SecurityLessons Reserve founders spot

Lesson-to-lab structure

SNCF-300-710 Labs

66 planned lessons collapse into 34 planned labs (1 built so far) across 66 scenarios, numbered per module in the order you meet them: each lab follows the last lesson it exercises.

34labs planned
66scenarios
14multi-scenario
20single-scenario

How a lab is put together

Scenario 1 establishes the foundation. Every later scenario depends on Scenario 1 and, wherever possible, on nothing else — hub-and-spoke rather than a chain. A failure in Scenario 3 does not strand Scenario 4, you can start at any scenario from one known state, and each lab needs one start-config rather than one per scenario.

Each module opens with a setup lab that brings its appliances up from the start-config — numbered like every other lab, first in its module. Labs are numbered per module, the way lessons are: M4 · Lab 2 is the second lab of Module 4. Every lab sits right after the last lesson it exercises, so you do a lesson or a few, then the lab.

Labs are grouped by module and exam objective; a grouping is refined lesson by lesson as each lab guide publishes, and the numbering never changes once a lab is live.

  1. M1 · Lab 1 Stand Up the SNCF Firewall Lab — FTD, FMC and the Traffic Generators sncf-deployment-modes Objective setup · Set up
    1. S1 M1 · Lab 1: Stand Up the SNCF Firewall Lab — FTD, FMC and the Traffic Generators lab-setup
  2. M1 · Lab 2 Threat Defense Architecture & Onboarding: the Snort/LINA Split, Manager Modes & Registration sncf-deployment-modes Objective 1.4 · Describe
    1. S1 Secure Firewall Platform Architecture: Threat Defense, FMC and the Snort/LINA Split concept
    2. S2 Onboarding Threat Defense to FMC: Manager Modes, Registration and Initial Setup configuration
  3. M1 · Lab 3 Routed & Transparent Mode: Interfaces, Security Zones, Bridge Groups & BVIs sncf-deployment-modes Objective 1.1 · Implement
    1. S1 Implementing Routed Mode: Interfaces, Security Zones and Sub-interfaces configuration
    2. S2 Implementing Transparent Mode: Bridge Groups, BVIs and Layer 2 Behaviour configuration
  4. M1 · Lab 4 NGIPS Deployment: Passive, ERSPAN, Inline Pairs, Inline Sets & Tap Mode sncf-deployment-modes Objective 1.2 · Implement
    1. S1 NGIPS Passive Deployment: Passive and ERSPAN Interfaces configuration
    2. S2 NGIPS Inline Deployment: Inline Pairs, Inline Sets and Tap Mode configuration
  5. M1 · Lab 5 Virtual Appliances and Cloud-Delivered Management: FTDv, FMCv and cdFMC sncf-deployment-modes Objective 1.4 · Describe
    1. S1 Virtual Appliances and Cloud-Delivered Management: FTDv, FMCv and cdFMC concept
  6. M2 · Lab 1 Add the Second Chassis - Failover Links, Port Channels and the Backup Upstream sncf-high-availability Objective setup · Set up
    1. S1 M2 · Lab 1: Add the Second Chassis - Failover Links, Port Channels and the Backup Upstream lab-setup
  7. M2 · Lab 2 Resiliency on Threat Defense: HA Pairs, Clustering, ECMP, Port Channels & Route Tracking sncf-high-availability Objective 1.3 · Implement
    1. S1 Choosing a Resiliency Model: HA Pair vs Clustering vs ECMP vs Port Channel concept
    2. S2 Port Channels on Threat Defense: EtherChannel, LACP and Load Balancing configuration
    3. S3 High Availability Pairs: Failover and State Links, Interface Monitoring, Split Brain configuration
    4. S4 Equal-Cost Multipath: Traffic Zones and Multi-Homed Threat Defense configuration
    5. S5 Static Route Tracking: SLA Monitors and Automatic Failover to a Backup ISP configuration
    6. S6 Clustering Threat Defense: Cluster Control Link, Owner/Director/Forwarder Roles concept
  8. M3 · Lab 1 A Clean FMC - Domains, Licensing and the Managed Device sncf-fmc-platform-configuration Objective setup · Set up
    1. S1 M3 · Lab 1: A Clean FMC - Domains, Licensing and the Managed Device lab-setup
  9. M3 · Lab 2 FMC Platform Administration: RBAC, External Authentication, Backup/Restore, Licensing & Updates sncf-fmc-platform-configuration Objective 2.1 · Configure
    1. S1 FMC Administration: Users, Role-Based Access Control and External Authentication configuration
