CSIS study plan

Map each OSI/TCP-IP layer to the attacks that target it and the control that mitigates each

Compare packet filtering, stateful inspection, NGFW, WAF, and proxy placement, and justify one design for a given topology

Build a least-privilege ACL or security-group ruleset for a three-tier application and verify it allows only required flows

Contrast IPsec and TLS-based VPNs and decide which fits remote access versus site-to-site connectivity

Diagram a segmented network with DMZ, internal, and management zones and label every enforcement point

Sequence the incident response lifecycle and assign an owner and artifact to each phase for a ransomware scenario

Triage a set of sample alerts by severity and false-positive likelihood using a written rubric

Write detection logic for three high-value events (privilege escalation, data exfiltration, impossible travel)

Document evidence handling, chain of custody, and order of volatility for a compromised host

Draft an escalation and communication matrix with defined time thresholds

Apply secure design principles (least privilege, defense in depth, fail-safe defaults, separation of duties) to a sample system

Distinguish Bell-LaPadula, Biba, Clark-Wilson, and Brewer-Nash and select the correct model for a stated requirement

Classify data assets and assign owner and custodian roles in a RACI chart

Separate policy, standard, procedure, and guideline, and name the approver for each

Select administrative, technical, and physical controls for five identified risks

Score five identified risks with a qualitative likelihood-by-impact method and rank them

Justify mitigate, transfer, avoid, or accept treatment for each risk

Determine which regulations or standards (GDPR, HIPAA, PCI DSS, SOX) apply to a given data set and explain why

Distinguish due care from due diligence and describe how contracts and insurance transfer risk

Define RTO and RPO for a sample business function through a lightweight BIA

Differentiate symmetric encryption, asymmetric encryption, hashing, MACs, and digital signatures by use case

Select algorithms (AES-GCM, RSA, ECDSA, SHA-256) for stated requirements and defend the choice

Walk the key lifecycle: generation, distribution, storage, rotation, escrow, and destruction

Explain PKI chain of trust and certificate validation, including revocation and common failure modes

Identify crypto misuse such as ECB mode, weak RNG, hard-coded keys, and IV reuse

Compare authentication factors and choose an MFA approach for three different risk profiles

Differentiate RBAC, ABAC, MAC, and DAC and select one for a stated scenario

Explain SSO and federation (SAML, OIDC) and trace the joiner-mover-leaver provisioning lifecycle

Design a privileged access management approach using vaulting, just-in-time elevation, and session recording

Set an access recertification cadence and describe identity proofing steps

Map OWASP Top 10 categories to concrete preventive and detective controls

Place threat modeling, SAST/DAST, and security gates within an SSDLC

Contrast controls for data at rest, in transit, and in use, including DLP and tokenization

Explain injection, XSS, and insecure deserialization and the input validation that stops them

Apply data classification, retention, and secure disposal rules to a sample data set

Sit a full-length timed mock exam and analyze every miss down to a root cause (knowledge gap, misread, or guess)

Re-study the two lowest-scoring domains identified in the mock score report

Condense each of the eight domains into a one-page cheat sheet of memory aids and key distinctions

Practice pacing on two half-length sets, targeting under 90 seconds per question