Wednesday 25 May 2016

Exam 70-466 Implementing Data Models and Reports with Microsoft SQL Server

Published: June 11, 2012
Languages: English, Chinese (Simplified), French, German, Japanese, Portuguese (Brazil)
Audiences: IT professionals
Technology: Microsoft SQL Server
Credit toward certification: MCP, MCSE

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.

Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.

If you have other questions or feedback about Microsoft Certification exams or about the certification program, registration, or promotions, please contact your Regional Service Center.

As of February 18, 2016, this exam includes content covering both SQL Server 2012 and 2014. Please note that this exam does not include questions on features or capabilities that are present only in the SQL Server 2012 product. For more information, please download and review this document.

Build an analysis services multidimensional database (35-40%)
Design dimensions and measures
Given a requirement, identify the dimension/measure group relationship that should be selected; design patterns for representing business facts and dimensions (many-to-many relationships); design dimensions to support multiple related measure groups (many related fact tables); handle degenerate dimensions in a cube; identify the attributes for dimensions; identify the measures; aggregation behavior for the measures; build hierarchies; define granularity of dimension relationships
Implement and configure dimensions in a cube
Translations, define attribute relationships, implement hierarchies, implement SQL Server Analysis Services (SSAS) dimensions and cubes, create the Attribute Relationships that should be made for a given set of attributes in a dimension, develop new custom attributes on dimensions, detect possible design flaws in attribute relationships, implement time dimensions in cubes, manage SSAS parent-child dimensions, dimension type
Design a schema to support cube architecture
Multidimensional modeling starting from a star schema, relational modeling for a data source view, choose or create a topology, identify the appropriate data types with correct precision and size
Create and configure measures
Logically group measures and configure Measure Group Properties, select appropriate aggregation functions, format measures, design the measure group for the correct granularity
Implement a cube
Use SQL Server Data Tools - Business Intelligence (SSDT-BI) to build the cube; use SSDT-BI to do non-additive or semi-additive measures in a cube, define measures, specify perspectives, define translations, define dimension usage, define cube-specific dimension properties, define measure groups, implement reference dimensions, implement many-to-many relationships, implement fact relationships, implement role-playing relationships, create and manage linked measure groups and linked dimensions, create actions
Create Multidimensional Expressions (MDX) and Data Analysis Expressions (DAX) queries
Identify the structures of MDX and the common functions (tuples, sets, TopCount, SCOPE, and more); identify which MDX statement would return the required result; implement a custom MDX or logical solution for a pre-prepared case task; identify the structure of DAX and common functions, including CALCULATE, EVALUATE, and FILTER; identify which DAX query would return the required result
Implement custom logic in a data model
Define key performance indicators (KPIs); define calculated members; create relative measures (growth, YoY, same period last year), percentage of total using MDX; named sets; add Time Intelligence; implement ranking and percentile; define MDX script to import partial PowerPivot model
Implement storage design in a multidimensional model
Create aggregations, create partitions, storage modes, define proactive caching, manage write-back partitions, implement linked cubes, implement distributed cubes
Select an appropriate model for data analysis
Select Tabular versus Multidimensional based on scalability needs, traditional hierarchical, data volume; select appropriate organizational BI, such as corporate BI, and team and personal BI needs and data status

Preparation resources
Dimension relationships
Defining dimension granularity within a measure group
Linked measure groups

Manage, maintain, and troubleshoot a SQL Server Analysis Services (SSAS) database (15-20%)
Analyze data model performance
Identify performance consequences of data source view design, optimize performance by changing the design of the cube or dimension, analyze and optimize performances of an MDX/DAX query, optimize queries for huge data sets, optimize MDX in the calculations, performance monitor counters, select appropriate Dynamic Management Views for Analysis Services, analyze and define performance counters, monitor growth of the cache, define and view logging options
Process data models
Define processing of tables or partitions for tabular and multidimensional models; define processing of databases, cubes, and dimensions for multidimensional models; select full processing versus incremental processing; define remote processing; define lazy aggregations; automate with Analysis Management Objects (AMO) or XML for Analysis (XMLA); process and manage partitions by using PowerShell
Troubleshoot data analysis issues
Use SQL Profiler; troubleshoot duplicate key dimension processing errors; error logs and event viewer logs of SSAS, mismatch of data: incorrect relationships or aggregations; dynamic security issues; validate logic and calculations
Deploy SSAS databases
Deployment Wizard, implement SSDT-BI, deploy SSMS; test solution post deployment, decide whether or not to process, test different roles
Install and maintain an SSAS instance
Install SSAS; install development tools; identify development and production installation considerations; upgrade SSAS instance; define data file and program file location; plan for Administrator accounts; define server and database level security; support scale-out read-only; update SSAS (service packs); install and maintain each instance type of Analysis Services, including PowerPivot; restore and import PowerPivot; back up and restore by using PowerShell

Preparation resources
Multidimensional model object processing
Performance counters (SSAS)

Build a tabular data model (15-20%)
Configure permissions and roles in a tabular model
Configure server roles, configure SSAS database roles, implement dynamic security (custom security approaches), role-based access, test security permissions, implement cell-level permissions
Implement a tabular data model
Define tables, import data, define calculated columns, define relationships, define hierarchies and perspectives, manage visibility of columns and tables, embed links, optimize BISM for Power View, mark a date table, sort a column by another column
Implement business logic in a tabular data model
Implement measures and KPIs, implement Data Analysis Expressions (DAX), define relationship navigation, implement time intelligence, implement context modification
Implement data access for a tabular data model
Manage partitions, processing, select xVelocity versus DirectQuery for data access

