization and event correlation.
Identify the common attack vectors.
Identify malicious activities.
Identify patterns of suspicious behaviors
Conduct security incident investigations
Explain the use of a typical playbook.

Included

What you get

Curriculum based on course outlines defined by Cisco Systems.
This Instructor-led classroom course is designed with an aim to build theoretical knowledge supplemented by ample hands-on lab exercises.
Facility of Lab on cloud available.
Courseware includes reference material to maximize learning.
Assignments and tests to ensure concept absorption.
Repeating of lectures allowed (On approval basis)
Candidates can attend lectures online.

Credential

Certification details

CCNA Cybersecurity200-201 CCNACBR

After the course

Placements & outcomes

Placement assistance is included: CV preparation, interview drills with real scenario questions, and referrals through our alumni network of 1 million+ engineers trained since 1997.

19 modules

Full syllabus

Every module below is taught live and practiced hands-on - nothing here is a slide-only topic.

Defining the Security Operations Center.

Types of Security Operations Centers.
SOC Analyst Tools.
Data Analytics.
Hybrid Installations: Automated Reports, Anomaly Alerts.
Staffing an Effective Incident Response Team.
Roles in a Security Operations Center.
Developing Key Relationships with External Resources.

Understanding Network Infrastructure and Network Security Monitoring Tools.

NAT Fundamentals.
Packet Filtering with ACLs.
ACLs with the Established Option.
Access Control Models.
Authentication, Authorization, and Accounting.
Load Balancing.
Network-Based Malware Protection.
Network Security Monitoring Tools.
Exploring Data Type Categories.
Network Security Monitoring Data Types.
Security Information and Event Management Systems.
Security Orchestration, Automation, and Response.
Security Onion Overview.
Full Packet Capture.
Packet Captures.
Packet Capture Using Tcpdump.
Session Data.
Transaction Data.
Alert Data.
Other Data Types.
Correlating NSM Data.
Information Security Confidentiality, Integrity, and Availability.
Personally Identifiable Information.
Regulatory Compliance.
Intellectual Property.
Use NSM Tools to Analyze Data Categories.

Understanding Basic Cryptography Concepts.

Impact of Cryptography on Security Investigations.
Cryptography Overview.
Hash Algorithms.
Encryption Overview.
Cryptanalysis.
Symmetric Encryption Algorithms.
Asymmetric Encryption Algorithms.
Diffie-Hellman Key Agreement.
Use Case: SSH.
Digital Signatures.
PKI Overview.
PKI Operations.
Use Case: SSL/TLS.
Cipher Suite.
Key Management.
NSA Suite B.
Explore Cryptographic Technologies.

Understanding Common TCP/IP Attacks.

Address Resolution Protocol.
Legacy TCP/IP Vulnerabilities.
IP Vulnerabilities.
ICMP Vulnerabilities.
TCP Vulnerabilities.
UDP Vulnerabilities.
Attack Surface and Attack Vectors.
Reconnaissance Attacks.
Access Attacks.
Man-in-the-Middle Attacks.
Denial of Service and Distributed Denial of Service.
Reflection and Amplification Attacks.
Spoofing Attacks.
DHCP Attacks.
Explore TCP/IP Attacks.

Understanding Endpoint Security Technologies.

Host-Based Personal Firewall.
Host-Based Antivirus.
Host Intrusion Prevention System.
Application Allowed Lists and Blocked Lists.
Host-Based Malware Protection.
Sandboxing.
File Integrity Checking.
Explore Endpoint Security.

Understanding Incident Analysis in a Threat-Centric SOC.

Classic Kill Chain Model Overview.
Kill Chain Phase 1: Reconnaissance.
Kill Chain Phase 2: Weaponization.
Kill Chain Phase 3: Delivery.
Kill Chain Phase 4: Exploitation.
Kill Chain Phase 5: Installation.
Kill Chain Phase 6: Command-and-Control.
Kill Chain Phase 7: Actions on Objectives.
Applying the Kill Chain Model.
Diamond Model Overview.
Applying the Diamond Model.
MITRE ATTACK Framework.
Investigation of Hacker Methodology.

