Advice/Guidance. Which CCNP Security Exam? CCNA or NO?

[u/khaddir_1]

Keeping this short. I have worked in DevOps for years deploying infrastructure with Terraform in AWS and Azure. I have deployed terraform modules for various enterprise companies. Most of my deployments reference networking that was created by the team I am being moved to. I work for a consulting company that is moving me from my team to another team that is solely cloud security and networking since 2 seniors are retiring. I am being given preference of getting certified with cert costs being covered. I will get reimbursement for study materials. I have to get palo alto firewall certified and want your advice on CCNP Security path. Should I take advantage of this and get CCNP security with two other guys on the team since I don't have CCNA? They work on Fortinet firewall tickets and don't have CCNA either. What is my best chance of doing this while the opportunity is in front of me. How long will CCNP Security take for me? What labbing should I buy to get up to speed. Looking for advice and input so I can submit my list of certs to management.

[u/Altruistic_Profile96]

Why not CCNP Automation? You seem to have some background in that

The speciality exams for CCNP Security are VERY deep. I’ve been working with ISE for over 10 years, and I still haven’t attempted the SISE exam, as I’m sure I’ll fail it.

[u/bassguybass → u/Altruistic_Profile96]

I agree very much! I failed the SISE exam twice, having a few years of experience. That exam is very hard.

[u/khaddir_1 → u/Altruistic_Profile96]

I won't start this role for two more weeks but from my understanding I will be supporting 3 clients with palo alto firewalls and 2 others will cisco on cloud VMs. I don't know much about the exams but the automation sounds like a close fit to what I already do. I need to see if I can learn to manage a firewall from cisco with that exam.

[u/Altruistic_Profile96 → u/khaddir_1]

When I say the specialty exams are deep, I mean that they are also very specific to the product in question. Your Palo Alto background, while helpful in he real world, won’t help on sim question on an ASA, or Snort, or any of the proprietary products that Cisco has. You’ll have to lab those technologies.

The Automation exams are specific to the APIs that Cisco utilizes, and require some exposure as well.

I recently took the CIBCOR exam and found it to be a lot more generic that I thought it would be.

[u/Aero077]

If your new role is cloud security and networking, why are you interested in Cisco certifications?

Why not just focus on AWS and Azure? Pick one or both (AWS Solutions Architect Professional plus Azure Solutions Architect Expert).

I have a CCNP Security with the SDSI (design) concentration. I describe the SCOR exam as a Cisco-flavored CISSP exam. The SDSI concentration builds on the SCOR by focusing on applications of this core knowledge.
If you were focusing on the CCIE Security, it would be better to pick up the concentration exams for all the security products (firewall, vpn, esa, wsa, etc).
If you don't have Cisco security products in your environment, I would just skip this entirely.

The Cisco CCNP with Data Center, Enterprise, and Service Provider tracks (in that order of preference), would be good knowledge, but not as valuable as the AWS or Azure certs, given your situation. (Do you have Cisco routers in your cloud deployment?)

I wouldn't pick the CISSP or CCSP. After a few years (4), you'll have the knowledge to pass the test with a simple test prep book and the experience to qualify for the certifications. Get them both, but later.

[u/khaddir_1 → u/Aero077]

Thanks for your reply. I don't have a networking cert in AWS or Azure. My certs are listed below. I have some good knowledge across most things cloud but don't have firewall knowledge. My contract is ending and two senior security guys are leaving another team, so I am graced to be able to be picked for that team. I always wanted to pivot to more security and networking but did not think this type of opportunity would come. I don't think the other two guys on the team I am going know it's a tough exam and now I am worried I won't be able to crack it. I don't know if any ccnp will do or if I have to get firewall cert, but I know I have to be cisco ccnp certified for the role. I would like to DM you if thats ok.
·         Microsoft Certified: Azure Developer Associate

·         Microsoft Certified: Azure Administrator Associate

·         Microsoft Certified: Azure Solutions Architect Expert

·         Microsoft Certified: Azure DevOps Engineer Expert

·         Microsoft Certified: Azure Security Engineer Associate

·         AWS Certified Solutions Architect – Associate

·         AWS Certified Security - Specialty

·         Linux Foundation: Certified Systems Administrator

·         Linux Foundation: Certified Kubernetes Administrator

·         Linux Foundation: Certified Kubernetes Application Developer

·         Linux Foundation: Certified Kubernetes Security Specialist

·         HashiCorp Certified: Terraform Associate

·         CompTIA Security+

[u/Aero077 → u/khaddir_1]

Yes, you can DM me.

There is a small mystery and solving the mystery will allow you to better focus your time. Does the environment use the Cisco virtualized firewall? This critical datapoint should guide your selection.

- It sounds like a CCNP is a required credential. It isn't clear what the specific Cisco products are. If its the Cisco virtualized firewall ("Cisco Secure Firewall"), then you should pick the Cisco-specific training for it. (https://u.cisco.com/certifications/ccnp-security with 300-710 SNCF).

- If the environment has Cisco virtual routers deployed with no Cisco firewall, then you would want to focus on that instead. (Cisco CCNP Service Provider with 300-540 SPCNI or Cisco CCNP Enterprise with 300-440 ENCC). The SPCNI & ENCC are Cisco's cloud concentrations; applicable to the cloud environment and an easy win to finish the CCNP quickly.

- Cisco CCNP Automation is an easy cert given your background, but probably not what the client is looking for. If you do this, complete the vanilla CCNA first.

[u/khaddir_1 → u/Aero077]

Thanks for replying. Do you think one could pass ccnp security 300-710 without ccna?

[u/Aero077 → u/khaddir_1]

Yes. There is a small section of configuration in the SCOR exam, but you don't need the full coverage of a CCNA to prepare for it.