Cisco 350-201 CBRCOR study plan

Map the exam blueprint into a personal checklist that lists every subtopic under core security operations and threat analysis

Define the CIA triad, threat actors, and attack lifecycle models in your own words and write one paragraph for each

Build a lab environment with a SIEM, a Linux host, and a Windows host so later weeks have somewhere to practice

Classify five recent public incidents by threat actor type and motive

Explain how the kill chain, MITRE ATT&CK tactics, and the diamond model relate to each other

Analyze packet captures and flow records to identify scanning, beaconing, and data exfiltration patterns

Describe common malware families and the artifacts each leaves on disk, in memory, and in network traffic

Practice writing a threat intelligence summary that turns indicators into actionable context

Configure detection rules in your SIEM for authentication anomalies, privilege escalation, and unusual process execution

Tune alert thresholds to reduce false positives while keeping true positives

Correlate endpoint, network, and identity logs to reconstruct a single attack timeline

Document the difference between an indicator of compromise and an indicator of attack with examples

Set up continuous monitoring across at least three log sources and verify each source is complete

Perform threat hunting with a hypothesis-driven approach rather than alert-driven triage

Analyze DNS, proxy, and TLS metadata to spot command-and-control traffic

Write triage notes that separate confirmed malicious activity from benign anomalies

Define incident severity levels and the escalation path for each level

Practice triaging a queue of simulated alerts within a time limit and justify each disposition

Identify the containment options available for endpoint, identity, and network compromises

Explain chain of custody and evidence handling requirements for volatile and non-volatile data

Execute containment, eradication, and recovery steps for a simulated ransomware incident

Collect and preserve forensic evidence from memory, disk, and logs in the correct order of volatility

Draft an incident response playbook for one scenario from detection through lessons learned

Coordinate communication with stakeholders using a defined notification matrix

Conduct a tabletop exercise that walks a team through a multi-stage breach

Perform root cause analysis and convert findings into preventive controls

Review regulatory and reporting obligations that apply after a confirmed breach

Revisit weak areas from earlier weeks and close at least three knowledge gaps

Complete a full timed practice exam and review every missed question by domain

Summarize each domain in a one-page reference sheet you can review quickly

Re-test the three weakest subtopics until you can explain them without notes

Build a final review schedule for the days before the exam