📘Cisco Certified CyberOps Associate (200-201 CBROPS)
Exam Guide
This topic focuses on understanding how systems work, how events are generated and logged, and how networking plays a role in security monitoring and incident response. These are key concepts for detecting and analyzing threats in a cybersecurity environment.
1. Systems
Systems refer to the devices and software that make up an organization’s IT infrastructure. This includes:
- Servers: Computers that provide services like email, web hosting, or file storage.
- Workstations: Employee computers used to access network resources.
- Network devices: Routers, switches, firewalls that move and control traffic.
- Virtual machines and cloud services: Software-based systems running on physical hardware or in the cloud.
Key concepts to understand:
- Operating Systems (OS): Systems run on OS like Windows, Linux, or macOS. Security events often come from OS logs.
- Applications: Software running on systems (like email servers or web applications) generate events.
- System Resources: CPU, memory, storage – attacks can impact these, triggering events.
Example in IT:
A web server might log when a user logs in or when there is an error serving a webpage. Security analysts monitor these logs to detect unusual activity.
2. Events
Events are records of actions or occurrences on a system or network. They are critical for security monitoring and investigations.
Types of events to know:
- System events: Generated by the OS. Examples:
- Login attempts (successful or failed)
- System crashes or shutdowns
- Software installation or removal
- Application events: Generated by programs running on systems. Examples:
- Database queries
- File access or modification
- Email sending/receiving events
- Network events: Generated by network devices. Examples:
- Firewall allows or blocks traffic
- Router logs traffic patterns
- Intrusion detection system alerts
Event details usually include:
- Timestamp (when it happened)
- Source (which system or user triggered it)
- Type of event (login, file change, network access)
- Severity or priority
Importance in security:
Events help analysts detect anomalies and incidents. For instance, multiple failed logins in a short time may indicate a brute-force attack.
3. Networking
Networking is the connection of systems to share resources. In cybersecurity, networking is essential because threats often move through network paths.
Key networking components:
- IP Addresses: Unique addresses for devices. Analysts track suspicious IPs.
- Ports: Communication endpoints. For example, web servers use port 80 (HTTP) and 443 (HTTPS).
- Protocols: Rules for communication, like TCP, UDP, HTTP, or DNS.
- Network devices: Firewalls, routers, switches, and intrusion detection/prevention systems (IDS/IPS).
How networking relates to events:
- Traffic logs: Firewalls log allowed or blocked connections.
- Connection events: Routers and switches track which devices are communicating.
- Alerts: IDS/IPS can generate alerts if malicious traffic is detected.
Example in IT:
If a server receives traffic from an unknown IP trying to connect to port 22 (SSH), this could generate an alert for investigation.
4. How Systems, Events, and Networking Work Together
All three areas are connected in security monitoring:
- Systems generate events: A workstation logs a failed login attempt.
- Events are collected and analyzed: Security tools (like SIEM – Security Information and Event Management) gather logs from servers, applications, and network devices.
- Networking shows context: Logs include IP addresses, protocols, and ports to help identify if the activity is normal or suspicious.
Example flow in an IT environment:
- A user tries to log in to a server from an unusual location.
- The OS logs a failed login attempt (system event).
- The firewall logs the connection attempt from an external IP (network event).
- SIEM correlates the events and generates an alert for the security analyst.
5. Key Terms to Remember for the Exam
| Term | Simple Explanation |
|---|---|
| Event | Any action recorded by a system or network device |
| Log | A record of events stored for review |
| SIEM | Tool that collects and analyzes logs from systems and networks |
| IP Address | Unique number assigned to each network device |
| Port | Endpoint for communication on a device |
| Protocol | Rules that devices follow to communicate |
| Network traffic | Data moving across network devices |
Exam Tips for 3.7.c
- Know the difference between system, application, and network events.
- Understand how logs are used to detect anomalies.
- Be able to identify common network elements like IPs, ports, and protocols.
- Remember: Security monitoring involves collecting, analyzing, and correlating events from multiple systems and networks.
- SIEM tools are central for combining systems and network events into actionable security intelligence