Preparation resources
Using DirectQuery in the tabular BI Semantic Model
Roles (SSAS tabular)
Hierarchies (SSAS tabular)

Build a report with SQL Server Reporting Services (SSRS) (25-30%)
Design a report
Select report components (crosstab report, Tablix, design chart, data visualization components), design report templates (Report Definition Language), identify the data source and parameters; design a grouping structure; drill-down reports, drill-through reports; determine if any expressions are required to display data that is not coming directly from the data source
Implement a report layout
Formatting; apply conditional formatting; page configuration; implement headers and footers; implement matrixes, table, chart, images, list, indicators, maps, and groupings in reports; use Report Builder to implement a report layout; create a range of reports using different data regions; define custom fields (implementing different parts of the report); implement collections (global collections); define expressions; implement data visualization components; identify report parts; implement group variables and report variables; design for multiple delivery extension formats
Configure authentication and authorization for a reporting solution
Configure server-level and item-level role-based security, configure reporting service security (setup or addition of role), authenticate against data source, store credential information, describe Report Server security architecture and site level security, create system level roles, item level security, create a new role assignment, assign Windows users to roles, secure reports using roles, configure SharePoint groups and permissions, define varying content for different role memberships
Implement interactivity in a report
Drilldown; drillthrough; interactive sorting; parameters: (databound parameters, multi-value parameters); create dynamic reports in SSRS using parameters; implement show/hide property; actions (jump to report); filters; parameter list; fixed headers; document map, embedded HTML
Troubleshoot reporting services issues
Query the ReportServer database; view Reporting Services log files; use Windows Reliability and Performance monitor data for troubleshooting; use the ReportServer: define service and web service objects; monitor for long-running reports, rendering, and connectivity issues; use SQL Profiler; perform data reconciliation for incorrect relationships or aggregations; detect dynamic security issues; validate logic and calculations
Manage a report environment
Manage subscriptions and subscription settings; define data-driven subscriptions; manage data sources; integrate SharePoint Server; define email delivery settings; manage the number of snapshots; manage schedules, running jobs, and report server logs; manage report server databases; manage the encryption keys; set up the execution log reporting; review the reports; configure site-level settings; design report lifecycle; automate management of reporting services; create a report organization structure; install and configure reporting services; deploy custom assemblies
Configure report data sources and datasets
Select appropriate query types (stored procedure versus table versus text only); configure parameterized connection strings (dynamic connection strings); define filter location (dataset versus query); configure data source options, for example, extract and connect to multiple data sources; shared and embedded data sources and datasets; use custom expressions in data sources; connect to Microsoft Azure SQL database; implement DAX and MDX queries to retrieve appropriate data sets; work with non-relational data sources, such as XML or SharePoint lists

Preparation resources
Tablix data region (Report Builder and SSRS)
Built-in Globals and Users references (Report Builder and SSRS)
Create data-driven subscription page (Report Manager)
QUESTION 1
You need to recommend a solution for the sales department that meets the security requirements.
What should you recommend?

A. Create one role for all of the sales department users. Add a DAX filter that reads the current user name and retrieves the user's region.
B. Create one role for each region. Configure each role to have read access to a specific region. Add the sales department users to their corresponding role.
C. Create a table for each region. Create a role for each region. Grant each role read access to its corresponding table.
D. Create one role for all of the sales department users. Configure the role to have read access to the sales transactions. Ensure that all of the reports that access the sales transaction data restrict read access to the data from the corresponding sales department region only.

Answer: C

Explanation: Scenario: Tailspin Toys identifies the following security requirement:
•Sales department users must be allowed to view the sales transactions from their region only.
•Sales department users must be able to view the contents of the manufacturing reports. •Sales department users must NOT be able to create new manufacturing reports.


QUESTION 2
You need to configure the dataset for the ManufacturingIssues report. The solution must meet the technical requirements and the reporting requirements.
What should you do?

A. Configure the dataset to use a stored procedure. Add the necessary parameters to the stored procedure.
B. Add a query to retrieve the necessary data from the database. Configure the dataset to use query parameters.
C. Add a query to retrieve the necessary data from the database. Configure the dataset to use filter parameters.
D. Configure the dataset to use a table. Ensure that the database has a table that contains the necessary information.

Answer: B


QUESTION 3
You need to ensure that all reports meet the reporting requirements.
What is the best way to achieve the goal? More than one answer choice may achieve the goal. Select the BEST answer.

A. Create a report part. Publish the report part to a server that has SSRS installed. Add the report part to each new report that is created.
B. Create a report part. Publish the report part to a SharePoint site. Add the report part to each new report that is created.
C. Create a report. Copy the report to source code control. Create each new report by using the report template in source code control.
D. Create a report. Copy the report to the PrivateAssemblies\ProjectItems\ReportProject folder in the Visual Studio directory. Create each new report by using the locally stored report

Answer: D


QUESTION 4
You need to configure a hierarchy for DimProduct that meets the technical requirements.
What should you do?

