CCNA Cybersecurity (200-201 CCNACBR) study plan

Define the three pillars of security monitoring (people, process, technology) and write a one-paragraph summary of how each pillar shows up in a SOC workflow.

Compare the roles of a SIEM, a syslog collector, and a packet capture appliance, listing at least two data sources each ingests.

Map the five exam domains to your current confidence on a 1-5 scale and identify the two weakest subtopics per domain.

Build a lab log pipeline: send syslog from a Linux host to a collector and confirm the events arrive with correct timestamps and hostnames.

Explain the difference between an event, an alert, and an incident, and classify ten sample log lines into those categories.

Describe how NetFlow and full packet capture differ in what they reveal, and state one investigation where only flow data is sufficient.

Configure a packet capture filter to isolate traffic for a single host and a single port, then verify the capture in Wireshark.

Identify the fields in a SIEM correlation rule (source, condition, threshold, action) and write two simple correlation rules in plain language.

Define confidentiality, integrity, and availability and give a concrete control that protects each in a corporate network.

Compare symmetric and asymmetric encryption, name one algorithm for each, and state where each is used in TLS.

Explain how hashing supports integrity and why a salt matters for password storage.

Differentiate authentication, authorization, and accounting and place each into a login workflow.

Describe the role of a PKI, including certificate authority, certificate signing request, and certificate revocation.

Describe the kill chain phases and map at least one defensive control to each phase.

Explain how vulnerabilities are scored and prioritized, and rank five sample findings by risk with justification.

List the host artifacts an analyst reviews after a suspected compromise (process list, autoruns, scheduled tasks, user accounts, network connections).

Compare antivirus, EDR, and application allowlisting by detection method and blind spot.

Interpret Windows event log entries for logon success, logon failure, and privilege assignment, and state what each indicates.

Explain what Sysmon adds beyond native Windows logging and name three event types worth monitoring.

Read a Linux process tree and identify a suspicious parent-child relationship.

Describe file integrity monitoring and where it detects tampering that antivirus misses.

Analyze a hash and file-path artifact to decide whether a file is likely malicious, documenting the reasoning.

Decode the fields of an IP, TCP, and UDP header and explain which fields an analyst uses to spot anomalies.

Recognize common malicious traffic patterns in packet captures, including port scanning, beaconing, and data exfiltration over DNS.

Explain how NAT and proxy logs complicate attribution and how to account for that in an investigation.

Trace a simulated intrusion across firewall, proxy, and DNS logs and produce a timeline.

Describe how TLS inspection works and its privacy and performance tradeoffs.

Distinguish policies, standards, procedures, and guidelines and give one example of each from a security program.

Describe the purpose of an incident response plan and name the phases of incident handling.

Explain data classification and how it drives handling requirements.

Summarize the intent of a common regulatory or industry framework without overstating what it mandates.

Outline the steps for preserving evidence and maintaining chain of custody during an investigation.

Re-score confidence per domain and close the two weakest subtopics identified in week 1.

Complete a timed mixed-domain practice set and review every missed item to its root cause.

Recite from memory the key distinctions between monitoring tools, host artifacts, and network evidence.

Review the runbook and timeline deliverables for gaps in reasoning and correct them.