Chapter 5 of 5 · Cisco CCNA 200-201 CBROPS
Security Policies and Procedures
Management, NIST response, forensics, profiling, data and attack models.
- 7topics
- 35 minfast track
- 4diagrams and exhibits
- 15%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Asset, Configuration, Mobile, Patch and Vulnerability ManagementDescribe asset management, configuration management, mobile device management, patch management and vulnerability management and…5 min
- 2NIST SP 800-61 Incident ResponseLearn the elements of an incident response plan in NIST SP 800-61 and the four phases of incident handling, and map actions to…Diagram5 min
- 3Incident Response Stakeholders and SOC MetricsMap stakeholders to the incident response phases in NIST SP 800-61 and CMMC, and learn how SOC metrics such as time to detect…Diagram5 min
- 4NIST SP 800-86 Digital ForensicsLearn the forensic concepts in NIST SP 800-86: order of evidence collection, data integrity, data preservation and the collection…5 min
- 5Network and Server ProfilingBuild network profiles from throughput, session duration, ports and critical asset address space, and server profiles from ports…5 min
- 6Protected Data in a NetworkIdentify protected data in a network, including PII, PSI, PHI and intellectual property, the rules that govern them, and the…5 min
- 7Cyber Kill Chain and Diamond ModelClassify intrusion events with the Cyber Kill Chain stages and the Diamond Model of Intrusion Analysis, and learn how the two…Diagram5 min
About this chapter
What this chapter covers
Security Policies and Procedures is about the organised, repeatable work that surrounds the technical analysis.
It starts with the management processes that keep systems known and patched. It then covers incident response, as set out by NIST, with the people involved and the metrics used to judge it.
The later pages cover forensic handling of evidence, profiling of networks and servers, the kinds of data that need protection, and two models for classifying attacks.
How the topics fit together
The chapter follows the life of an incident, from prevention to response to analysis.
The first page covers the processes that reduce risk before anything happens. The second page gives the four phase response process, and the third page adds stakeholders and metrics.
The forensics page explains how to collect and keep evidence during that process. The profiling page gives the baselines that make a deviation visible, and the protected data page explains why some incidents matter more than others.
The final page brings in the Cyber Kill Chain and the Diamond Model. They help you place an event in an attack and describe it consistently.
The phases from the second page are used again by the forensics, stakeholder and kill chain pages, so learn them first.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and diagrams.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Much of this chapter is about order and mapping. Practise by taking a short incident story and placing each action in its phase, kill chain stage and stakeholder.
Ready for more practice?
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.