A. Set ProductName as the parent of ProductSubCategory and set ProductSubcategory as the parent of ProductCategory. For ProductSubcategory, click Hide if Name Equals Parent.
B. Set ProductCategory as the parent of ProductSubCategory and set ProductSubcategory as the parent of ProductName. For ProductSubcategory, click Hide if Name Equals Parent.
C. Set ProductName as the parent of ProductSubcategory and set ProductSubCategory as the parent of ProductCategory. For ProductCategory, click Hide if Name Equals Parent.
D. Set ProductCategory as the parent of ProductSubcategory and set ProductSubCategory as the parent of ProductName. For ProductCategory, click Hide if Name Equals Parent.

Answer: B


QUESTION 5
You need to recommend a solution to meet the requirements for the
ManufacturingIssues.rdl report.
What is the best solution that you should include in the recommendation? More than one answer choice may achieve the goal. Choose the BEST answer.

A. Add a dataset to the report that uses an ad hoc SQL statement. Configure the dataset to include the parameters required for the different views. Add a dataset for each parameter created. Configure each parameter to use the values in the dataset.
B. Add a dataset to the report that uses an ad hoc SQL statement. Configure the dataset to include the parameters required for the different views. Update each parameter to use a set of values from Report Designer.
C. Add a dataset to the report that uses an ad hoc SQL statement. Configure the dataset to include the parameters required for the different views. Use the default display for the parameters.
D. Add a dataset to the report that uses a stored procedure. Configure the dataset to include the parameters required for the different views. Update each parameter to use a set of values from Report Designer.

Answer: C

Sunday 15 May 2016

Exam 70-462 Administering Microsoft SQL Server 2012/2014 Databases

Published: June 11, 2012
Languages: English, Chinese (Simplified), French, German, Japanese, Portuguese (Brazil)
Audiences: IT professionals
Technology: Microsoft SQL Server 2012/2014
Credit toward certification: MCP, MCSA, MCSE

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.

Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.

If you have other questions or feedback about Microsoft Certification exams or about the certification program, registration, or promotions, please contact your Regional Service Center.

As of February 18, 2016, this exam includes content covering both SQL Server 2012 and 2014. Please note that this exam does not include questions on features or capabilities that are present only in the SQL Server 2012 product. For more information, please download and review this document.

Install and configure (20–25%)
Plan installation
Evaluate installation requirements; design the installation of SQL Server and its components (drives, service accounts, etc.); plan scale-up vs. scale-out basics; plan for capacity, including if/when to shrink, grow, autogrow, and monitor growth; manage the technologies that influence SQL architecture (for example, service broker, full text, scale out, etc.); design the storage for new databases (drives, filegroups, partitioning); design database infrastructure; configure a SQL Server standby database for reporting purposes; Windows-level security and service level security; Core mode installation; benchmark a server before using it in a production environment (SQLIO, Tests on SQL Instance); choose the right hardware
Install SQL Server and related services
Test connectivity; enable and disable features; install SQL Server database engine and SSIS (not SSRS and SSAS); configure an OS disk
Implement a migration strategy
Restore vs detach/attach; migrate security; migrate from a previous version; migrate to new hardware; migrate systems and data from other sources
Configure additional SQL Server components
Set up and configure all SQL Server components (Engine, AS, RS and SharePoint integration) in a complex and highly secure environment; configure full-text indexing; SSIS security; filestream; filetable
Manage SQL Server Agent
Create, maintain, and monitor jobs; administer jobs and alerts; automate (setup, maintenance, monitoring) across multiple databases and multiple instances; send to "Manage SQL Server Agent jobs"

Preparation resources
Understanding surface area configuration
Hardware and software requirements for installing SQL Server 2012
Quick-start installation of SQL Server 2012

Maintain instances and databases (15–20%)
Manage and configure databases
Design multiple file groups; database configuration and standardization: autoclose, autoshrink, recovery models; manage file space, including adding new filegroups and moving objects from one filegroup to another; implement and configure contained databases; data compression; configure TDE; partitioning; manage log file growth; DBCC
Configure SQL Server instances
Configure and standardize a database: autoclose, autoshrink, recovery models; install default and named instances; configure SQL to use only certain CPUs (affinity masks, etc.); configure server level settings; configure many databases/instance, many instances/server, virtualization; configure clustered instances including MSDTC; memory allocation; database mail; configure SQL Server engine: memory, filffactor, sp_configure, default options
Implement a SQL Server clustered instance
Install a cluster; manage multiple instances on a cluster; set up subnet clustering; recover from a failed cluster node
Manage SQL Server instances
Install an instance; manage interaction of instances; SQL patch management; install additional instances; manage resource utilization by using Resource Governor; cycle error logs

Preparation resources
ALTER DATABASE file and filegroup options (Transact-SQL)
Contained databases
Data compression

Optimize and troubleshoot (15–20%)
Identify and resolve concurrency problems
Examine deadlocking issues using the SQL server logs using trace flags; design reporting database infrastructure (replicated databases); monitor via DMV or other MS product; diagnose blocking, live locking and deadlocking; diagnose waits; performance detection with built in DMVs; know what affects performance; locate and if necessary kill processes that are blocking or claiming all resources
Collect and analyze troubleshooting data
Monitor using Profiler; collect performance data by using System Monitor; collect trace data by using SQL Server Profiler; identify transactional replication problems; identify and troubleshoot data access problems; gather performance metrics; identify potential problems before they cause service interruptions; identify performance problems;, use XEvents and DMVs; create alerts on critical server condition; monitor data and server access by creating audit and other controls; identify IO vs. memory vs. CPU bottlenecks; use the Data Collector tool
Audit SQL Server instances
Implement a security strategy for auditing and controlling the instance; configure an audit; configure server audits; track who modified an object; monitor elevated privileges as well as unsolicited attempts to connect; policy-based management

