Domain 1 · 30%
SNCF-300-710 · blueprint v1.2
Securing Networks with Cisco Firewalls
CCNP Security concentration. One master lab topology, built once and added to module by module.
2/66
SNCF-300-710 · Securing Networks with Cisco Firewalls
Lesson slugs never change and lessons are never renumbered — a link you save today still resolves after a blueprint revision.
CCNP Security concentration. One master lab topology, built once and added to module by module — every lesson written for this exam, not stitched from a video library.
MODULE 1 Deployment: Firewall & NGIPS Modes
01 M1 · Lab 1: Stand Up the SNCF Firewall Lab — FTD, FMC and the Traffic Generators In Production 02 Secure Firewall Platform Architecture: Threat Defense, FMC and the Snort/LINA Split Free 03 Onboarding Threat Defense to FMC: Manager Modes, Registration and Initial Setup In Production L2 M1 · Lab 2: Threat Defense Architecture & Onboarding: the Snort/LINA Split, Manager Modes & Registration · 2 scenarios Lab 04 Implementing Routed Mode: Interfaces, Security Zones and Sub-interfaces In Production 05 Implementing Transparent Mode: Bridge Groups, BVIs and Layer 2 Behaviour In Production L3 M1 · Lab 3: Routed & Transparent Mode: Interfaces, Security Zones, Bridge Groups & BVIs · 2 scenarios Lab 06 NGIPS Passive Deployment: Passive and ERSPAN Interfaces In Production 07 NGIPS Inline Deployment: Inline Pairs, Inline Sets and Tap Mode In Production L4 M1 · Lab 4: NGIPS Deployment: Passive, ERSPAN, Inline Pairs, Inline Sets & Tap Mode · 2 scenarios Lab 08 Virtual Appliances and Cloud-Delivered Management: FTDv, FMCv and cdFMC Live L5 M1 · Lab 5: Virtual Appliances and Cloud-Delivered Management: FTDv, FMCv and cdFMC Lab 01 M2 · Lab 1: Add the Second Chassis - Failover Links, Port Channels and the Backup Upstream In Production 02 Choosing a Resiliency Model: HA Pair vs Clustering vs ECMP vs Port Channel In Production 03 Port Channels on Threat Defense: EtherChannel, LACP and Load Balancing In Production 04 High Availability Pairs: Failover and State Links, Interface Monitoring, Split Brain In Production 05 Equal-Cost Multipath: Traffic Zones and Multi-Homed Threat Defense In Production 06 Static Route Tracking: SLA Monitors and Automatic Failover to a Backup ISP In Production 07 Clustering Threat Defense: Cluster Control Link, Owner/Director/Forwarder Roles In Production L2 M2 · Lab 2: Resiliency on Threat Defense: HA Pairs, Clustering, ECMP, Port Channels & Route Tracking · 6 scenarios Lab
01 M3 · Lab 1: A Clean FMC - Domains, Licensing and the Managed Device In Production 02 FMC Administration: Users, Role-Based Access Control and External Authentication In Production 03 FMC Maintenance: Time Synchronization and Backup and Restore In Production 04 FMC Licensing and Software Updates: Smart Licensing, Geolocation, VDB and Rule Updates In Production L2 M3 · Lab 2: FMC Platform Administration: RBAC, External Authentication, Backup/Restore, Licensing & Updates · 3 scenarios Lab 05 Object Management at Scale: Overrides, Dynamic Objects and Bulk Operations In Production L3 M3 · Lab 3: Object Management at Scale: Overrides, Dynamic Objects and Bulk Operations Lab 06 Device Management: Platform Settings and Health Policies In Production 07 Device Management: PKI Objects and Certificate Enrollment In Production 08 Network Settings I: Static and Dynamic Routing (OSPF, BGP) In Production 09 Network Settings I: Virtual Routing and Forwarding and Policy-Based Routing In Production 10 Network Settings I: QoS Policy - Classification, Policing and Prioritization In Production 11 Network Settings II: NAT on Threat Defense - Auto, Manual and Twice NAT In Production 12 Secure Access on Threat Defense: Site-to-Site VPN Topologies and Certificate-Based Authentication In Production 13 Secure Access on Threat Defense: Remote-Access VPN with Cisco Secure Client In Production 14 Secure Access on Threat Defense: Zero Trust Access Policy In Production L4 M3 · Lab 4: Device Configuration on Threat Defense: Platform Settings, PKI, Routing, VRF/PBR, QoS, NAT & VPN · 9 scenarios Lab
01 M4 · Lab 1: Policy Bench - Attacker, Identity Sources and a Policy-Ready FMC In Production 02 Firepower: Packet Processing & Policies In Production 03 Snort 3 Inside Threat Defense: Inspectors, Binders, Rule Syntax and Snort 2 Migration In Production L2 M4 · Lab 2: Packet Processing & Snort 3: the Policy Pipeline Inside Threat Defense · 2 scenarios Lab 04 Intrusion Rules as Objects: Writing, Importing and Grouping Custom Snort Rules In Production L3 M4 · Lab 3: Intrusion Rules as Objects: Writing, Importing and Grouping Custom Snort Rules Lab 05 Firepower: Policies - Prefilter In Production 06 Access Control Policy in Depth: Hierarchy, Inheritance, Rule Expansion and Logging Strategy In Production 07 Security Intelligence and the DNS Policy: Feeds, Sinkholes and Encrypted DNS In Production 08 Identity Policy: Realms, Passive Auth via ISE/pxGrid and Active Captive Portal In Production 09 Network Analysis Policy: Preprocessors, Inline Normalization and Custom NAP Tuning In Production 10 Intrusion Policy Tuning: Rule Groups, Recommendations, Thresholds and Variable Sets In Production L4 M4 · Lab 4: The Security Policy Stack: Prefilter, Access Control, Security Intelligence, DNS, Identity, NAP & IPS Tuning · 6 scenarios Lab
