SecurityLessons Reserve founders spot

Lesson-to-lab structure

SCAZT-300-740 Labs

56 planned lessons collapse into 35 planned labs (0 built so far) across 50 scenarios, numbered per module in the order you meet them: each lab follows the last lesson it exercises.

35labs planned
50scenarios
8multi-scenario
27single-scenario

How a lab is put together

Scenario 1 establishes the foundation. Every later scenario depends on Scenario 1 and, wherever possible, on nothing else — hub-and-spoke rather than a chain. A failure in Scenario 3 does not strand Scenario 4, you can start at any scenario from one known state, and each lab needs one start-config rather than one per scenario.

Each module opens with a setup lab that brings its appliances up from the start-config — numbered like every other lab, first in its module. Labs are numbered per module, the way lessons are: M4 · Lab 2 is the second lab of Module 4. Every lab sits right after the last lesson it exercises, so you do a lesson or a few, then the lab.

Labs are grouped by module and exam objective; a grouping is refined lesson by lesson as each lab guide publishes, and the numbering never changes once a lab is live.

  1. M1 · Lab 1 Build the SCAZT Lab - Cloud Accounts, the IdP & the Container Node scazt-zero-trust-foundations Objective setup · Set up
    1. S1 M1 · Lab 1: Build the SCAZT Lab - Cloud Accounts, the IdP & the Container Node lab-setup
  2. M1 · Lab 2 MITRE ATT&CK for the Cloud: Selecting Mitigations for IdP, SaaS & IaaS Techniques scazt-zero-trust-foundations Objective 1.2 · Select
    1. S1 MITRE ATT&CK for the Cloud: Selecting Mitigations for IdP, SaaS & IaaS Techniques concept
  3. M1 · Lab 3 Security Requirements for AWS, Azure & GCP: Identity, Native Controls, Posture & Shared Responsibility scazt-zero-trust-foundations Objective 1.3 · Describe
    1. S1 Security Requirements for AWS, Azure & GCP: Identity, Native Controls, Posture & Shared Responsibility concept
  4. M1 · Lab 4 Operational Requirements for Public Cloud: Visibility, Monitoring, Infrastructure & the Consumption Model scazt-zero-trust-foundations Objective 1.4 · Describe
    1. S1 Operational Requirements for Public Cloud: Visibility, Monitoring, Infrastructure & the Consumption Model concept
  5. M1 · Lab 5 Private Cloud: VMware Hypervisors & Kubernetes Container Orchestration scazt-zero-trust-foundations Objective 1.5 · Describe
    1. S1 Private Cloud: VMware Hypervisors & Kubernetes Container Orchestration concept
  6. M1 · Lab 6 eBPF Runtime Security: Cilium & Tetragon Observability and Enforcement for Containers scazt-zero-trust-foundations Objective 1.6 · Describe
    1. S1 eBPF Runtime Security: Cilium & Tetragon Observability and Enforcement for Containers concept
  7. M2 · Lab 1 Stand Up the Identity Plane - IdP, Duo Tenant & Directory scazt-identity Objective setup · Set up
    1. S1 M2 · Lab 1: Stand Up the Identity Plane - IdP, Duo Tenant & Directory lab-setup
  8. M2 · Lab 2 Identity Signals: Duo SSO, the Authentication Proxy & Identity Intelligence Across Providers scazt-identity Objective 2.1 · Describe
    1. S1 Cisco Duo SSO, the Authentication Proxy & Cisco Identity Intelligence concept
    2. S2 Identity Intelligence Across Identity Providers: Signals, Risk Scoring & Blind Spots concept
  9. M2 · Lab 3 Implement User & Device Authentication with Identity Certificates scazt-identity Objective 2.2 · Implement
    1. S1 Implement User & Device Authentication with Identity Certificates configuration
  10. M2 · Lab 4 Implement Phishing-Resistant Multifactor Authentication with Cisco Duo scazt-identity Objective 2.3 · Implement
