CCIE安全 LAB考试升级说明 ccie安全认证5.0来了

**华尔思_小号 [Lv5 不断成长]** · 发表于 2016-9-13 08:48:17

本帖最后由宅男女神于 2016-9-13 11:29 编辑

据思科官网消息， CCIE 安全LAB考试将于2017年1月31日升级，新的考试版本号为 Lab Examv5.0
思科CCIE安全实验考试v5.0，考试时间为8个小时，需要考生在给定的场景中计划，设计，执行，操作并故障排除复合网络安全完成动手实验考试。故障排除的知识是一项重要的技能，在实验考试中考生需要诊断并解决网络问题。

CCIE安全v5.0 将笔试及实验考试考纲合二为一，并明确指出了每项考试主题的权重。

统一版的考纲

CCIE安全实验考试v5.0统一版的考纲

实验考试格式

实验考试时间为8个小时，由3个考试模块组成，在考试中需要完成以下：

Module 1：故障排除单元（2小时）

故障排除单元中的题目之间相互独立。每道题目的解决方法也与其他题目的不尽相同。故障排除单元中的拓扑与配置单元中的拓扑不尽相同。

故障排除单元的时间为两个小时；然而，考生可以从配置单元中借30分钟来答题。换而言之，考生可以额外使用30分钟来解决故障排除单元或配置单元中的问题。

Module2：诊断单元（1小时）

全新整段单元考生在没有设备访问的情况下，被提供一系列的文档，代表一种与真实工作场景相同的写照：一个网络工程师可能会在某个调查过程的某一点中遇到的场景。诊断单元的主要目标是验证考生是否具备正确诊断网络问题的技能。这些技能包括：

分析4 ]' G+ k0 O/ P% A

关联：查阅多种文档资源（例如电子邮件回复组，网络拓扑图，控制台输出，日志，甚至是流量捕捉）- a, n" w2 E" _

这些考核内容是整个故障排除技能中的自身的部分。由于题目的格式的显著不同，他们被分别设计在不同实验单元中。在故障排除单元，考试需要完成故障排除并再真实的设备上解决网络安全问题

在Diagnostic module（诊断单元）中，考生需要在预先定义的选项间做出决策：

出现网络问题的根本原因是什么?
& u/ |. g" I: ?; j+ J

网络问题出现在图表中的哪个位置?
哪些关键信息可以帮助确认根本原因?
缺乏哪些能够帮助确认根本原因的信息?
2 l# @! a: G% R" q+ u; f6 U

Module 3：配置单元（5个小时）

配置单元会提供一套设施，与实际的网络非常接近，能够提供在不同层面的网络中不同的节点上的各种的安全组成元件。虽然配置单元的主要部分是基于思科安全设备的虚拟实例，你可能也会被要求在物理设备上工作。在这个单元刚开始时，考生可以预览整个单元，并决定是否按照顺序答题。这完全取决于考生的舒适度以及整个场景和问题的关联度。

注意
: 考生必须按顺序完成每个单元，不允许在单元之间来回答题。

当考生在答故障排除单元中的题目时，可以选择从配置单元的5个小时答题时间中借30分钟来答题。这样考生完成配置单元的总时间将缩短为4.5个小时。

为了保证整个考试时间为8个小时。可选的30分钟，考生可以决定使用在故障排除单元中，系统会自动从配置单元的时间中减去。

当考生在处理故障排除单元的问题时，若超过两小时时，基于网页的系统会跳出一个提示信息。系统会提问考生是否希望继续在故障排除单元中答题，在进入到下一个单元之前加上额外的30分钟，或者停止在故障排除单元的答题，跳转到下一个单元中。

考试通过标准

为了通过实验考试，考生必须同时满足以下两个条件：

高于每个单元的最低分数" `! ^8 @# ]8 n7 [

总成绩高于整个考试的最低分数0 |+ s1 a- k$ d0 B2 |

设定这两项考试通过标准的原因是为了防止考生没有通过或绕过某个单元的考题，但总分却达到及格线的情况发生。例如，诊断单元。

各个单元中的每个考题的得分情况都会告知考生。请注意只有当考生完成了考题的所有要求并满足了特定条件才能得分。任何考题都不会出现部分得分的情况。

考试分数

考生通常在48小时内就能够在网上查看实验考试分数（需要登录）。考试结果包含Pass/Fail以及failing scorereports，在report中会显示出对考生有用的，但需要额外学习并准备的内容。