Preparation resources
blocked process threshold server configuration option
Configure login auditing (SQL Server Management Studio)
Data collection

Manage data (20–25%)
Configure and maintain a back-up strategy
Manage different backup models, including point-in-time recovery; protect customer data even if backup media is lost; perform backup/restore based on proper strategies including backup redundancy; recover from a corrupted drive; manage a multi-TB database; implement and test a database implementation and a backup strategy (multiple files for user database and tempdb, spreading database files, backup/restore); back up a SQL Server environment; back up system databases
Restore databases
Restore a database secured with TDE; recover data from a damaged DB (several errors in DBCC checkdb); restore to a point in time; file group restore; page level restore
Implement and maintain indexes
Inspect physical characteristics of indexes and perform index maintenance; identify fragmented indexes; identify unused indexes; implement indexes; defrag/rebuild indexes; set up a maintenance strategy for indexes and statistics; optimize indexes (full, filter index); statistics (full, filter) force or fix queue; when to rebuild vs. reorg and index; full text indexes; column store indexes
Import and export data
Transfer data; bulk copy; bulk insert

Preparation resources
Backup and restore of SQL Server databases
File restores (full recovery mode)
DBCC INDEXDEFRAG (Transact-SQL)

Implement security (15–20%)
Manage logins and server roles
Configure server security; secure the SQL Server using Windows Account / SQL Server accounts, server roles; create log in accounts; manage access to the server, SQL Server instance, and databases; create and maintain user-defined server roles; manage certificate logins
Manage database security
Configure database security; database level, permissions; protect objects from being modified; auditing; encryption
Manage users and database roles
Create access to server / database with least privilege; manage security roles for users and administrators; create database user accounts; contained login
Troubleshoot security
Manage certificates and keys; endpoints

Preparation resources
Server-level roles
Permissions (database engine)
Database-level roles

Implement high availability (5–10%)
Implement AlwaysOn
Implement AlwaysOn availability groups; implement AlwaysOn failover clustering
Implement replication
Troubleshoot replication problems; identify appropriate replication strategy

Preparation resources
AlwaysOn Availability Groups (SQL Server)
Microsoft SQL Server AlwaysOn solutions guide for high availability and disaster recovery
AlwaysOn architecture guide: Building a high availability and disaster recovery solution by using AlwaysOn Availability Groups

QUESTION 1
You administer a Microsoft SQL Server 2012 database that has multiple tables in the Sales schema.
Some users must be prevented from deleting records in any of the tables in the Sales schema.
You need to manage users who are prevented from deleting records in the Sales schema. You need to achieve this goal by using the minimum amount of administrative effort.
What should you do?

A. Create a custom database role that includes the users. Deny Delete permissions on the Sales schema for the custom database role.
B. Include the Sales schema as an owned schema for the db_denydatawriter role. Add the users to the db_denydatawriter role.
C. Deny Delete permissions on each table in the Sales schema for each user.
D. Create a custom database role that includes the users. Deny Delete permissions on each table in the Sales schema for the custom database role.

Answer: A


QUESTION 2
You administer a Microsoft SQL Server 2012 failover cluster that contains two nodes named Node A and Node B. A single instance of SQL Server is installed on the cluster.
An additional node named Node C has been added to the existing cluster.
You need to ensure that the SQL Server instance can use all nodes of the cluster.
What should you do?

A. Run the New SQL Server stand-alone installation Wizard on Node C.
B. Run the Add Node to SQL Server Failover Cluster Wizard on Node C.
C. Use Node B to install SQL Server on Node C.
D. Use Node A to install SQL Server on Node C.

Answer: B

Explanation:
http://technet.microsoft.com/en-us/library/ms191545.aspx
To add a node to an existing SQL Server failover cluster, you must run SQL Server Setup on the node that is to be added to the SQL Server failover cluster instance. Do not run Setup on the active node.
The Installation Wizard will launch the SQL Server Installation Center. To add a node to an existing failover cluster instance, click Installation in the left-hand pane. Then, select Add node to a SQL Server failover cluster.


QUESTION 3
You administer a Microsoft SQL Server 2012 database named ContosoDB. The database contains a table named Suppliers and a column named IsActive in the Purchases schemA.
You create a new user named ContosoUser in ContosoDB. ContosoUser has no permissions to the Suppliers table.
You need to ensure that ContosoUser can delete rows that are not active from Suppliers. You also need to grant ContosoUser only the minimum required permissions.
Which Transact-SQL statement should you use?