    2. S2 FMC Maintenance: Time Synchronization and Backup and Restore configuration
    3. S3 FMC Licensing and Software Updates: Smart Licensing, Geolocation, VDB and Rule Updates configuration
  10. M3 · Lab 3 Object Management at Scale: Overrides, Dynamic Objects and Bulk Operations sncf-fmc-platform-configuration Objective 2.4 · Configure
    1. S1 Object Management at Scale: Overrides, Dynamic Objects and Bulk Operations configuration
  11. M3 · Lab 4 Device Configuration on Threat Defense: Platform Settings, PKI, Routing, VRF/PBR, QoS, NAT & VPN sncf-fmc-platform-configuration Objective 2.5 · Configure
    1. S1 Device Management: Platform Settings and Health Policies configuration
    2. S2 Device Management: PKI Objects and Certificate Enrollment configuration
    3. S3 Network Settings I: Static and Dynamic Routing (OSPF, BGP) configuration
    4. S4 Network Settings I: Virtual Routing and Forwarding and Policy-Based Routing configuration
    5. S5 Network Settings I: QoS Policy - Classification, Policing and Prioritization configuration
    6. S6 Network Settings II: NAT on Threat Defense - Auto, Manual and Twice NAT configuration
    7. S7 Secure Access on Threat Defense: Site-to-Site VPN Topologies and Certificate-Based Authentication configuration
    8. S8 Secure Access on Threat Defense: Remote-Access VPN with Cisco Secure Client configuration
    9. S9 Secure Access on Threat Defense: Zero Trust Access Policy configuration
  12. M4 · Lab 1 Policy Bench - Attacker, Identity Sources and a Policy-Ready FMC sncf-security-policies Objective setup · Set up
    1. S1 M4 · Lab 1: Policy Bench - Attacker, Identity Sources and a Policy-Ready FMC lab-setup
  13. M4 · Lab 2 Packet Processing & Snort 3: the Policy Pipeline Inside Threat Defense sncf-security-policies Objective 2.6 · Describe
    1. S1 Firepower: Packet Processing & Policies concept
    2. S2 Snort 3 Inside Threat Defense: Inspectors, Binders, Rule Syntax and Snort 2 Migration concept
  14. M4 · Lab 3 Intrusion Rules as Objects: Writing, Importing and Grouping Custom Snort Rules sncf-security-policies Objective 2.4 · Configure
    1. S1 Intrusion Rules as Objects: Writing, Importing and Grouping Custom Snort Rules configuration
  15. M4 · Lab 4 The Security Policy Stack: Prefilter, Access Control, Security Intelligence, DNS, Identity, NAP & IPS Tuning sncf-security-policies Objective 2.2 · Configure
    1. S1 Firepower: Policies - Prefilter configuration
    2. S2 Access Control Policy in Depth: Hierarchy, Inheritance, Rule Expansion and Logging Strategy configuration
    3. S3 Security Intelligence and the DNS Policy: Feeds, Sinkholes and Encrypted DNS configuration
    4. S4 Identity Policy: Realms, Passive Auth via ISE/pxGrid and Active Captive Portal configuration
    5. S5 Network Analysis Policy: Preprocessors, Inline Normalization and Custom NAP Tuning configuration
    6. S6 Intrusion Policy Tuning: Rule Groups, Recommendations, Thresholds and Variable Sets configuration
  16. M5 · Lab 1 A Population to Discover - Mixed Hosts, Servers and Real Application Traffic sncf-discovery-visibility Objective setup · Set up
    1. S1 M5 · Lab 1: A Population to Discover - Mixed Hosts, Servers and Real Application Traffic lab-setup
  17. M5 · Lab 2 Discovery & Visibility: Network Discovery, Correlation Policies & the Encrypted Visibility Engine sncf-discovery-visibility Objective 2.3 · Configure
    1. S1 Network Discovery and Application Detectors: Building a Host Map You Can Trust configuration
    2. S2 Correlation Policies: Rules, Compliance Allow Lists, Traffic Profiles and Remediations configuration
    3. S3 Encrypted Visibility Engine: Fingerprinting TLS Without Decrypting It configuration
  18. M6 · Lab 1 Break It on Purpose - A Lab Wired for Diagnosis sncf-troubleshooting Objective setup · Set up
    1. S1 M6 · Lab 1: Break It on Purpose - A Lab Wired for Diagnosis lab-setup
  19. M6 · Lab 2 Troubleshooting Threat Defense: the FTD CLI, Expert Mode & FMC Diagnostics sncf-troubleshooting Objective 3.1 · Troubleshoot
    1. S1 The Threat Defense CLI: FTD Shell, LINA and Expert Mode troubleshooting
