Contents

Introduction

Why Should You Become Certified in the SSFIPS Securing Cisco Networks with Sourcefire Intrusion Prevention System?
What Does This Book Cover?
Interactive Online Learning Environment and Test Bank
How to Use This Book
Where Do You Take the Exams?
SSFIPS Exam Objectives

Assessment Test

Answers to Assessment Test

Chapter 1 Getting Started with FireSIGHT

Industry Terminology
Cisco Terminology
Appliance Models
FireSIGHT Licensing
Network Design
Policies
The User Interface
Initial Appliance Setup
Summary
Hands-on Lab
Review Questions

Chapter 2 Object Management

What Are Objects?
Getting Started
Network Objects
Security Intelligence
Port Objects
VLAN Tag
URL Objects and Site Matching
Application Filters
Variable Sets
File Lists
Security Zones
Geolocation
Summary
Hands-on Lab
Exam Essentials
Review Questions

Chapter 3 IPS Policy Management

IPS Policies
Default Policies
Policy Layers
Creating a Policy
Summary
Hands-on Labs
Exam Essentials
Review Questions

Chapter 4 Access Control Policy

Getting Started with Access Control Policies
Security Intelligence Lists
Access Control Rules
Summary
Hands-on Lab
Exam Essentials
Review Questions

Chapter 5 FireSIGHT Technologies

FireSIGHT Technologies
Summary
Hands-on Labs
Exam Essentials
Review Questions

Chapter 6 Intrusion Event Analysis

Intrusion Analysis Principles
The Dashboard and Context Explorer
Intrusion Events
Summary
Hands-on Lab
Exam Essentials
Review Questions

Chapter 7 Network-Based Malware Detection

AMP Architecture
File Policy
File Types and Categories
File and Malware Event Analysis
Summary
Hands-on Lab
Exam Essentials
Review Questions

Chapter 8 System Settings

User Preferences
System Configuration
System Policy
Health
Summary
Hands-on Lab
Exam Essentials
Review Questions

Chapter 9 Account Management

User Account Management
User Privileges
Creating New User Accounts
Configuring External Authentication
Summary
Hands-on Lab
Exam Essentials
Review Questions

Chapter 10 Device Management

Device Management
NAT Configuration
Virtual Private Networks
Summary
Hands-on Labs
Exam Essentials
Review Questions

Chapter 11 Correlation Policy

Correlation Overview
Correlation Rules, Responses, and Policies
White Lists
Traffic Profiles
Summary
Hands-on Lab
Exam Essentials
Review Questions

Chapter 12 Advanced IPS Policy Settings

Advanced Settings
Summary
Hands-on Lab
Exam Essentials
Review Questions

Chapter 13 Creating Snort Rules

Overview of Snort Rules
Writing Rules
Summary
Exam Essentials
Review Questions

Chapter 14 FireSIGHT v5.4 Facts and Features

Branding
Simplified IPS Policy
Network Analysis Policy
Access Control Policy
SSL Inspection
New Rule Keywords
Platform Enhancements
International Enhancements
Minor Changes
Summary

Appendix Answers to Review Questions

Advert

EULA

List of Illustrations

Chapter 1

Figure 1.1 Inline IPS
Figure 1.2 Passive IPS
Figure 1.3 Web UI login screen
Figure 1.4 Analysis and configuration items
Figure 1.5 Operational Items
Figure 1.6 Network configuration
Figure 1.7 Time and update settings

Chapter 2

Figure 2.1 The Objects menu
Figure 2.2 Object types
Figure 2.3 Network object groups
Figure 2.4 The IP context menu
Figure 2.5 Warning dialog
Figure 2.6 Update Feeds button
Figure 2.7 Custom Security Intelligence feed dialog
Figure 2.8 Custom Security Intelligence list dialog
Figure 2.9 Port Objects dialog
Figure 2.10 Port object groups
Figure 2.11 VLAN tag group
Figure 2.12 Creating URL groups
Figure 2.13 Application Filter dialog
Figure 2.14 Application filter balloon
Figure 2.15 Edit Variable dialog
Figure 2.16 Editing the HOME_NET variable
Figure 2.17 Customized variable set
Figure 2.18 Edit Variable FTP_PORTS dialog
Figure 2.19 Variable set warning dialog
Figure 2.20 File List dialog
Figure 2.21 Adding file list entries
Figure 2.22 Security zones
Figure 2.23 Security zones edit dialog
Figure 2.24 Security zone confirmation dialog
Figure 2.25 Creating a geolocation object

