The
following topics are general guidelines
for the content likely to be included
on the CCSP CSIDS Exam 642-531. However,
other related topics may also appear on
any specific delivery of the exam (excerpts
from Cisco Certification web site).
1. Describe and explain the various
intrusion detection technologies and
evasive techniques
1.1. Define intrusion detection
1.2. Explain the difference between true
and false, and positive and negative
alarms
1.3. Describe the relationship between
vulnerabilities and exploits
1.4. Explain the difference between HIP
and NIDS
1.5. Describe the various techniques
used to evade intrusion detection
2. Design a Cisco IDS protection solution
for small, medium, and enterprise customers
2.1. List the network devices involved
in capturing traffic for intrusion detection
analysis
2.2. Describe the traffic flows for each
of the network devices
2.3. Explain the features and benefits
of IDM
2.4. Identify the requirements for IDM
2.5. Configure Cisco Catalyst switches
to capture network traffic for intrusion
detection analysis
3. Identify the Cisco IDS Sensor platforms
and describe their features
3.1. Describe the features of the various
IDS Sensor appliance models
4. Install and configure a Cisco IDS
Sensor including a network appliance
and IDS module
4.1.
Identify the interfaces
and ports on the various Sensors
4.2. Distinguish between the functions
of the various Catalyst IDS Module
ports
4.3. Initialize a Catalyst IDS Module
4.4. Verify the Catalyst 6500 switch
and Catalyst IDSM configurations
4.5. Install the Sensor software image
4.6. Install the Sensor appliance on
the network
4.7. Obtain management access on the
Sensor
4.8. Initialize the Sensor
4.9. Describe the various command line
modes
4.10. Navigate the CLI
4.11. Apply configuration changes made
via the CLI
4.12. Create user accounts via the
CLI
4.13. Configure Sensor communication
properties
4.14. Configure Sensor logging properties
4.15. Perform a configuration backup
via the CLI
4.16. Setting up Sensors and Sensor
Groups
4.17. Sensor Communications Sensor
Logging
5. Tune and customize Cisco IDS signatures
to work optimally in specific environments
5.1. Configure the Sensor's sensing parameters
5.2. Configure a signature's enable status,
severity level, and action
5.3. Create signature filters to exclude
or include a specific signature or list
of signatures
5.4. Tune a signature to perform optimally
based on a network's characteristics
5.5. Create a custom signature given
an attack scenario
6. Configure a Cisco IDS Sensor to perform
device management of supported blocking
devices
6.1. Describe the device management capability
of the Sensor and how it is used to perform
blocking with a Cisco device
6.2. Design a Cisco IDS solution using
the blocking feature, including the ACL
placement considerations, when deciding
where to apply Sensor-generated ACLs
6.3. Configure a Sensor to perform blocking
with a Cisco IDS device
6.4. Configure a Sensor to perform blocking
through a Master Blocking Sensor
7. Describe the Cisco IDS signatures
and determine the immediate threat posed
to the network
7.1. Explain the Cisco IDS signature
features
7.2. Select the Cisco IDS signature engine
to create a custom signature
7.3. Explain the global Cisco IDS signature
parameters
7.4. Explain the engine-specific signature
parameters
8. Perform maintenance operations such
as signature updates, software upgrades,
data archival and license updates
8.1. Identify the correct IDS software
update files for a Sensor and an IDSM
8.2. Install IDS signature updates and
service packs
8.3. Upgrade a Sensor and an IDSM to
an IDS major release version
9. Describe the Cisco IDS architecture
including supporting services and configuration
files
9.1. Explain the Cisco IDS directory
structure
9.2. Explain the communication infrastructure
of the Cisco IDS
9.3. Locate and identify the Cisco IDS
log and error files
9.4. List the Cisco IDS services and
their associated configuration files
9.5. Describe the Cisco IDS configuration
files and their function
10. Monitor a Cisco IDS protection solution
for small and medium networks
10.1. Explain the features and benefits
of IEV
10.2. Identify the requirements for IEV
10.3. Install the IEV software and configure
it to monitor IDS devices
10.4. Create custom IEV views and filters
10.5. Navigate IEV to view alarm details
10.6. Perform IEV database administration
functions
10.7. Configure IEV application settings
and preferences
11. Manage a large scale deployment
of Cisco IDS Sensors with Cisco IDS Management
software
11.1. Define features and key concepts
of the IDS MC
11.2. Install the IDS MC
11.3. Generate, approve, and deploy sensor
configuration files
11.4. Administer the IDS MC Server
11.5. Use the IDS MC to set up Sensors
11.6. Use the IDS MC to configure Sensor
communication properties
11.7. Use the IDS MC to configure Sensor
logging properties
12. Monitor a large scale deployment
of Cisco IDS Sensors with Cisco IDS Monitoring
software
12.1. Define features and key concepts
of the Security Monitor
12.2. Install and verify the Security
Monitor functionality
12.3. Monitor IDS devices with the Security
Monitor
12.4. Administer Security Monitor event
rules
12.5. Create alarm exceptions to reduce
alarms and possible false positives
12.6. Use the reporting features of the
Security Monitor
12.7. Administer the Security Monitor
server
|
