SC study plan
SC · Give each week a clear focus.
8 weeks · About 7 hours per week
Security and Risk Management
Define each core security triad element and classify 10 real-world incidents against confidentiality, integrity, and availability impacts.
Draft a risk register with 8 entries, assigning likelihood and impact scores and computing a simple risk value for each.
Distinguish qualitative from quantitative risk analysis by computing SLE, ARO, and ALE for 3 sample scenarios.
Map 6 common control types (preventive, detective, corrective, deterrent, compensating, recovery) to concrete examples you can defend.
Your checkpoint
A one-page risk register plus a written summary showing ALE calculations for 3 scenarios and the control type assigned to each mitigation.
Security and Risk Management & Identity and Access Management
Summarize the key elements of a security policy framework (policy, standard, procedure, guideline) and produce one example of each.
Compare at least 4 access control models (DAC, MAC, RBAC, ABAC) and state one scenario where each is the best fit.
Explain the identity lifecycle (provisioning, review, deprovisioning) and identify the control failures behind 3 sample offboarding incidents.
List the main legal and regulatory categories (privacy, breach notification, industry-specific) and match them to the data types they govern.
Your checkpoint
A two-page policy framework outline with a model-selection matrix that maps 6 scenarios to the correct access control model with justification.
Security Architecture and Engineering & Communication and Network Security
Diagram the OSI and TCP/IP models side by side and label the security controls that operate at each layer.
Explain symmetric vs asymmetric encryption and select appropriate use cases for AES, RSA, and ECC without confusing key management roles.
Describe how TLS establishes a session, including certificate validation and the role of the CA chain.
Identify the function of common network security devices (firewall types, IDS/IPS, WAF, proxy) and place each on a reference topology.
Your checkpoint
A labeled network reference diagram with at least 8 security devices placed by layer, plus a one-page cryptography comparison table.
Security Architecture and Engineering & Communication and Network Security
Compare network architectures (segmentation, DMZ, VLANs, SDN) and state the security tradeoff of each.
Differentiate symmetric and asymmetric key distribution problems and explain how hybrid encryption solves them.
Classify 10 attack types (spoofing, MITM, DoS, injection, on-path) by layer and by the control that mitigates each.
Explain secure design principles (least privilege, defense in depth, fail-safe defaults, separation of duties) with one architecture example each.
Your checkpoint
A segment-by-segment threat model for a three-tier web application that lists at least 10 threats, the layer each occurs at, and a mitigating control.
Asset Security & Security Operations
Classify data by sensitivity and define handling requirements for each classification tier.
Describe data lifecycle stages (creation, storage, use, sharing, archive, destruction) and the control expected at each stage.
Sequence the incident response lifecycle and write the first three actions for a suspected data exfiltration event.
Explain the purpose of BCP and DRP, and distinguish RTO from RPO using a concrete recovery scenario.
Your checkpoint
A data classification and handling matrix covering 4 tiers across the full lifecycle, plus a one-page incident response runbook for a data loss scenario.
Security Operations & Security Assessment and Testing
Compare backup strategies (full, incremental, differential) and select the right combination to meet a stated RTO/RPO.
Differentiate vulnerability assessment from penetration testing and from security auditing, and identify when each is appropriate.
Explain the purpose of a test coverage metric and describe how to design a test that validates a specific control.
Describe log collection, retention, and monitoring requirements and identify which events should trigger alerts.
Your checkpoint
A security testing plan that names 5 controls, the test method for each, the expected evidence, and the pass/fail criterion.
Security Assessment and Testing & Software Development Security
Explain how to conduct a risk-based assessment of a third-party or supply chain dependency.
Describe the SDLC phases and identify the security activity that belongs in each phase.
Compare SAST, DAST, and SCA and state which SDLC phase each fits best.
Explain secure coding practices for input validation, output encoding, and secrets management.
Your checkpoint
A secure SDLC checklist mapping at least 8 security activities to specific SDLC phases, plus a third-party risk questionnaire with 10 questions.
Security and Risk Management & Asset Security & Security Architecture and Engineering & Communication and Network Security & Identity and Access Management & Security Assessment and Testing & Security Operations & Software Development Security
Re-derive the highest-yield facts from every domain into a single condensed review sheet.
Complete a timed practice set and categorize every miss by domain and by cause (knowledge gap vs. misread).
Re-teach the 5 weakest concepts aloud or in writing without notes.
Build a final-week schedule that allocates remaining time proportional to your weakest domains.
Your checkpoint
A consolidated one-page-per-domain review sheet plus a scored practice log with a remediation list of the 10 weakest concepts.
Milestones
Week 2: Can explain the risk management process end to end and justify an access control model choice for any given scenario without notes.
Week 4: Can place any named security device or cryptographic primitive at the correct layer and state its primary control function.
Week 6: Can write a complete incident response sequence and select a backup strategy that satisfies a stated RTO and RPO.
Week 8: Score at or above your target on a timed full-length practice set and have a written remediation list for every missed concept.