Chapter 3

Figure 3.1 Policy layers
Figure 3.2 Create Intrusion Policy dialog
Figure 3.3 The Policy Information section in the policy editor
Figure 3.4 The Rules section in the policy editor
Figure 3.5 The Threshold dialog
Figure 3.6 Dynamic State dialog
Figure 3.7 The FireSIGHT Recommended Rules Configuration screen
Figure 3.8 Policy layers
Figure 3.9 IPS policy repository

Chapter 4

Figure 4.1 The Access Control policy main page
Figure 4.2 Creating a new AC policy
Figure 4.3 Policy edit page
Figure 4.4 Security Intelligence
Figure 4.5 Blacklist Options dialog
Figure 4.6 Blacklist logging options
Figure 4.7 Blacklist context menu
Figure 4.8 Blacklist actions
Figure 4.9 HTTP response pages
Figure 4.10 Sample browser time-out message
Figure 4.11 Sourcefire block response
Figure 4.12 Edit Block Response Page dialog
Figure 4.13 Sourcefire Interactive Block page
Figure 4.14 AC advanced settings
Figure 4.15 AC rules main page
Figure 4.16 AC default action logging
Figure 4.17 Add Category dialog
Figure 4.18 AC Rule dialog
Figure 4.19 AC insert rule drop-down
Figure 4.20 AC rule actions
Figure 4.21 AC Zones tab
Figure 4.22 AC Networks tab
Figure 4.23 AC VLAN Tags tab
Figure 4.24 AC Users tab
Figure 4.25 AC Applications tab
Figure 4.26 Ports tab
Figure 4.27 ICMP types and codes
Figure 4.28 URLs tab
Figure 4.29 Inspection tab
Figure 4.30 Logging tab
Figure 4.31 Comments tab
Figure 4.32 Access Control rules example
Figure 4.33 Apply Access Control Policy dialog
Figure 4.34 The Details dialog
Figure 4.35 Apply Policy dialog

Chapter 5

Figure 5.1 Network discovery policy
Figure 5.2 Network discovery rule
Figure 5.3 User tab
Figure 5.4 Discovery policy advanced tab
Figure 5.5 Indications of compromise rules
Figure 5.6 Event logging settings
Figure 5.7 Host event views
Figure 5.8 Creating an event search
Figure 5.9 Newly discovered hosts
Figure 5.10 Host profile
Figure 5.11 Host profile (continued)
Figure 5.12 Connection events
Figure 5.13 Connection event workflows
Figure 5.14 Traffic Over Time workflow
Figure 5.15 Connection event summary
Figure 5.16 Users policy configuration
Figure 5.17 User Agent configuration
Figure 5.18 Active Directory server configuration
Figure 5.19 LDAP configuration
Figure 5.20 Table view of users
Figure 5.21 User Activity view
Figure 5.22 Host attribute creation
Figure 5.23 List attribute creation
Figure 5.24 Network Map Host Attribute view

Chapter 6

Figure 6.1 Dashboard menu
Figure 6.2 Event oriented widget examples
Figure 6.3 Status oriented widget examples
Figure 6.4 Connection Summary dashboard
Figure 6.5 The Context Explorer
Figure 6.6 Context Explorer filter
Figure 6.7 Applying filters
Figure 6.8 The Switch Workflow link
Figure 6.9 Default IPS workflows
Figure 6.10 Time window link
Figure 6.11 Date/time pop-up window
Figure 6.12 Sliding time window
Figure 6.13 Time Window Preferences
Figure 6.14 Destination Port workflow
Figure 6.15 Event-Specific workflow
Figure 6.16 Events by Priority and Classification workflow
Figure 6.17 Events to Destinations workflow
Figure 6.18 Impact and Priority workflow
Figure 6.19 Impact and Source workflow
Figure 6.20 Impact to Destination workflow
Figure 6.21 IP-Specific workflow
Figure 6.22 Source and Destination workflow
Figure 6.23 Source Port workflow
Figure 6.24 “Breadcrumb trail” of workflow pages
Figure 6.25 Sample intrusion events
Figure 6.26 Impact levels
Figure 6.27 Sample intrusion events
Figure 6.28 Event drill-down
Figure 6.29 Host entry
Figure 6.30 Table View drill-down
Figure 6.31 Expanding disabled columns
Figure 6.32 Packet View page
Figure 6.33 Snort rule
Figure 6.34 Packet Information section
Figure 6.35 Packet payload
Figure 6.36 The Actions section
Figure 6.37 Rule documentation
Figure 6.38 Disable in Current Policy
Figure 6.39 Suppression options
Figure 6.40 Thresholding options
Figure 6.41 The Add comment page
Figure 6.42 Search menu
Figure 6.43 Search quick link
Figure 6.44 Edit Search link
Figure 6.45 Top of the search page
Figure 6.46 Bottom of the search page
Figure 6.47 Searching for objects
Figure 6.48 Reviewed status
Figure 6.49 Reviewed By search
Figure 6.50 Reviewed events menu
Figure 6.51 Packet download buttons
Figure 6.52 Copy dialog
Figure 6.53 Create New Incident

