HCIE-Security study plan
HCIE-Security · Give each week a clear focus.
8 weeks · About 7 hours per week
Security Architecture and Design
Map every objective in Domain 1 (security architecture and design) to a one-line self-assessment of confident, shaky, or unknown
Explain the layered defense-in-depth model and place each Huawei security product family (firewall, DDoS mitigation, WAF, endpoint, cloud security) on the layer it protects
Describe how a next-generation firewall separates management, control, and data planes and why that separation matters for security
Sketch a reference enterprise security zone design (untrust, trust, DMZ, management, and guest) with traffic flows between zones
Your checkpoint
A one-page zone-and-layer diagram plus a Domain 1 objective checklist scored confident, shaky, or unknown
Security Architecture and Design
Compare stateful packet inspection, application-layer gateway, and full proxy inspection models on latency, visibility, and failure modes
Explain the role of hardware security modules and key management in protecting stored credentials and certificates
Design a high-availability firewall pair and state why session synchronization and split-brain prevention matter
Identify single points of failure in a given three-tier security architecture and propose redundancy for each
Your checkpoint
A written architecture review of a two-firewall HA design listing at least six failure points and a mitigation for each
Network Security Technologies
Walk through the packet-processing pipeline of a next-generation firewall from ingress to application identification
Configure and explain NAT types (source, destination, server, and bidirectional) and predict the order of NAT versus policy lookup
Explain how application identification and signature plus behavior detection classify encrypted and evasive traffic
Describe IPS modes (detection versus prevention), signature tuning, and how to reduce false positives without losing coverage
Your checkpoint
A configuration walkthrough document for a NAT-plus-policy scenario with the expected packet path annotated step by step
Network Security Technologies
Explain site-to-site and remote-access VPN negotiation phases and the parameters that must match on both peers
Compare IPsec and SSL VPN for a given remote-work requirement and justify the choice in writing
Describe DDoS attack categories (volumetric, protocol, application) and match each to a mitigation technique
Explain how anti-DDoS scrubbing, rate limiting, and source verification work together during an attack
Your checkpoint
A VPN and DDoS mitigation design note for a branch-office scenario covering peer parameters, failure recovery, and attack response
Endpoint and Cloud Security
Explain endpoint detection and response telemetry sources and how they feed a central analysis engine
Describe host-based firewall, application control, and device-compliance enforcement on managed endpoints
Map shared-responsibility boundaries for IaaS, PaaS, and SaaS and state who secures what in each
Explain cloud workload protection, micro-segmentation, and identity-based access control in a multi-cloud environment
Your checkpoint
A shared-responsibility matrix and endpoint-plus-cloud control map for one hybrid deployment scenario
Security Operations and Management
Describe the security operations workflow from log collection through correlation, alert triage, and incident closure
Explain how SIEM correlation rules, baselines, and threat intelligence feeds reduce alert noise
Draft an incident-response runbook for a ransomware detection covering containment, eradication, and recovery
Define measurable SOC metrics (mean time to detect, mean time to respond, false-positive rate) and how to collect them
Your checkpoint
A one-page incident-response runbook plus a SOC metrics dashboard definition with at least five metrics
Security Troubleshooting and Optimization
Diagnose common connectivity failures (policy deny, asymmetric routing, NAT mismatch, MTU and fragmentation) using a structured evidence-gathering order
Interpret session tables, logs, and packet captures to isolate where a flow is being dropped
Tune firewall and IPS policies to cut false positives while preserving required coverage
Explain performance bottlenecks (session table exhaustion, CPU and memory pressure, throughput limits) and their mitigations
Your checkpoint
A troubleshooting decision tree for a dropped-flow scenario, validated against at least three simulated failure cases
Security Architecture and Design & Network Security Technologies & Endpoint and Cloud Security & Security Operations and Management & Security Troubleshooting and Optimization
Re-score every objective across all five domains and close remaining shaky items with targeted review
Complete two timed full-length practice sets and analyze every wrong answer by root cause
Re-derive the top failure points, protocol parameters, and troubleshooting steps from memory without notes
Build a final-week review sheet of only the items still marked shaky
Your checkpoint
A final readiness report with per-domain scores, root-cause notes for every missed question, and a go or delay decision
Milestones
Week 2: Domain 1 objective checklist shows at least 80 percent confident, and the architecture review names six or more failure points with mitigations
Week 4: Can trace a packet through NAT and policy and explain VPN negotiation phases from memory in under ten minutes each
Week 6: Incident-response runbook is complete enough that a peer could execute it without asking clarifying questions
Week 8: Two timed practice sets completed with per-domain scores recorded and every missed item traced to a root cause