SecurityLessons Reserve founders spot

Lesson-to-lab structure

SCOR-350-701 Labs

106 planned lessons collapse into 52 planned labs (4 built so far) across 79 scenarios, numbered per module in the order you meet them: each lab follows the last lesson it exercises.

52labs planned
79scenarios
11multi-scenario
41single-scenario

How a lab is put together

Scenario 1 establishes the foundation. Every later scenario depends on Scenario 1 and, wherever possible, on nothing else — hub-and-spoke rather than a chain. A failure in Scenario 3 does not strand Scenario 4, you can start at any scenario from one known state, and each lab needs one start-config rather than one per scenario.

Each module opens with a setup lab that brings its appliances up from the start-config — numbered like every other lab, first in its module. Labs are numbered per module, the way lessons are: M4 · Lab 2 is the second lab of Module 4. Every lab sits right after the last lesson it exercises, so you do a lesson or a few, then the lab.

Labs are grouped by module and exam objective; a grouping is refined lesson by lesson as each lab guide publishes, and the numbering never changes once a lab is live.

  1. M1 · Lab 1 Build the Core Lab — Workstations, AD & the Attacker is-fundamentals Objective setup · Set up
    1. S1 M1 · Lab 1: Build the Core Lab — Workstations, AD & the Attacker lab-setup
  2. M2 · Lab 1 Common Threats: On-Premises, Hybrid & Cloud — Malware, DoS/DDoS, Breaches & Credential Compromise common-threats Objective 1.1 · Explain
    1. S1 Common Threats: On-Premises, Hybrid & Cloud — Malware, DoS/DDoS, Breaches & Credential Compromise concept
  3. M2 · Lab 2 Exploit the Web & Beyond: OWASP Top Ten, Weak Credentials, Missing Ciphers & Overflows common-threats Objective 1.2 · Describe
    1. S1 OWASP Top Ten in Practice: SQL Injection & XSS, Live from ATK-KALI-01 concept
    2. S2 Vulnerability Classes Beyond the Web: Weak/Hardcoded Passwords, Missing Ciphers, Buffer Overflow, Path Traversal & CSRF concept
  4. M2 · Lab 3 AI/LLM Security: Prompt Injection, System Prompt Leakage, Embedding Weaknesses & AI Supply Chain common-threats Objective 1.3 · Describe
    1. S1 AI/LLM Security: Prompt Injection, System Prompt Leakage, Embedding Weaknesses & AI Supply Chain concept
  5. M2 · Lab 4 Man-in-the-Middle: ARP Spoofing Packet Walk common-threats Objective 1.1 · Explain
    1. S1 Man-in-the-Middle: ARP Spoofing Packet Walk protocol
  6. M3 · Lab 1 Cryptography End to End: Enterprise CA, the TLS Handshake, Post-Quantum & QUIC cryptography-pki Objective 1.5 · Describe
    1. S1 Cryptography Foundations: Hashing, Encryption & PKI concept
    2. S2 Stand Up the Enterprise CA on AD-01 & Issue Certificates configuration
    3. S3 The SSL/TLS Handshake: Packet Walk protocol
    4. S4 Post-Quantum Cryptography: NIST Algorithms, Hybrid Key Exchange & Migration concept
    5. S5 QUIC & MASQUE: Where TLS Is Going concept
  7. M4 · Lab 1 Power On the ASA Perimeter asa-stateful-firewall Objective setup · Set up
    1. S1 M4 · Lab 1: Power On the ASA Perimeter lab-setup
  8. M4 · Lab 2 ASA Foundations: Stateful Inspection, Deployment Types & Security Contexts asa-stateful-firewall Objective 2.1 · Describe
    1. S1 Stateful Firewalls concept
    2. S2 ASA: Deployment Types configuration
    3. S3 ASA: Security Contexts configuration