实验考试结果申诉
重阅卷将由另一位考官将考生的配置重新上传到机架上，重现考试并对整个测试重新评分。重阅卷适用于路由和交换，ServiceProvider考试。

重评分将由另一位考官验证考生的答题以及从考生的考试中保持的任何可应用的system-generated debugdata。重评分适用于任何考试。

考试费用

实验考试费用
用不包括差旅以及住宿费。考试费用可能会由于汇率以及当地的税务（VAT，GST）产生不同。考生需要自行负责完成全部的支付交易费用。考试费用会产生浮动，以完成付款时的汇率为准。

考试环境

考试期间
Cisco documentation
可供考生参考，然而更多的共同协议和技术可以被假定。
Documentation
只能使用索引进行导航，搜索功能无法使用。
外部的参考资料不允许带入实验考试考场。在考试期间你需要向考官汇报任何可疑的设备问题。考试结束时不允许做任何改动。

CCIE安全考试（400-251）考试大纲

考试介绍：

CCIE安全v5.0 将笔试及实验考试考纲合二为一，并明确指出了每项考试主题的权重。

思科CCIE安全笔试考试（400-251）v5.0，考试时间为2小时，考试题目90-110道，验证专业人士是否具备阐释，设计，实施，操作和故障排除的复合网络安全技能及解决方案。考生必须理解网络安全所需，以及网络安全部件之间如何互相操作，并将其翻译成设备配置语言。闭卷考试，考场中不允许带任何参考资料。

思科CCIE安全实验考试v5.0，考试时间为8个小时，需要考生在给定的场景中计划，设计，执行，操作并故障排除复合网络安全完成动手实验考试。故障排除的知识是一项重要的技能，在实验考试中考生需要诊断并解决网络问题。

下列考纲列出了CCIE安全考试中可能出现的考试内容。但是，其他相关要点也可能会出现在考试中。下面的大纲可能会在未提前通知的情况下发生改变，这是为了更好地反映考试内容及更加透明化。

附： CCIE安全5.0考试大纲

1.0 Perimeter Security and Intrusion Prevention

1.1 Describe, implement, and troubleshoot HA features on CiscoASA and Cisco FirePOWER Threat Defense (FTD)
1.2 Describe, implement, and troubleshoot clustering on CiscoASA and Cisco FTD
1.3 Describe, implement, troubleshoot, and secure routingprotocols on Cisco ASA and Cisco FTD
1.4 Describe, implement, and troubleshoot different deploymentmodes such as routed, transparent, single, and multicontext onCisco ASA and Cisco FTD
1.5 Describe, implement, and troubleshoot firewall features suchas NAT (v4,v6), PAT, application inspection, traffic zones,policy-based routing,  traffic redirection toservice modules, and identity firewall on Cisco ASA and CiscoFTD
1.6 Describe, implement, and troubleshoot IOS security featuressuch as Zone-Based Firewall (ZBF), application layer inspection,NAT (v4,v6), PAT and  TCP intercept on CiscoIOS/IOS-XE
1.7 Describe, implement, optimize, and troubleshoot policies andrules for traffic control on Cisco ASA, Cisco FirePOWER and CiscoFTD
1.8 Describe, implement, and troubleshoot Cisco FirepowerManagement Center (FMC) features such as alerting, logging, andreporting
1.9 Describe, implement, and troubleshoot correlation andremediation rules on Cisco FMC
1.10 Describe, implement, and troubleshoot Cisco FirePOWER andCisco FTD deployment such as in-line, passive, and TAP modes
1.11 Describe, implement, and troubleshoot Next GenerationFirewall (NGFW) features such as SSL inspection, user identity,geolocation, and AVC  (Firepower appliance)
1.12 Describe, detect, and mitigate common types of attacks suchas DoS/DDoS, evasion techniques, spoofing, man-in-the-middle, andbotnet
2.0 Advanced Threat Protection and Content Security