Chapter 7

Figure 7.1 AMP communications architecture
Figure 7.2 Allow rule Inspection tab
Figure 7.3 New File Policy dialog
Figure 7.4 File Policy Advanced tab
Figure 7.5 Add File Rule dialog
Figure 7.6 File application protocols
Figure 7.7 File rule actions
Figure 7.8 Detect Files option
Figure 7.9 Block File options
Figure 7.10 Malware Cloud Lookup options
Figure 7.11 Block Malware options
Figure 7.12 File Type selection
Figure 7.13 Example file rule
Figure 7.14 Conflicting file rules
Figure 7.15 Rule conflict help
Figure 7.16 Malware event workflows
Figure 7.17 Malware Summary workflow
Figure 7.18 Hosts Receiving Malware workflow
Figure 7.19 Malware Summary page
Figure 7.20 Malware table view
Figure 7.21 File Summary workflow
Figure 7.22 Captured File Summary workflow
Figure 7.23 Captured files table view
Figure 7.24 Threat score
Figure 7.25 Dynamic Analysis Summary dialog
Figure 7.26 Dynamic Analysis details
Figure 7.27 Detailed file analysis
Figure 7.28 Recent malware
Figure 7.29 Network File Trajectory
Figure 7.30 Download warning
Figure 7.31 Trajectory Information
Figure 7.32 Context Explorer

Chapter 8

Figure 8.1 Event Preferences
Figure 8.2 File Preferences
Figure 8.3 Default Time Windows
Figure 8.4 Default workflows
Figure 8.5 System configuration
Figure 8.6 System policy time settings
Figure 8.7 System policy list
Figure 8.8 Health Monitor
Figure 8.9 Health policy settings
Figure 8.10 Health events
Figure 8.11 Blacklisting health events
Figure 8.12 Creating an alert
Figure 8.13 Health Monitor alerts

Chapter 9

Figure 9.1 Access User Management
Figure 9.2 User Management page
Figure 9.3 User Configuration options page
Figure 9.4 Choosing an external authentication option
Figure 9.5 Creating an internal user
Figure 9.6 Verifying that the new user is active
Figure 9.7 Verifying the current user rights and logging out
Figure 9.8 Logging in and verifying the new user’s rights
Figure 9.9 Verifying the default user roles
Figure 9.10 Creating a custom user role
Figure 9.11 Assigning a custom user role
Figure 9.12 Configuring permission escalation
Figure 9.13 Configuring permission escalation part II
Figure 9.14 Logging out as Admin
Figure 9.15 Escalating permissions
Figure 9.16 Login Authentication tab
Figure 9.17 Choosing LDAP or RADIUS
Figure 9.18 Configuring LDAP server options
Figure 9.19 LDAP-specific parameters
Figure 9.20 Show Advanced Options field
Figure 9.21 Attribute Mapping options
Figure 9.22 Fetch Attrs output
Figure 9.23 Group Controlled Access Roles configuration
Figure 9.24 Shell Access Filter and Additional Test Parameters settings
Figure 9.25 Server test results
Figure 9.26 Authentication Profiles

