ACIA Capstone study guide
ACIA Capstone · Work through your exam, one topic at a time.
The ACIA Capstone is an advanced, integrative certification exam for security practitioners who already hold foundational knowledge and want to demonstrate that they can reason across domains rather than recite isolated facts. It is aimed at analysts, engineers, architects, and consultants preparing for senior or cross-functional roles, and at candidates who want a single credential that reflects end-to-end judgment. The ACIA Capstone study guide has 9 sections and about 2,965 words.
01Governance, Risk, and Compliance Frameworks
Governance is the decision-rights layer: who approves risk, who owns controls, and how exceptions are documented. Candidates must distinguish policies (management intent), standards (mandatory measurable requirements), procedures (step-by-step execution), and guidelines (recommended practice).
334 words, about 2 min02Identity and Access Management
IAM spans identification, authentication, authorization, and accounting. Know the factor categories - something you know, have, are, do, and somewhere you are - and that multifactor authentication requires factors from different categories.
345 words, about 2 min03Network and Infrastructure Security
Understand the OSI and TCP/IP models well enough to place controls: segmentation at Layer 2/3, filtering at Layer 3/4, and application-aware inspection at Layer 7. Know the difference between a stateful firewall, a stateless packet filter, a web application firewall, and a proxy.
341 words, about 2 min04Cloud and Virtualization Security
Understand the shared responsibility model and how it shifts by service model: infrastructure as a service leaves the customer responsible for OS, runtime, and application; platform as a service moves OS and runtime to the provider; software as a service leaves configuration, identity, and data handling with the customer. Know that data classification and identity are always customer responsibilities.
351 words, about 2 min05Data Protection and Cryptography
Start with data lifecycle and classification: creation, storage, use, sharing, archival, and destruction. Controls follow classification - labeling, handling rules, retention, and secure disposal (crypto-shredding, sanitization, physical destruction).
314 words, about 2 min06Threat Detection and Incident Response
Understand the detection stack: log collection, normalization, correlation, alerting, and tuning. Know data sources - endpoint telemetry, network flows, DNS, authentication logs, cloud audit logs, and application logs - and what each can and cannot reveal.
324 words, about 2 min07Vulnerability Management and Secure Development
Vulnerability management is a continuous cycle: asset inventory, scanning, validation, prioritization, remediation, and verification. Understand why prioritization must combine severity with exploitability, exposure, and business criticality - a critical score on an unreachable host may rank below a moderate flaw on an internet-facing system.
327 words, about 2 min08Security Architecture and Engineering
Architecture translates risk decisions into structure. Understand security models and principles: least privilege, separation of duties, defense in depth, fail-safe defaults, complete mediation, and economy of mechanism.
318 words, about 2 min09Capstone Integration and Case Analysis
Capstone questions test synthesis: given a scenario, identify the most significant risk, choose the control that addresses root cause, and sequence actions correctly. Work through a repeatable method - clarify the business objective, identify assets and trust boundaries, enumerate threats and existing controls, assess residual risk, then select and justify treatment.
311 words, about 2 min