  9. M4 · Lab 3 ASA Perimeter Build: Security Levels, DMZ, Objects, NAT, ACLs & MPF asa-stateful-firewall Objective legacy-value · Legacy value
    1. S1 ASA: Security Levels concept
    2. S2 ASA: DMZ Interface & Verification configuration
    3. S3 ASA: Objects & Object Groups configuration
    4. S4 ASA: Service Groups & Access Rules configuration
    5. S5 ASA: NAT — Static NAT and Dynamic PAT configuration
    6. S6 ASA: NAT — Identity Rules, Verification and Troubleshooting configuration
    7. S7 ASA: Interface ACLs configuration
    8. S8 ASA: Global ACLs configuration
    9. S9 ASA: Advanced Access Policies — Modular Policy Framework (MPF) configuration
  10. M4 · Lab 4 ASA: High Availability (HA) asa-stateful-firewall Objective 2.1 · Describe
    1. S1 ASA: High Availability (HA) configuration
  11. M4 · Lab 5 ASA Perimeter Policy asa-stateful-firewall Objective legacy-value · Legacy value
    1. S1 M4 · Lab 5: ASA Perimeter Policy lab
  12. M5 · Lab 1 Power On FTD & FMC firepower-ngfw Objective setup · Set up
    1. S1 M5 · Lab 1: Power On FTD & FMC lab-setup
  13. M5 · Lab 2 Firepower: Deployments firepower-ngfw Objective 2.1 · Describe
    1. S1 Firepower: Deployments configuration
  14. M5 · Lab 3 Management Models: Single vs Multidevice, In-Band vs Out-of-Band, On-Premises vs Cloud (Cisco Security Cloud Control) firepower-ngfw Objective 2.4 · Select
    1. S1 Management Models: Single vs Multidevice, In-Band vs Out-of-Band, On-Premises vs Cloud (Cisco Security Cloud Control) configuration
  15. M5 · Lab 4 Firepower: Packet Processing & Policies firepower-ngfw Objective 2.1 · Describe
    1. S1 Firepower: Packet Processing & Policies concept
  16. M5 · Lab 5 Firepower Access Control: Objects, the ACP, AVC & URL Filtering firepower-ngfw Objective 2.8 · Implement
    1. S1 Firepower: Objects configuration
    2. S2 Firepower: Policies — Access Control (ACP) configuration
    3. S3 Firepower: Policies — AVC & Application Control configuration
    4. S4 Firepower: Policies — URL Filtering configuration
  17. M5 · Lab 6 FTD NAT: PAT, Static Publication, Identity Rules & Verification firepower-ngfw Objective 2.1 · Describe
    1. S1 FTD: NAT — Dynamic PAT and Static Publication configuration
    2. S2 FTD: NAT — Identity Rules, Verification and Troubleshooting configuration
  18. M5 · Lab 7 Firepower: Policies — Prefilter firepower-ngfw Objective 2.8 · Implement
    1. S1 Firepower: Policies — Prefilter configuration
  19. M5 · Lab 8 Firepower: Security Intelligence (SI) firepower-ngfw Objective 1.7 · Describe
    1. S1 Firepower: Security Intelligence (SI) configuration
  20. M5 · Lab 9 Firepower Threat Policies: Network Discovery, IPS & Malware/File firepower-ngfw Objective 2.8 · Implement
    1. S1 Firepower: Policies — Network Discovery configuration
    2. S2 Firepower: Policies — IPS configuration
    3. S3 Firepower: Policies — Malware & File configuration
  21. M6 · Lab 1 Power On the Secure Endpoint Console & Workstations endpoint-security Objective setup · Set up
    1. S1 M6 · Lab 1: Power On the Secure Endpoint Console & Workstations lab-setup
  22. M6 · Lab 2 Configure Antimalware Protection: Policies, Outbreak Control & Quarantines endpoint-security Objective 5.5 · Configure
    1. S1 Configure Antimalware Protection: Policies, Outbreak Control & Quarantines configuration