2.1 Compare and contrast different AMP solutions includingpublic and private cloud deployment models
2.2 Describe, implement, and troubleshoot AMP for networks, AMPfor endpoints, and AMP for content security (CWS, ESA, and WSA)
2.3 Detect, analyze, and mitigate malware incidents
2.4 Describe the benefit of threat intelligence provided by AMPThreat GRID
2.5 Perform packet capture and analysis using Wireshark,tcpdump, SPAN, and RSPAN
2.6 Describe, implement, and troubleshoot web filtering, useridentification, and Application Visibility and Control (AVC)
2.7 Describe, implement, and troubleshoot mail policies, DLP,email quarantines, and SenderBase on ESA
2.8 Describe, implement, and troubleshoot SMTP authenticationsuch as SPF and DKIM on ESA
2.9 Describe, implement, and troubleshoot SMTP encryption onESA
2.10 Compare and contrast different LDAP query types on ESA
2.11 Describe, implement, and troubleshoot WCCP redirection
2.12 Compare and contrast different proxy methods such as SOCKS,Auto proxy/WPAD, and transparent
2.13 Describe, implement, and troubleshoot HTTPS decryption andDLP
2.14 Describe, implement, and troubleshoot CWS connectors onCisco IOS routers, Cisco ASA, Cisco AnyConnect, and WSA
2.15 Describe the security benefits of leveraging the OpenDNSsolution.
2.16 Describe, implement, and troubleshoot SMA for centralizedcontent security management
2.17 Describe the security benefits of leveraging Lancope
3.0 Secure Connectivity and Segmentation

3.1 Compare and contrast cryptographic and hash algorithms suchas AES, DES, 3DES, ECC, SHA, and MD5
3.2 Compare and contrast security protocols such asISAKMP/IKEv1, IKEv2, SSL, TLS/DTLS, ESP, AH, SAP, and MKA
3.3 Describe, implementc and troubleshoot remote access VPNusing technologies such as FLEXVPN, SSL-VPN between Ciscofirewalls, routers, and end hosts
3.4 Describe, implement, and troubleshoot the Cisco IOS CA forVPN authentication
3.5 Describe, implement, and troubleshoot clientless SSL VPNtechnologies with DAP and smart tunnels on Cisco ASA and CiscoFTD
3.6 Describe, implement, and troubleshoot site-to-site VPNs suchas GETVPN, DMVPN and IPsec
3.7 Describe, implement, and troubleshoot uplink and downlinkMACsec (802.1AE)
3.8 Describe, implement, and troubleshoot VPN high availabilityusing Cisco ASA VPN clustering and dual-hub DMVPN deployments
3.9 Describe the functions and security implications ofcryptographic protocols such as AES, DES, 3DES, ECC, SHA, MD5,ISAKMP/IKEv1, IKEv2, SSL,  TLS/DTLS, ESP, AH, SAP,MKA, RSA, SCEP/EST, GDOI, X.509, WPA, WPA2, WEP, and TKIP
3.10 Describe the security benefits of network segmentation andisolation
3.11 Describe, implement, and troubleshoot VRF-Lite andVRF-Aware VPN
3.12 Describe, implement, and troubleshoot microsegmentationwith TrustSec using SGT and SXP
3.13 Describe, implement, and troubleshoot infrastructuresegmentation methods such as VLAN, PVLAN, and GRE
3.14 Describe the functionality of Cisco VSG used to securevirtual environments
3.15 Describe the security benefits of data center segmentationusing ACI, EVPN, VXLAN, and NVGRE
4.0 Identity Management, Information Exchange, and AccessControl

