Information Technology

Vulnerabilities

2012-01-11T09:41:00.000-08:00

To understand the techniques for securing a computer system, it is important to first understand the various types of "attacks" that can be made against it. These threats can typically be classified into one of these seven categories:

Exploits

An exploit (from the same word in the French language, meaning "achievement", or "accomplishment") is a piece of software, a chunk of data, or sequence of commands that take advantage of a software "bug" or "glitch" in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized). This frequently includes such things as gaining control of a computer system or allowing privilege escalation or a denial of service attack. Many development methodologies rely on testing to ensure the quality of any code released; this process often fails to discover unusual potential exploits. The term "exploit" generally refers to small programs designed to take advantage of a software flaw that has been discovered, either remote or local. The code from the exploit program is frequently reused in trojan horses and computer viruses. In some cases, a vulnerability can lie in certain programs' processing of a specific file type, such as a non-executable media file. Some security web sites maintain lists of currently known unpatched vulnerabilities found in common programs (see "External links" below).

Eavesdropping

Eavesdropping is the act of surreptitiously listening to a private conversation, typically between hosts on a network. Even machines that operate as a closed system (i.e., with no contact to the outside world) can be eavesdropped upon via monitoring the faint electro-magnetic transmissions generated by the hardware such as TEMPEST. The FBI's proposed Carnivore program was intended to act as a system of eavesdropping protocols built into the systems of internet service providers.

Social engineering and human error

A computer system is no more secure than the human systems responsible for its operation. Malicious individuals have regularly penetrated well-designed, secure computer systems by taking advantage of the carelessness of trusted individuals, or by deliberately deceiving them, for example sending messages that they are the system administrator and asking for passwords. This deception is known as Social engineering.

Denial-of-service attack

Unlike other exploits, denial of service attacks are not used to gain unauthorized access or control of a system. They are instead designed to render it unusable. Attackers can deny service to individual victims, such as by deliberately entering a wrong password 3 consecutive times and thus causing the victim account to be locked, or they may overload the capabilities of a machine or network and block all users at once. These types of attack are, in practice, very hard to prevent, because the behavior of whole networks needs to be analyzed, not only the behaviour of small pieces of code. Distributed denial of service (DDoS) attacks are common, where a large number of compromised hosts (commonly referred to as "zombie computers", used as part of a botnet with, for example; a worm, trojan horse, or backdoor exploit to control them.) are used to flood a target system with network requests, thus attempting to render it unusable through resource exhaustion. Another technique to exhaust victim resources is through the use of an attack amplifier — where the attacker takes advantage of poorly designed protocols on 3rd party machines, such as FTP or DNS, in order to instruct these hosts to launch the flood. There are also commonly found vulnerabilities in applications that cannot be used to take control over a computer, but merely make the target application malfunction or crash. This is known as a denial-of-service exploit.

Indirect attacks

An indirect attack is an attack launched by a third party computer. By using someone else's computer to launch an attack, it becomes far more difficult to track down the actual attacker. There have also been cases where attackers took advantage of public anonymizing systems, such as the tor onion router system.

Backdoors

A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program (e.g., Back Orifice), or could be a modification to an existing program or hardware device. A specific form of backdoors are rootkits, which replaces system binaries and/or hooks into the function calls of the operating system to hide the presence of other programs, users, services and open ports. It may also fake information about disk and memory usage.

Direct access attacks

Common consumer devices that can be used to transfer data surreptitiously.

Someone who has gained access to a computer can install any type of devices to compromise security, including operating system modifications, software worms, key loggers, and covert listening devices. The attacker can also easily download large quantities of data onto backup media, for instance CD-R/DVD-R, tape; or portable devices such as keydrives, digital cameras or digital audio players. Another common technique is to boot an operating system contained on a CD-ROM or other bootable media and read the data from the harddrive(s) this way. The only way to defeat this is to encrypt the storage media and store the key separate from the system.

Reducing vulnerabilities

Computer code is regarded by some as a form of mathematics. It is theoretically possible to prove the correctness of certain classes of computer programs, though the feasibility of actually achieving this in large-scale practical systems is regarded as small by some with practical experience in the industry — see Bruce Schneier et al.

