CNCC(C) study plan
CNCC(C) · Give each week a clear focus.
8 weeks · About 7 hours per week
Security Technology and Controls (network, host, application, data)
Map the OSI and TCP/IP models layer by layer and state one control that operates at each layer
Explain how firewalls, IDS/IPS, proxies, and segmentation devices differ in placement and purpose
Compare symmetric and asymmetric cryptography, hashing, and PKI trust chains well enough to choose a control for a given scenario
Diagram a small enterprise network with trust zones and label where each control sits
Your checkpoint
A one-page annotated network diagram with trust zones plus a 300-word control-placement rationale
Security Technology and Controls (network, host, application, data)
Distinguish authentication, authorization, and accounting mechanisms and match each to host and application controls
Classify data by sensitivity and select encryption, masking, and retention controls per class
Identify common application weaknesses (injection, broken access control, insecure deserialization) and the control that mitigates each
Rank ten given weaknesses by exploitability and business impact
Your checkpoint
A data-classification table with at least four classes and mapped controls, plus a ranked top-ten weakness register
Network Architecture and Security Fundamentals & Security Operations, Monitoring, and Incident Response
Describe how defense in depth and zero-trust principles change architecture decisions
Explain how logging, SIEM correlation, and alert triage fit into a detection pipeline
Sequence the phases of incident response and assign an owner and artifact to each phase
Draft detection logic for two plausible attack scenarios
Your checkpoint
A two-page incident response runbook for one scenario, including detection source, escalation path, and containment steps
Risk Assessment and Security Audit
Perform a qualitative risk assessment using likelihood and impact scales you define
Translate identified risks into a register with owner, treatment option, and residual rating
Select audit techniques (interviews, sampling, configuration review, evidence collection) appropriate to a given scope
Write findings that state condition, criteria, cause, effect, and recommendation
Your checkpoint
A risk register with at least eight risks, treatments, residual ratings, and two fully written audit findings
Cybersecurity Governance, Law, and Compliance
Outline the governance layers: policy, standard, procedure, and guideline, with one example of each
Summarize the obligations that common privacy and data-protection regimes place on a security program
Explain how contractual, legal, and regulatory requirements flow into security controls
Map three client obligations to the controls that satisfy them
Your checkpoint
A compliance obligation matrix linking at least six requirements to specific controls and evidence sources
Cybersecurity Governance, Law, and Compliance & Risk Assessment and Security Audit
Build a control framework crosswalk between two common frameworks
Design a metrics set that shows whether a control is operating effectively
Plan an audit engagement end to end: scope, criteria, sampling, fieldwork, reporting
Anticipate how an auditor would test three controls you proposed earlier
Your checkpoint
A control crosswalk plus a one-page audit plan with scope, criteria, sampling approach, and timeline
Consulting Practice, Solution Design, and Client Communication
Elicit client requirements and separate stated wants from underlying business needs
Structure a solution recommendation that ties each component to a requirement and a risk
Write an executive summary that communicates risk in business terms without jargon
Handle a scope-change or disagreement scenario in a written client response
Your checkpoint
A five-page client-facing solution proposal covering requirements, recommended design, risks, and cost considerations
Security Operations, Monitoring, and Incident Response & Consulting Practice, Solution Design, and Client Communication & Network Architecture and Security Fundamentals & Cybersecurity Governance, Law, and Compliance & Risk Assessment and Security Audit & Security Technology and Controls (network, host, application, data)
Consolidate weak areas by re-testing every domain and logging missed concepts
Practice explaining a technical control to a non-technical stakeholder in under two minutes
Complete two timed mixed-domain practice sets and review every wrong answer
Finalize a one-page reference sheet of formulas, frameworks, and decision rules
Your checkpoint
A scored full-length practice result log with a remediation note for each missed item and a final one-page reference sheet
Milestones
Week 2: Can select an appropriate control for any given data class or application weakness without notes, scoring at least 80% on a self-made 20-question quiz
Week 4: Produces a complete risk register and a well-formed audit finding from a short scenario within 45 minutes
Week 6: Explains how a legal or regulatory obligation becomes an auditable control, tracing the full chain, and passes a 30-question mixed quiz at 75% or higher
Week 8: Scores 80% or higher on two timed mixed-domain practice sets and can name the remediation for every missed item