A. GRANT DELETE ON Purchases. Suppliers TC ContosoUser

B. CREATE PROCEDURE Purchases.PurgelnactiveSuppliers WITH EXECUTE AS USER = 'dbo'
AS
DELETE FROM Purchases.Suppliers WHERE IsActive = 0
GO
GRANT EXECUTE ON Purchases.PurgelnactiveSuppliers TO ContosoUser

C. GRANT SELECT ON Purchases.Suppliers TO ContosoUser

D. CREATE PROCEDURE Purchases. PurgeInactiveSuppliers AS
DELETE FROM Purchases.Suppliers WHERE IsActive = 0
GO
GRANT EXECUTE ON Purchases. PurgeInactiveSuppliers TO ContosoUser

Answer: B

Explanation: Explanation/Reference:
http://msdn.microsoft.com/en-us/library/ms188354.aspx
http://msdn.microsoft.com/en-us/library/ms187926.aspx

QUESTION 4
You administer a Microsoft SQL Server 2012 instance. After a routine shutdown, the drive that contains tempdb fails.
You need to be able to start the SQL Server.
What should you do?

A. Modify tempdb location in startup parameters.
B. Start SQL Server in minimal configuration mode.
C. Start SQL Server in single-user mode.
D. Configure SQL Server to bypass Windows application logging.

Answer: B

Explanation: Explanation/Reference:
http://msdn.microsoft.com/en-us/library/ms186400.aspx
http://msdn.microsoft.com/en-us/library/ms345408.aspx


QUESTION 5
You use a contained database named ContosoDb within a domain.
You need to create a user who can log on to the ContosoDb database. You also need to ensure that you can port the database to different database servers within the domain without additional user account configurations.
Which type of user should you create?

A. User mapped to a certificate
B. SQL user without login
C. Domain user
D. SQL user with login

Answer: C

Saturday 7 May 2016

350-018 CCIE Security version 4.0 and version 4.1

CCIE Security
Exam Number 350-018 CCIE Security
Associated Certifications CCIE Security
Duration 120 minutes (90 - 110 questions)
Available Languages English
Register Pearson VUE
Exam Policies Read current policies and requirements
Exam Tutorial Review type of exam questions

This exam tests the skills and competencies of security professionals in terms of describing, implementing, deploying, configuring, maintaining, and troubleshooting Cisco network security solutions and products, as well as current industry best practices and internetworking fundamentals.

Topics include networking fundamentals and security-related concepts and best practices, as well as Cisco network security products and solutions in areas such as VPNs, intrusion prevention, firewalls, identity services, policy management, and device hardening. Content includes both IPv4 and IPv6 concepts and solutions.

CCIE Security Written Exam (350-018) version 4.0

Exam Description
The Cisco CCIE® Security Written Exam (350-018) version 4.0 is a 2-hour test with 90–110 questions. This exam tests the skills and competencies of security professionals in terms of describing, implementing, deploying, configuring, maintaining, and troubleshooting Cisco network security solutions and products, as well as current industry best practices and internetworking fundamentals.

Topics include networking fundamentals and security-related concepts and best practices, as well as Cisco network security products and solutions in areas such as VPNs, intrusion prevention, firewalls, identity services, policy management, and device hardening. Content includes both IPv4 and IPv6 concepts and solutions.

The exam is closed book, and no outside reference materials are allowed.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

CCIE Security Written Exam Topics v4.0 (Recommended for candidates who are scheduled to take the exam BEFORE July 25, 2016)


1.0 Infrastructure, Connectivity, Communications, and Network Security 20%

1.1 Network addressing basics

1.2 OSI layers

1.3 TCP/UDP/IP protocols

1.4 LAN switching (for example, VTP, VLANs, spanning tree, and trunking)

1.5 Routing protocols (for example, RIP, EIGRP, OSPF, and BGP)

1.5.a Basic functions and characteristics
1.5.b Security features

1.6 Tunneling protocols

1.6.a GRE
1.6.b NHRP
1.6.c IPv6 tunnel types

1.7 IP multicast

1.7.a PIM
1.7.b MSDP
1.7.c IGMP and CGMP
1.7.d Multicast Listener Discovery

1.8 Wireless

1.8.a SSID
1.8.b Authentication and authorization
1.8.c Rogue APs
1.8.d Session establishment

1.9 Authentication and authorization technologies

1.9.a Single sign-on
1.9.b OTPs
1.9.c LDAP and AD
1.9.d RBAC

1.10 VPNs

1.10.a L2 vs L3
1.10.b MPLS, VRFs, and tag switching

1.11 Mobile IP networks

2.0 Security Protocols 15%

2.1 RSA

2.2 RC4

2.3 MD5

2.4 SHA

2.5 DES

2.6 3DES

2.7 AES

2.8 IPsec

2.9 ISAKMP

2.10 IKE and IKEv2

2.11 GDOI

2.12 AH

2.13 ESP

2.14 CEP

2.15 TLS and DTLS

2.16 SSL

2.17 SSH

2.18 RADIUS

2.19 TACACS+

2.20 LDAP

2.21 EAP methods (for example, EAP-MD5, EAP-TLS, EAP-TTLS, EAP-FAST, PEAP, and LEAP)

2.22 PKI, PKIX, and PKCS

2.23 IEEE 802.1X

2.24 WEP, WPA, and WPA2

2.25 WCCP

2.26 SXP

2.27 MACsec

2.28 DNSSEC
3.0 Application and Infrastructure Security 10%

3.1 HTTP

3.2 HTTPS

3.3 SMTP

3.4 DHCP

3.5 DNS

3.6 FTP and SFTP

3.7 TFTP

3.8 NTP

3.9 SNMP

3.10 syslog

3.11 Netlogon, NetBIOS, and SMB

3.12 RPCs

3.13 RDP and VNC

3.14 PCoIP

3.15 OWASP

3.16 Manage unnecessary services

4.0 Threats, Vulnerability Analysis, and Mitigation 10%

4.1 Recognize and mitigate common attacks

4.1.a ICMP attacks and PING floods
4.1.b MITM
4.1.c Replay
4.1.d Spoofing
4.1.e Backdoor
4.1.f Botnets
4.1.g Wireless attacks
4.1.h DoS and DDoS attacks
4.1.i Virus and worm outbreaks
4.1.j Header attacks
4.1.k Tunneling attacks

