CCIE Security study guide
CCIE Security · Work through your exam, one topic at a time.
The CCIE Security credential is a professional-level certification offered by Cisco that validates advanced expertise in designing, implementing, and troubleshooting secure network infrastructures. It is intended for experienced security engineers, network architects, and consultants who work with Cisco security technologies and want to demonstrate their ability to handle complex security challenges. The exam covers five key domains: Network Security, Cloud Security, Content Security, Endpoint Security, and Identity and Access Management, each weighted at 20% of the total. This balanced structure ensures candidates possess a broad understanding of security principles across various environments, from on-premises networks to cloud-based services. The CCIE Security study guide has 5 sections and about 2,316 words.
01Network Security
Network Security covers protecting the transport itself: IPsec and FlexVPN, DMVPN and GET VPN, zone-based firewall policy, segmentation with Cisco TrustSec, and control-plane hardening. Exam scenarios often present a tunnel that negotiates but passes no traffic, or a segmentation rule enforced at the wrong device.
471 words, about 2 min02Cloud Security
Cloud Security tests how you secure workloads and connectivity in public cloud and with cloud-delivered security. Expect Cisco Secure Firewall Threat Defense virtual (FTDv) insertion, AWS and Azure native controls, identity for workloads, and Umbrella Secure Internet Gateway.
465 words, about 2 min03Content Security
Content Security covers Cisco Secure Email and Secure Web Appliance plus Umbrella: mail authentication and policy, web proxy deployment, identity, TLS decryption, and acceptable-use controls. The exam favors operational reasoning about why a message is quarantined or a site is blocked.
451 words, about 2 min04Endpoint Security
Endpoint Security focuses on Cisco Secure Endpoint (formerly AMP for Endpoints), endpoint detection and response, and posture integration with Cisco ISE and AnyConnect. Questions probe verdict handling, isolation, retrospective detection, and indicators of compromise.
453 words, about 2 min05Identity and Access Management
Identity and Access Management covers Cisco ISE, 802.1X and MAB, RADIUS and TACACS+, EAP methods, guest and BYOD flows, posture, TrustSec integration, and pxGrid context sharing. Expect policy-set reasoning: which identity store, which protocol, and which authorization result applies.
476 words, about 2 min