    2. S2 Troubleshooting from FMC: Deployment Failures, Message Center, Health Monitor and Troubleshoot Files troubleshooting
  20. M6 · Lab 3 Prove the Decision: Packet Capture, Packet Tracer & Firewall Engine Debug sncf-troubleshooting Objective 3.3 · Troubleshoot
    1. S1 Packet Capture Procedures: LINA Captures, Snort capture-traffic and Exporting to Wireshark troubleshooting
    2. S2 Packet Tracer: Proving Which Rule, NAT Statement or Route Made the Decision troubleshooting
    3. S3 Firewall Engine Debug and System Support Trace: Watching Snort Decide troubleshooting
  21. M6 · Lab 4 A Repeatable Workflow: From "The App Is Broken" to the Offending Rule sncf-troubleshooting Objective 3.1 · Troubleshoot
    1. S1 A Repeatable Workflow: From "The App Is Broken" to the Offending Rule troubleshooting
  22. M7 · Lab 1 Something Worth Reporting On - Seeding Events Across Every Policy sncf-events-reporting Objective setup · Set up
    1. S1 M7 · Lab 1: Something Worth Reporting On - Seeding Events Across Every Policy lab-setup
  23. M7 · Lab 2 Dashboards and Reporting: Widgets, Custom Workflows, Report Templates and Scheduling sncf-events-reporting Objective 3.2 · Configure
    1. S1 Dashboards and Reporting: Widgets, Custom Workflows, Report Templates and Scheduling configuration
  24. M7 · Lab 3 Event Analysis & Reporting: Unified Events, Risk Reports, the Network Map & IoCs sncf-events-reporting Objective 3.4 · Analyze
    1. S1 Event Analysis: Connection, Intrusion, Malware, Discovery and the Unified Event Viewer troubleshooting
    2. S2 Risk Reports, the Network Map and Indications of Compromise troubleshooting
  25. M7 · Lab 4 Choosing the Manager: FMC vs Device Manager vs Security Cloud Control sncf-events-reporting Objective 3.5 · Describe
    1. S1 Choosing a Manager: FMC vs Secure Firewall Device Manager vs Security Cloud Control concept
    2. S2 Cisco Security Cloud Control: Cloud-Delivered Firewall Management concept
  26. M8 · Lab 1 Wire the Ecosystem - Endpoints, ISE, Feeds and the Cloud Consoles sncf-integrations Objective setup · Set up
    1. S1 M8 · Lab 1: Wire the Ecosystem - Endpoints, ISE, Feeds and the Cloud Consoles lab-setup
  27. M8 · Lab 2 Malware Defense: File Policies, Dispositions, Dynamic Analysis and Retrospection sncf-integrations Objective 4.1 · Configure
    1. S1 Malware Defense: File Policies, Dispositions, Dynamic Analysis and Retrospection configuration
  28. M8 · Lab 3 Integrating Secure Endpoint with FMC: Connection, Event Streaming and Endpoint IoCs sncf-integrations Objective 4.2 · Configure
    1. S1 Integrating Secure Endpoint with FMC: Connection, Event Streaming and Endpoint IoCs configuration
  29. M8 · Lab 4 Threat Intelligence: Authoring, Sharing & the Threat Intelligence Director (STIX/TAXII) sncf-integrations Objective 4.3 · Implement
    1. S1 Security Intelligence: Authoring, Sharing & Consumption concept
    2. S2 Threat Intelligence Director: STIX/TAXII Feeds, Observables, Incidents and Elements configuration
  30. M8 · Lab 5 FMC and ISE over pxGrid: Identity Mapping, SGT Exchange and Session Awareness sncf-integrations Objective 4.5 · Describe
    1. S1 FMC and ISE over pxGrid: Identity Mapping, SGT Exchange and Session Awareness configuration
  31. M8 · Lab 6 Rapid Threat Containment: Remediation Modules, ANC Policies and Automatic Quarantine sncf-integrations Objective 4.6 · Describe
    1. S1 Rapid Threat Containment: Remediation Modules, ANC Policies and Automatic Quarantine configuration
  32. M8 · Lab 7 Cisco XDR Investigations Driven from the Firewall sncf-integrations Objective 4.4 · Describe
    1. S1 Cisco XDR Investigations Driven from the Firewall concept
  33. M8 · Lab 8 Off-Box Logging I: Cisco Security Analytics and Logging (SaaS and On-Prem) sncf-integrations Objective 4.7 · Describe
    1. S1 Off-Box Logging I: Cisco Security Analytics and Logging (SaaS and On-Prem) concept
  34. M8 · Lab 9 Off-Box Logging II: Splunk Integration and AI-Driven Threat Intelligence sncf-integrations Objective 4.8 · Describe
    1. S1 Off-Box Logging II: Splunk Integration and AI-Driven Threat Intelligence concept