Resources - JNCIA-IDP Exam Objectives (Exam: JN0-541)

This list is intended to provide a general view of the skill set required to successfully complete the specified certification exam. Topics listed are subject to change.

• Intrusion Detection Concepts
• Initial Configuration of an IDP Sensor
• Configuring and Fine-Tuning Policies
• Configuring Other IDP-related Rulebases
• Configuring and Using the Profiler
• Sensor Operation and Sensor Command-line Utilities
• Managing Attack Objects and Creating Custom Signatures
• Maintenance and Troubleshooting

Intrusion Detection Concepts

• Identify features and fuctions on an IDP sensor
• Identify the uses of the IDP interfaces
• Identify TCP ports used by IDP sensor and Security Manager
• Understand the IDP deployment modes

Initial Configuration of an IDP Sensor

• Identify the steps to deploy the IDP Sensor
• Describe how to configure a new sensor via the console
• Describe how to establish communication between Security Manager and the IDP sensor

Configuring and Fine-Tuning Policies

• Match IDP attack terminology to their associated definitions
• Understand the components of an IDP rule
• Choose appropriate IDP actions and IP actions
• Describe the IDP rule-matching algorithm
• Explain the use of packet captures
• Explain how to fine-tune policies

Configuring Other IDP-related Rulebases

• Explain Exempt rulebase operation
• Explain Traffic Anomlies rulebase operation
• Explain Backdoor rulebase operation
• Explain SYN Protector rulebase operation
• Explain Network Honeypot operation

Configuring and Using the Profiler

• Describe the general operation of the Profiler
• List the steps to operate the Profiler
• Describe how to use Profiler for network discovery
• Describe how to use Profiler to detect new devices and ports
• Describe how to use Profiler to detect policy violations

Sensor Operation and Sensor Command-line Utilities

• Describe the sensor components and sensor processes
• Use scio to manage policies and view sensor configuration
• Use sctop to view sensor statistics

Managing Attack Objects and Creating Custom Signatures

• Describe the use of static groups vs. dynamic groups
• Explain how to update the attack object database
• List the steps for obtaining information on an attack
• Understand the purpose and use of the sensor commands "scio ccap" and "scio pcap"
• List the steps for creating a simple attack object
• Describe the purpose of compound attack objects

Maintenance and Troubleshooting

• Use Appliance Configuration Manager (ACM) to view and change sensor configuration
• Use sensor commands and Unix commands to troubleshoot IDP problems
• Understand the operation of external HA and NIC bypass