CCNP Security study plan
CCNP Security · Give each week a clear focus.
8 weeks · About 6 hours per week
Network Security
Compare IPsec site-to-site, DMVPN, and FlexVPN designs, and list the negotiation steps (IKEv1/v2 phase 1 and phase 2) for each
Configure and verify a policy-based versus route-based tunnel, identifying which traffic selectors and routing entries each requires
Diagnose a Phase 1 mismatch (proposal, PSK, identity, hash) from debug and show-crypto output
Describe how ZTNA differs from classic VPN in trust model, per-application access, and identity binding
Your checkpoint
One-page comparison table of the four secure-connectivity technologies plus a written troubleshooting decision tree covering 8 IKE/IPsec failure modes
Network Security & Secure Access
Design a segmentation scheme using VLANs, VRFs, and Security Zones, and map which zone pairs require policy
Write firewall rules that enforce least privilege between zones, including default-deny and logging strategy
Explain identity-based policy enforcement using 802.1X, MAB, and SGT/TrustSec classification
Trace a packet through a zone-based policy and predict permit/deny from a given rule set
Your checkpoint
Zone-to-zone policy matrix for a 4-zone campus design (users, servers, guest, DMZ) with 15+ rules and justification notes
Endpoint Protection and Detection
Distinguish endpoint prevention (AV, HIPS, application control, device control) from detection/response (EDR telemetry, behavioral analytics, containment)
Describe the telemetry pipeline stages: endpoint agent, cloud analytics, verdict, retrospective alerting
Explain file disposition states (clean, malicious, unknown, custom) and how prevalence and signatureless detection drive a verdict
Outline containment actions and their blast radius (host isolation, process kill, file quarantine, hash block)
Your checkpoint
Incident runbook for a 'malicious file detonated on 3 endpoints' scenario, from alert to containment to lessons-learned, with the specific console actions in order
Endpoint Protection and Detection & Cloud Security
Map endpoint protections onto cloud-hosted workloads and identify where agent coverage gaps appear (containers, serverless, snapshot restores)
Compare CASB deployment modes (API-based, inline proxy, log-based) and state what each can and cannot inspect
Explain how cloud workload and posture tooling detects misconfiguration versus runtime threat
Interpret a cloud trail/audit log excerpt to reconstruct who changed a security group and when
Your checkpoint
Score 75% or higher on a timed 60-question practice exam covering Domains 1 and 4, with every miss rewritten as a flashcard
Cloud Security
Describe DNS-layer security: recursive resolution path, category and reputation blocking, and why DNS control survives roaming devices
Differentiate forward proxy vs. explicit proxy vs. transparent redirection for cloud web gateways
Explain how security groups, network ACLs, and identity-based cloud policies differ in scope and statefulness
Identify the shared-responsibility boundary for a SaaS, PaaS, and IaaS offering
Your checkpoint
Architecture diagram of a branch-to-cloud traffic path with three enforcement points labeled, plus a shared-responsibility table for the three service models
Content Security
Trace an inbound email through the gateway stages (connection filtering, reputation, anti-spam, anti-malware, content filters, DLP, encryption) and list the order of evaluation
Configure and justify URL filtering categories, acceptable-use policies, and HTTPS decryption exceptions
Compare file-reputation and sandbox analysis for attachments versus links, and explain time-of-click protection
Explain DLP policy components: classifiers, sensitivity levels, destinations, and remediation actions
Your checkpoint
Written 12-step walkthrough of a phishing email with a malicious link, naming the exact control that acts at each step and which single control fails if the link is weaponized 3 days later
Secure Access & Content Security
Explain MFA factor types, push fatigue, and phishing-resistant factors, and select an appropriate factor per user population
Describe how a zero-trust access broker authenticates, authorizes, and proxies an application without exposing it to the internet
Compare agent-based versus agentless posture assessment and the remediation actions each can trigger
Explain the risk of implicit trust in legacy remote-access designs and how continuous verification replaces one-time login
Your checkpoint
Zero-trust rollout plan with three user cohorts (privileged, standard remote, contractor), the factor and posture policy for each, and a rollback step
Network Security & Cloud Security & Content Security & Endpoint Protection and Detection & Secure Access
Re-run every missed practice question from weeks 1-7 and state the correct concept in one sentence without notes
Complete two full-length timed practice exams under exam conditions
Identify the three weakest subdomains by score and close each with a targeted 45-minute review
Build a one-page 'if you see X, answer Y' cue sheet for high-frequency exam patterns
Your checkpoint
Two full practice exam scores logged at 80% or higher, plus a final gap list with zero unresolved items
Milestones
Week 2: Can design and defend a zone-based segmentation policy from scratch in under 20 minutes, and correctly predict permit/deny for 10 of 10 sample rule matches
Week 4: Scored 75%+ on the 60-question Domain 1+4 practice exam; all misses converted into flashcards
Week 6: Can order the email gateway evaluation stages and name the correct control for 5 different attack scenarios without notes
Week 8: Two full-length practice exams at 80%+ overall with no single domain below 70%, taken under timed conditions