CCSE R80 - Study Recommendations

[Maik]

Hey guys,

I am planning to achieve the CCSE R80 in the upcoming months, this summer.

In about 2 weeks I will attend the official training to get a first overview and look into the topics.

After pre-checking the CCSE R80 website I realized that the study guide is outdated and still refering to the R77 exam. So I searched through CheckMates and found out, that the R80 CCSE study guide is still in development and the currently available study methods appear to be:

- the offcial training

- the test exam (after studying, to verify your knowledge)

- the exam overview that lists all the topics

Now my question is, do you guys have any recommendations do study for the CCSE R80 right now? I achieved my CCSA R80 about one year ago and never really worked with systems under R80 (except 64k appliances that run 76.50, but the management server is running R80 or some lab environments). So I am not sure if the "outdated" study guide is still fine to use.

If you can recommend me any books or video courses (or websites/in general any information) I'd be very glad.

Thanks in advance and best regards,

Maik

[Maik · Accepted solution]

Hello guys,

Not sure if anyone is interested in this, but as I passed the CCSE R80 today I thought it would be a good idea to write down some study recommendations, as no one answered this thread.

So as mentioned above you should attend the official training if possible.

The lab guide that comes with it contains lots of useful information not only regarding the actual practices and possibilities but also regarding the exam itself - make notes especially regarding small hints like port numbers and so on.

In addition to that I read the following documents and Checkmates Threads:

- ClusterXL Admin Guide

- Gaia Admin Guide

- Threat Prevention Admin Guide

- R80.x Security Gateway Architecture (Logical Packet Flow) 

- R80.x Security Gateway Architecture (Content Inspection) (thanks to Heiko Ankenbrand‌ for both docs as well as the other pulications from him - really useful!)

- several SKs like sk97638 (processes and daemons), sk114395 (Automatic creation of Proxy ARP for Manual NAT)

- attended the online course for the SandBlast admin accrediation - VERY useful not only for the CCSE and it's also free for CheckMates members, so what are you waiting for?

And of course: Build a lab! Practice everything that is shown in the documents, get hands-on experience and realize how to proceed further if something should not work as intended (from your point of view ).

Also; repeat the CCSA course ware (if you have any) and take a look at the example CCSA questions that are listed in the CCSA study guide - it will defnitely show you your weak points and also the facts that you already know. If you should discover any weak points - dig deeper into the related topic until you feel fine about it and your knowledge regarding it. Learn topic wise - like e.g. focus just on SecureXL for a week, the next week CoreXL etc and summarize everything you learn so that you have notes. This is especially useful for commands that you will not need everyday but that still provide a huge benefit or are even required in some circumstances.

And be prepared that some questions feel weird while reading them... due to incorrect sentence formulation and grammatical mistakes. But overall I only had 1-2 questions that itself did not make any sense at all. I wrote comments during the exam, so that Check Point can review them - so hopefully that will change for the upcoming CCSE attendees

That's kinda everything that I did, summarized. Of course there were other things like checking CheckMates nearly to everyday to read about the latest problems in the community and benefit from the different solution approaches that all the members are writing. But that's just an addition if you really want to dig into the topic completely. I studied about 3 months with the methods mentioned above, 2 months of the time with daily studying and yeah - seems that it worked.

Hopefully somebody can benefit from these words, as I would have been quite happy to read something like that when I started with the CCSE - especially as I started with Check Point within the R80 revision. Maybe we will also see an official study guide in the future.

Edit: Just watched Video Link : 7987  - this video is by far the most useful one I've seen so far regarding Secure and CoreXL + advanced tweaks. Definitely also watch this if you are preparing for your CCSE.

Edit 2: Event Management & Reporting with Smart Event (R80.20)

Very interesting explanation of the log & analysis features in R80. Some things are at CCSA level but a few details of this video are definitely going to help you with the CCSE as well as daily business. 🙂

Regards,

Maik

[_Val_]

Thank you Maik Dummer‌, this is a very useful write-up.

[Dario_Ferroni]

Hello Mark,

Thanks a lot for the shared Information, very useful.

Do you think it can also help some sort of Test Engine for practicing the Questions, like VUE or Testking etc.