It's also possible to protect messages in transit (i.e., communications) by means of cryptography. One method of encryption — the one-time pad — is unbreakable when correctly used. This method was used by the Soviet Union during the Cold War, though flaws in their implementation allowed some cryptanalysis (See Venona Project). The method uses a matching pair of key-codes, securely distributed, which are used once-and-only-once to encode and decode a single message. For transmitted computer encryption this method is difficult to use properly (securely), and highly inconvenient as well. Other methods of encryption, while breakable in theory, are often virtually impossible to directly break by any means publicly known today. Breaking them requires some non-cryptographic input, such as a stolen key, stolen plaintext (at either end of the transmission), or some other extra cryptanalytic information.

Social engineering and direct computer access (physical) attacks can only be prevented by non-computer means, which can be difficult to enforce, relative to the sensitivity of the information. Even in a highly disciplined environment, such as in military organizations, social engineering attacks can still be difficult to foresee and prevent.

In practice, only a small fraction of computer program code is mathematically proven, or even goes through comprehensive information technology audits or inexpensive but extremely valuable computer security audits, so it's usually possible for a determined hacker to read, copy, alter or destroy data in well secured computers, albeit at the cost of great time and resources. Few attackers would audit applications for vulnerabilities just to attack a single specific system. It is possible to reduce an attacker's chances by keeping systems up to date, using a security scanner or/and hiring competent people responsible for security. The effects of data loss/damage can be reduced by careful backing up and insurance.

Security

2012-01-10T12:10:00.000-08:00

Although there are many aspects to take into consideration when designing a computer system, security can prove to be very important. According to Symantec, in 2010 94 percent of organizations polled expect to implement security improvements to their computer systems, with 42 percent claiming cyber security as their top risk.
At the same time many organizations are improving security, many types of cyber criminals are finding ways to continue their activities. Almost every type of cyber attack is on the rise. In 2009 respondents to the CSI Computer Crime and Security Survey admitted that malware infections, denial-of-service attacks, password sniffing, and web site defacements were significantly higher than in the previous two years.

Reasons

There are many similarities (yet many fundamental differences) between computer and physical security. Just like real-world security, the motivations for breaches of computer security vary between attackers, sometimes called hackers or crackers. Some are thrill-seekers or vandals (the kind often responsible for defacing web sites); similarly, some web site defacements are done to make political statements. However, some attackers are highly skilled and motivated with the goal of compromising computers for financial gain or espionage. An example of the latter is Markus Hess (more diligent than skilled), who spied for the KGB and was ultimately caught because of the efforts of Clifford Stoll, who wrote a memoir, The Cuckoo's Egg, about his experiences. For those seeking to prevent security breaches, the first step is usually to attempt to identify what might motivate an attack on the system, how much the continued operation and information security of the system are worth, and who might be motivated to breach it. The precautions required for a home personal computer are very different for those of banks' Internet banking systems, and different again for a classified military network. Other computer security writers suggest that, since an attacker using a network need know nothing about you or what you have on your computer, attacker motivation is inherently impossible to determine beyond guessing. If true, blocking all possible attacks is the only plausible action to take.

CCDE Blue prints written exam

2009-06-14T23:40:00.003-07:00

CCDE is Cisco Systems registered Exam, ADVDESIGN is the qualifying exam for the Cisco Certified Design Expert CCDE certification. The ADVDESIGN exam will test a candidate's combined knowledge of routing protocols, internetworking theory and design principles .The exam assesses a candidate's understanding of network design in the areas of routing, tunneling, Quality of Service, Management, Cost, Capacity, and Security. This exam combines in-depth technical concepts with Network Design principles and is intended for a Network Professional with at least 5 years of experience in Network Engineering or Advanced Network Design.

120 minutes

The following blueprint provides general guidelines for the content to be included on the ADVDESIGN beta exam.

Topic

IP Routing

Explain route aggregation concepts and techniques.

Purpose of route aggregation
Scalability and fault isolation
How to Aggregate

Explain the theory and application of network topology abstraction and layering.

Layers and their purpose
Core, aggregation, distribution, access
Purpose of Link State Topology Summarization
What is the purpose of LS topology summarization (not how it works)
Use of Link State Topology Summarization
Where and how to build a flooding domain border

Explain the impact of fault isolation and resiliency on network design.

