Cisco CBRFIR (300-215) study plan
Cisco CBRFIR (300-215) · Give each week a clear focus.
8 weeks · About 6 hours per week
Firewall Fundamentals and Architecture
Map the data-plane versus control-plane split of a Secure Firewall deployment so you can explain where access control, prefilter, and intrusion inspection each sit in the packet path
Diagram a routed, a transparent, and an inline-set deployment from memory, labeling interfaces, zones, and the failure behavior of each
Compare the threat defense hardware and virtual form factors and state which one fits a branch, a data center, and a public cloud edge
Write down the boot and registration sequence a device follows from first power-on to being managed by a manager, in order
Your checkpoint
A one-page hand-drawn architecture diagram of a routed deployment with the packet path labeled from ingress interface through prefilter, access control, and intrusion inspection to egress, plus a written list of the three deployment modes and their failure behavior
Firewall Fundamentals and Architecture & Cisco Secure Firewall Deployment and Initial Configuration
Configure initial device setup on a fresh threat defense, including management interface addressing, gateway, DNS, and time source, and verify each with a show command
Register a device to a management center and confirm health status turns green
Explain how licensing tiers differ and which features stop working when a license expires
Describe high availability and clustering at a conceptual level, naming what state is synchronized and what is not
Your checkpoint
A configuration checklist you executed end to end on a lab device, with the exact commands and the show-command output that proves management connectivity, registration, and license state
Cisco Secure Firewall Deployment and Initial Configuration
Build a policy structure from scratch: prefilter, access control, intrusion, and the default action, and articulate the order of evaluation
Configure interface objects, network objects, and dynamic objects, then reuse them in a rule to show the benefit over inline values
Set up a NAT policy for both hide and static translations and verify with packet-tracer output
Configure a site-to-site VPN or a remote-access tunnel and prove the tunnel comes up
Your checkpoint
A working lab topology with at least two interfaces, an object library, a NAT rule for outbound traffic, and one tunnel, documented with a packet-tracer walkthrough showing each policy stage a test flow passes through
Access Control and Prefilter Policies
Write access control rules that combine source, destination, application, URL category, and user identity, and predict the verdict before you commit
Order rules so that a specific allow precedes a broad block and demonstrate the shadowing problem when you reverse them
Configure prefilter rules to fast-path trusted traffic and to tunnel or block traffic before access control runs, and measure the effect on rule hit counts
Apply an intrusion policy and a file policy to a single access control rule and confirm the inspection actually fires on matching traffic
Your checkpoint
An access control policy of at least eight rules that uses application, URL, and identity conditions, with a written prediction-versus-result table for five test flows and a note on which rule each flow matched
Intrusion Prevention, Malware, and File Policies
Tune an intrusion policy: start from a balanced baseline, add a custom variable set, and suppress a noisy signature with a documented reason
Explain the difference between a rule action of alert, drop, and reject, and choose the right one for a given exposure
Configure malware and file policies with file capture, and describe what happens to a file that matches a blocking rule
Trace a simulated malware event from detection through the connection event to the file event, and identify the fields that tie them together
Your checkpoint
A tuning log for one intrusion policy listing every signature you changed, the reason, and the before-and-after event count, plus a malware policy that blocks a test file and the correlated event record proving the block
Intrusion Prevention, Malware, and File Policies & Troubleshooting, Monitoring, and Operations
Read the connection event table and filter it by rule, by application, and by action to isolate a single flow
Correlate an intrusion event to its parent connection event and to the access control rule that allowed it
Use packet capture and packet-tracer together to prove where a dropped packet was discarded
Configure alerting so that a high-severity intrusion event reaches you without opening the console
Your checkpoint
A troubleshooting write-up of one deliberately broken flow, showing the event query you ran, the packet-tracer output, the packet capture, and the single policy change that fixed it
Troubleshooting, Monitoring, and Operations
Perform a policy deployment and read the deployment history to diagnose a failed push
Explain how a device's health monitors work and what to check when a monitor turns red
Back up a configuration and restore it to a clean device, then verify the policies match
Describe how to upgrade a device and a manager in the correct order and what to verify between steps
Your checkpoint
A runbook covering deploy, backup, restore, and upgrade, with a failed-deployment diagnosis recorded from a real lab attempt and the exact fix you applied
Firewall Fundamentals and Architecture & Cisco Secure Firewall Deployment and Initial Configuration & Access Control and Prefilter Policies & Intrusion Prevention, Malware, and File Policies & Troubleshooting, Monitoring, and Operations
Re-derive the full packet path from memory and place every policy type on it
Retake a timed practice set and score each domain separately to find the weakest area
Reconfigure the two weakest areas from a blank device without notes
Write a one-page cheat sheet of the commands and event fields you keep forgetting
Your checkpoint
A scored practice result broken out by domain with a written remediation note for each domain below your target, plus a one-page cheat sheet you authored
Milestones
Week 2: You can take a factory-default device to registered-and-healthy in under 30 minutes without notes, and you can name every license tier and the feature it unlocks
Week 4: You can predict the verdict of a test flow against your access control policy before committing, and your prediction matches the result for at least four of five flows
Week 6: Given a single broken flow, you can find the responsible rule and the drop point using event views, packet-tracer, and capture in under 20 minutes
Week 8: Your timed practice score is at or above your target in every domain, and you can rebuild a working policy set from a blank device without reference material