Chapter 10

Figure 10.1 Managed device console login
Figure 10.2 Initial device settings
Figure 10.3 Specifying the Defense Center
Figure 10.4 Add Device dialog
Figure 10.5 Devices tab
Figure 10.6 Device management
Figure 10.7 Device settings
Figure 10.8 Passive interface configuration
Figure 10.9 Inline interface configuration
Figure 10.10 Switched interface configuration
Figure 10.11 Routed interface configuration
Figure 10.12 Inline set configuration
Figure 10.13 General virtual switch configuration
Figure 10.14 Advanced virtual switch configuration
Figure 10.15 Virtual router configuration
Figure 10.16 Static route configuration
Figure 10.17 New NAT policy
Figure 10.18 NAT rule configuration
Figure 10.19 Point-to-Point VPN configuration
Figure 10.20 Star VPN configuration
Figure 10.21 Mesh VPN configuration
Figure 10.22 Advanced VPN configuration tab

Chapter 11

Figure 11.1 Rule Management tab
Figure 11.2 Rule Information screen
Figure 11.3 Event types
Figure 11.4 Event criteria
Figure 11.5 Connection event criteria
Figure 11.6 More event criteria
Figure 11.7 Application protocols
Figure 11.8 Rule condition
Figure 11.9 Completed rule criteria
Figure 11.10 Rule Snooze settings
Figure 11.11 Inactive periods
Figure 11.12 Responses menu
Figure 11.13 Alert options
Figure 11.14 Sample email alert
Figure 11.15 Built-in remediation modules
Figure 11.16 Cisco IOS Null Route remediation module
Figure 11.17 Cisco IOS Null Route configuration
Figure 11.18 Configured Remediations
Figure 11.19 Edit Remediation page
Figure 11.20 Policy Management tab
Figure 11.21 Create a correlation policy
Figure 11.22 Add correlation rule
Figure 11.23 Policy with rule added
Figure 11.24 Assigned responses
Figure 11.25 Policy with a rule and responses
Figure 11.26 Updated policy
Figure 11.27 Active correlation policy
Figure 11.28 White List page
Figure 11.29 Survey Network screen
Figure 11.30 Survey results
Figure 11.31 Host Profile details
Figure 11.32 Newly added white list
Figure 11.33 New correlation policy
Figure 11.34 White list violations
Figure 11.35 Non-compliant host entry
Figure 11.36 White List Events page
Figure 11.37 Traffic profile list
Figure 11.38 Traffic profile configuration
Figure 11.39 Traffic profile example
Figure 11.40 Completed traffic profile example
Figure 11.41 Updated traffic profile list
Figure 11.42 Traffic profile graph
Figure 11.43 Correlation rule criteria
Figure 11.44 Completed correlation rule

Chapter 12

Figure 12.1 Advanced Settings
Figure 12.2 Preprocessor rule link
Figure 12.3 HTTP Configuration global settings
Figure 12.4 HTTP Configuration targets
Figure 12.5 HTTP Configuration targets continued
Figure 12.6 SCADA preprocessors
Figure 12.7 Transport/Network layer preprocessors
Figure 12.8 Inline Normalization
Figure 12.9 IP Defragmentation
Figure 12.10 TCP Stream Configuration
Figure 12.11 IP defragmentation
Figure 12.12 Specific Threat Detection preprocessors
Figure 12.13 Adaptive Profiles Settings
Figure 12.14 Global Rule Thresholding Settings
Figure 12.15 Performance Settings
Figure 12.16 Latency-Based Packet Handling
Figure 12.17 Latency-Based Rule Handling
Figure 12.18 External Responses
Figure 13.2 Constraining content matches
Figure 13.3 Distance
Figure 13.4 Fast_Pattern
Figure 13.5 Getting to the FireSIGHT graphical rule builder
Figure 13.6 Creating a rule
Figure 13.7 FireSIGHT graphical rule builder
Figure 13.8 Finding your rule in the system
Figure 13.9 Importing a rule

Chapter 14

Figure 14.1 5.4 Login screen
Figure 14.2 5.4 IPS Advanced Settings
Figure 14.3 5.4 Network Analysis Policy list
Figure 14.4 5.4 Network analysis policy creation
Figure 14.5 5.4 Network analysis base policy
Figure 14.6 Edit network analysis policy
Figure 14.7 Access Control advanced settings
Figure 14.8 General Settings
Figure 14.9 Network Analysis and Intrusion Policies
Figure 14.10 Network analysis custom rules
Figure 14.11 Transport/Network Layer Preprocessor Settings
Figure 14.12 Detection Enhancement Settings
Figure 14.13 Creating a cipher suite list
Figure 14.14 Creating a distinguished name object
Figure 14.15 Distinguished name object group
Figure 14.16 Trusted CA objects
Figure 14.17 SSL Policy tab
Figure 14.18 SSL policy
Figure 14.19 SSL rule
Figure 14.20 Decrypt – Known Key
Figure 14.21 Decrypt – Resign

Introduction

Welcome to the exciting world of Cisco certification! If you’ve picked up this book because you want to improve yourself and your life with a better, more satisfying, and secure job, you’ve done the right thing. Whether you’re striving to enter the thriving, dynamic IT sector or seeking to enhance your skill set and advance your position within it, being Cisco certified can seriously stack the odds in your favor to help you attain your goals!

