C-SWCM study plan

Map the OWASP-style injection taxonomy into a one-page threat-model worksheet linking each flaw to a trust boundary

Trace how untrusted input flows from HTTP parameters through a controller to a database driver, and annotate three interception points

Write vulnerable and remediated pairs of code samples for SQL injection, reflected XSS, and OS command injection

Explain parameterized queries, output encoding context, and argument-array process execution with a short written rationale for each

Construct a local test lab with a deliberately vulnerable app and a proxy interceptor, and confirm traffic capture works

Craft and execute at least ten injection test payloads across SQLi, stored XSS, and command injection against the lab app

Classify each payload result as confirmed, likely, or false positive, and record the evidence that supports each verdict

Draft remediation guidance for every confirmed finding using the code fixes built in week 1

Build a reusable assessment checklist covering scoping, reconnaissance, authentication testing, and reporting

Perform an authenticated crawl of the lab app and enumerate endpoints, roles, and parameters into an inventory

Rate five findings on a standard severity scale and justify each score with exploitability and impact

Practice writing an executive summary that translates technical findings into business risk in under 300 words

Diagram a complete authentication and session lifecycle, marking where credentials, tokens, and session identifiers are created, stored, and invalidated

Implement and test session fixation, weak logout, and missing re-authentication defenses in a sample application

Compare role-based, attribute-based, and policy-based authorization models and select one for a described scenario with written justification

Identify at least three insecure design patterns in a code review exercise and propose a secure architectural alternative for each

Classify data handled by a sample application into sensitivity tiers and specify protection controls for each tier

Demonstrate correct use of a vetted cryptography library for hashing passwords, encrypting data at rest, and generating random tokens

Identify and correct at least four common cryptographic misuse patterns such as static IVs, weak hashing, and hardcoded keys

Document secure handling of secrets across code, configuration, and deployment environments

Harden a sample web server and API configuration by applying headers, TLS settings, method restrictions, and rate limiting

Assess a containerized deployment for at least five misconfigurations and write the corrective configuration for each

Define logging and alerting requirements that would detect injection attempts and authentication anomalies

Draft an incident response runbook for a suspected data breach covering detection, containment, eradication, and notification

Integrate security activities into each phase of a software development lifecycle and map them to a delivery timeline

Perform a lightweight risk assessment on a sample feature using likelihood and impact scoring

Identify the compliance obligations that apply to a described application handling personal data and note the evidence each requires

Run a timed 60-question mixed-domain practice exam and log every missed question by domain

Re-study the three domains with the lowest practice exam scores using targeted review notes

Complete two additional timed practice exams under exam conditions and compare scores against week 7

Rewrite every missed concept as a one-sentence rule you can recall without notes

Assemble a final one-page reference sheet of decision rules for the highest-frequency exam traps