01 M5 · Lab 1: A Population to Discover - Mixed Hosts, Servers and Real Application Traffic In Production 02 Network Discovery and Application Detectors: Building a Host Map You Can Trust In Production 03 Correlation Policies: Rules, Compliance Allow Lists, Traffic Profiles and Remediations In Production 04 Encrypted Visibility Engine: Fingerprinting TLS Without Decrypting It In Production L2 M5 · Lab 2: Discovery & Visibility: Network Discovery, Correlation Policies & the Encrypted Visibility Engine · 3 scenarios Lab
01 M6 · Lab 1: Break It on Purpose - A Lab Wired for Diagnosis In Production 02 The Threat Defense CLI: FTD Shell, LINA and Expert Mode In Production 03 Troubleshooting from FMC: Deployment Failures, Message Center, Health Monitor and Troubleshoot Files In Production L2 M6 · Lab 2: Troubleshooting Threat Defense: the FTD CLI, Expert Mode & FMC Diagnostics · 2 scenarios Lab 04 Packet Capture Procedures: LINA Captures, Snort capture-traffic and Exporting to Wireshark In Production 05 Packet Tracer: Proving Which Rule, NAT Statement or Route Made the Decision In Production 06 Firewall Engine Debug and System Support Trace: Watching Snort Decide In Production L3 M6 · Lab 3: Prove the Decision: Packet Capture, Packet Tracer & Firewall Engine Debug · 3 scenarios Lab 07 A Repeatable Workflow: From "The App Is Broken" to the Offending Rule In Production L4 M6 · Lab 4: A Repeatable Workflow: From "The App Is Broken" to the Offending Rule Lab
01 M7 · Lab 1: Something Worth Reporting On - Seeding Events Across Every Policy In Production 02 Dashboards and Reporting: Widgets, Custom Workflows, Report Templates and Scheduling In Production L2 M7 · Lab 2: Dashboards and Reporting: Widgets, Custom Workflows, Report Templates and Scheduling Lab 03 Event Analysis: Connection, Intrusion, Malware, Discovery and the Unified Event Viewer In Production 04 Risk Reports, the Network Map and Indications of Compromise In Production L3 M7 · Lab 3: Event Analysis & Reporting: Unified Events, Risk Reports, the Network Map & IoCs · 2 scenarios Lab 05 Choosing a Manager: FMC vs Secure Firewall Device Manager vs Security Cloud Control In Production 06 Cisco Security Cloud Control: Cloud-Delivered Firewall Management In Production L4 M7 · Lab 4: Choosing the Manager: FMC vs Device Manager vs Security Cloud Control · 2 scenarios Lab
01 M8 · Lab 1: Wire the Ecosystem - Endpoints, ISE, Feeds and the Cloud Consoles In Production 02 Malware Defense: File Policies, Dispositions, Dynamic Analysis and Retrospection In Production L2 M8 · Lab 2: Malware Defense: File Policies, Dispositions, Dynamic Analysis and Retrospection Lab 03 Integrating Secure Endpoint with FMC: Connection, Event Streaming and Endpoint IoCs In Production L3 M8 · Lab 3: Integrating Secure Endpoint with FMC: Connection, Event Streaming and Endpoint IoCs Lab 04 Security Intelligence: Authoring, Sharing & Consumption In Production 05 Threat Intelligence Director: STIX/TAXII Feeds, Observables, Incidents and Elements In Production L4 M8 · Lab 4: Threat Intelligence: Authoring, Sharing & the Threat Intelligence Director (STIX/TAXII) · 2 scenarios Lab 06 FMC and ISE over pxGrid: Identity Mapping, SGT Exchange and Session Awareness In Production L5 M8 · Lab 5: FMC and ISE over pxGrid: Identity Mapping, SGT Exchange and Session Awareness Lab 07 Rapid Threat Containment: Remediation Modules, ANC Policies and Automatic Quarantine In Production L6 M8 · Lab 6: Rapid Threat Containment: Remediation Modules, ANC Policies and Automatic Quarantine Lab 08 Cisco XDR Investigations Driven from the Firewall In Production L7 M8 · Lab 7: Cisco XDR Investigations Driven from the Firewall Lab 09 Off-Box Logging I: Cisco Security Analytics and Logging (SaaS and On-Prem) In Production L8 M8 · Lab 8: Off-Box Logging I: Cisco Security Analytics and Logging (SaaS and On-Prem) Lab 10 Off-Box Logging II: Splunk Integration and AI-Driven Threat Intelligence In Production L9 M8 · Lab 9: Off-Box Logging II: Splunk Integration and AI-Driven Threat Intelligence Lab
Part of the Cisco Security Track
All-Access covers every course in the track — see pricing.
Exam Mapping
The objective namespace is separate from the course namespace — a blueprint revision cannot break a course link, and the reverse is also true.