What is the impact of fault isolation on network reliability
Separating rapid and/or massive changes from the remainder of the network, how to create fault isolation
What is fate sharing, and what is it's impact
What is the impact of redundancy on convergence times

Explain metric based traffic flow and modification.

How to engineer metrics to modify traffic flow
"MPLS vs. IGP Traffic Engineering

Modifying IGP Metrics to Engineer Traffic Flow"

Understanding Traffic Flow & Metrics
Third Party Next Hop
Impact on redistribution design

Explain fast convergence techniques and mechanisms.

Layer 2 Down Detection
For all media types
Fast hello timers
OSPF, EIGRP, IS-IS, BGP
Fast SPF Timers
OSPF, IS-IS
Recursion and Convergence
Impact of Third Party Next Hop & BGP recursion

Explain routing protocol operation.

Neighbor Relationships
OSPF, EIGRP, IS-IS, BGP
Determining Loop Free Paths
OSPF, EIGRP, IS-IS, BGP, MPLS Constrained SPF
General Operation
OSPF, EIGRP, IS-IS, BGP; How each protocol operates
Flooding Domains and Stubs
OSPF/IS-IS flooding domains, EIGRP stubs
iBGP Mesh
Next hop mechanisms in BGP, RR's, etc.

Select lower operational costs and complexity.

Route Filters
Simple vs. complex
General
Redistribution
Simple designs, tags, route filters, etc.

Explain transport mechanisms and interaction with routing protocols.

Link Characteristics
Point-to-point, point-to-multipoint, broadcast, etc.
RP Implementation on Various Links
OSPF on each link type
IS-IS on each link type
EIGRP considerations for point-to-multipoint
Topology Characteristics
Full mesh, partial mesh, ring, etc.
RP Implementation on Various Topologies
OSPF/IS-IS flood blocking, etc.

Explain generic routing and addressing concepts.

Policy Based Routing
IPv6 Basics

Explain multicast routing concepts.

General Multicast concepts

Tunneling

Explain how tunneling affects end service applications.

Identify and select tunneling technologies appropriate to meet network design objectives.
Identify where and when tunneling parameters must be tuned to optimize the operation of end user applications.
Knowledge of issues related to Layer 2 tunneling: i.e. packet ordering, MTU, etc.
What technologies support Layer 2 and Layer 3 tunneling: L2TPv3, GRE, ATOM, IPsec, etc.
How to implement tunneling given a specific situation: i.e. tunneling Novel IPX over a Layer 3 service provider core, etc.
Understanding of issues related to tunneling L3(IP) in L2(ATM, MPLS)

Explain, recognize, and select tunneling techniques appropriate to the size and scale of the network requirements.

What is the impact of different tunneling technologies on scalability (Selection of a tunneling technology with scalability as a criteria)
How scalability is affected based on type of tunnels (point-to-point, point-to-multipoint)

Explain how L3 routing is affected by tunneling technologies and select L3 routing protocols appropriate to implement tunneling and as passenger traffic in tunnels

How L3 routing is overlaid on a given tunneling technologies
What L3 Routing Protocol would suit a given tunneling technology, topology and scalability

Explain, recognize, and select logical and physical topologies required to meet network design requirements.

What are the best points/nodes in network to initiate and terminate tunnels
Which model would fulfill the requirements (full mesh, partial mesh, hierarchical)

Explain, recognize, and select methods for interconnecting tunneling environments across one or more service provider networks.

Describe different inter-provider tunneling models (i.e. 2547, GRE, IPsec, etc.

Explain, recognize, and select methods for steering traffic with tunnels and into tunnels.

Class Based Tunnel Selection
Traffic Engineering

Explain, recognize, and select methods for providing network failover and redundancy to meet network availability requirements.

Restoration vs. Protection (IGP Fast Convergence, FRR)
Non-stop Forwarding vs. Restoration (at the IP routing layer)

Explain, recognize, and select methods for interconnecting different types of attachment media on tunnel endpoints. Recognize and explain the differences in mapping different L2 technologies onto an L3 tunneling environment.

