1.2 - Compare common security vulnerabilities such as software bugs, weak and/or hardcoded passwords, SQL injection, missing encryption, buffer overflow, path traversal, cross-site scripting/forgery
1.3 - Describe functions of the cryptography components such as hashing, encryption, PKI, SSL, IPsec, NAT-T IPv4 for IPsec, pre-shared key and certificate based authorization
1.4 - Compare site-to-site VPN and remote access VPN deployment types such as sVTI, IPsec, Cryptomap, DMVPN, FLEXVPN including high availability considerations, and AnyConnect
2.0 - Network Security - 20%
2.1 - Compare network security solutions that provide intrusion prevention and firewall capabilities
2.3 - Describe the components, capabilities, and benefits of NetFlow and Flexible NetFlow records
2.9.c - Debug commands to view IPsec tunnel establishment and troubleshooting
2.2 - Describe deployment models of network security solutions and architectures that provide intrusion prevention and firewall capabilities
2.4.b - Device hardening of network infrastructure security devices (control plane, data plane, management plane, and routing protocol security)
2.7 - Configure AAA for device and network access (authentication and authorization, TACACS+, RADIUS and RADIUS flows, accounting, and dACL)
2.4.a - Layer 2 methods (Network segmentation using VLANs and VRF-lite; Layer 2 and port security; DHCP snooping; Dynamic ARP inspection; storm control; PVLANs to segregate network traffic; and defenses against MAC, ARP, VLAN hopping, STP, and DHCP rogue attacks
2.6 - Implement management options for network security solutions such as intrusion prevention and perimeter security (Single vs. multidevice manager, in-band vs. out-of-band, CDP, DNS, SCP, SFTP, and DHCP security and risks)
2.8 - Configure secure network management of perimeter security and infrastructure devices (secure device management, SNMPv3, views, groups, users, authentication, and encryption, secure logging, and NTP with authentication)
3.0 - Securing the Cloud - 15%
3.1 - Identify security solutions for cloud environments
3.1.a - Public, private, hybrid, and community clouds
3.1.b - Cloud service models: SaaS, PaaS, IaaS (NIST 800-145)
3.2 - Compare the customer vs. provider security responsibility for the different cloud service models
3.2.a - Patch management in the cloud
3.2.b - Security assessment in the cloud
3.2.c - Cloud-delivered security solutions such as firewall, management, proxy, security intelligence, and CASB
3.3 - Describe the concept of DevSecOps (CI/CD pipeline, container orchestration, and security
3.4 - Implement application and data security in cloud environments
3.5 - Identify security capabilities, deployment models, and policy management to secure the cloud
3.6 - Configure cloud logging and monitoring methodologies
3.7 - Describe application and workload security concepts
4.0 - Content Security - 15%
4.1 - Implement traffic redirection and capture methods
4.2 - Describe web proxy identity and authentication including transparent user identification
4.7 - Describe the components, capabilities, and benefits of Cisco Umbrella
4.3 - Compare the components, capabilities, and benefits of local and cloud-based email and web solutions (ESA, CES, WSA)
4.4 - Configure and verify web and email security deployment methods to protect on-premises and remote users (inbound and outbound controls and policy management)
4.5 - Configure and verify email security features such as SPAM filtering, antimalware filtering, DLP, blacklisting, and email encryption
4.6 - Configure and verify secure internet gateway and web security features such as blacklisting, URL filtering, malware scanning, URL categorization, web application filtering, and TLS decryption
4.8 - Configure and verify web security controls on Cisco Umbrella (identities, URL content settings, destination lists, and reporting)