CCOA (ISACA) study plan

Map the OSI and TCP/IP layers to the artifacts a SOC analyst actually inspects, then label each of the 20% domain's subtopics (packet capture, flow records, DNS, HTTP/TLS, IDS alerts) with the layer it lives in

Capture live traffic with tcpdump and tshark on a lab segment, then write display filters that isolate DNS queries, TCP SYN scans, and HTTP POST bodies without touching the GUI

Explain the handshake, teardown, and retransmission behavior that distinguishes a port scan from a slowloris-style exhaustion attempt

Build a one-page cheat sheet of tshark filters you can type from memory, covering host, port, protocol, and TCP flag combinations

Detect beaconing by computing inter-arrival time variance and jitter across a flow dataset, then rank the top five candidate periodic connections

Distinguish DNS tunneling from normal high-volume DNS by inspecting query length distributions, TXT/NULL record abuse, and entropy of subdomain labels

Analyze TLS metadata (SNI, JA3-style fingerprints, certificate anomalies, self-signed chains) to flag encrypted channels that evade payload inspection

Correlate a suspicious flow with its IDS alert and decide which single indicator would justify escalation versus which needs corroboration

Enumerate the Windows event IDs and Sysmon event IDs that record process creation, parent-child relationships, service installs, and scheduled task registration, and state what each proves

Trace a process tree from an Office application to a spawned shell, then identify the parent-child pair that is anomalous and why

Inspect Linux host artifacts - auth logs, cron entries, systemd units, and shell history - to reconstruct how persistence was established

Collect volatile evidence in a defensible order and record the commands used so the acquisition can be repeated by another analyst

Normalize logs from at least three source types (endpoint, firewall, authentication) into a common field schema and document the mapping decisions

Write SIEM correlation rules that combine a failed-logon burst with a subsequent successful logon from a new source, and tune the threshold against baseline noise

Reconstruct an attack timeline purely from log timestamps, reconciling clock skew and timezone offsets between sources

Identify which log sources would be missing in a cloud-only environment and how that gap changes the detection story

Grade indicators by confidence and half-life, then decide which are worth blocking outright, which warrant monitoring, and which are too generic to act on

Enrich a set of file hashes and domains using local tooling and passive sources, and record provenance and retrieval time for every enrichment

Perform static triage of a suspicious binary - strings, imports, section entropy, packer signatures - and state what the evidence does and does not prove

Extract and interpret C2 configuration artifacts and note how malware behavior (persistence, evasion, lateral movement) should feed back into detection rules

Apply a severity rubric that weighs asset criticality, data sensitivity, and confirmed versus suspected compromise to rank five incoming alerts

Draft escalation handoffs that separate confirmed facts, analyst inferences, and open questions so the receiving tier can act without re-investigating

Decide containment timing trade-offs - isolate now versus preserve traffic for scope - and justify the choice in writing

Practice a triage interview: ask the questions that establish scope, initial access vector, and blast radius within the first ten minutes

Write a full incident report that opens with a decision-ready executive summary and follows with scope, timeline, evidence, impact, and recommendations

Translate technical findings into language a non-technical stakeholder can act on without losing accuracy or overstating certainty

Structure an evidence and findings appendix so every claim in the narrative traces to a specific artifact

Review your own report against a checklist for unsupported assertions, missing timestamps, and ambiguous ownership of follow-up actions

Run a timed end-to-end scenario that moves from a network alert through log correlation to a triage decision and a written handoff

Re-test your weakest two domains using a fresh set of self-written questions and score them against your own answer key

Rebuild your filter, event-ID, and indicator cheat sheets into a single condensed reference you can recall under time pressure

Identify remaining knowledge gaps and assign each a concrete follow-up resource and date