Identifying Resources for Hunting Cyber Threats.

Cyber-Threat Hunting Concepts.
Hunting Maturity Model.
Cyber Threat Hunting Cycle.
Common Vulnerability Scoring System.
CVSS v3.0 Scoring.
CVSS v3.0 Example.
Hot Threat Dashboard.
Publicly Available Threat Awareness Resources.
Other External Threat Intelligence Sources and Feeds Reference.
Security Intelligence.
Threat Analytic Systems.
Security Tools Reference.
Hunt Malicious Traffic.

Understanding Event Correlating and Normalization.

Event Sources.
Evidence.
Chain of Custody.
Security Data Normalization.
Event Correlation.
Other Security Data Manipulation.
Correlate Event Logs, PCAPs, and Alerts of an Attack.

Identifying Common Attack Vectors.

DNS Operations.
Recursive DNS Query.
Dynamic DNS.
HTTP Operations.
HTTPS Operations.
HTTP/2 Operations.
SQL Operations.
SMTP Operations.
Web Scripting.
Obfuscated JavaScript.
Shellcode and Exploits.
Common Metasploit Payloads.
Directory Traversal.
SQL Injection.
Cross-Site Scripting.
Punycode.
DNS Tunneling.
Pivoting.
HTTP 302 Cushioning.
Gaining Access Via Web-Based Attacks.
Exploit Kits.
Emotet Advanced Persistent Threat.
Investigate Browser-Based Attacks.

Identifying Malicious Activity.

Understanding Network Design.
Zero Trust Model.
Identifying Possible Threat Actors.
Log Data Search.
System Logs.
Windows Event Viewer.
Firewall Log.
DNS Log.
Web Proxy Log.
Email Proxy Log.
AAA Server Log.
Next-Generation Firewall Log.
Applications Log.
NetFlow.
NetFlow as a Security Tool.
Network Behavior Anomaly Detection.
Data Loss Detection Using NetFlow Example.
DNS Risk and Mitigation Tool.
IPS Evasion Techniques.
The Onion Router.
Gaining Access and Control.
Peer-to-Peer Networks.
Encapsulation.
Altered Disk Image.
Analyze Suspicious DNS Activity.
Explore Security Data for Analysis.

Identifying Patterns of Suspicious Behavior.

Network Baselining.
Identifying Anomalies and Suspicious Behaviors.
PCAP Analysis.
Delivery.
Investigate Suspicious Activity Using Security Onion.

Conducting Security Incident Investigations.

Security Incident Investigation Procedures.
Threat Investigation Example: China Chopper Remote Access Trojan.
Investigate Advanced Persistent Threats.

Using a Playbook Model to Organize Security Monitoring.

Security Analytics.
Playbook Definition.
What Is in a Play?
Playbook Management System.
Explore SOC Playbooks.

Understanding SOC Metrics.

Security Data Aggregation.
Time to Detection.
Security Controls Detection Effectiveness.
SOC Metrics.

Understanding SOC Workflow and Automation.

SOC WMS Concepts.
Incident Response Workflow.
SOC WMS Integration.
SOC Workflow Automation Example.

Describing Incident Response.

Incident Response Planning.
Incident Response Lifecycle.
Incident Response Policy Elements.
Incident Attack Categories.
Reference: US-CERT Incident Categories.
Regulatory Compliance Incident Response Requirements.
CSIRT Categories.
CSIRT Framework.
CSIRT Incident Handling Services.

Understanding the Use of VERIS.

VERIS Overview.
VERIS Incidents Structure.
VERIS 4 A's.
VERIS Records.
VERIS Community Database.
Verizon Data Breach Investigations Report and Cisco Annual Security Report.

Understanding Windows Operating System Basics.

