CCNA Cybersecurity (200-201 CCNACBR) case studies
CCNA Cybersecurity (200-201 CCNACBR) · Put your knowledge to work in context.
The Cisco Certified CyberOps Associate credential - exam code 200-201 CCNACBR - is Cisco's entry-level security-operations certification. It is aimed at people who want to work in, or are newly working in, a security operations center: Tier 1 analysts, SOC triage staff, network engineers moving toward security, and students building a defensive-security foundation. The CCNA Cybersecurity (200-201 CCNACBR) case studies are 5 cases and about 3,937 words.
1Vendor-Managed HVAC Controllers Reachable From the Corporate Subnet
Northline Foods runs a 240-employee food plant. An HVAC vendor manages three building controllers sitting on VLAN 40 (10.40.0.0/24) and connects remotely over a site-to-site VPN.
778 words, about 4 min2Alert Fatigue in a Three-Analyst SOC
A SOC has three analysts covering 07:00 to 19:00 with no overnight staff. The SIEM ingests 1,200 endpoints, 40 servers and 60 network devices and produces roughly 4,800 alerts per day.
771 words, about 4 min3Encoded PowerShell on a Finance Laptop During Month-End Freeze
At 09:12 on a Tuesday, EDR alerts on FIN-WS-114, the laptop of an accounts-payable clerk: WINWORD.EXE spawned powershell.exe with the -enc and -nop flags, which wrote a 2 KB blob into HKCU and then exited. No file was written to disk.
778 words, about 4 min4Regular Beaconing With NXDOMAIN Bursts From an Application Server
NetFlow shows INT-APP-07, a Java application server at 10.20.14.33, opening 1,440 outbound TLS sessions per day to 203.0.113.47 port 443, one per minute, with a standard deviation of about 3 seconds over 24 hours. Each session carries roughly 500 bytes in both directions.
796 words, about 4 min5A Six-Page IR Plan, an Untested Backup, and a 24-Hour Vendor Clause
Meridian Clinics operates 14 sites with 1,100 staff; its EHR is vendor-hosted. The incident response plan is a six-page PDF last edited in 2019.
814 words, about 4 min