    1. S1 Implement Phishing-Resistant Multifactor Authentication with Cisco Duo configuration
  11. M2 · Lab 5 Device Trust with Duo: Endpoint Posture & Trusted Endpoint Policies scazt-identity Objective 2.4 · Implement
    1. S1 Implement Endpoint Posture Policies for User Access to Resources configuration
    2. S2 Implement Trusted Endpoint Policies for Device Access with Cisco Duo configuration
  12. M2 · Lab 6 Configure User & Device Trust with SAML Authentication for Web and Mobile Applications scazt-identity Objective 2.5 · Configure
    1. S1 Configure User & Device Trust with SAML Authentication for Web and Mobile Applications configuration
  13. M2 · Lab 7 Configure SSO & Automated User Provisioning Over an IdP Connection: SAML + SCIM scazt-identity Objective 2.6 · Configure
    1. S1 Configure SSO & Automated User Provisioning Over an IdP Connection: SAML + SCIM configuration
  14. M2 · Lab 8 SAML Assertions & SCIM Provisioning Calls: Packet Walk scazt-identity Objective 2.5 · Configure
    1. S1 SAML Assertions & SCIM Provisioning Calls: Packet Walk protocol
  15. M3 · Lab 1 The Policy Edge - Secure Firewall, the WAF Node & the Secure Access Tenant scazt-policy-edge Objective setup · Set up
    1. S1 M3 · Lab 1: The Policy Edge - Secure Firewall, the WAF Node & the Secure Access Tenant lab-setup
  16. M3 · Lab 2 Encrypting Data In Transit and At Rest in the Cloud: TLS, IPsec & Tunnel Design scazt-policy-edge Objective 3.1 · Describe
    1. S1 Encrypting Data In Transit and At Rest in the Cloud: TLS, IPsec & Tunnel Design concept
  17. M3 · Lab 3 How IPS, DLP & Malware Protection Secure Private Access scazt-policy-edge Objective 3.2 · Describe
    1. S1 How IPS, DLP & Malware Protection Secure Private Access concept
  18. M3 · Lab 4 AI Access & AI Guardrails in Cisco Secure Access scazt-policy-edge Objective 3.4 · Describe
    1. S1 AI Access & AI Guardrails in Cisco Secure Access concept
  19. M3 · Lab 5 Web Application Firewalls & DDoS: What a WAF Actually Absorbs scazt-policy-edge Objective 3.5 · Describe
    1. S1 Web Application Firewalls & DDoS: What a WAF Actually Absorbs concept
  20. M3 · Lab 6 Policy at the Edge: SSE Rule Design & Enforcement on Secure Firewall, Meraki & SD-WAN scazt-policy-edge Objective 3.6 · Determine
    1. S1 Design Security Policy for the Security Service Edge: Rule Model, Order & Identity Conditions design
    2. S2 Enforcing Application Policy on Edge Devices: Cisco Secure Firewall, Meraki & Catalyst SD-WAN design
  21. M4 · Lab 1 The Workload Lab - App Tiers, Enforcement Agents & the Cluster scazt-workload-segmentation Objective setup · Set up
    1. S1 M4 · Lab 1: The Workload Lab - App Tiers, Enforcement Agents & the Cluster lab-setup
  22. M4 · Lab 2 Workload Segmentation with Secure Workload: Discovery, Microsegmentation, Enforcement & Vulnerability Response scazt-workload-segmentation Objective 3.7 · Determine
    1. S1 Cloud Network, Application & Data Security: Multicloud Defense & Secure Workload concept
    2. S2 Application Discovery & Dependency Mapping with Cisco Secure Workload concept
    3. S3 Designing Microsegmentation to Stop Lateral Movement design
    4. S4 Enforce Microsegmentation Hands-On: Host Agents & Kubernetes Network Policy configuration
    5. S5 Policy Creation, Validation & Analysis in Cisco Secure Workload configuration
    6. S6 Vulnerability Assessment & Response for Workloads concept
  23. M5 · Lab 1 Prepare the Secure Access Lab - Tenant, Roaming Client & Branch Egress scazt-secure-internet-access Objective setup · Set up