Windows Operating System History.
Windows Operating System Architecture.
Windows Processes, Threads, and Handles.
Windows Virtual Memory Address Space.
Windows Services.
Windows File System Overview.
Windows File System Structure.
Windows Domains and Local User Accounts.
Windows GUI.
Run as Administrator.
Windows CLI.
Windows PowerShell.
Windows net Command.
Controlling Startup Services and Executing System Shutdown.
Controlling Services and Processes.
Monitoring System Resources.
Windows Boot Process.
Windows Networking.
Windows netstat Command.
Accessing Network Resources with Windows.
Windows Registry.
Windows Management Instrumentation.
Common Windows Server Functions.
Common Third-Party Tools.
Explore the Windows Operating System.

Understanding Linux Operating System Basics.

History and Benefits of Linux.
Linux Architecture.
Linux File System Overview.
Basic File System Navigation and Management Commands.
File Properties and Permissions.
Editing File Properties.
Root and Sudo.
Disks and File Systems.
System Initialization.
Emergency/Alternate Startup Options.
Shutting Down the System.
System Processes.
Interacting with Linux.
Linux Command Shell Concepts.
Piping Command Output.
Other Useful Command-Line Tools.
Overview of Secure Shell Protocol.
Networking.
Managing Services in SysV Environments.
Viewing Running Network Services.
Name Resolution: DNS.
Testing Name Resolution.
Viewing Network Traffic.
Configuring Remote Syslog.
Running Software on Linux.
Executables vs. Interpreters.
Using Package Managers to Install Software in Linux.
System Applications.
Lightweight Directory Access Protocol.
Explore the Linux Operating System.

Reserve your seat

Watch a real class. Meet your instructor. Then decide.

Hold a place on the next batch and sit in on the opening session. See the teaching, the racks and the labs exactly as students do, then enrol if it's right for you.

Reserve my seat Chat on WhatsApp

1 million+

engineers trained

1997

training since

24/7

Skillopia lab access

Keep exploring

View the full Cyber Security track

Fee

₹15,000

Reserve a seat

Who should attend

Skills you'll gain

What you'll be able to do

What you get

Certification details

Placements & outcomes

Full syllabus

Defining the Security Operations Center.

Understanding Network Infrastructure and Network Security Monitoring Tools.

Understanding Basic Cryptography Concepts.

Understanding Common TCP/IP Attacks.

Understanding Endpoint Security Technologies.

Understanding Incident Analysis in a Threat-Centric SOC.

Identifying Resources for Hunting Cyber Threats.

Understanding Event Correlating and Normalization.

Identifying Common Attack Vectors.

Identifying Malicious Activity.

Identifying Patterns of Suspicious Behavior.

Conducting Security Incident Investigations.

Using a Playbook Model to Organize Security Monitoring.

Understanding SOC Metrics.

Understanding SOC Workflow and Automation.

Describing Incident Response.

Understanding the Use of VERIS.

Understanding Windows Operating System Basics.

Understanding Linux Operating System Basics.

Hands-on labs

Hands-on labs

Use NSM Tools to Analyze Data Categories

Explore Cryptographic Technologies

Explore TCP/IP Attacks

Explore Endpoint Security

Investigate Hacker Methodology

Hunt Malicious Traffic

Correlate Event Logs, PCAPs, and Alerts of an Attack

Investigate Browser-Based Attacks

Analyze Suspicious DNS Activity

Explore Security Data for Analysis

Investigate Suspicious Activity Using Security Onion

Investigate Advanced Persistent Threats

Explore SOC Playbooks

Explore the Windows Operating System

Explore the Linux Operating System

Upcoming start dates

Course Fees

Frequently asked questions

Watch a real class. Meet your instructor. Then decide.

More Cyber Security courses

Automating Security Solutions (SAUTO)

CCIE Lab Certification (Security)

CCNA Cybersecurity (200-201 CCNACBR)

CCNP Cybersecurity (350-201 CBRCOR)