4.2 Software and OS exploits

4.3 Security and attack tools

4.4 Generic network intrusion prevention concepts

4.5 Packet filtering

4.6 Content filtering and packet inspection

4.7 Endpoint and posture assessment

4.8 QoS marking attacks

5.0 Cisco Security Products, Features, and Management 20%

5.1 Cisco Adaptive Security Appliance (ASA)

5.1.a Firewall functionality
5.1.b Routing and multicast capabilities
5.1.c Firewall modes
5.1.d NAT (before and after version 8.4)
5.1.e Object definition and ACLs
5.1.f MPF functionality (IPS, QoS, and application awareness)
5.1.g Context-aware firewall
5.1.h Identity-based services
5.1.i Failover options

5.2 Cisco IOS firewalls and NAT

5.2.a CBAC
5.2.b Zone-based firewall
5.2.c Port-to-application mapping
5.2.d Identity-based firewalling

5.3 Cisco Intrusion Prevention Systems (IPS)

5.4 Cisco IOS IPS

5.5 Cisco AAA protocols and application

5.5.a RADIUS
5.5.b TACACS+
5.5.c Device administration
5.5.d Network access
5.5.e IEEE 802.1X
5.5.f VSAs

5.6 Cisco Identity Services Engine (ISE)

5.7 Cisco Secure ACS Solution Engine

5.8 Cisco Network Admission Control (NAC) Appliance Server

5.9 Endpoint and client

5.9.a Cisco AnyConnect VPN Client
5.9.b Cisco VPN Client
5.9.c Cisco Secure Desktop
5.9.d Cisco NAC Agent

5.10 Secure access gateways (Cisco IOS router or ASA)

5.10.a IPsec
5.10.b SSL VPN
5.10.c PKI

5.11 Virtual security gateway

5.12 Cisco Catalyst 6500 Series ASA Services Modules

5.13 ScanSafe functionality and components

5.14 Cisco Web Security Appliance and Cisco Email Security Appliance

5.15 Security management

5.15.a Cisco Security Manager
5.15.b Cisco Adaptive Security Device Manager (ASDM)
5.15.c Cisco IPS Device Manager (IDM)
5.15.d Cisco IPS Manager Express (IME)
5.15.e Cisco Configuration Professional
5.15.f Cisco Prime

6.0 Cisco Security Technologies and Solutions 17%

6.1 Router hardening features (for example, CoPP, MPP, uRPF, and PBR)

6.2 Switch security features (for example, anti-spoofing, port, STP, MACSEC, NDAC, and NEAT)

6.3 NetFlow

6.4 Wireless security

6.5 Network segregation

6.5.a VRF-aware technologies
6.5.b VXLAN

6.6 VPN solutions

6.6.a FlexVPN
6.6.b DMVPN
6.6.c GET VPN
6.6.d Cisco EasyVPN

6.7 Content and packet filtering

6.8 QoS application for security

6.9 Load balancing and failover

7.0 Security Policies and Procedures, Best Practices, and Standards 8%

7.1 Security policy elements

7.2 Information security standards (for example, ISO/IEC 27001 and ISO/IEC 27002)

7.3 Standards bodies (for example, ISO, IEC, ITU, ISOC, IETF, IAB, IANA, and ICANN)

7.4 Industry best practices (for example, SOX and PCI DSS)

7.5 Common RFC and BCP (for example, RFC2827/BCP38, RFC3704/BCP84, and RFC5735)

7.6 Security audit and validation

7.7 Risk assessment

7.8 Change management process

7.9 Incident response framework

7.10 Computer security forensics

7.11 Desktop security risk assessment and desktop security risk management

CCIE Security Written Exam (350-018) Version 4.1

Exam Description
The Cisco CCIE® Security Written Exam [350-018] version 4.1 is a 2-hour test with 90–110 questions. This exam tests the skills and competencies of security professionals in terms of describing, implementing, deploying, configuring, maintaining, and troubleshooting Cisco network security solutions and products, as well as current industry best practices and internetworking fundamentals.

Topics include networking fundamentals and security-related concepts and best practices, as well as Cisco network security products and solutions in areas such as VPNs, intrusion prevention, firewalls, identity services, policy management, and device hardening. Content includes both IPv4 and IPv6 concepts and solutions.