Thank you

Dario

[Maik]

Hello Dario,

The practice questions offered by Check Point via PearsonVue are definitely helpful to verify if you understood the topics.

It also gives you an idea based on the question wording and the direction. As far as I know these questions are the only official ones.

Every other source must be some illegal stuff which is definitely not recommended and not allowed at all.

Regards

[Anthony_Britti1]

Appreciate this, had the same question and wanted to know how to go about this. Been trying to get CheckPoint to do some live training since we are partners with them, but this will work.

[Di_Junior]

Hi Maik

Can you please direct me to the link where I can take the Sandblast Admin Accreditation Course?

Kind regards

Dialungana Malungo

[Maik]

Hey,

I think the course is not available anymore.

You could attend it by registering on a online learning platform provided by checkpoint from ~ August until December 2018. Could be the case that I am mistaken here and it is still - somehow - possible to attend. I guess to be on the safe side you should ask someone from Check Point.

Regards

[Alessandro_Marr]

Thak you Maik, please, any tip about how to study chain modules?

[Maik]

Hey Alessandro,

I primarely used the information from the official CCSE course regarding the topic of chain modules.

But I don't think that you need a deep understanding for it in regards to passing the exam.

Just be familiar with the chain modules itself (what is it, what does it telll you, how can you display them etc.) and you should be fine.

I also read this blogpost [external link] in order to get additional information.

Regards

[Goadsta]

I'm starting on the long road to CCSE so want to know if there are any videos for CCSA and CCSE please.  I know its a lot of work but have just finished my cisco CCIE lab so have lots of spare time 🙂

Thanks

[HeikoAnkenbrand]

@Maik

Yes, this is a very useful write-up to learn for ccse and ccsa.

[Goadsta]

Thanks for the quick reply but was wondering about videos.  I see cbtnuggets do training but is there anything else?

Thanks

Iain

[Maik]

Hey Goadsta,

I know the CBT video series regarding the CCSA R80. It's a nice start if you have access to it. As far as I know it also includes some online labs without the need to set it up on your own machine. But of course own labs provide a (in most cases) better performance while also allowing you to add several other things to your environment 🙂

That being said - give it a try, but also read the R80 Administration Guide for Security Management.

In addition to that you should search for the CCSA study recommendations here on Check Mates - there are at least a dozen of threads that all mention the same or different study styles as well as links and other useful information.

In regards to the CCSE this thread seems to be the only one that lists details, as the official Check Point study guide still references to an quite old version. (The CCSA study guide was renewed to fit R80 btw, you can find it on the official CCSA page  @CheckPoint.)

Regards,

Maik

[MN]

Hi Maik,

Thanks for the study recommendations. I am planning to take CCSE Exam in 2 months as my CCSA is going to expire soon. The second link, Event Management & Reporting with Smart Event, is dead. Do you have some other links for Smart Event?

Any other new suggestions would also be welcome.

Thanks.

Manish.

[CP_user2020]

Let me make a complain about this topic: I tried to pass the CCSE R80 exam in the late 2018, and I didn't pass.

Before, I attended a 1 week full-time official course, I read the official CCSE manual and still when I read those crazy, non-sense questions, I realized that they could NOT be answered just by studying "officially": in simple words you CAN NOT find those topics, commands, even names just following the official paths.

Now let's move to the dark side...
Of course we all know that dumps are not official nor recommended, and they are "illegal" (still I don't know how it is possible to find dozens of official websites that sell them... but ok).
They have a lot of mistakes and bla bla bla.
BUT, to be honest I think that they should be cleared, since by using them I've been aware of what questions I should answer AND go studying the specific topics, AND then... remembering them when actually working on the field.

And in the end this what I mean about knowing something, what I actually need to be an expert.

I found out that some questions can be answered only AFTER looking for that specific command, buried in a specific SK!!!
Some questions don't make sense at all, others point to names not used in the official products, and so on.
And this is not about how these dumps are made, I remember clearly those crazy questions.

Many of us are not working full-time on CheckPoint firewalls or facing all the possible scenarios and weird problems, but at least it would be nice to be able to pass an exam by studying and attending in official, well paid, courses.

End of my complain 🙂