Kirkian Computing – Page 2

Microsoft Security, Compliance, and Identity Fundamentals (SC-900)

In July 2021, I took the Microsoft Security, Compliance, and Identity Fundamentals (SC-900) exam.
NB The exam content has changed since then, so some of the specifics in this blog post might be out of date.

According to the exam description:
“Candidates should be familiar with Microsoft Azure and Microsoft 365 and want to understand how Microsoft security, compliance, and identity solutions can span across these solution areas to provide a holistic and end-to-end solution.”
I’ve previously taken MS-900 (Microsoft 365 Fundamentals) and AZ-900 (Azure Fundamentals), and I’d recommend them as a starting point to address the prerequisites.

Microsoft Azure Fundamentals (AZ-900)

In May 2021, I took the Microsoft Azure Fundamentals (AZ-900) exam. This is similar to Microsoft 365 Fundamentals (MS-900), i.e. it’s asking about what the technology does rather than how you use it. However, I thought this was a better exam than MS-900, i.e. it was more relevant to what you actually need to know for a job, and it’s not just acting as a marketing brochure. This isn’t a formal prerequisite for any other Azure exams (e.g. at associate level), but it seems like a good place to start.

This is also a good exam if you’re on a budget: the training and the exam itself were free of charge! More precisely, I attended a Microsoft Azure virtual training day. The name is a slight misnomer: it was 2½ hours on 2 consecutive days. That training isn’t enough to prepare you for the exam on its own, but it’s useful as a high level overview. When I booked the exam, I entered the email address that I used to book the virtual training day, then that address was linked to my Microsoft certification account, and I was credited with a voucher for the full cost of the exam. I did the exam at home (via online proctoring); I’m not sure whether the voucher is also valid if you attend a Pearson Vue test centre.

Cisco Certified CyberOps Associate

Overview

In November 2016, Cisco introduced “CCNA CyberOps”. This consisted of 2 exams:

210-250 Understanding Cisco Cybersecurity Fundamentals (SECFND)
210-255 Implementing Cisco Cybersecurity Operations (SECOPS)

At this point, there were 10 associate level certifications: 9 versions of CCNA (Cisco Certified Network Associate), and also CCDA (Cisco Certified Design Associate).

In February 2020, most of the associate exams were merged together into the new CCNA (200-301). The only exception was CCNA CyberOps, which got rebranded as Cisco Certified CyberOps Associate.

In May 2020, the 2 exams above were replaced with a single exam:

200-201 CBROPS: Understanding Cisco Cybersecurity Operations Fundamentals

NB There was no overlap period between the old/new exams; the last date to take the old exams was 28th May, and the first date to take the new exam was 29th May.

I interleaved the CyberOps exams with the CCNA R&S:

In Mar 2016 I did ICND1.
In Mar 2019, I did SECFND.
In Nov 2019, I did ICND2.
In May 2020, I did SECOPS.

The main reason I did it this way was to stop the CCENT from expiring before I was ready for ICND2.

For training material, I used the Cisco Press books and Matt Carey’s Udemy course.

Looking at the 2 books:

The SECFND book had 15 chapters (taking up 550 pages) along with appendixes.
The SECOPS book had 11 chapters (taking up 280 pages) along with an appendix.

So, the combined length (830 pages) was equivalent to one of the CCNA textbooks (800-900 pages each). I’m glad to see that the CBROPS study guide is a single book, with 16 chapters (575 pages) plus appendixes.

The Udemy course has been updated for the CBROPS exam, so anyone who paid for the old course will automatically get access to the new material.

NB This blog post applies to the original 2 exams.

Server+ (SK0-004)

In May 2020, I took CompTIA’s Server+ exam. This certification is “good for life”, i.e. it’s not part of the CE program and I don’t have to recertify.

As with all of CompTIA’s exams, there are no formal prerequisites, but they advise you to have A+ first (or at least know the material that’s covered by the A+ certification) along with 18 months of IT experience. I found that there was quite a bit of overlap with the Network+ and Security+ syllabus, so I’d prefer to see it aimed at people who’ve already done those exams. That would reduce duplication in the training material, and allow for more depth on the topics that are server/storage specific. (This certification has absorbed the old Storage+.)

NB I did the SK0-004 syllabus, and the current syllabus is SK0-005. Based on the exam objectives, SK0-005 seems like an improvement, e.g. it goes into more detail about high availability clusters. However, I think that most of the information in this blog post will still be relevant.

Continue reading “Server+ (SK0-004)”

eLearnSecurity Junior Penetration Tester (eJPT)

In April 2020, I took the eJPT exam from eLearnSecurity. As the “Junior” part of the name suggests, this is an entry level exam, and I think it acts as a good stepping stone towards the eCPPT or the OSCP.

All of eLearnSecurity’s certifications are good for life, as opposed to Cisco/CompTIA certifications which have to be renewed every 3 years; however, they update the syllabus every so often, so eJPTv2 has now replaced the original eJPT (which I did).

