Cisco strike again! Another exam without official study material. Seems if you want to pass an exam these days you either have to take the course, or use cisco.com and pray that you cover everything!

I recently took and passed this exam and used the following:

Security Threat Mitigation and Response: Understanding Cisco Security Mars - Cisco Press

Security Monitoring with Cisco Security Mars - Cisco Press

As an engineer, the latter will appeal to you more. It is very much focused around real-world information. It has all the practical information you could need to understand administering and maintaining a MARS deployment. This book also covers the relationship between Global and Local controllers, which the STM book only briefly touches on.

The first book, Security Threat Mitigation and Response, Is also a very useful read. It takes you through the process of setting a MARS box up and adding reporting devices, all the way through to more advanced topics.

There is definitely a fair amount of overlap between these books, but you NEED both in my opinion.

Lastly, and this is simply the most important thing, you must have plenty of hands on experience with MARS, after-all this is why you are trying to pass the exam…. to better yourself. I worked with MARS day in, day out for months before even considering taking the exam. In the end, I had worked with it so much I figured I may as well just go take it.

One thing to bare in mind is that the 642-544 Exam appears to be based on older code. I couldn’t quite place it, but it certainly isn’t up to 4.3+ level,  and wouldn’t be given the age of these releases. This means that you need to read the 4.1 User and Setup guides on Cisco.com to be safe, maybe even older. Unfortunately, until Cisco releases an official Study Guide, I’m not sure there is a way to find out what release they are testing on.

 Feel free to ask any questions via the comments function. Be aware, that any questions you ask should follow Cisco’s certification guidelines. I will not be providing any information that is in violation of these terms.

This entry was posted on Sunday, December 16th, 2007 at 4:03 pm and is filed under Study Related. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.