  23. M6 · Lab 3 Triage Secure Endpoint: Interpreting Malware Detection Events endpoint-security Objective 5.6 · Interpret
    1. S1 Triage Secure Endpoint: Interpreting Malware Detection Events troubleshooting
  24. M6 · Lab 4 Configure Email Security with Cisco Secure Email Threat Defense endpoint-security Objective 5.7 · Configure
    1. S1 Configure Email Security with Cisco Secure Email Threat Defense configuration
  25. M7 · Lab 1 Power On ISE, the Access Layer & Wireless secure-network-access-ise Objective setup · Set up
    1. S1 M7 · Lab 1: Power On ISE, the Access Layer & Wireless lab-setup
  26. M7 · Lab 2 ISE AAA: TACACS+ Device Administration & RADIUS Network Access secure-network-access-ise Objective 2.6 · Troubleshoot
    1. S1 Configure & Troubleshoot TACACS+ Device Administration configuration
    2. S2 Configure & Troubleshoot RADIUS Network Access configuration
  27. M7 · Lab 3 802.1X End to End: EAP & RADIUS Flows, MAB, WebAuth, dACLs & Dynamic VLANs secure-network-access-ise Objective 6.3 · Configure
    1. S1 802.1X, EAP & RADIUS Flows: Packet Walk protocol
    2. S2 Configure 802.1X, MAB & WebAuth with ISE configuration
    3. S3 Authorization: dACLs & Dynamic VLAN Assignment configuration
  28. M7 · Lab 4 Change of Authorization (CoA): Triggers, Packet Flow & Verification secure-network-access-ise Objective 6.4 · Configure
    1. S1 Change of Authorization (CoA): Triggers, Packet Flow & Verification configuration
  29. M7 · Lab 5 Configure Profiling, Guest Services & BYOD secure-network-access-ise Objective 6.1 · Describe
    1. S1 Configure Profiling, Guest Services & BYOD configuration
  30. M7 · Lab 6 Configure Posture Assessment & Device Compliance secure-network-access-ise Objective 5.3 · Describe
    1. S1 Configure Posture Assessment & Device Compliance configuration
  31. M8 · Lab 1 Layer 2 Hardening & Segmentation: Port Security, DHCP Snooping, DAI, VLANs, SGTs & PVLANs infrastructure-security Objective 2.3 · Configure
    1. S1 Layer 2 Attacks & Defenses: Port Security, DHCP Snooping, DAI & Storm Control configuration
    2. S2 Configure Segmentation: VLANs, SGTs & Private VLANs configuration
  32. M8 · Lab 2 Device Hardening with CIS Benchmarks: Cisco Secure Firewall (FTD) & IOS XE infrastructure-security Objective 2.5 · Describe
    1. S1 Device Hardening with CIS Benchmarks: Cisco Secure Firewall (FTD) & IOS XE configuration
  33. M8 · Lab 3 Secure the Management Plane: SNMPv3, APIs, Syslog Hardening & Authenticated NTP infrastructure-security Objective 2.7 · Configure
    1. S1 Secure Management Access: SNMPv3, NetConf, RestConf & APIs configuration
    2. S2 Secure Log Transport: Syslog Hardening configuration
    3. S3 Trusted Time: Authenticated NTP configuration
  34. M9 · Lab 1 Power On the Telemetry Stack telemetry-visibility Objective setup · Set up
    1. S1 M9 · Lab 1: Power On the Telemetry Stack lab-setup
  35. M9 · Lab 2 Configure Flexible NetFlow Export: Telemetry Hands-On telemetry-visibility Objective 2.2 · Describe
    1. S1 Configure Flexible NetFlow Export: Telemetry Hands-On configuration
  36. M9 · Lab 3 Network Visibility & Enforcement: Telemetry, AI/ML Analytics & Cisco XDR telemetry-visibility Objective 6.6 · Describe
    1. S1 Network Visibility & Enforcement: Telemetry, AI/ML Analytics & Cisco XDR concept
