CCST Cybersecurity study plan

Define the CIA triad and give one realistic breach example for each leg

Classify at least 15 security controls as preventive, detective, or corrective

Distinguish authentication, authorization, and accounting and map each to a concrete example

Explain least privilege, separation of duties, and defense in depth in your own words

Compare symmetric and asymmetric encryption and state when each is used

Identify the three authentication factors and give two examples of each

Describe how hashing differs from encryption and where each appears in practice

Match common security policies (AUP, password, BYOD) to the risk each mitigates

Label the OSI and TCP/IP layers and place five common protocols on the correct layer

Identify well-known ports (22, 53, 80, 443, 3389) and the risk of exposing each

Contrast stateful firewalls, stateless ACLs, and proxies by what each inspects

Explain network segmentation, DMZ, and VLAN use in reducing blast radius

List wireless hardening steps including WPA2/WPA3, SSID hygiene, and rogue AP detection

Describe the malware families (virus, worm, trojan, ransomware, rootkit) and one detection signal for each

Outline an endpoint hardening checklist covering patching, host firewall, and disabling unused services

Distinguish signature-based, heuristic, and behavioral detection

Explain how EDR differs from traditional antivirus in what it collects and acts on

Differentiate vulnerability, threat, and risk and use each correctly in a sentence

Walk through the vulnerability management lifecycle from discovery to verification

Interpret a CVSS base score and rank five given findings by priority

Choose a mitigation strategy (avoid, transfer, mitigate, accept) for four sample risks

Sequence the incident response phases from preparation through lessons learned

Classify five sample events as true positive, false positive, or benign by triage criteria

State evidence-handling basics: chain of custody, order of volatility, and hashing

Identify who to notify and when for a suspected data breach versus a commodity malware infection

Re-run practice questions from Domains 1-3 and log every miss by root cause

Complete two timed 25-question mixed sets and compute your per-domain accuracy

Rewrite your three weakest concept notes using plain language you could explain to a colleague

Connect at least three incident-handling steps back to a specific risk treatment from week 5

Complete a full-length timed practice exam under test conditions

Review every missed item and confirm the correct reasoning without notes

Recite the key frameworks (CIA, IR phases, risk treatment options) from memory

Re-test the tracker items from week 7 and verify they now pass