Interworking
Mapping Layer 2 service onto Layer 3 at the edge

Explain, recognize, and select methods to manage the size and scale of broadcast domains in tunneled L2VPN environments.

VPLS scaling issues
Spanning Tree issues
Broadcast issues across various topologies

3) QoS

Measure and interpret different QoS performance metrics.

Correlate performance metrics to application performance.
Knowledge of the different QoS performance metrics: one-way delay, round-trip delay, jitter, etc.
How to measure and interpret QoS performance metrics
How QoS performance metrics relate to user applications: i.e. impact of QoS metrics on application performance, etc.

Determine why, where and how to implement traffic classification, traffic conditioning and PHB.

Explain how DiffServ QoS tools work.
What DiffServ Terminology means (DS codepoint, Meter, DS ingress/egress node, Remark, DS domain, etc.)
Where to do Traffic Classification (edge and core of DS Domain)
What is Traffic Conditioning and where is it applied? (metering, marking, shaping and policing)
What are traffic profiles and meaning of in/out of profile (Token bucket)
What is the difference between micro-flow and DS behavior aggregate (PHB)
What is the impact on non-DS-compliant nodes within a DS domain on SLAs
What is the issue with MF Classifier and Fragmentation
What is the issue with re-marking and OoO packets
What is the purpose of shapers and droppers
What are different PHB models (e.g. x% minimal resources and proportional remaining link capacity)
What are issues with Different number/type of PHBs in different part of the network
What are the benefits of MF classification on edge and DS classification in the core
Understanding Classification/conditioning/PHB on a per customer basis or few number of templates
What are ways of DS Field Mapping to PHB: 1->1 or N->1 or both
What are tools for PHB Queue management and bounding delay, jitter, packet loss (e.g. TS, WRED, WFQ,etc.)
Understanding QoS provide differentiated services only when there is contention for resources

Explain operations of RSVP.

How RSVP Application does CAC and resource reservation

Explain generic QoS requirements for common application (VoIP, Video, TCP, UDP, control plane traffic).

Explain QoS requirements for control plane traffic.
What are generic VoIP Requirements
What are generic Video Requirements
What are generic TCP Requirements
What are generic UDP Requirements
Understanding of differentiation of control traffic vs data traffic
Where and how to define marking/conditioning of Control Traffic

Explain the techniques to avoid Class starvation when multiple classes are used (EF and non-EF).

How EF with a policer and MDRR/Priority Queue solves the problem
How minimum BW assignment per class or proportional BW assignment among all classes solves the problem
What is the impact of applications' traffic within a given queue with same DS or different DS codepoint
What is the impact of applications' traffic riding on the same node/link in case of failure

Explain the interaction of IP DSCP with other marking schemes (IP Prec, .1P, MPLS EXP, ATM, Frame Relay).

Interaction b/w DSCP and other technologies (understanding/issues/concerns)

Ethernet
ATM
Frame Relay
MPLS
RPR
IP Prec

In case of tunneling layers of marking : Differentiation between tunnel marking and data packet marking

Explain QoS based routing (PBR).

Situations where one has to pick one or two of the following to solve a problem (and understanding of the following)

BGP QoS Propagation
MTR
OER
PBR
CBTS

Management

Analyze network conditions and behavior to determine potential degradation or failure conditions.

Recognize conditions from SHOW output for data plane, control plane, hardware, etc.
Recognize conditions from DEBUG output for data plane, control plane, hardware, etc.
Recognize conditions from network behaviors for data plane, control plane, hardware, etc.
Recognize conditions from external monitoring and reporting systems.

Explain the operation and advantages of different management access mechanisms.

How to implement out of band access to all devices in a network
What should be considered when defining secure access to routers
Recognize when and where a design will result in failure.

Explain the operation and use of network management protocols.

Differences between the versions of SNMP.
Knowledge of puts, gets, operations (read, write)
Use of SNMP in SLA management
Identify when use of CMIP is appropriate
Identify when use of TMN is appropriate

Identify network management tools and their uses.

Recognize tools used for SLA management
Identify use of Generic On-Line Diagnostics (GOLD)
Identify and Classify tools for Event Management
State rules for use of Syslog
Knowledge of where to place Netflow Collectors
Identify Services required for flow collection
Recognize Port number for Netflow
Identify services required for event correlation

Identify auditable factors in a network.

