CAP-C01 study plan
CAP-C01 · Give each week a clear focus.
8 weeks · About 7 hours per week
Web Application Security
Map the OWASP Top 10 categories to concrete exploit primitives (injection, broken access control, SSRF, auth flaws)
Configure a local vulnerable-by-design lab stack and reproduce at least three injection variants
Write remediation notes contrasting input validation, parameterization, and output encoding for each reproduced flaw
Explain session management and access-control failure modes from first principles in your own words
Your checkpoint
A lab notebook with three reproduced web flaws, request/response evidence, and a one-page remediation summary per flaw.
Web Application Security
Practice identifying and exploiting broken authentication and access-control logic in a multi-role test app
Analyze client-side controls (CORS, CSP, cookie flags) and articulate which bypasses they do and do not stop
Draft a repeatable web assessment checklist covering recon, auth, session, input, and business-logic phases
Time-box a mock assessment of a single app to 90 minutes and record where you lost time
Your checkpoint
A reusable web assessment checklist plus a 90-minute timed mock assessment write-up with prioritized findings.
Internal Network Security
Enumerate an internal lab subnet and document host discovery and service-identification techniques
Explain and safely demonstrate credential-relay and lateral-movement concepts in an isolated environment
Compare segmentation, least-privilege, and monitoring controls as mitigations for internal pivoting
Classify common internal protocol weaknesses (SMB, LDAP, Kerberos-adjacent auth) by risk
Your checkpoint
An internal-network lab report covering discovery, one lateral-movement scenario, and a mitigation table.
Internal Network Security & External Network Security
Assess an externally exposed lab service and document the full attack surface from recon to findings
Distinguish external perimeter risks (exposed admin panels, TLS misconfig, default creds) from internal-only risks
Write findings in a severity-ranked format with likelihood, impact, and evidence
Review your week 1-3 notes and consolidate recurring themes into a single concept map
Your checkpoint
A severity-ranked external assessment report (min five findings) plus a consolidated concept map of domains 1-3.
Mobile Application Security
Analyze a mobile app package to identify insecure storage, weak transport security, and hardcoded secrets
Contrast platform-specific risks (Android exported components, iOS keychain misuse) and their assessment approaches
Document how mobile auth and token handling differ from web and where that changes test strategy
Produce a mobile-specific test checklist derived from your web checklist
Your checkpoint
A mobile assessment write-up on a sample app with at least four findings and a mobile-specific test checklist.
Source-Code Analysis
Trace tainted data flow through a small codebase from source to sink and document the path
Identify injection, deserialization, and crypto-misuse patterns by reading code rather than running it
Review dependency manifests for known-vulnerable components and justify each flagged item
Practice writing precise remediation diffs for three code-level flaws
Your checkpoint
A code-review report with three source-to-sink traces, a dependency review, and remediation diffs.
Cloud Security Assessment
Enumerate cloud identity and permission risks (over-broad roles, public storage, exposed keys) in a sandbox account
Compare shared-responsibility boundaries across compute, storage, and identity services
Assess logging and monitoring coverage gaps and recommend concrete detections
Reconcile cloud findings with equivalent on-prem risks from weeks 3-4
Your checkpoint
A cloud assessment summary with at least five findings, a shared-responsibility table, and detection recommendations.
Web Application Security & Internal Network Security & External Network Security & Mobile Application Security & Source-Code Analysis & Cloud Security Assessment
Synthesize all domains into a single one-page methodology you could apply to any engagement
Complete two timed mixed-domain practice sets and log every missed concept by domain
Re-drill the weakest three concepts identified by practice-set misses
Write a personal exam-day time-allocation and triage strategy
Your checkpoint
A one-page cross-domain methodology, an error log of missed concepts with re-drill notes, and a timed exam-day strategy.
Milestones
Week 2: Can execute a full web assessment checklist unaided within 90 minutes and explain each step's purpose.
Week 4: Can describe internal lateral-movement risk and external perimeter risk separately, with a mitigation for each, without notes.
Week 6: Can trace a tainted data flow source-to-sink in unfamiliar code and justify remediation in under 20 minutes.
Week 8: Scores at least 75% on both mixed-domain practice sets and has a written re-drill log covering all missed concepts.