Cisco certifications are powerful instruments of success that also markedly improve your grasp of all things internetworking. As you progress through this book, you’ll gain a complete understanding of security that reaches far beyond Cisco devices. By the end of this book, you’ll comprehensively know how Sourcefire technologies work together in your network, which is vital to today’s very way of life in the developed world. The knowledge and expertise you’ll gain here is essential for and relevant to every networking job and is why Cisco certifications are in such high demand—even at companies with few Cisco devices!

Although it’s now common knowledge that Cisco rules routing and switching, the fact that it also rocks the voice, data center, and security worlds is also well recognized. And Cisco certifications reach way beyond the popular but less extensive certifications like those offered by CompTIA and Microsoft to equip you with indispensable insight into today’s vastly complex networking realm. Essentially, by deciding to become Cisco certified, you’re proudly announcing that you want to become an unrivaled networking expert—a goal that this book will get you well on your way to achieving. Congratulations in advance on the beginning of your brilliant future!

Why Should You Become Certified in the SSFIPS Securing Cisco Networks with Sourcefire Intrusion Prevention System?

Cisco, like Microsoft and other vendors that provide certification, has created the certification process to give administrators a set of skills and to equip prospective employers with a way to measure those skills or match certain criteria.

The SSFIPS Securing Cisco Networks with Sourcefire Intrusion Prevention System (500-285) exam is designed for technical professionals who need to demonstrate their expertise and skills in deployment and management of Cisco NGIPS solutions, including Cisco FirePOWER appliances and the Cisco FireSIGHT management system.

Rest assured that if you make it through the SSFIPS and are still interested in Cisco and security, you’re headed down a path to certain success!

What Does This Book Cover?

This book covers everything you need to know to pass the SSFIPS 500-285 exam.

You will learn the following information in this book:

Chapter 1: Getting Started with FireSIGHT What is FirePOWER? What is FireSIGHT? What is Sourcefire? Understand Sourcefire by building a solid foundation in defining key, industry-wide, and Cisco-specific terms that we’ll be using throughout this book. Various FireSIGHT appliance models will be discussed as well as licensing, policies, and initial system setup.

Chapter 2: Object Management This chapter will provide you with the understanding of object types that are used by the FireSIGHT System. And as with the other chapters, this chapter includes review questions and a hands-on lab to help you build a strong foundation.

Chapter 3: IPS Policy Management This chapter provides you with the background necessary for success on the exam as well as in the real world with a thorough presentation of IPS policy management. This in-depth chapter covers IPS policies, which precisely describe the suspicious and/or malicious traffic that the system must watch out for, and they also control how evil traffic is dealt with when it’s discovered.

Chapter 4: Access Control Policy Chapter 4 covers the heart of the FireSIGHT system. An Access Control policy acts kind of like the central traffic cop for FireSIGHT because all traffic passing through a device is processed through it. And you’ll find plenty of help in this chapter as long as you don’t skip the review questions and hands-on lab at the end.

Chapter 5: FireSIGHT Technologies FireSIGHT is the name given to a technology built into the Cisco FirePOWER NGIPS to provide us with contextual awareness regarding events, IP addresses, users on the network, and even background about the hosts in the system. As with Chapter 4, plenty of help is there for you if don’t skip the review questions and hands-on labs at the end.

Chapter 6: Intrusion Event Analysis In this chapter, we’ll review using the FireSIGHT System to analyze intrusion event data. We’ll explore some of the workflows available when analyzing events and show you examples of how to drill into relevant event data. We’ll also cover how to use the Dashboards and Context Explorer. As always, before tackling the hands-on lab in this chapter, complete the review questions.

Chapter 7: Network-Based Malware Detection A nickname derived from the term malicious software, malware comes in a variety of vile flavors, from coded weapons fashioned to damage, control, or disable a computer system to reconnaissance tools for stealing data or identity theft. FireSIGHT’s Advanced Malware Protection (AMP) is designed to tackle one of the worst and arguably most prevalent threat vectors today—malware! As always, don’t skip the review questions and hands-on lab at the end.

