NetSec Professional study plan
NetSec Professional · Give each week a clear focus.
8 weeks · About 6 hours per week
Firewall Configuration, Routing, and Network Interfaces
Map every firewall interface to its zone and write the resulting zone-pair matrix from memory
Configure a lab firewall with three interfaces (WAN, LAN, DMZ) and assign addressing without consulting a guide
Distinguish transparent vs. routed mode deployments and state which mode fits a given topology
Trace a packet from client to internet through the zone matrix and predict the permit/deny outcome before testing
Your checkpoint
A one-page topology diagram plus a filled-in zone-pair matrix for your lab, with a packet-flow trace for three sample flows
Firewall Configuration, Routing, and Network Interfaces
Configure static routes, then a dynamic routing adjacency, and verify each with the routing and forwarding tables
Diagnose and fix three deliberately broken routes (black hole, asymmetric path, wrong next hop)
Compare policy-based and route-based forwarding decisions in writing with a concrete example of each
Apply link aggregation or redundant-interface configuration and confirm failover behavior
Your checkpoint
A troubleshooting log of three broken-route scenarios, each with symptom, root cause, fix, and verification command output
VPN and Secure Tunneling
Build a site-to-site IPsec tunnel between two lab firewalls and bring phase 1 and phase 2 up
Explain each IKE parameter choice (encryption, hash, DH group, lifetime) and why the two peers must agree
Break the tunnel on purpose by mismatching one parameter and read the logs to identify which one
Configure a dial-up/remote-access VPN for a client and validate that the client receives a virtual address
Your checkpoint
A working site-to-site tunnel plus a written parameter-comparison table listing each setting, both peers' values, and the failure symptom when mismatched
VPN and Secure Tunneling
Configure a client-based SSL/TLS VPN and contrast its authentication and traffic flow with IPsec
Capture and interpret tunnel negotiation traffic to confirm which side is rejecting a proposal
Apply split tunneling and enforce tunnel-all policy, then verify the routing change on the client
Review VPN configuration for common exposure mistakes (weak proposals, no PFS, overly broad selectors) and harden each
Your checkpoint
A hardening checklist scored against your own lab VPN config, with every weak item remediated or explicitly justified
Security Policies, NAT, and Authentication
Write security policies in top-down order and predict which rule matches a given flow before sending traffic
Convert a legacy permissive ruleset into a deny-by-default policy set with explicit permits
Configure source NAT and destination NAT, then verify translations with session table inspection
Resolve two policy-ordering conflicts in which a shadowed rule silently changes the outcome
Your checkpoint
A before/after policy set (permissive to deny-by-default) with a rule-hit table proving each flow is matched by the intended rule
Security Policies, NAT, and Authentication
Configure at least two user authentication methods (local and an external directory) and test both paths
Map an authenticated user or group to a policy and confirm identity-based enforcement in the session table
Set up multi-factor authentication for a remote-access path and verify the failure case when the second factor is absent
Design a guest or captive-portal flow with isolation from internal zones
Your checkpoint
A written access-control matrix (user/group, authentication method, permitted resources) validated by four live test logins including one denied attempt
Security Profiles, Logging, and Monitoring
Attach antivirus, IPS, and URL/web filtering profiles to a policy and confirm each blocks a test sample
Tune an IPS signature set to reduce false positives on normal business traffic
Compare flow-based and proxy-based inspection and state which one your test traffic required
Verify that profile actions (block, alert, allow) behave as intended in each direction of traffic
Your checkpoint
A profile-attachment table showing profile, policy, action, and observed result for at least five test events
Security Profiles, Logging, and Monitoring & Firewall Configuration, Routing, and Network Interfaces & Security Policies, NAT, and Authentication & VPN and Secure Tunneling
Configure local and remote log destinations and confirm events arrive at the collector
Build two correlation-style alerts (repeated failed logins, denied traffic spikes) and trigger each
Review logs to reconstruct a full session for one allowed and one blocked flow end to end
Run a timed mixed-domain review of missed practice questions and re-derive each missed concept from config rather than memory
Your checkpoint
A one-page incident reconstruction from logs (timeline, source, destination, policy hit, action) plus a scored list of remaining weak topics with a remediation date
Milestones
Week 2: You can draw the zone matrix and the routing table for your lab from memory and correctly predict the fate of a new flow before testing it
Week 4: Site-to-site and remote-access tunnels both come up, and you can identify a mismatched IKE parameter from logs alone
Week 6: A deny-by-default policy set with identity-based rules passes all four test logins, and you can justify each rule's position
Week 8: Logs reconstruct a complete allowed and blocked session, and every remaining weak topic on your list has a scheduled remediation