CCNP IPS v7.0 Video on Demand (642-627)

Why Choose IPexpert

Enjoying nearly a decade of success and boasting the world's largest list of successful candidates, IPexpert has expanded their product line and is pleased to offer you the world's most proven, content-rich CCNP IPS v7.0 exam preparation Video on Demand Course. The industry's most recognized video training solution for the CCNP IPS exam is explained as follows:

• A designed training solution in which our industry-recognized Instructor delivers lecture and thorough configuration examples of nearly every topic covered on the CCNP IPS v7.0 blueprint 
• A training solution with extremely detailed slides and diagrams that are thorough are easy to comprehend
• Hints, tips and tricks outline what to watch for are explained in detail by an Author / Instructor
• An amazing training solution that is kept current by the world's most elite team of technical Instructors, all of which hold multiple certifications, degrees and multiple CCIE certifications
• The world's most proven product and methodology, boasting more CCIE success stories and testimonials than any other company
• A "must have" training product backed by IPepxert's Investment Assurance program that has raised the bar and set the precedence for training guarantees!

Closing Statements on Why You Should Use IPexpert's Training Solutions

As we expand our product lines we continue to serve our clients with the most up-to-date, content rich materials for the CCNP Security exams. We would like to highlight a few key points you should consider when selecting a CCNP training vendor:

• Which vendor's products have been (and is currently) used by more candidates to pass the Lab exam for each particular track?
• Which vendor includes their full printed slides and topology diagrams along with their video training solution free of charge?
• Can you find another vendor that offers the level of support, guidance and authenticity that comes close to IPexpert?
• Which vendor's products have scaled the world and have been delivered to every developed country in the world?
• What vendor can match the level of competency as it relates to our dedicated, full time team of industry-recognized and accredited CCIE Instructors?

Our Training Advisors, Support Engineers, Instructors and Developers will stand with you, by your side, during the entire process of your journey, regardless of how long it takes you!

Table of Contents

IPS

Introduction and Setup

This module is an overview of Cisco IPS models including the appliances as well as the modules available for the ASA firewalls and ISR router platforms.  A comparison of the management tools including the IPS Manager Express (IME), IPS Device Manager (IDM) and Cisco Security Manager (CSM) is covered.  Basic initialization of the IPS sensor is also covered.

After viewing this module you will be able to:

• Select the correct IPS module or appliance according to the High Level Design
• Describe the use of the CLI
• Describe the authentication modes available on the IPS sensor
• Initialize the IPS sensor
• Configure time

IPS Basic Configuration

This module covers connecting to the IDM and IME as well as a demonstration of the management tools.  The Signature Policy is discussed and the sensor modes are discussed.

After viewing this module you will be able to:

• Connect to the IME and IDM
• Describe how the IPS sensor is licensed
• Explain the components that make up a Signature Policy
• Describe the default policies
• Use virtual sensors to apply different policies for IPS inspection
• Describe the options for sensor interface modes
• Maintain an IPS sensor
• Monitor threats on the IPS sensor

Advanced IPS Configuration

Risk Assessment and how threats are rated on the sensor and the components that make up the risk rating are discussed.  In addition, signature tuning is discussed which covers both modifying the signatures directly and the Event Action Overrides are also covered.

• Describe the components that make up a signature definition
• Explain how the IPS determines how severe a detected threat is
• Clone and modify signatures
• Tune signatures to reduce false positives
• Use Anomaly Detection to detect worm infected hosts
• Describe the signature engines available on the IPS sensor and how they work
• Create new signatures using the signature wizard
• Upgrade the sensor to take advantage of the latest signatures

MARS and CSM

The Monitoring, Analysis and Response System (MARS) is the logging and analysis portion of the Cisco Secure portfolio and provides correlation based on events received from multiple devices across the network reducing the number of event the security analyst needs to review.  The Cisco Security Manager (CSM) is a centralized configuration element that is a single point to manage Cisco security hardware in the network.  The MARS can be used to collect events from the IPS sensor and the CSM can configure multiple sensors on the network.

After viewing this module you will be able to:

Explain how a Security Information and Event Management (SIEM) correlates events

• Describe how the MARS uses rules to correlate events
• Connect to the MARS appliance and navigate the GUI
• View and respond to events on the MARS
• Query events on the MARS for historical analysis
• Determine if a CSM is required based on HLD requirements
• Add managed devices to the CSM
• Configure integration between the CSM and the MARS