CSA (Other exams) study plan

Map the security architecture foundations domain into a one-page concept outline covering governance structures, control categories (preventive, detective, corrective, compensating), and the security architect's decision rights

Explain, in writing, how security strategy, business drivers, and risk appetite flow into architecture principles and standards

Distinguish security governance bodies and their outputs (policy, standard, procedure, guideline) using a self-built comparison table

Draft five architecture principles with rationale and a measurable compliance check for each

Build a comparison matrix of major security frameworks (ISO 27001-style ISMS, NIST CSF functions, NIST 800-53 control families, COBIT) showing scope and intended audience

Perform a qualitative risk assessment on a fictional organization: identify assets, threats, vulnerabilities, and score likelihood and impact

Select and justify risk treatment options (mitigate, transfer, avoid, accept) for the top five risks

Describe how compliance obligations and audit findings feed back into architecture decisions

Compare authentication factors and authenticator assurance levels, and state where multi-factor authentication is mandatory in an architecture

Diagram a federated identity flow (identity provider, service provider, assertions, tokens) and label trust boundaries

Differentiate role-based, attribute-based, and policy-based access control with a worked example of each

Explain privileged access management controls including just-in-time elevation, session recording, and credential vaulting

Identify common identity attack paths (credential stuffing, token theft, lateral movement via service accounts) and the architecture countermeasure for each

Design a segmented network for a three-tier application, placing zones, enforcement points, and east-west controls

Compare stateful inspection, next-generation firewalls, and microsegmentation on enforcement granularity and operational cost

Explain zero-trust principles and translate them into concrete network policy statements

Describe secure remote access and site-to-site designs, including where encryption terminates and why

Identify detection gaps created by segmentation and specify the logging needed to close them

Map the shared responsibility model across infrastructure, platform, and software as a service, listing who owns what for a chosen workload

Compare hypervisor, container, and serverless isolation models and their respective attack surfaces

Explain how workload identity, secrets management, and key custody differ in cloud versus on-premises environments

Describe cloud posture management, baseline hardening, and drift detection as architecture controls

Draft a cloud landing-zone control checklist covering network, identity, logging, and encryption

Select appropriate cryptographic primitives for data at rest, in transit, and in use, and justify key length and algorithm choices

Design a key management lifecycle covering generation, distribution, rotation, revocation, and destruction

Classify data by sensitivity and map each class to handling, retention, and privacy requirements

Apply secure design principles (least privilege, fail-safe defaults, defense in depth, separation of duties) to a sample application architecture

Identify the top software weakness categories in a code review scenario and specify the architectural control that prevents each

Define the logging and telemetry sources needed for detection across identity, network, cloud, and application layers

Write three detection use cases with data source, logic, and expected false-positive profile

Outline an incident response lifecycle and assign architecture-relevant responsibilities at each phase

Explain how tabletop exercises and post-incident reviews change architecture requirements

Describe forensic readiness requirements such as evidence preservation and chain of custody

Synthesize all eight domains into a single architecture case study for one fictional organization

Re-derive the weakest two domains from practice scores and close specific gaps with targeted review

Practice justifying architecture trade-offs verbally within a two-minute limit per decision

Verify recall of key definitions, framework names, and control categories without notes