4.1 Describe, implement, and troubleshoot various personas ofISE in a multinode deployment
4.2 Describe, implement, and troubleshoot network access device(NAD), ISE, and ACS configuration for AAA
4.3 Describe, implement, and troubleshoot AAA for administrativeaccess to Cisco network devices using ISE and ACS
4.4 Describe, implement, verify, and troubleshoot AAA fornetwork access with 802.1X and MAB using ISE.
4.5 Describe, implement, verify, and troubleshoot cut-throughproxy/auth-proxy using ISE as the AAA server
4.6 Describe, implement, verify, and troubleshoot guest lifecycle management using ISE and Cisco network infrastructure
4.7 Describe, implement, verify, and troubleshoot BYODon-boarding and network access flows with an internal or externalCA
4.8 Describe, implement, verify, and troubleshoot ISE and ACSintegration with external identity sources such as LDAP, AD, andexternal RADIUS
4.9 Describe ISE and ACS integration with external identitysources such as RADIUS Token, RSA SecurID, and SAML
4.10 Describe, implement, verify, and troubleshoot provisioningof AnyConnect with ISE and ASA
4.11 Describe, implement, verify, and troubleshoot postureassessment with ISE
4.12 Describe, implement, verify, and troubleshoot endpointprofiling using ISE and Cisco network infrastructure includingdevice sensor
4.13 Describe, implement, verify, and troubleshoot integrationof MDM with ISE
4.14 Describe, implement, verify, and troubleshoot certificatebased authentication using ISE
4.15 Describe, implement, verify, and troubleshootauthentication methods such as EAP Chaining and Machine AccessRestriction (MAR)
4.16 Describe the functions and security implications of AAAprotocols such as RADIUS, TACACS+, LDAP/LDAPS, EAP (EAP-PEAP,EAP-TLS, EAP-TTLS, EAP-FAST,  EAP-TEAP, EAP- MD5,EAP-GTC), PAP, CHAP, and MS-CHAPv2
4.17 Describe, implement, and troubleshoot identity mapping onASA, ISE, WSA and FirePOWER
4.18 Describe, implement, and troubleshoot pxGrid betweensecurity devices such as WSA, ISE, and Cisco FMC
5.0 Infrastructure Security, Virtualization, andAutomation

5.1 Identify common attacks such as Smurf, VLAN hopping, andSYNful knock, and their mitigation techniques
5.2 Describe, implement, and troubleshoot device hardeningtechniques and control plane protection methods, such as CoPP andIP Source routing.
5.3 Describe, implement, and troubleshoot management planeprotection techniques such as CPU and memory thresholding andsecuring device access
5.4 Describe, implement, and troubleshoot data plane protectiontechniques such as iACLs, uRPF, QoS, and RTBH
5.5 Describe, implement, and troubleshoot IPv4/v6 routingprotocols security
5.6 Describe, implement, and troubleshoot Layer 2 securitytechniques such as DAI, IPDT, STP security, port security, DHCPsnooping, and VACL
5.7 Describe, implement, and troubleshoot wireless securitytechnologies such as WPA, WPA2, TKIP, and AES
5.8 Describe wireless security concepts such as FLEX Connect,wIPS, ANCHOR, Rogue AP, and Management Frame Protection (MFP)
5.9 Describe, implement, and troubleshoot monitoring protocolssuch as NETFLOW/IPFIX, SNMP, SYSLOG, RMON, NSEL, and eSTREAMER
5.10 Describe the functions and security implications ofapplication protocols such as SSH, TELNET, TFTP, HTTP/HTTPS, SCP,SFTP/FTP, PGP, DNS/DNSSEC,  NTP, and DHCP
5.11 Describe the functions and security implications of networkprotocols such as VTP, 802.1Q, TCP/UDP, CDP, LACP/PAgP, BGP, EIGRP,OSPF/OSPFv3,  RIP/RIPng, IGMP/CGMP, PIM, IPv6, andWCCP
5.12 Describe the benefits of virtualizing security functions inthe data center using ASAv, WSAv, ESAv, and NGIPSv
5.13 Describe the security principles of ACI such as objectmodels, endpoint groups, policy enforcement, application networkprofiles, and contracts
5.14 Describe the northbound and southbound APIs of SDNcontrollers such as APIC-EM
5.15 Identify and implement security features to comply withorganizational security policies, procedures, and standards such asBCP 38, ISO 27001, RFC  2827, and PCI-DSS
5.16 Describe and identify key threats to different places inthe network (campus, data center, core, edge) as described in CiscoSAFE
5.17 Validate network security design for adherence to CiscoSAFE recommended practices
5.18 Interpret basic scripts that can retrieve and send datausing RESTful API calls in scripting languages such as Python
5.19 Describe Cisco Digital Network Architecture (DNA)principles and components.
6.0 Evolving Technologies