Identify auditable factors in a network

Explain traffic management concepts and actions based on traffic statistics.

What is a traffic matrix
When to upgrade a link or re-route traffic
Interpretation of historical data to predict future growth and needs

Recognize configuration management tools and best practices.

Recognize uses of templating tools
Identify best practices for configuration management (i.e. logging config changes, auditing "as running" vs "as configured," consistent feature application, etc.)
Describe role-based configuration access.

Security

Explain the impact of security availability design in the characteristics of a network.

OOB Access
Decoupling
Paul Baran Model
Compartmentalization

Use available tools in a network security design to address identity, monitoring and correlation aspects.

SNMP
Netflow
Syslog
RMON
DNS
Radius/AAA
Full Packet Classifiers

Explain the impact of control plane design decisions on the security of a network; implement security mechanisms to protect the control plane.

Use and impact of addressing.
Use and impact of area (flooding domain/summary points) placement.
Route/Topology/Link Hiding
Adjacency Protection (MD5, GTSM, etc.)
Route Validation
Route Filtering
Routing Plan
Other routing techniques.

Explain the impact of data plane design decisions on the security of a network; implement security mechanisms to protect the data plane.

Infrastructure Protection
Policy Enforcement (QoS, BCP38)

Prepare and explain security incident preparation and response strategies in a network.

Reaction Tools (Identification and Classification)
Traceback Tools
Remotely-Triggered Black Holes (RTBH) (destination, source, rate limit, etc.)
Sink Holes
Reactive ACLs