  37. M9 · Lab 4 Exfiltration & Its Detection: DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger/IRC, NTP & Cloud Storage telemetry-visibility Objective 6.5 · Explain
    1. S1 Exfiltration & Its Detection: DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger/IRC, NTP & Cloud Storage concept
  38. M10 · Lab 1 Power On the Branch Site site-to-site-vpn Objective setup · Set up
    1. S1 M10 · Lab 1: Power On the Branch Site lab-setup
  39. M10 · Lab 2 IKEv2 Tunnel Establishment: Packet Walk site-to-site-vpn Objective 1.5 · Describe
    1. S1 IKEv2 Tunnel Establishment: Packet Walk protocol
  40. M10 · Lab 3 Configure IOS Site-to-Site IPsec with sVTI site-to-site-vpn Objective 1.6 · Describe
    1. S1 Configure IOS Site-to-Site IPsec with sVTI configuration
  41. M10 · Lab 4 Configure Site-to-Site VPN: FTD to Branch Router site-to-site-vpn Objective 2.9 · Configure
    1. S1 Configure Site-to-Site VPN: FTD to Branch Router configuration
  42. M10 · Lab 5 Troubleshoot VPN Tunnel Establishment on FTD: Debugs That Matter site-to-site-vpn Objective 2.10 · Troubleshoot
    1. S1 Troubleshoot VPN Tunnel Establishment on FTD: Debugs That Matter troubleshooting
  43. M11 · Lab 1 Configure Remote Access VPN: FTD & Cisco Secure Client remote-access-vpn Objective 2.9 · Configure
    1. S1 Configure Remote Access VPN: FTD & Cisco Secure Client configuration
  44. M11 · Lab 2 Verify & Troubleshoot RA VPN: TLS/DTLS Session Establishment & Debugs remote-access-vpn Objective 2.10 · Troubleshoot
    1. S1 Verify & Troubleshoot RA VPN: TLS/DTLS Session Establishment & Debugs troubleshooting
  45. M12 · Lab 1 Secure Access Tenant & Branch Component Availability sase-umbrella-sdwan Objective setup · Set up
    1. S1 M12 · Lab 1: Secure Access Tenant & Branch Component Availability lab-setup
  46. M12 · Lab 2 Configure Secure Internet Access: DNS Forwarding, Branch Egress, Web Policies, Destination Lists & Reporting sase-umbrella-sdwan Objective 4.2 · Configure
    1. S1 Configure Secure Internet Access: DNS Forwarding, Branch Egress, Web Policies, Destination Lists & Reporting configuration
  47. M12 · Lab 3 Configure Secure Private Access: ZTNA to Internal Apps sase-umbrella-sdwan Objective 4.3 · Configure
    1. S1 Configure Secure Private Access: ZTNA to Internal Apps configuration
  48. M12 · Lab 4 Configure DLP & AI Guardrails for Secure Internet Access sase-umbrella-sdwan Objective 4.4 · Configure
    1. S1 Configure DLP & AI Guardrails for Secure Internet Access configuration
  49. M13 · Lab 1 Power On the Cloud Services Simulator cloud-security Objective setup · Set up
    1. S1 M13 · Lab 1: Power On the Cloud Services Simulator lab-setup
  50. M13 · Lab 2 Cloud Network, Application & Data Security: Multicloud Defense & Secure Workload cloud-security Objective 3.4 · Describe
    1. S1 Cloud Network, Application & Data Security: Multicloud Defense & Secure Workload concept
  51. M13 · Lab 3 Configure Splunk to Ingest Cloud Logging & Monitoring Data cloud-security Objective 3.5 · Configure
    1. S1 Configure Splunk to Ingest Cloud Logging & Monitoring Data configuration
  52. M14 · Lab 1 Secure a CI/CD Pipeline: Container & IaC Scanning Hands-On devsecops Objective 3.7 · Describe
    1. S1 Secure a CI/CD Pipeline: Container & IaC Scanning Hands-On configuration