Cisco 300-220 CBRTHD study plan

Map the security monitoring domain objectives into a checklist of specific telemetry sources (endpoint, network, DNS, proxy, authentication) and the detection use case each one supports

Differentiate signature-based, anomaly-based, and behavioral detection by writing one realistic example of each and stating what each misses

Trace a single simulated event from raw log line to alert to analyst triage decision, documenting each handoff

Configure a free SIEM or log collector to ingest at least two log sources and confirm events are searchable

Write and test at least three correlation or threshold rules against the ingested logs, including one rule that produces a false positive you must then tune

Classify a set of sample alerts by severity using an explicit impact-and-confidence rubric you define

Build a triage runbook for one alert type with escalation criteria, evidence to collect, and containment triggers

Explain how alert fatigue and tuning decisions affect detection quality, using your own false-positive result as evidence

Compare symmetric and asymmetric cryptography and identify where each appears in TLS, VPN, and credential storage

Walk through a TLS handshake and state what each certificate field proves and what it does not prove

Contrast authentication factors and describe how MFA defeats credential replay but not real-time phishing proxies

Diagram a defense-in-depth architecture for a small enterprise and label where each security concept (confidentiality, integrity, availability, non-repudiation) is enforced

Identify common endpoint artifacts (process trees, autoruns, scheduled tasks, services, WMI subscriptions) and state which attack technique each would reveal

Analyze a process tree from a benign and a suspicious parent-child relationship and justify the verdict with evidence

Explain how fileless and living-off-the-land techniques evade signature detection and which artifacts remain

Apply a structured host triage sequence (volatile first, then disk) to a sample scenario and justify the ordering

Interpret Windows event log IDs relevant to logon, privilege use, service creation, and process creation, and state the normal baseline for each

Correlate a suspicious logon event with a process creation event to reconstruct a short intrusion narrative

Examine persistence mechanisms across registry, services, and scheduled tasks and rank them by stealth

Distinguish malware categories by behavior and artifact footprint rather than by name

Read a packet capture and identify protocol anomalies in DNS, HTTP, and TLS without relying on payload decryption

Recognize beaconing behavior by computing or estimating interval regularity and jitter across a flow set

Map network evidence to intrusion phases and identify which phase a given flow set most likely represents

Differentiate scanning, exploitation, and exfiltration patterns by their traffic shape and volume characteristics

Compare IDS and IPS placement decisions and state the tradeoff each placement makes between visibility and enforcement

Draft an incident response policy section covering severity classification, notification timelines, and evidence handling

Sequence the phases of incident response and identify the decision point where each phase can fail

Explain chain of custody and describe how a handling mistake can render evidence unusable

Audit your own weak areas across all five domains using missed practice questions and rank them by frequency

Re-derive the three most-missed concepts from first principles without notes

Complete a timed mixed-domain practice set and record per-domain accuracy

Build a one-page personal reference sheet of facts you repeatedly forget, limited to items you have verified