CCIE R & S Blue prints LAB exam

2009-06-14T23:33:00.000-07:00

Exam Sections and Sub-task Objectives

1.00	Implement Layer 2 Technologies	√
1.10	Implement Spanning Tree Protocol (STP)
	(a) 802.1d
	(b) 802.1w
	(c) 801.1s
	(d) Loop guard
	(e) Root guard
	(f) Bridge protocol data unit (BPDU) guard
	(g) Storm control
	(h) Unicast flooding
	(i) Port roles, failure propagation, and loop guard operation
1.20	Implement VLAN and VLAN Trunking Protocol (VTP)
1.30	Implement trunk and trunk protocols, EtherChannel, and load-balance
1.40	Implement Ethernet technologies
	(a) Speed and duplex
	(b) Ethernet, Fast Ethernet, and Gigabit Ethernet
	(c) PPP over Ethernet (PPPoE)
1.50	Implement Switched Port Analyzer (SPAN), Remote Switched Port Analyzer (RSPAN), and flow control
1.60	Implement Frame Relay
	(a) Local Management Interface (LMI)
	(b) Traffic shaping
	(c) Full mesh
	(d) Hub and spoke
	(e) Discard eligible (DE)
1.70	Implement High-Level Data Link Control (HDLC) and PPP
2.00	Implement IPv4
2.10	Implement IP version 4 (IPv4) addressing, subnetting, and variable-length subnet masking (VLSM)
2.20	Implement IPv4 tunneling and Generic Routing Encapsulation (GRE)
2.30	Implement IPv4 RIP version 2 (RIPv2)
2.40	Implement IPv4 Open Shortest Path First (OSPF)
	(a) Standard OSPF areas
	(b) Stub area
	(c) Totally stubby area
	(d) Not-so-stubby-area (NSSA)
	(e) Totally NSSA
	(f) Link-state advertisement (LSA) types
	(g) Adjacency on a point-to-point and on a multi-access network
	(h) OSPF graceful restart
2.50	Implement IPv4 Enhanced Interior Gateway Routing Protocol (EIGRP)
	(a) Best path
	(b) Loop-free paths
	(c) EIGRP operations when alternate loop-free paths are available, and when they are not available
	(d) EIGRP queries
	(e) Manual summarization and autosummarization
	(f) EIGRP stubs
2.60	Implement IPv4 Border Gateway Protocol (BGP)
	(a) Next hop
	(b) Peering
	(c) Internal Border Gateway Protocol (IBGP) and External Border Gateway Protocol (EBGP)
2.70	Implement policy routing
2.80	Implement Performance Routing (PfR) and Cisco Optimized Edge Routing (OER)
2.90	Implement filtering, route redistribution, summarization, synchronization, attributes, and other advanced features
3.00	Implement IPv6
3.10	Implement IP version 6 (IPv6) addressing and different addressing types
3.20	Implement IPv6 neighbor discovery
3.30	Implement basic IPv6 functionality protocols
3.40	Implement tunneling techniques
3.50	Implement OSPF version 3 (OSPFv3)
3.60	Implement EIGRP version 6 (EIGRPv6)
3.70	Implement filtering and route redistribution
4.00	Implement MPLS Layer 3 VPNs
4.10	Implement Multiprotocol Label Switching (MPLS)
4.20	Implement Layer 3 virtual private networks (VPNs) on provider edge (PE), provider (P), and customer edge (CE) routers
4.30	Implement virtual routing and forwarding (VRF) and Multi-VRF Customer Edge (VRF-Lite)
5.00	Implement IP Multicast
5.10	Implement Protocol Independent Multicast (PIM) sparse mode
5.20	Implement Multicast Source Discovery Protocol (MSDP)
5.30	Implement interdomain multicast routing
5.40	Implement PIM Auto-Rendezvous Point (Auto-RP), unicast rendezvous point (RP), and bootstrap router (BSR)
5.50	Implement multicast tools, features, and source-specific multicast
5.60	Implement IPv6 multicast, PIM, and related multicast protocols, such as Multicast Listener Discovery (MLD)
6.00	Implement Network Security
6.01	Implement access lists
6.02	Implement Zone Based Firewall
6.03	Implement Unicast Reverse Path Forwarding (uRPF)
6.04	Implement IP Source Guard
6.05	Implement authentication, authorization, and accounting (AAA) (configuring the AAA server is not required, only the client-side (IOS) is configured)
6.06	Implement Control Plane Policing (CoPP)
6.07	Implement Cisco IOS Firewall
6.08	Implement Cisco IOS Intrusion Prevention System (IPS)
6.09	Implement Secure Shell (SSH)
6.10	Implement 802.1x
6.11	Implement NAT
6.12	Implement routing protocol authentication
6.13	Implement device access control
6.14	Implement security features
7.00	Implement Network Services
7.10	Implement Hot Standby Router Protocol (HSRP)
7.20	Implement Gateway Load Balancing Protocol (GLBP)
7.30	Implement Virtual Router Redundancy Protocol (VRRP)
7.40	Implement Network Time Protocol (NTP)
7.50	Implement DHCP
7.60	Implement Web Cache Communication Protocol (WCCP)
8.00	Implement Quality of Service (QoS)
8.10	Implement Modular QoS CLI (MQC)
	(a) Network-Based Application Recognition (NBAR)
	(b) Class-based weighted fair queuing (CBWFQ), modified deficit round robin (MDRR), and low latency queuing (LLQ)
	(c) Classification
	(d) Policing
	(e) Shaping
	(f) Marking
	(g) Weighted random early detection (WRED) and random early detection (RED)
	(h) Compression
8.20	Implement Layer 2 QoS: weighted round robin (WRR), shaped round robin (SRR), and policies
8.30	Implement link fragmentation and interleaving (LFI) for Frame Relay
8.40	Implement generic traffic shaping
8.50	Implement Resource Reservation Protocol (RSVP)
8.60	Implement Cisco AutoQoS
9.00	Troubleshoot a Network
9.10	Troubleshoot complex Layer 2 network issues
9.20	Troubleshoot complex Layer 3 network issues
9.30	Troubleshoot a network in response to application problems
9.40	Troubleshoot network services
9.50	Troubleshoot network security
10.00	Optimize the Network
10.01	Implement syslog and local logging
10.02	Implement IP Service Level Agreement SLA
10.03	Implement NetFlow
10.04	Implement SPAN, RSPAN, and router IP traffic export (RITE)
10.05	Implement Simple Network Management Protocol (SNMP)
10.06	Implement Cisco IOS Embedded Event Manager (EEM)
10.07	Implement Remote Monitoring (RMON)
10.08	Implement FTP
10.09	Implement TFTP
10.10	Implement TFTP server on router
10.11	Implement Switch-module Configuration Protocol (SCP)
10.12	Implement HTTP and HTTPS
10.13	Implement Telnet