Chapter 8: System Settings This chapter will cover how to apply settings on the systems to control user preferences, time zones, and other key factors plus configuring health checks to alert you to conditions within your devices. Remember the review questions and hands-on labs at the end.

Chapter 9: Account Management In this chapter, we’re going to cover a variety of administrative functions for user account management. We’ll discuss creating and managing both internal and external users. The hands-on labs and review questions will help you master this chapter.

Chapter 10: Device Management In this chapter we’ll discuss and demonstrate registering the device with the Defense Center as well as touring each of the device’s properties. You’ll discover the different settings for the interfaces and switch and router configurations, plus, we’ll survey the different VPN and NAT types available to managed devices as well.

Chapter 11: Correlation Policy Correlation Policy is an often overlooked but useful feature of the FireSIGHT System. The features available in this area concentrate on detection of unusual activity rather than specific intrusion or malware events. By using correlation rules, white lists, and traffic profiles, we can detect network or host behaviors that may be an indication of malicious activity.

Chapter 12: Advanced IPS Policy Settings This chapter is the perfect time to introduce you to some essential advanced IPS policy settings, and we’ll also survey important application layer preprocessor settings, network and transport layer preprocessors, and specific threat detection preprocessors. We’ll also talk about the significant advantages gained via detection enhancements and performance settings.

Chapter 13: Creating Snort Rules In this chapter, we’re going to focus exclusively on the fundamentals of Snort rules, detailing their structure, syntax, and options. We’ll also explore how Snort performs rule optimization for better performance and show you how rule matching takes place internally.

Chapter 14: FireSIGHT version 5.4 Facts and Features Last, but definitely not least, this key chapter covers all the great new features in FireSIGHT Version 5.4 that launched in February 2015. Don’t be fooled when you hear people refer to this release as a “point” upgrade because that’s a serious understatement. Version 5.4 is a major-league upgrade with substantial new capabilities. In addition to all the bright new features, the user interface has been updated, changing the location of some configuration settings. The settings remain largely unchanged from previous versions, but they’ve been moved in the user interface.

Appendix A: Answers to Chapter Review Questions This appendix contains the answers to the book’s review questions.

Interactive Online Learning Environment and Test Bank

We’ve worked hard to provide some really great tools to help you with your certification process. The interactive online learning environment that accompanies the SSFIPS Securing Cisco Networks with Sourcefire Intrusion Prevention System Study Guide, Exam 500-285, provides a test bank with study tools to help you prepare for the certification exam—and increase your chances of passing it the first time! The test bank includes the following:

Sample Tests All of the questions in this book are provided, including the assessment test, which you’ll find at the end of this introduction, and the chapter tests that include the review questions at the end of each chapter. In addition, there are two exclusive practice exams with 50 questions each. Use these questions to test your knowledge of the study guide material. The online test bank runs on multiple devices.

Flashcards The online text banks includes 100 flashcards specifically written to hit you hard, so don’t get discouraged if you don’t ace your way through them at first! They’re there to ensure that you’re really ready for the exam. And no worries—armed with the review questions, practice exams, and flashcards, you’ll be more than prepared when exam day comes! Questions are provided in digital flashcard format (a question followed by a single correct answer). You can use the flashcards to reinforce your learning and provide last-minute test prep before the exam.

Other Study Tools A glossary of key terms from this book and their definitions are available as a fully searchable PDF.

In addition to the online test bank, the authors have provided additional study material that’ll help you get the most out of your exam preparation:

Todd Lammle Bonus Material and Labs Be sure to check the www.lammle.com/firepower web page for directions on how to download all the latest bonus material created specifically to help you study for your Securing Cisco Networks with Sourcefire Intrusion Prevention System (SSFIPS) exam.

Online Videos Check out the online videos available at www.lammle.com/firepower.

How to Use This Book

If you want a solid foundation for the serious effort of preparing for the Securing Cisco Networks with Sourcefire Intrusion Prevention System (SSFIPS) exam, then look no further. We’ve spent hundreds of hours putting together this book with the sole intention of helping you to pass the exam as well as really learn how to correctly configure and manage Firepower!

This book is loaded with valuable information, and you will get the most out of your study time if you understand why the book is organized the way it is.

