- Explain how different threat actors operate by describing their motivations, common attack vectors, typical breach and credential-abuse patterns, and the role of the cyber threat intelligence lifecycle in helping organizations understand and track these evolving threats
- Describe how structural weaknesses in software and web applications are identified, classified, and prioritized using concepts such as vulnerability classes, OWASP, CVE, and CVSS, and explain how AI/LLM systems extend this landscape with new vulnerability patterns
- Explain why humans and identity remain a primary attack vector by describing social-engineering and credential-theft lifecycles and by outlining the key conceptual defense layers that organizations apply to reduce, but not completely remove, identity-driven risk
- Describe the main cryptographic building blocks, hashing, symmetric and asymmetric encryption, key exchange, digital signatures, PKI, and encrypted transport protocols, and explain the specific security guarantees and trust assumptions each introduces into an enterprise design
- Explain how Zero Trust, defense in depth, and the Cisco SAFE Blueprint framework together turn threat, vulnerability, identity, and cryptographic insights into a coherent security architecture that assumes failure, limits blast radius, and guides technology placement across the environment
- Describe why the Layer 2 access network is a foundational security boundary by explaining how segmentation, topology, addressing, neighbor discovery, and edge-port controls work together to prevent local attacks from undermining higher-layer security
- Describe how to secure network infrastructure devices by reducing their attack surface, protecting management and control planes as privileged authority channels, and choosing management-plane architectures that create clear, defensible trust boundaries
- Explain how to design and operate AAA for infrastructure administration by choosing appropriate protocols, defining AAA and fallback behavior, and systematically troubleshooting AAA failures to restore secure administrative access
- Perform Cisco Secure Firewall Threat Defense Basic Setup
- Configure access control policy with intrusion policy, file and malware policy to meet given security requirements
- Configure secure site-to-site VPN solutions to establish connectivity between remote sites using Cisco Secure Firewall Threat Defense
- Configure remote access VPN solutions on Cisco Secure Firewall Threat Defense to provide secure connectivity to the corporate network for remote users
- Evaluate cloud security strategies using NIST 800-145 shared responsibility models, security frameworks, and CASB solutions for multicloud environments
- Describe cloud workload security strategies encompassing microsegmentation principles, Cisco Secure Workload, Multicloud Defense platforms, and eBPF-based security approaches
- Describe DevSecOps and Infrastructure as Code principles and interpret Python scripts to call security appliances API
- Describe SASE and SSE architectures and Cisco Secure Access capabilities providing unified, cloud-delivered protection of private applications and the internet across remote and branch environments
- Configure cloud-delivered connectivity, identity-aware authentication, and granular access policies to provide secure access to private applications for remote and branch users
- Configure connectivity identity, and security controls to provide secure access to the internet and SaaS applications for remote and branch users
- Explain how identity, device context, and policy-driven access control work together in secure network access solutions, and describe how Cisco ISE supports differentiated access through AAA, guest access, profiling, and BYOD
- Configure wired and wireless network access control with Cisco ISE by implementing 802.1X and MAB, applying Cisco ISE authentication and authorization policy, selecting appropriate EAP and supplicant approaches, and using RADIUS and CoA to enforce the change access state
- Explain how Cisco Duo supports zero-trust principles through strong user verification, device trust, adaptive access policy, and identity-risk visibility with Cisco Identity Intelligence
- Explain how Cisco Secure Email Threat Defense is integrated and configured in Microsoft 365-based email environments to provide message visibility, threat analysis, and remediation against phishing, business email compromise, and account takeover
- Explain how organizations build, validate, and enforce endpoint trust through device management, asset visibility, compliance and posture assessment, and application control to reduce endpoint security risk
- Explain how modern endpoint security, such as Cisco Secure Endpoint with Cisco Secure Malware Analytics, combines prevention, continuous detection, malware analysis, and event-driven investigation by using Endpoint Protection Platform (EPP) and Endpoint Detection and Response (EDR) concepts
- Describe how Splunk Enterprise and Splunk Cloud function as data analytics platforms for security operations, explain how Splunk platform components and deployment models support scalable data processing and analytics, construct queries using Splunk Processing Language to search and analyze the ingested data, explain how Cisco security products are integrated into Splunk, and describe how Splunk Enterprise extends the platform with SIEM capabilities
- Explain how Splunk SOAR supports SOC operations through orchestration, playbook automation, and case-driven response, and describe how it works with Splunk Enterprise Security and Cisco XDR to automate investigation and response workflows
- Explain how XDR unifies threat detection, investigation, and response across multiple security domains, and describe how Cisco XDR provides cross-domain visibility, correlation, prioritization, investigation, and coordinated and automated response across integrated security controls