The exam is closed book, and no outside reference materials are allowed.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

CCIE Security Written Exam Topics v4.1 (Recommended for candidates who are scheduled to take the exam ON July 25, 2016 and beyond)


1.0 Infrastructure, Connectivity, Communications, and Network Security 14%

1.1 Network addressing basics

1.2 OSI layers

1.3 TCP/UDP/IP protocols

1.4 LAN switching [for example, VTP, VLANs, spanning tree, and trunking]

1.5 Routing protocols [for example, RIP, EIGRP, OSPF, and BGP]

1.5.a Basic functions and characteristics
1.5.b Security features

1.6 Tunneling protocols

1.6.a GRE
1.6.b NHRP
1.6.c IPv6 tunnel types

1.7 IP multicast

1.7.a PIM
1.7.b MSDP
1.7.c IGMP and CGMP
1.7.d Multicast Listener Discovery

1.8 Wireless

1.8.a SSID
1.8.b Authentication and authorization
1.8.c Rogue APs
1.8.d Session establishment

1.9 Authentication and authorization technologies

1.9.a Single sign-on
1.9.b OTPs
1.9.c LDAP and AD
1.9.d RBAC

1.10 VPNs

1.10.a L2 vs L3
1.10.b MPLS, VRFs, and tag switching

1.11 Mobile IP networks

2.0 Security Protocols 14%

2.1 RSA

2.2 RC4

2.3 MD5

2.4 SHA

2.5 DES

2.6 3DES

2.7 AES

2.8 IPsec

2.9 ISAKMP

2.10 IKE and IKEv2

2.11 GDOI

2.12 AH

2.13 ESP

2.14 CEP

2.15 TLS and DTLS

2.16 SSL

2.17 SSH

2.18 RADIUS

2.19 TACACS+

2.20 LDAP

2.21 EAP methods [for example, EAP-MD5, EAP-TLS, EAP-TTLS, EAP-FAST, PEAP, and LEAP]

2.22 PKI, PKIX, and PKCS

2.23 IEEE 802.1X

2.24 WEP, WPA, and WPA2

2.25 WCCP

2.26 SXP

2.27 MACsec

2.28 DNSSEC

3.0 Application and Infrastructure Security 10%

3.1 HTTP

3.2 HTTPS

3.3 SMTP

3.4 DHCP

3.5 DNS

3.6 FTP and SFTP

3.7 TFTP

3.8 NTP

3.9 SNMP

3.10 syslog

3.11 Netlogon, NetBIOS, and SMB

3.12 RPCs

3.13 RDP and VNC

3.14 PCoIP

3.15 OWASP

3.16 Manage unnecessary services

4.0 Threats, Vulnerability Analysis, and Mitigation 10%

4.1 Recognize and mitigate common attacks

4.1.a ICMP attacks and PING floods
4.1.b MITM
4.1.c Replay
4.1.d Spoofing
4.1.e Backdoor
4.1.f Botnets
4.1.g Wireless attacks
4.1.h DoS and DDoS attacks
4.1.i Virus and worm outbreaks
4.1.j Header attacks
4.1.k Tunneling attacks

4.2 Software and OS exploits

4.3 Security and attack tools

4.4 Generic network intrusion prevention concepts

4.5 Packet filtering

4.6 Content filtering and packet inspection

4.7 Endpoint and posture assessment

4.8 QoS marking attacks

5.0 Cisco Security Products, Features, and Management 18%

5.1 Cisco Adaptive Security Appliance [ASA]

5.1.a Firewall functionality
5.1.b Routing and multicast capabilities
5.1.c Firewall modes
5.1.d NAT [before and after version 8.4]
5.1.e Object definition and ACLs
5.1.f MPF functionality [IPS, QoS, and application awareness]
5.1.g Context-aware firewall
5.1.h Identity-based services
5.1.i Failover options

5.2 Cisco IOS firewalls and NAT

5.2.a CBAC
5.2.b Zone-based firewall
5.2.c Port-to-application mapping
5.2.d Identity-based firewalling

5.3 Cisco Intrusion Prevention Systems [IPS]

5.4 Cisco IOS IPS

5.5 Cisco AAA protocols and application

5.5.a RADIUS
5.5.b TACACS+
5.5.c Device administration
5.5.d Network access
5.5.e IEEE 802.1X
5.5.f VSAs

5.6 Cisco Identity Services Engine [ISE]

5.7 Cisco Secure ACS Solution Engine

5.8 Cisco Network Admission Control [NAC] Appliance Server

5.9 Endpoint and client

5.9.a Cisco AnyConnect VPN Client
5.9.b Cisco VPN Client
5.9.c Cisco Secure Desktop
5.9.d Cisco NAC Agent

5.10 Secure access gateways [Cisco IOS router or ASA]

5.10.a IPsec
5.10.b SSL VPN
5.10.c PKI

5.11 Virtual security gateway

5.12 Cisco Catalyst 6500 Series ASA Services Modules

5.13 ScanSafe functionality and components

5.14 Cisco Web Security Appliance and Cisco Email Security Appliance

5.15 Security management

5.15.a Cisco Security Manager
5.15.b Cisco Adaptive Security Device Manager [ASDM]
5.15.c Cisco IPS Device Manager [IDM]
5.15.d Cisco IPS Manager Express [IME]
5.15.e Cisco Configuration Professional
5.15.f Cisco Prime

