This list is intended to provide a general view of the skill set required to successfully complete the specified certification exam. Topics listed are subject to change.
- Intrusion Detection Concepts
- Initial Configuration of an IDP Sensor
- Configuring and Fine-Tuning Policies
- Configuring Other IDP-related Rulebases
- Configuring and Using the Profiler
- Sensor Operation and Sensor Command-line Utilities
- Managing Attack Objects and Creating Custom Signatures
- Maintenance and Troubleshooting
Intrusion Detection Concepts
- Identify features and fuctions on an IDP sensor
- Identify the uses of the IDP interfaces
- Identify TCP ports used by IDP sensor and Security Manager
- Understand the IDP deployment modes
Initial Configuration of an IDP Sensor
- Identify the steps to deploy the IDP Sensor
- Describe how to configure a new sensor via the console
- Describe how to establish communication between Security Manager and the IDP sensor
Configuring and Fine-Tuning Policies
- Match IDP attack terminology to their associated definitions
- Understand the components of an IDP rule
- Choose appropriate IDP actions and IP actions
- Describe the IDP rule-matching algorithm
- Explain the use of packet captures
- Explain how to fine-tune policies
Configuring Other IDP-related Rulebases
- Explain Exempt rulebase operation
- Explain Traffic Anomlies rulebase operation
- Explain Backdoor rulebase operation
- Explain SYN Protector rulebase operation
- Explain Network Honeypot operation
Configuring and Using the Profiler
- Describe the general operation of the Profiler
- List the steps to operate the Profiler
- Describe how to use Profiler for network discovery
- Describe how to use Profiler to detect new devices and ports
- Describe how to use Profiler to detect policy violations
Sensor Operation and Sensor Command-line Utilities
- Describe the sensor components and sensor processes
- Use scio to manage policies and view sensor configuration
- Use sctop to view sensor statistics
Managing Attack Objects and Creating Custom Signatures
- Describe the use of static groups vs. dynamic groups
- Explain how to update the attack object database
- List the steps for obtaining information on an attack
- Understand the purpose and use of the sensor commands "scio ccap" and "scio pcap"
- List the steps for creating a simple attack object
- Describe the purpose of compound attack objects
Maintenance and Troubleshooting
- Use Appliance Configuration Manager (ACM) to view and change sensor configuration
- Use sensor commands and Unix commands to troubleshoot IDP problems
- Understand the operation of external HA and NIC bypass
