Cisco 200-201 CCNACBR v1.2 Roadmap

Week 1: build precise terms so triage does not confuse a vulnerability, indicator, alert and incident.

• Apply confidentiality, integrity and availability to realistic service outcomes.
• Distinguish threat, vulnerability, exposure, likelihood, impact and risk.
• Use least privilege, separation of duties, defense in depth and segmentation.
• Understand authentication, authorization and accounting.
• Differentiate hashing, encryption, digital signatures and PKI trust.
• Recognize phishing, social engineering, malware and ransomware behavior.
• Explain zero trust as explicit verification and continuous least privilege, not a product.
• Complete all ten Security Concepts questions and related cards.

Weeks 2–3: create an evidence pipeline that can state what it sees and when it is blind.

• Map firewall, DNS, proxy, flow, identity, endpoint, application and email sources.
• Normalize fields and time while retaining source IDs and raw references.
• Understand SIEM collection, correlation, prioritization, investigation and reporting.
• Use NTA for north-south and east-west behavior and flow-level baselines.
• Apply threat intelligence with source, confidence, age and local context.
• Track collection, parsing, queue, delivery, detector and synthetic-test health.
• Separate false positives from false negatives and tune with regression tests.
• Validate source health before deciding an alert disposition.

Weeks 4–5: reconstruct execution and persistence while preserving volatile state.

• Read process ancestry, command lines, users, privileges and execution time.
• Use file hashes for identity without treating them as proof of maliciousness.
• Inspect services, scheduled tasks, startup entries and login persistence.
• Correlate authentication, account changes and service-account purpose.
• Distinguish volatile memory, processes and sockets from stored evidence.
• Recognize legitimate-tool abuse through behavior rather than filename alone.
• Isolate endpoints while preserving approved management and forensic paths.
• Search peer hosts for both exact indicators and equivalent behavior.

Weeks 6–7: interpret protocols and correlate packet, flow, DNS and endpoint outcomes.

• Reconstruct TCP handshake, resets, retransmissions and session outcomes.
• Distinguish scanning from authorized discovery through context and rate.
• Investigate high-entropy DNS, unusual query volume and resolver behavior.
• Analyze HTTP request and response evidence without equating attempts with exploitation.
• Use TLS handshake, certificate, endpoint, timing and volume metadata honestly.
• Differentiate passive IDS visibility from inline IPS prevention and availability risk.
• Investigate ARP changes with gateway ownership, CAM and port evidence.
• Correlate lateral movement with identity, process, protocol, targets and successful outcomes.

Week 8+: turn evidence into authorized decisions, trusted recovery and tested improvement.

• Define roles, severity, declaration, communication, legal/privacy and technical authority.
• Preserve hashes, custody, access and retention for evidence.
• Record observations, hypotheses, confidence, unknowns and decision thresholds.
• Contain the least capability needed, validate target identity and retain rollback.
• Recover from trusted state, rotate exposed authority and validate monitoring.
• Complete all three projects, including loss, wrong-target and recurrence injects.
• Answer all 50 questions and review all 40 nonduplicate flashcards.
• Recheck Cisco's active v1.2 topics and current testing policies before scheduling.