6.1 Cloud

6.1.a Compare and contrast Cloud deployment models* H+ D9 B. L& }- M( l3 z" }
- 6.1.a Infrastructure, platform, and software services(XaaS)
  6 T0 B2 K. Q! }* Y( P/ \" ?; C, I P7 Q: r9 u: O( z/ W
6.1.a [ii] Performance and reliability
- C+ p, e3 E X, f: W
2 F! [# E8 J8 D

7 E( n$ |, w; D7 a% m5 j
6.1.a [iii] Security and privacy
6.1.a [iv] Scalability and interoperability
6.1.b Describe Cloud implementations and operations
' p! N) X& L" F- {9 v2 v4 O
6.1.b Automation and orchestration
: m  A7 u3 P6 Z9 Z2 _' H5 Q; E. D  z* G4 e' b

6.1.b [ii] Workload mobility
6.1.b [iii] Troubleshooting and management
6.1.b [iv] OpenStack components
! ^+ Q7 B, k8 L# c+ e& \1 g! @! o! q) r! z( ?$ J* z

6.2 Network Programmability (SDN)0 k2 U" w( D$ I6 n# Q9 W$ o3 b0 B' F

6.2.a Describe functional elements of network programmability(SDN) and how they interact
: ~( z0 m+ Q9 Y3 b2 s
6.2.a Controllers
3 h* R- O. O; V( L
, t2 R+ D/ N2 c2 i. {

9 F0 l* _" o/ |' Z  E
6.2.a [ii] APIs
6.2.a [iii] Scripting
6.2.a [iv] Agents
6.2.a [v] Northbound vs. Southbound protocols
6.2.b Describe aspects of virtualization and automation innetwork environments
, N9 n6 y' y) s% M% |# {% E
6.2.b DevOps methodologies, tools and workflows
2 x/ S2 x4 u- x1 J0 {$ Y# i6 t# V7 t' y3 N7 N! E5 X+ |* F/ U

6.2.b [ii] Network/application function virtualization (NFV,AFV)
6.2.b [iii] Service function chaining
6.2.b [iv] Performance, availability, and scalingconsiderations
# {8 o3 N8 ?! b5 I$ N% w5 d/ o, m
7 p& u4 F! s# J4 q
6.3 Internet of Things (IoT)  n3 m7 c$ i. K( `' ~

6.3.a Describe architectural framework and deploymentconsiderations for Internet of Things
7 f; @; r7 ?$ L% a( i
6.3.a Performance, reliability and scalability
  H6 q( _; X, J8 W! `! G% R+ K9 G+ [0 l+ e; X" ?9 b

1 g& k" O; E( F+ a' V

6.3.a [ii] Mobility
6.3.a [iii] Security and privacy
6.3.a [iv] Standards and compliance
6.3.a [v] Migration
6.3.a [vi] Environmental impacts on the network
" {- H. n* Y; l, i) Y0 r$ B

' U3 c* D% p( @( p: H # o  }& U# j# j9 ~+ x
! P% {1 S5 X  C
# H2 W7 H( j5 S$ Q, H* O9 t! ^/ O
参加免费公开课，请您说是由【攻城狮论坛】推荐的。报名收费培训的论坛会员，可享受优惠价格+赠送攻城狮论坛VIP会员。本文转自华尔思 www.wallslab.net，版权归原作者所有。

**Rockyw [Lv10 举世无双]** · 发表于 2016-9-13 12:06:39

路过了解一下

**muhu325 [Lv6 略有所成]** · 发表于 2019-2-23 08:01:38

攻城狮论坛每天更新免费下载谁来谁知道

**gentlebrother [Lv8 技术精悍]** · 发表于 2022-9-15 07:58:18

知道么? 加2000人思科华为网络技术讨论群2258097 然后私聊群主可以免费回答学习工作中遇到的问题

主题标签Tag

more　+今日重磅推荐Recommend No.1

more　+社区更新Forums

more　+随机图赏Gallery

[新闻] CCIE安全 LAB考试升级说明 ccie安全认证5.0来了

相关帖子

客服中心

投诉建议