CCIE R & S Blue prints written exam

2009-06-14T23:22:00.000-07:00

This CCIE R&S version 4 blue prints now start working on this one:

Exam Sections and Sub-task Objectives

1.00	Implement Layer 2 Technologies	√
1.10	Implement Spanning Tree Protocol (STP)
	(a) 802.1d
	(b) 802.1w
	(c) 801.1s
	(d) Loop guard
	(e) Root guard
	(f) Bridge protocol data unit (BPDU) guard
	(g) Storm control
	(h) Unicast flooding
	(i) Port roles, failure propagation, and loop guard operation
1.20	Implement VLAN and VLAN Trunking Protocol (VTP)
1.30	Implement trunk and trunk protocols, EtherChannel, and load-balance
1.40	Implement Ethernet technologies
	(a) Speed and duplex
	(b) Ethernet, Fast Ethernet, and Gigabit Ethernet
	(c) PPP over Ethernet (PPPoE)
1.50	Implement Switched Port Analyzer (SPAN), Remote Switched Port Analyzer (RSPAN), and flow control
1.60	Implement Frame Relay
	(a) Local Management Interface (LMI)
	(b) Traffic shaping
	(c) Full mesh
	(d) Hub and spoke
	(e) Discard eligible (DE)
1.70	Implement High-Level Data Link Control (HDLC) and PPP
2.00	Implement IPv4
2.10	Implement IP version 4 (IPv4) addressing, subnetting, and variable-length subnet masking (VLSM)
2.20	Implement IPv4 tunneling and Generic Routing Encapsulation (GRE)
2.30	Implement IPv4 RIP version 2 (RIPv2)
2.40	Implement IPv4 Open Shortest Path First (OSPF)
	(a) Standard OSPF areas
	(b) Stub area
	(c) Totally stubby area
	(d) Not-so-stubby-area (NSSA)
	(e) Totally NSSA
	(f) Link-state advertisement (LSA) types
	(g) Adjacency on a point-to-point and on a multi-access network
	(h) OSPF graceful restart
2.50	Implement IPv4 Enhanced Interior Gateway Routing Protocol (EIGRP)
	(a) Best path
	(b) Loop-free paths
	(c) EIGRP operations when alternate loop-free paths are available, and when they are not available
	(d) EIGRP queries
	(e) Manual summarization and autosummarization
	(f) EIGRP stubs
2.60	Implement IPv4 Border Gateway Protocol (BGP)
	(a) Next hop
	(b) Peering
	(c) Internal Border Gateway Protocol (IBGP) and External Border Gateway Protocol (EBGP)
2.70	Implement policy routing
2.80	Implement Performance Routing (PfR) and Cisco Optimized Edge Routing (OER)
2.90	Implement filtering, route redistribution, summarization, synchronization, attributes, and other advanced features
3.00	Implement IPv6
3.10	Implement IP version 6 (IPv6) addressing and different addressing types
3.20	Implement IPv6 neighbor discovery
3.30	Implement basic IPv6 functionality protocols
3.40	Implement tunneling techniques
3.50	Implement OSPF version 3 (OSPFv3)
3.60	Implement EIGRP version 6 (EIGRPv6)
3.70	Implement filtering and route redistribution
4.00	Implement MPLS Layer 3 VPNs
4.10	Implement Multiprotocol Label Switching (MPLS)
4.20	Implement Layer 3 virtual private networks (VPNs) on provider edge (PE), provider (P), and customer edge (CE) routers
4.30	Implement virtual routing and forwarding (VRF) and Multi-VRF Customer Edge (VRF-Lite)
5.00	Implement IP Multicast
5.10	Implement Protocol Independent Multicast (PIM) sparse mode
5.20	Implement Multicast Source Discovery Protocol (MSDP)
5.30	Implement interdomain multicast routing
5.40	Implement PIM Auto-Rendezvous Point (Auto-RP), unicast rendezvous point (RP), and bootstrap router (BSR)
5.50	Implement multicast tools, features, and source-specific multicast
5.60	Implement IPv6 multicast, PIM, and related multicast protocols, such as Multicast Listener Discovery (MLD)
6.00	Implement Network Security
6.01	Implement access lists
6.02	Implement Zone Based Firewall
6.03	Implement Unicast Reverse Path Forwarding (uRPF)