So to maximize your benefit from this book, I recommend the following study method:

Take the assessment test that’s provided at the end of this introduction. (The answers are at the end of the test.) It’s okay if you don’t know any of the answers; that’s why you bought this book! Carefully read over the explanations for any question you get wrong and note the chapters in which the material relevant to them is covered. This information should help you plan your study strategy.
Study each chapter carefully, making sure you fully understand the information and the test objectives listed at the beginning of each one. Pay extra-close attention to any chapter that includes material covered in questions you missed.
Complete all hands-on labs in each chapter, referring to the text of the chapter so that you understand the reason for each step you take. Try to get your hands on some real equipment, or rent ASA/FirePOWER pods at www.lammle.com/firepower, which you can use for the hands-on labs found only in this book. These labs will equip you with everything you need for your SSFIPS certification goals.
Answer all of the review questions related to each chapter. (The answers appear in Appendix A.) Note the questions that confuse you, and study the topics they cover again until the concepts are crystal clear. And again—do not just skim these questions! Make sure you fully comprehend the reason for each correct answer. Remember that these will not be the exact questions you will find on the exam, but they’re written to help you understand the chapter material and ultimately pass the exam!
Try your hand at the practice questions that are exclusive to this book. The questions can be found at www.sybex.com/go/firepower. And be sure to check out www.lammle.com/firepower for the most up-to-date exam prep questions, bonus material, videos, Todd Lammle bootcamps, and more.
Test yourself using all the flashcards, which are also found on the download link. These are brand-new and updated flashcards to help you prepare for the SSFIPS exam and a wonderful study tool!

To learn every bit of the material covered in this book, you’ll have to apply yourself regularly, and with discipline. Try to set aside the same time period every day to study, and select a comfortable and quiet place to do so. I’m confident that if you work hard, you’ll be surprised at how quickly you learn this material!

If you follow these steps and really study—doing hands-on labs every single day in addition to using the review questions, the practice exams, and the electronic flashcards—it would actually be hard to fail the Cisco exam. But understand that studying for the Cisco exams is a lot like getting in shape—if you do not go to the gym every day, it’s not going to happen!

Where Do You Take the Exams?

You may take the Securing Cisco Networks with Sourcefire Intrusion Prevention System (SSFIPS) exam, or any Cisco exam, at any of the Pearson VUE authorized testing centers. For information, check www.vue.com or call 877-404-EXAM (3926).

To register for a Cisco exam, follow these steps:

Determine the number of the exam you want to take. (The SSFIPS exam number is 500-285.)
Register with the nearest Pearson VUE testing center. At this point, you will be asked to pay in advance for the exam. At the time of this writing, the exam is $250 and must be taken within one year of payment. You can schedule exams up to six weeks in advance or as late as the day you want to take it—but if you fail a Cisco exam, you must wait five days before you will be allowed to retake it. If something comes up and you need to cancel or reschedule your exam appointment, contact Pearson VUE at least 24 hours in advance.
When you schedule the exam, you’ll get instructions regarding all appointment and cancellation procedures, the ID requirements, and information about the testing-center location.

Tips for Taking Your Cisco Exams

The Cisco exams contain about 50 to 60 questions and must be completed in about 90 minutes or less. This information can change per exam. You must get a score of about 80 percent to pass this exam, but again, each exam can be different.

Many questions on the exam have answer choices that at first glance look identical—especially the syntax questions! So remember to read through the choices carefully because close just doesn’t cut it. If you get commands in the wrong order or forget one measly character, you’ll get the question wrong. So, to practice, do the hands-on exercises at the end of this book’s chapters over and over again until they feel natural to you.

Also, never forget that the right answer is the Cisco answer. In many cases, more than one appropriate answer is presented, but the correct answer is the one that Cisco recommends. On the exam, you will always be told to pick one, two, or three options; never “choose all that apply.” The Cisco exam may include the following test formats:

Multiple-choice single answer
Multiple-choice multiple answer
Drag-and-drop
Router simulations

However, be advised that the current SSFIPS exam is listed as all multiple choice questions for now, but understand that this can change at any time.

Here are some general tips for exam success:

Arrive early at the exam center so you can relax and review your study materials.
Read the questions carefully. Don’t jump to conclusions. Make sure you’re clear about exactly what each question asks. “Read twice, answer once” is what I always tell my students.
When answering multiple-choice questions that you’re not sure about, use the process of elimination to get rid of the obviously incorrect answers first. Doing this greatly improves your odds if you need to make an educated guess.
You can no longer move forward and backward through the Cisco exams, so double-check your answer before clicking Next since you can’t change your mind.

