3.2.11 Lab - Exploring Processes, Threads, Handles, and Windows Registry (CISCO CyberOps Associate)
Introduction
Today's organizations are challenged with rapidly detecting cybersecurity breaches and effectively responding to security incidents. Teams of people in Security Operations Centers (SOCs) keep a vigilant eye on security systems, protecting their organizations by detecting and responding to cybersecurity exploits and threats. CyberOps Associate prepares candidates to begin a career working as associate-level cybersecurity analysts within security operations centers.
Target Audience
The CyberOps Associate course is designed for students who are seeking careeroriented, entry-level security analyst skills. Target students include individuals enrolled in technology degree programs at institutions of higher education and IT professionals who want to pursue a career in the Security Operation Center (SOC). Learners in this course are exposed to all of the foundational knowledge required to detect, analyze, and escalate basic cybersecurity threats using common open-source tools.
Prerequisites
CyberOps Associate students should have the following skills and knowledge:
• PC and internet navigation skills
• Basic Windows and Linux system concepts
• Basic understanding of computer networks
• Binary and Hexadecimal understanding
• Familiarity with Cisco Packet Tracer
Target Certification
This course aligns with the Cisco Certified CyberOps Associate (CBROPS) certification. Candidates need to pass the 200-201 CBROPS exam to achieve the Cisco Certified CyberOps Associate certification.
The CBROPS exam tests a candidate’s knowledge and skills related to:
• security concepts
• security monitoring
• host-based analysis
• network intrusion analysis
• security policies and procedures
Course Objectives
CyberOps Associate covers knowledge and skills needed to successfully handle the tasks, duties, and responsibilities of an associate-level Cybersecurity Analyst working in a Security Operations Center (SOC).
Upon completion of the CyberOps Associate v1.0 course, students will be able to perform the following tasks:
• Install virtual machines to create a safe environment for implementing and analyzing cybersecurity threat events.
• Explain the role of the Cybersecurity Operations Analyst in the enterprise.
• Explain the Windows Operating System features and characteristics needed to support cybersecurity analyses.
• Explain the features and characteristics of the Linux Operating System.
• Analyze the operation of network protocols and services.
• Explain the operation of the network infrastructure.
• Classify the various types of network attacks.
• Use network monitoring tools to identify attacks against network protocols and services.
• Explain how to prevent malicious access to computer networks, hosts, and data.
• Explain the impacts of cryptography on network security monitoring.
• Explain how to investigate endpoint vulnerabilities and attacks.
• Evaluate network security alerts.
• Analyze network intrusion data to identify compromised hosts.
• Apply incident response models to manage network security incidents.
3.2.11 Lab - Exploring Processes, Threads, Handles, and Windows Registry (CISCO CyberOps Associate)
Part 1: Exploring Processes
In this part, you will explore processes. Processes are programs or applications in execution. You will explore
the processes using Process Explorer in the Windows SysInternals Suite. You will also start and observe a
new process.
Part 2: Exploring Threads and Handles
In this part, you will explore threads and handles. Processes have one or more threads. A thread is a unit of execution in a process. A handle is an abstract reference to memory blocks or objects managed by an
operating system. You will use Process Explorer (procexp.exe) in Windows SysInternals Suite to explore the threads and handles.
Part 3: Exploring Windows Registry
The Windows Registry is a hierarchical database that stores most of the operating systems and desktop
environment configuration settings.
EMAIL:
[email protected]