6.04	Implement IP Source Guard
6.05	Implement authentication, authorization, and accounting (AAA) (configuring the AAA server is not required, only the client-side (IOS) is configured)
6.06	Implement Control Plane Policing (CoPP)
6.07	Implement Cisco IOS Firewall
6.08	Implement Cisco IOS Intrusion Prevention System (IPS)
6.09	Implement Secure Shell (SSH)
6.10	Implement 802.1x
6.11	Implement NAT
6.12	Implement routing protocol authentication
6.13	Implement device access control
6.14	Implement security features
7.00	Implement Network Services
7.10	Implement Hot Standby Router Protocol (HSRP)
7.20	Implement Gateway Load Balancing Protocol (GLBP)
7.30	Implement Virtual Router Redundancy Protocol (VRRP)
7.40	Implement Network Time Protocol (NTP)
7.50	Implement DHCP
7.60	Implement Web Cache Communication Protocol (WCCP)
8.00	Implement Quality of Service (QoS)
8.10	Implement Modular QoS CLI (MQC)
	(a) Network-Based Application Recognition (NBAR)
	(b) Class-based weighted fair queuing (CBWFQ), modified deficit round robin (MDRR), and low latency queuing (LLQ)
	(c) Classification
	(d) Policing
	(e) Shaping
	(f) Marking
	(g) Weighted random early detection (WRED) and random early detection (RED)
	(h) Compression
8.20	Implement Layer 2 QoS: weighted round robin (WRR), shaped round robin (SRR), and policies
8.30	Implement link fragmentation and interleaving (LFI) for Frame Relay
8.40	Implement generic traffic shaping
8.50	Implement Resource Reservation Protocol (RSVP)
8.60	Implement Cisco AutoQoS
9.00	Troubleshoot a Network
9.10	Troubleshoot complex Layer 2 network issues
9.20	Troubleshoot complex Layer 3 network issues
9.30	Troubleshoot a network in response to application problems
9.40	Troubleshoot network services
9.50	Troubleshoot network security
10.00	Optimize the Network
10.01	Implement syslog and local logging
10.02	Implement IP Service Level Agreement SLA
10.03	Implement NetFlow
10.04	Implement SPAN, RSPAN, and router IP traffic export (RITE)
10.05	Implement Simple Network Management Protocol (SNMP)
10.06	Implement Cisco IOS Embedded Event Manager (EEM)
10.07	Implement Remote Monitoring (RMON)
10.08	Implement FTP
10.09	Implement TFTP
10.10	Implement TFTP server on router
10.11	Implement Switch-module Configuration Protocol (SCP)
10.12	Implement HTTP and HTTPS
10.13	Implement Telnet
11.00	Evaluate proposed changes to a Network
11.01	Evaluate interoperability of proposed technologies against deployed technologies
	(a) Changes to routing protocol parameters
	(b) Migrate parts of a network to IPv6
	(c) Routing Protocol migration
	(d) Adding multicast support
	(e) Migrate spanning tree protocol
	(f) Evaluate impact of new traffic on existing QoS design
11.02	Determine operational impact of proposed changes to an existing network
	(a) Downtime of network or portions of network
	(b) Performance degradation
	(c) Introducing security breaches
11.03	Suggest Alternative solutions when incompatible changes are proposed to an existing network
	(a) Hardware/Software upgrades
	(b) Topology shifts
	(c) Reconfigurations

2009-06-14T22:54:00.000-07:00

Information Technology

Vulnerabilities

Exploits

Eavesdropping

Social engineering and human error

Denial-of-service attack

Indirect attacks

Backdoors

Direct access attacks

Reducing vulnerabilities

Security

Reasons

CCDE Blue prints written exam

Topic

IP Routing

Tunneling

3) QoS

Management

Security

CCIE R & S Blue prints LAB exam

Exam Sections and Sub-task Objectives

CCIE R & S Blue prints written exam

Exam Sections and Sub-task Objectives