CYBER SECURITY

Cisco cyber security 210-255 0/35

This course includes the following topics

• Lecture 2.1

  1.0 Endpoint Threat Analysis and Computer Forensics
• Lecture 2.2

  1.1 Interpret the output report of a malware analysis tool such as AMP Threat Grid and Cuckoo Sandbox
• Lecture 2.3

  1.2 Describe these terms as they are defined in the CVSS 3.0
• Lecture 2.4

  1.3 Describe these terms as they are defined in the CVSS 3.0
• Lecture 2.5

  1.4 Define these items as they pertain to the Microsoft Windows file system
• Lecture 2.6

  1.5 Define these terms as they pertain to the Linux file system
• Lecture 2.7

  1.6 Compare and contrast three types of evidence
• Lecture 2.8

  1.7 Compare and contrast two types of image
• Lecture 2.9

  1.8 Describe the role of attribution in an investigation
• Lecture 2.10

  2.0 Network Intrusion Analysis
• Lecture 2.11

  2.1 Interpret basic regular expressions
• Lecture 2.12

  2.2 Describe the fields in these protocol headers as they relate to intrusion analysis
• Lecture 2.13

  2.3 Identify the elements from a NetFlow v5 record from a security event
• Lecture 2.14

  2.4 Identify these key elements in an intrusion from a given PCAP file
• Lecture 2.15

  2.5 Extract files from a TCP stream when given a PCAP file and Wireshark
• Lecture 2.16

  2.6 Interpret common artifact elements from an event to identify an alert
• Lecture 2.17

  2.7 Map the provided events to these source technologies
• Lecture 2.18

  2.8 Compare and contrast impact and no impact for these items
• Lecture 2.19

  2.9 Interpret a provided intrusion event and host profile to calculate the impact flag generated by Firepower Management Center (FMC)
• Lecture 2.20

  3.0 Incident Response
• Lecture 2.21

  3.1 Describe the elements that should be included in an incident response plan as stated in NIST.SP800-61 r2
• Lecture 2.22

  3.2 Map elements to these steps of analysis based on the NIST.SP800-61 r2
• Lecture 2.23

  3.3 Map the organization stakeholders against the NIST IR categories (C2M2, NIST.SP800-61 r2)
• Lecture 2.24

  3.4 Describe the goals of the given CSIRT
• Lecture 2.25

  3.5 Identify these elements used for network profiling
• Lecture 2.26

  3.6 Identify these elements used for server profiling
• Lecture 2.27

  3.7 Map data types to these compliance frameworks
• Lecture 2.28

  3.8 Identify data elements that must be protected with regards to a specific standard (PCI-DSS)
• Lecture 2.29

  4.0 Data and Event Analysis
• Lecture 2.30

  5.0 Incident Handling
• Lecture 2.31

  5.1 Classify intrusion events into these categories as defined by the Cyber Kill Chain Model
• Lecture 2.32

  5.2 Apply the NIST.SP800-61 r2 incident handling process to an event
• Lecture 2.33

  5.3 Define these activities as they relate to incident handling
• Lecture 2.34

  5.4 Describe these concepts as they are documented in NIST SP800-86
• Lecture 2.35

  5.5 Apply the VERIS schema categories to a given incident