    1. S1 M5 · Lab 1: Prepare the Secure Access Lab - Tenant, Roaming Client & Branch Egress lab-setup
  24. M5 · Lab 2 Secure Internet Access: DNS Security, Web Policies, Destination Lists & Reporting scazt-secure-internet-access Objective 4.1 · Configure
    1. S1 Configure Secure Internet Access: DNS & Web Policies, Destination Lists & Reporting configuration
    2. S2 Configure DNS Security in Cisco Secure Access configuration
  25. M5 · Lab 3 Configure the Secure Web Gateway: Web Policy, TLS Decryption & Tenant Controls scazt-secure-internet-access Objective 4.2 · Configure
    1. S1 Configure the Secure Web Gateway: Web Policy, TLS Decryption & Tenant Controls configuration
  26. M5 · Lab 4 Configure Data Loss Protection in Cisco Secure Access scazt-secure-internet-access Objective 4.3 · Configure
    1. S1 Configure Data Loss Protection in Cisco Secure Access configuration
  27. M5 · Lab 5 Configure CASB: App Discovery, Risk Scoring & Tenant Restrictions scazt-secure-internet-access Objective 4.4 · Configure
    1. S1 Configure CASB: App Discovery, Risk Scoring & Tenant Restrictions configuration
  28. M5 · Lab 6 Troubleshoot Secure Internet Access: Steering, Certificates, Identity & Bypass scazt-secure-internet-access Objective 4.1 · Configure
    1. S1 Troubleshoot Secure Internet Access: Steering, Certificates, Identity & Bypass troubleshooting
  29. M6 · Lab 1 Tenant, Hosts & Branch Devices for Secure Private Access scazt-secure-private-access Objective setup · Set up
    1. S1 M6 · Lab 1: Tenant, Hosts & Branch Devices for Secure Private Access lab-setup
  30. M6 · Lab 2 Secure Private Access: ZTNA to Internal Apps, Resource Connectors, IPsec Backhaul & Branch Connectivity scazt-secure-private-access Objective 4.5 · Configure
    1. S1 Configure Secure Private Access: ZTNA to Internal Apps configuration
    2. S2 Configure Secure Private Access for Workloads: Resource Connector vs IPsec Backhaul configuration
    3. S3 Configure Branch Connectivity to the Secure Access Edge configuration
  31. M6 · Lab 3 Zero-Trust Tunnels: VPNaaS with ISE, Clientless & Client ZTNA, MASQUE over QUIC & ThousandEyes DEM scazt-secure-private-access Objective 4.6 · Configure
    1. S1 Configure VPN as a Service with ISE as the RADIUS Server configuration
    2. S2 Configure Zero-Trust Access: Clientless and Client-Based with Cisco Secure Client configuration
    3. S3 MASQUE over QUIC: How the Zero-Trust Tunnel Is Actually Built - Packet Walk protocol
    4. S4 Digital Experience Monitoring with ThousandEyes & Secure Access concept
  32. M7 · Lab 1 The Operations Stack - Splunk, Telemetry Sources & the XDR Trial scazt-operations Objective setup · Set up
    1. S1 M7 · Lab 1: The Operations Stack - Splunk, Telemetry Sources & the XDR Trial lab-setup
  33. M7 · Lab 2 Interpret the Telemetry: Visibility, XDR Analytics, Flow Baselines & Compliance Behaviour scazt-operations Objective 5.2 · Interpret
    1. S1 Network Visibility & Enforcement: Telemetry, AI/ML Analytics & Cisco XDR concept
    2. S2 Interpreting Traffic Flow & Telemetry Reports: Baselines and Compliance Behaviour concept
  34. M7 · Lab 3 Interpreting Cisco Secure Access Dashboards & Reports scazt-operations Objective 5.3 · Interpret
    1. S1 Interpreting Cisco Secure Access Dashboards & Reports concept
  35. M7 · Lab 4 Integrating Cisco Secure Access with Cisco XDR & Splunk Enterprise for the SOC scazt-operations Objective 5.4 · Integrate
    1. S1 Integrating Cisco Secure Access with Cisco XDR & Splunk Enterprise for the SOC configuration