Chapter 2 of 5 · Cisco CCNA 200-201 CBROPS
Security Monitoring
Data sources, visibility, monitoring data types, common attacks, evasion and certificates.
- 8topics
- 36 minfast track
- 5diagrams and exhibits
- 25%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Attack Surface and Monitoring Data SourcesCompare attack surface and vulnerability, and learn what data tcpdump, NetFlow, firewalls, application control and web and email…5 min
- 2How Network Technologies Affect VisibilitySee how ACLs, NAT and PAT, tunnelling, Tor, encryption, peer to peer, encapsulation and load balancing change what a security…5 min
- 3Types of Security Monitoring DataLearn the uses of full packet capture, session data, transaction data, statistical data, metadata and alert data in security…4 min
- 4Network Attacks: Protocol, DoS, DDoS and MITMDescribe protocol based attacks, denial of service, distributed denial of service and man in the middle attacks, with signs to…Diagram5 min
- 5Web Application AttacksDescribe SQL injection, command injection and cross site scripting, how each attack works, what it looks like in logs and how…Diagram4 min
- 6Social Engineering AttacksDescribe manual social engineering such as phishing and pretexting, and how generative AI makes lures, voice and video fakes more…4 min
- 7Endpoint Attacks, Evasion and ObfuscationDescribe buffer overflows, command and control, malware and ransomware, plus evasion and obfuscation methods such as tunnelling…4 min
- 8Certificates, PKI and TLS ComponentsUnderstand how PKI and certificates secure traffic, how asymmetric and symmetric keys work together, and the parts of X.509…Diagram5 min
About this chapter
What this chapter covers
Security Monitoring is about what an analyst can see, and what attackers do to make that harder.
It starts with the data that tools such as packet capture, NetFlow and firewalls produce. It then looks at how everyday network technologies change that data, and at the main types of monitoring data.
The second half of the chapter describes the attacks an analyst expects to meet. It ends with certificates and encryption, since much of today's traffic is encrypted.
How the topics fit together
The chapter moves from what you can collect, to what attackers do, to what encryption hides.
The first page names the data each tool gives. The second page explains why that data can be incomplete, for example behind NAT or inside a tunnel.
The third page ranks the data types from full packets down to alerts, so you know which one answers which question.
The attack pages then describe what those attacks look like in the data. They cover network attacks, web application attacks, social engineering, endpoint attacks and evasion.
The last page covers certificates, PKI and the parts of a TLS handshake. It explains why encryption protects users and also limits inspection.
The attack pages rely on the data pages. Knowing which tool records what helps you decide where an attack would show up.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and diagrams.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
For the attack pages, practise saying what the attacker wants, how the attack works and what trace it leaves. For the data pages, practise matching a question to the data type that answers it.
Ready for more practice?
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.