CCNA – Security or Cisco Certified Network Associate Security is an associate level certification offered by Cisco Systems and is aimed at laying a strong foundation for the network engineers to move higher in their careers related to network security.
This certification is suitable for the job roles of Network Security Specialist or Support Engineer and Security Administrator with a professional work experience of 1 to 3 years.
A CCNA security certified professional is considered to be an expert in handling products and technologies like Cisco routers, Cisco IOS and security management.
The advance curriculum of this certification ensures that the certified engineer is not only able to develop security infrastructure but also able to determine the potential threats and mitigate them accordingly.
This certification is valid or active for a period of three years

1. Common security principles
   

   Describe confidentiality, integrity, availability (CIA)
   Identify common security terms

2. BYOD
   

   Describe the BYOD architecture framework

3. VPN concepts
   

   Describe IPsec protocols and delivery modes (IKE, ESP, AH, tunnel mode, transport mode)
   Describe hairpinning, split tunneling, always-on, NAT traversal

4. Remote access VPN
   

   Describe basic clientless SSL VPN
   Describe basic AnyConnect SSL VPN

5. Site-to-site VPN
   

   Implement an IPsec site-to-site VPN with pre-shared key authentication on Cisco routers and ASA firewalls
   Verify an IPsec site-to-site VPN

6. Security on Cisco routers
   

   Configure multiple privilege levels
   Configure Cisco IOS role-based CLI access

7. Securing routing protocols
   

   Implement routing update authentication on OSPF
   Implement routing update authentication on RIP
   Implement routing update authentication on EIGRP

8. Secure management
   

   Compare in-band and out-of band
   Configure secure network management
   Configure and verify security for NTP

9. AAA concepts
   

   Describe RADIUS and TACACS+ technologies
   Configure administrative access on a Cisco router using TACACS+
   Verify connectivity on a Cisco router to a TACACS+ server
   Explain the integration of Active Directory with AAA
   Describe authentication and authorization using ACS and ISE

10. 802.1X authentication
    

    Identify the functions 802.1X components

11. Securing the control plane
    

    Explain the function of control plane policing

12. Common security threats
    

    Identify common network attacks
    Describe social engineering
    Identify malware

13. Cryptography concepts
    

    Describe key exchange
    Describe hash algorithm
    Compare and contrast symmetric and asymmetric encryption
    Describe digital signatures, certificates, and PKI

14. Describe network topologies
    

    Campus area network (CAN)
    Cloud, wide area network (WAN)
    Small office/home office (SOHO)

15. Common Layer 2 attacks
    

    Describe STP attacks
    Describe ARP spoofing
    Describe MAC spoofing
    Describe CAM table (MAC address table) overflows
    Describe CDP/LLDP reconnaissance
    Describe VLAN hopping
    Describe DHCP spoofing

16. Mitigation procedures
    

    Implement DHCP snooping
    Implement Dynamic ARP Inspection
    Implement port security
    Implement BPDU guard, root guard, loop guard
    Verify mitigation procedures

17. VLAN security
    

    VACL
    Implementation of PVLAN

18. Implement NAT on Cisco ASA 9.x
    

    Static NAT
    Dynamic NAT
    PAT
    Verify NAT operations

19. Implement zone-based firewall
    

    Zone to zone
    Self zone

20. Firewall features on the Cisco Adaptive Security Appliance (ASA) 9.x
    

    Configure ASA access management
    Configure security access policies
    Configure Cisco ASA interface security levels
    Configure default Cisco Modular Policy Framework (MPF)
    Describe modes of deployment (routed firewall, transparent firewall)
    Describe methods of implementing high availability
    Describe security contexts
    Describe firewall services

21. Describe IPS technologies
    

    Rules/signatures
    Detection/signature engines
    Trigger actions/responses (drop, reset, block, alert, monitor/log, shun)
    Blacklist (static and dynamic)

22. Describe mitigation technology for endpoint threats
    

    Anti-virus/anti-malware
    Personal firewall/HIPS