CCSM Elite R82 study plan

Map the eight exam domains to your current knowledge by scoring each one from 1 to 5 and recording the evidence behind each score.

Explain the security models Bell-LaPadula, Biba, Clark-Wilson, and Brewer-Nash, and state for each the property it enforces and one real scenario where it applies.

Draw the Common Criteria evaluation levels and the TCSEC divisions from memory, then correct your diagram against a reference.

Differentiate trusted computing base, reference monitor, and security kernel, and identify which boundary each one protects.

Classify five system designs you know as centralized, decentralized, or hybrid, and justify each classification in two sentences.

Apply the OSI model layer by layer to a single end-to-end transaction, naming the protocol and the attack surface at each layer.

Compare TLS, IPsec, and SSH by their placement in the stack, their key exchange mechanism, and their typical failure modes.

Design a segmented network for a three-tier application, placing firewalls, DMZs, and VLANs, and state the trust boundary at each hop.

Explain how ARP spoofing, DNS cache poisoning, and BGP hijacking differ in scope and mitigation.

List the security properties of common wireless standards and identify which ones address confidentiality versus authentication.

Perform a qualitative risk assessment on a scenario with at least six assets, scoring likelihood and impact and ranking the results.

Compute single loss expectancy, annualized loss expectancy, and annualized rate of occurrence for three asset scenarios and interpret the output.

Compare risk transfer, avoidance, mitigation, and acceptance, and select the appropriate response for each ranked risk with a written rationale.

Draft a risk register with owner, treatment, residual risk, and review date for every identified risk.

Explain how a security steering committee and a defined risk appetite shape treatment decisions.

Build a data classification scheme with four tiers and assign handling rules for storage, transmission, and destruction at each tier.

Map the roles of data owner, data custodian, and data processor, and assign each role to a named function in a sample organization.

Sequence the asset lifecycle from acquisition through decommissioning and identify the security control that applies at each stage.

Describe retention, legal hold, and secure destruction requirements and explain how each constrains the others.

Explain how privacy principles such as data minimization and purpose limitation affect collection and retention decisions.

Compare authentication factors and select an appropriate multi-factor combination for three user populations with different risk profiles.

Explain federation protocols including SAML, OAuth 2.0, and OpenID Connect, and state precisely what each one does and does not provide.

Design a role-based access control model for a sample organization, including role explosion risks and a mitigation.

Differentiate discretionary, mandatory, and attribute-based access control and match each to a scenario where it is the better fit.

Outline the identity lifecycle from provisioning through deprovisioning and identify the control that prevents orphaned accounts.

Distinguish vulnerability scanning, penetration testing, and code review by their objective, authorization requirement, and output.

Interpret a sample scan report, prioritize findings by exploitability and business impact, and write remediation guidance for the top three.

Explain coverage metrics and how to design a test that measures whether a control actually works rather than whether it exists.

Sequence the incident response phases and describe the decision point at each phase using a ransomware scenario.

Compare log sources and monitoring approaches, and state which event types each one reliably detects.

Explain change management, backup strategy, and recovery testing as operational controls and the failure each one prevents.

Explain secure development practices including threat modeling, security requirements, and code review, and place each in the development lifecycle.

Apply STRIDE to a login and payment flow and record at least one mitigation per identified threat.

Describe common vulnerability classes such as injection, broken access control, and insecure deserialization, and the coding control that prevents each.

Compare the security responsibilities of SaaS, PaaS, and IaaS providers and state where the boundary shifts.

Outline how CI/CD pipeline controls, dependency management, and environment separation reduce release risk.

Re-score all eight domains against your week 1 baseline and identify the three weakest areas with supporting evidence.

Complete a timed full-length practice set and categorize every incorrect answer by domain and by failure type, whether knowledge gap or misread question.

Re-teach your three weakest concepts aloud or in writing without notes, and correct any gaps revealed.

Review your architecture cheat sheet, risk register, access control design, and incident runbook, and consolidate them into a single reference.

Write a day-before-exam checklist covering logistics, timing strategy, and the topics you will review last.