CCNP Security SCAZT.
Cloud Security Architecture
- Describe the components of the Cisco Security Reference Architecture
- Understanding and implementing Threat intelligence.
- Understanding and implementing Security operations toolset
- Understanding and implementing User/device security
- Understanding and implementing Network security: cloud edge and on-premises
- Understanding and implementing Workload, application, and data security
- Describe use cases and the recommended capabilities within an integrated architecture.
- Describing and implementing Common identity
- Describing and implementing Converged multi-cloud policy
- Describing and implementing SASE integrations
- Describing and implementing Zero-trust network access
- Describing Cisco SecureX telemetry and orchestration
- Describe industry security frameworks such as NIST, CISA, and DISA
- Describe the SAFE architectural framework.
- Describe the SAFE Key structure like Places in the Network and Secure Domains
User and Device Security
- Implement user and device authentication via identity certificates.
- Implement multifactor authentication for users and devices.
- Implement endpoint posture policies for user access to resources.
- Configure SAML/SSO and OIDC using an identity provider connection.
- Configure user and device trust using SAML authentication for a mobile or web application.
Network and Cloud Security.
- Determine security policies for endpoints to permit access to cloud applications.
- Implement URL filtering (web layer and DNS layer).
- Implement Advanced app control.
- Implement Network protocol blocking such as FTP and bit torrent.
- Configure Direct-internet-access for trusted business applications.
- Configure Web application firewall. Implement Reverse proxy.
- Determine security policies for endpoints to permit access to SaaS applications such as Office 365, Workday, and Salesforce.
- Determine security policies for remote users using VPN or application based.
- Determine security policies for network security edge to enforce application policy.
- Implement security policies- Security services edge.
- Implement security policies- Cisco Secure Firewall (FTD and ASA).
- Describe the MITRE ATT&CK framework and attacker defense mitigation techniques.
- Describe cloud security attack tactics and mitigation strategies.
- Describe how web application firewall protects against DDoS attacks.
- Determine security policies for application enforcement using Cisco Secure #### Workload and enforcement agents.
- Configure Lateral movement prevention.
- Implement Micro segmentation.
- Determine cloud (hybrid and multi cloud) platform security policies based on application connectivity requirements (3rd party providers such as AWS, Azure, and Google Cloud).
Visibility and Assurance.
- Describe the Cisco XDR solution.
- Describe use cases for visibility and assurance automation.
- Describe benefits and capabilities of visibility and logging tools such as SIEM, Open Telemetry, and Cisco Secure Network Analytics.
- Validate traffic flow and telemetry reports for baseline and compliance behavior analysis.
- Diagnose issues with user application and workload access using Cisco Secure Network Analytics, Cloud Analytics, Cloud Insights and Logging.
- Verify user access to applications and data using tools (firewall logs, Duo, Umbrella, and Cisco Secure Workload).
- Analyze application dependencies using tools such as firewall logs and Cisco Secure Workload.
Threat Response.
- Describe use cases for response automation.
- Determine actions based on telemetry reports.
- Determine policies based on security audit reports.
- Determine action based on user or application compromise.
- Contain.
- Report.
- Remediate.
- Reinstantiate.