CCIE Security study plan
CCIE Security · Give each week a clear focus.
8 weeks · About 6 hours per week
Network Security
Build a topology in a lab with two firewalls, a router, and a switch, and configure routed and transparent modes.
Configure and verify site-to-site IPsec IKEv2 with pre-shared key and certificate authentication.
Configure zone-based policy firewall and application inspection for at least three protocols.
Document the packet flow for each configured path using show and debug commands, capturing output.
Your checkpoint
A lab workbook with topology diagram, device configs, and verification output for each of the four goals, reviewed against a self-made checklist.
Network Security & Identity and Access Management
Configure remote-access VPN with AnyConnect/SSL and IKEv2, including split tunneling and posture-independent client profiles.
Configure device hardening: control-plane policing, management access, AAA with TACACS+, and local fallback.
Implement 802.1X with MAB and guest VLAN on a switch, integrating with an external RADIUS server.
Compare and contrast authentication, authorization, and accounting flows across device and user access.
Your checkpoint
A 10-entry configuration journal mapping each hardening and AAA command to the risk it mitigates, with lab verification notes.
Network Security & Cloud Security
Implement segmentation with VRF-lite and security zones, and verify inter-zone policy enforcement.
Configure a cloud-delivered security service (e.g., Umbrella or equivalent) for DNS-layer protection and verify policy application.
Map on-premises security controls to a public cloud shared-responsibility model for compute, storage, and network.
Configure identity-based policy using a cloud identity provider group in a lab or sandbox.
Your checkpoint
A one-page segmentation and cloud-controls matrix showing which control is enforced where (on-prem, cloud edge, SaaS) and the evidence of enforcement.
Cloud Security
Deploy a virtual firewall in a cloud VPC/VNet and validate ingress and egress filtering with test traffic.
Configure site-to-site VPN between on-premises and cloud, and verify failover behavior.
Automate a security policy change using an API (e.g., FMC or cloud-native firewall API) and capture the request and response.
Evaluate cloud workload protection options and document selection criteria.
Your checkpoint
A working cloud lab with a virtual firewall, VPN to on-prem, and one API-driven policy change, documented with screenshots and validation results.
Content Security
Configure web proxy with URL filtering, TLS decryption, and category-based policy; verify with test clients.
Configure email security with SPF, DKIM, and DMARC validation, and test spoofed and legitimate messages.
Tune a file-reputation and AMP pipeline to block a known test malware sample in a sandbox.
Configure CTA/stealthwatch-style network telemetry and identify a simulated anomaly.
Your checkpoint
A content-security test report with pass/fail results for web, email, file, and telemetry scenarios, including policy excerpts.
Content Security & Endpoint Security
Deploy an endpoint protection agent on Windows and Linux, and verify policy enforcement and quarantine.
Configure application control and exfiltration prevention on the endpoint, and test with a benign script.
Integrate endpoint telemetry with the SIEM and create one detection rule that fires on a simulated event.
Compare endpoint detection and response capabilities with traditional antivirus using a feature matrix.
Your checkpoint
An endpoint deployment runbook covering install, policy assignment, telemetry verification, and one validated detection, with command output.
Endpoint Security & Identity and Access Management
Implement ISE or equivalent with device administration and posture assessment for a wired and wireless client.
Configure TrustSec/SGT-based segmentation and verify enforcement across a switch and firewall.
Configure multi-factor authentication and conditional access for a test application.
Troubleshoot a failed 802.1X authentication using logs and packet captures, and document the root cause.
Your checkpoint
A troubleshooting case study with packet capture, log excerpts, root-cause statement, and remediation steps for one failed authentication scenario.
Network Security & Cloud Security & Content Security & Endpoint Security & Identity and Access Management
Complete a timed 60-question mixed-domain practice set and score each domain separately.
Reconfigure the two weakest lab areas from scratch without notes, within a time limit.
Build a one-page quick-reference of commands and concepts per domain.
Review all missed items and write a corrective action for each.
Your checkpoint
A final readiness report with per-domain scores, a list of remaining gaps, and a 30-day post-exam improvement plan.
Milestones
Week 2: Can configure and verify site-to-site and remote-access VPN, device hardening, and 802.1X from a blank topology in under 90 minutes with no notes.
Week 4: Can explain and demonstrate on-premises to cloud segmentation and VPN failover, and has one API-driven policy change working end to end.
Week 6: Can show a blocked malware sample through the content pipeline and an endpoint detection firing in the SIEM from a single simulated event.
Week 8: Scores at least 80% overall and at least 70% in every domain on the timed mixed practice set, with all missed items corrected.