6.0 Cisco Security Technologies and Solutions 16%

6.1 Router hardening features [for example, CoPP, MPP, uRPF, and PBR]

6.2 Switch security features [for example, anti-spoofing, port, STP, MACSEC, NDAC, and NEAT]

6.3 NetFlow

6.4 Wireless security

6.5 Network segregation

6.5.a VRF-aware technologies
6.5.b VXLAN

6.6 VPN solutions

6.6.a FlexVPN
6.6.b DMVPN
6.6.c GET VPN
6.6.d Cisco EasyVPN

6.7 Content and packet filtering

6.8 QoS application for security

6.9 Load balancing and failover

7.0 Security Policies and Procedures, Best Practices, and Standards 8%

7.1 Security policy elements

7.2 Information security standards [for example, ISO/IEC 27001 and ISO/IEC 27002]

7.3 Standards bodies [for example, ISO, IEC, ITU, ISOC, IETF, IAB, IANA, and ICANN]

7.4 Industry best practices [for example, SOX and PCI DSS]

7.5 Common RFC and BCP [for example, RFC2827/BCP38, RFC3704/BCP84, and RFC5735]

7.6 Security audit and validation

7.7 Risk assessment

7.8 Change management process

7.9 Incident response framework

7.10 Computer security forensics

7.11 Desktop security risk assessment and desktop security risk management

8.0 Evolving Technologies 10%

8.1 Cloud

8.1.a Compare and contrast Cloud deployment models
8.1.a [i] Infrastructure, platform, and software services [XaaS]
8.1.a [ii] Performance and reliability
8.1.a [iii] Security and privacy
8.1.a [iv] Scalability and interoperability
8.1.b Describe Cloud implementations and operations
8.1.b [i] Automation and orchestration
8.1.b [ii] Workload mobility
8.1.b [iii] Troubleshooting and management
8.1.b [iv] OpenStack components

8.2 Network programmability [SDN]

8.2.a Describe functional elements of network programmability [SDN] and how they interact
8.2.a [i] Controllers
8.2.a [ii] APIs
8.2.a [iii] Scripting
8.2.a [iv] Agents
8.2.a [v] Northbound vs. Southbound protocols
8.2.b Describe aspects of virtualization and automation in network environments
8.2.b [i] DevOps methodologies, tools and workflows
8.2.b [ii] Network/application function virtualization [NFV, AFV]
8.2.b [iii] Service function chaining
8.2.b [iv] Performance, availability, and scaling considerations

8.3 Internet of Things

8.3.a Describe architectural framework and deployment considerations for Internet of Things [IoT]
8.3.a [i] Performance, reliability and scalability
8.3.a [ii] Mobility
8.3.a [iii] Security and privacy
8.3.a [iv] Standards and compliance
8.3.a [v] Migration
8.3.a [vi] Environmental impacts on the network


QUESTION 1
An RSA key pair consists of a public key and a private key and is used to set up PKI. Which statement applies to RSA and PKI?

A. The public key must be included in the certificate enrollment request.
B. The RSA key-pair is a symmetric cryptography.
C. It is possible to determine the RSA key-pair private key from its corresponding public key.
D. When a router that does not have an RSA key pair requests a certificate, the certificate request is sent, but a warning is shown to generate the RSA key pair before a CA signed certificate is received.

Answer: A

Explanation:
An RSA key pair consists of a public key and a private key. When setting up your PKI, you must include the public key in the certificate enrollment request. After the certificate has been granted, the public key will be included in the certificate so that peers can use it to encrypt data that is sent to the router. The private key is kept on the router and used both to decrypt the data sent by peers and to digitally sign transactions when negotiating with peers.
Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_pki/configuration/xe-3s/sec-pki-xe-3s-book/sec-pki-overview.html


QUESTION 2
Refer to the exhibit.


Which three descriptions of the configuration are true? (Choose three.)

A. The configuration is on the NHS.
B. The tunnel IP address represents the NBMA address.
C. This tunnel is a point-to-point GRE tunnel.
D. The tunnel is not providing peer authentication.
E. The configuration is on the NHC.
F. The tunnel encapsulates multicast traffic.
G. The tunnel provides data confidentiality.

Answer: A,F,G


QUESTION 3
Which two values you must configure on the Cisco ASA firewall to support FQDN ACL? (Choose two.)

A. a DNS server
B. an FQDN object
C. a policy map
D. a class map
E. a service object
F. a service policy

Answer: A,B
Reference: https://supportforums.cisco.com/document/66011/using-hostnames-dns-
access-lists-configuration-steps-caveats-and-troubleshooting


QUESTION 4
Which set of encryption algorithms is used by WPA and WPA2?

A. Blowfish and AES
B. CAST and RC6
C. TKIP and RC6
D. TKIP and AES

Answer: D


QUESTION 5
What are two enhancements in WCCP V2.0 over WCCP V1.0? (Choose two.)

A. support for HTTP redirection
B. multicast support
C. authentication support
D. IPv6 support
E. encryption support

Answer: B,C

Explanation: WCCP V2.0 supports the following enhancements to the WCCP V1.0
Protocol:
* Multi-Router Support.
WCCP V2.0 allows a farm of web-caches to be attached to more than one router.
* Multicast Support.
WCCP V2.0 supports multicasting of protocol messages between web-caches and routers.
* Improved Security.
WCCP V2.0 provides optional authentication of protocol packets received by web-caches and routers.
* Support for redirection of non-HTTP traffic.
WCCP V2.0 supports the redirection of traffic other than HTTP traffic through the concept of Service Groups.
* Packet return.
WCCP V2.0 allows a web-cache to decline to service a redirected packet and to return it to a router to be forwarded. The method by which packets are returned to a router is negotiable.
Reference: https://tools.ietf.org/id/draft-wilson-wrec-wccp-v2-01.txt