This was my third penetration testing exam, and it took an interesting approach. PenTest+ is a traditional theory based exam, where you answer multiple choice questions and then a computer instantly gives you the result when you finish. OSWP is a practical exam, where I had to submit a written report and wait for a human to review it. In the eJPT exam, you are given VPN access to a network, and then you have to answer multiple choice questions based on that network. For instance, they might ask you “How many Windows services are configured for automatic startup on SERVER1?” The only way to find out is to gain access to that server, i.e. you have to actually use the skills that you’ve learnt rather than regurgitating trivia points from memory. I think this approach gives the best of both worlds, i.e. a practical test with instant results, although reports are an important skill for real-life penetration tests.

OSCP: Windows Buffer Overflows

I’m currently preparing for the OSCP exam. As part of that, I’ve spent a lot of time on OffSec’s Discord server, where I’ve helped other students and been made a “Community Companion”. I noticed that a lot of people got stuck on a particular exercise (section 11.2.8, question 3) so I made a video walkthrough:

NB OffSec have a blogging policy, which says:
“We encourage you to blog about your overall experience, however we must request that you do not publish any scripts or solutions for systems within our labs.”
In this case, my solution applies to a topic exercise rather than a lab VM. However, I emailed OffSec before I made the video, and they reviewed it before I made it public.

IPv4 exhaustion (2022)

Today is the 10th anniversary of World IPv6 Launch. IPv6 has been around since the 1990s, but some organisations were hesitant about using it for their websites. So, World IPv6 Day (in June 2011) was an opportunity for these organisations to enable IPv6 for 24 hours. That way, if anything broke then it would probably affect all these sites rather than just one, and therefore it would be obvious that the problem was related to IPv6 connectivity in general rather than Facebook (or whatever) in particular. Also, these problems would only be temporary, for the duration of the 24 hour test. This event was successful, so it was followed by World IPv6 Launch in June 2012: this was when lots of companies would enable IPv6 and then leave it turned on permanently.

Meanwhile, ISPs (Internet Service Providers) are gradually making IPv6 available to more customers (in parallel with IPv4). Google have statistics for IPv6 adoption, showing the percentage of their users who connect to Google services over IPv6; this includes the Google search engine, along with Gmail, YouTube, etc. Globally, that’s now up to 38%, with the UK on 44%, the USA on 50%, and France in the lead on 71%.

So, this is a good time to summarise the current state of IPv4 exhaustion; what does it mean, and how significant is it? In brief, we’re now at the point where UK ISPs can’t get any new IPv4 addresses; they’re almost at the point of operating a “one in, one out” system, i.e. they’ll have to reclaim addresses from old customers in order to issue them to new customers.

Delete Exchange database

When you try to delete a mailbox database from Exchange, you might see an error like this:

Wall of text: a long error message with red text on a black background.

At first glance, that’s not very user-friendly! I’ve seen some people get stuck at this stage and ask for help. However, the error message does actually tell you everything you need to know.

CySA+ (CS0-001)

In March 2020, I took CompTIA’s CySA+ (Cybersecurity Analyst) exam. Along with PenTest+, this bridges the gap between Security+ and CASP. In simple terms, PenTest+ is about “red team” activities (attack) whereas CySA+ is about “blue team” activities (defence). This certification was launched in 2017 as CSA+, but it was rebranded in January 2018 because someone else had already registered “CSA” as a trademark. The exam (CS0-001) stayed the same, although this was retired in October 2020.

NB The CS0-002 exam was launched in April 2020, giving a 6 month overlap, but this blog post covers the older exam. I noticed a bit of overlap between CS0-001 and PT0-001 (possibly because CySA+ launched first), so I’m guessing that CS0-002 will make them more distinct, but I can’t confirm that.

Thinking about the target audience for this certification, it seems to cover a hybrid role. Some of the objectives cover hand-on skills, e.g. configuring a firewall or doing forensic analysis on a PC that’s infected with malware. Other objectives are on the management side, e.g. risk assessments and data classification.

Palo Alto Networks Certified Cybersecurity Associate (PCCSA)

Palo Alto Networks make security products. In particular, they sell firewalls (physical and virtual), and their Panorama software will let you manage multiple firewalls centrally (e.g. for branch offices). Their certification program has 3 tiers:

Entry level
Administrator
Engineer

Palo Alto Networks offer free training for all of these, although you have to pay for the exam. Even if you don’t do the exam, the training might be worthwhile on its own merits.

In December 2019, I took the entry level exam. At the time, that was the Palo Alto Networks Certified Cybersecurity Associate (PCCSA). However, that exam is being retired at the end of this month (2021-01-31), to be replaced by the Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET). This is basically a rebranding exercise; I assume that it was confusing to have “Associate” (PCCSA) and “Administrator” (PCNSA) certifications which both ended with an A. According to the FAQ: “PCCSA certified individuals will have their credentialing status grandfathered into the upgraded PCCET certification framework.” The syllabus has been revised at the same time, to keep it up to date, but it looks much the same as before.

In brief, this exam is “what” rather than “how”, i.e. it’s all about the concepts rather than the implementation. In that respect, it’s quite similar to Microsoft 365 Fundamentals, and both exams are a similar price ($100/£70). When I did the training, the videos were about 50% advertising for Palo Alto Networks products; the pdf (ebook) was a bit more restrained, but there was still quite a bit of marketing/advocacy in there. E.g. the course will describe what WildFire and GlobalProtect are used for, but not how to configure them. By contrast, the exam was much more general, so there was a lot of overlap between this, Security+, and the SSCP.