After you complete an exam, you’ll get immediate, online notification of your pass or fail status, a printed examination score report that indicates your pass or fail status, and your exam results by section. (The test administrator will give you the printed score report.) Test scores are automatically forwarded to Cisco within five working days after you take the test, so you don’t need to send your score to them. If you pass the exam, you’ll receive confirmation from Cisco, typically within two to four weeks, sometimes a bit longer.

SSFIPS Exam Objectives

Candidates will demonstrate knowledge of in-depth event analysis, IPS tuning, and configuration in addition to the Snort rules language. Exam takers will show their skills in using and configuring Cisco NGIPS technology, including application control, firewalls, and routing and switching capabilities.

This study guide has been written to cover the SSFIPS exam objectives at a level appropriate to their exam weightings. The following table provides a breakdown of this book’s exam coverage, showing you the weight of each section and the chapter where each objective or subobjective is covered:

Objective/Subobjective	Percentage of Exam	Chapters
1.0 Object Management	6%
1.1 Understand the types of objects that may be created and configured in object management		2
1.2 Describe the implementation of security intelligence feeds		2, 4
2.0 Access Control Policy	10%
2.1 Describe the purpose, features, and configuration of access control policy rules		4
2.2 Describe the purpose and configuration of an access control policy		4
3.0 Event Analysis	5%
3.1 Understand the role that geolocation can play in analysis		6
3.2 Be familiar with the interfaces for analysis, including the Dashboard, Work Flows and Context Explorer		6
4.0 IPS Policy Basics	5%
4.1 Understand and describe the operation of the IPS policy interface		3
4.2 Describe the use of the rule management user interface in the IPS policy editor		3
4.3 Be able to implement Cisco FireSIGHT recommendations		3
5.0 FireSIGHT Technologies	12%
5.1 Understand the discovery component inside FireSIGHT, including the policy configuration and the data collected		5
5.2 Understand the type of data collected by connection events with FireSIGHT		5
5.3 Understand the user information that is discovered with FireSIGHT		5
6.0 Network-Based Malware Detection	10%
6.1 Describe the interface components used for analyzing malware events		7
6.2 Understand the different techniques used to identify malware		7
6.3 Describe the features of malware detection as used by the Cisco NGIPS, including communication, actions, and protocols		7
7.0 Basic Administration	12%
7.1 Describe the settings contained in the system polices		8
7.2 Understand the general user preferences and system settings of the Cisco NGIPS		8
7.3 Describe the settings available for the health monitoring features of the Cisco NGIPS		8
8.0 Account Management	5%
8.1 Understand the permissions available to different account roles		9
8.2 Describe the features that can use external authentication		9
9.0 Creating Snort Rules	5%
9.1 Be familiar with the options used to create Snort rules inside the Cisco NGIPS		13
10.0 Device Management	10%
10.1 Describe the VPN types supported and the configuration of those VPNs		10
10.2 Define the different NAT types		10
10.3 Understand the properties of the managed devices and the settings that may be configured		10
10.4 Describe the settings for configuring the virtual interface and virtual router switch types		10
11.0 Correlation Policies	10%
11.1 Describe the components of a correlation policy		11
11.2 Understand the process for creating a white list		11
11.3 Describe the purpose and creation of traffic profiles		11
11.4 Be familiar with the types of responses available when dealing with correlation policies		11
12.0 Advanced IPS Policy Configuration	10%
12.1 Describe the features and settings of application layer preprocessors		12
12.2 Describe the features and settings of network and transport layer preprocessors		12
12.3 Describe the features and settings for specific threat detections in the advanced section of IPS polices		12
12.4 Understand the benefits of the detection enhancements and performance settings in the intrusion policy editor		12

SSFIPS
Securing Cisco^® Networks with Sourcefire^® Intrusion Prevention System

Study Guide

Acknowledgments

About the Authors

Introduction

Why Should You Become Certified in the SSFIPS Securing Cisco Networks with Sourcefire Intrusion Prevention System?

What Does This Book Cover?

Interactive Online Learning Environment and Test Bank

How to Use This Book

Where Do You Take the Exams?

Tips for Taking Your Cisco Exams

SSFIPS Exam Objectives