Certified Cybersecurity Technician - Module 07 - Network Security Controls - Technical Controls - Labs (EC-Council) (Z-Library)

【One-Line Pitch】 A hands-on lab manual for building and testing core network security controls—host and network firewalls, IDS, honeypots, and VPNs—inside a guided virtual environment. Best for CCT candidates and entry-level defenders who learn by doing, not by reading theory. 【Book Arc】 - **Opening (~0%–15%)**: Orients you to the lab environment and the nine recommended exercises, then walks through host-based firewall protection using iptables on Linux, including rule creation, listing, and deletion. - **Early (~15%–31%)**: Moves to Windows Firewall for host-based control (inbound rules, blocking Remote Desktop and FTP), then shifts to network-based firewalling with pfSense—blocking unwanted websites via aliases and rules. - **Middle (~31%–54%)**: Extends pfSense work to blocking insecure ports and scheduling rules, then introduces detection: deploying the Wazuh HIDS agent and beginning Suricata IDS setup with npcap and Splunk. - **Late (~54%–77%)**: Completes the Suricata pipeline—configuring YAML, forwarding logs to Splunk, running a Hydra brute-force attack, and verifying alerts—then covers honeypot traffic detection with HoneyBOT. - **Ending (~77%–100%)**: Closes with VPN fundamentals and a SoftEther VPN lab for establishing secure remote connections; excerpts do not cover the final exercise on Kaspersky virus scanning in detail. 【Key Takeaways】 - **Technical controls are learned by configuring, not memorizing** (Opening): the manual's value is in step-by-step tool operation across nine labs, from iptables to SoftEther. - **Host-based and network-based controls are complementary layers** (Early): iptables and Windows Firewall protect individual machines, while pfSense enforces policy across the network—readers see both sides. - **Firewall rules follow a consistent logic** (Early–Middle): action, interface, address family, protocol, and scheduling recur across pfSense exercises, making rule syntax transferable. - **Detection requires an end-to-end pipeline** (Middle–Late): Wazuh agents report to a manager; Suricata captures packets via npcap, writes alerts to fast.log, and forwards them to Splunk for analysis. - **Attacker simulation validates defenses** (Late): a Hydra brute-force from the attacker machine generates Suricata alerts visible in Splunk, closing the detect-and-verify loop. - **Honeypots reveal what firewalls miss** (Late): HoneyBOT logs ports and remote IPs from unsolicited requests, offering a lightweight early-warning view. - **VPNs solve secure remote access economically** (Ending): the SoftEther lab frames VPNs as a cheaper alternative to leased lines, using tunneling and encryption over public networks. - **Lab hygiene matters** (Throughout): repeated notes on rebooting pfSense, clearing browser cache, and deleting rules show that state management is part of the skill. 【Reading Tips】 - **Deep-read the pfSense exercises (Early–Middle)**: rule creation, aliases, and scheduling are the most transferable skills; skim the repetitive login/navigation steps. - **Treat the Suricata–Splunk chain as one unit (Middle–Late)**: configuration files (suricata.yaml, inputs.conf) are easy to misplace—follow the file paths carefully. - **Use the attacker-machine steps as validation checkpoints**: if Hydra doesn't trigger alerts, revisit the IDS pipeline before moving on. - **Skim the VPN overview if you know IPsec basics**: the lab steps are the real content; the conceptual section is brief. - **Keep the pfSense VM running throughout**: the manual explicitly warns that many labs depend on it. 【Coverage Limits】 This guide covers the nine lab exercises and their toolchains as reflected in the excerpts; the final Kaspersky exercise and any concluding assessment material are only mentioned, not detailed.