NISP Level 1 - Security Operations study plan

Explain the CIA triad, defense in depth, least privilege, and separation of duties, and map each concept to a concrete control in a network or endpoint setting.

Distinguish reference monitor, Bell-LaPadula, Biba, Clark-Wilson, and RBAC models, and state for each one the security property it protects and one realistic failure it prevents.

Describe the OSI and TCP/IP layers and identify at least two attack vectors and two defensive controls at each layer from Layer 2 through Layer 7.

Compare stateful inspection, proxy, and next-generation firewalls, and explain where each belongs in a segmented perimeter design with DMZ, internal zones, and egress filtering.

Explain how NAT, VLANs, and network segmentation reduce attack surface, and list two misconfigurations for each that create exposure.

Configure and explain the purpose of ACLs, port security, and DHCP snooping on a switch, and describe how ARP spoofing and VLAN hopping are mitigated.

Differentiate IDS from IPS, signature from anomaly detection, and explain where taps, SPAN ports, and inline sensors are deployed in a monitored network.

Describe how VPNs (IPsec and TLS-based) and wireless security (WPA2/WPA3, 802.1X) protect confidentiality and authentication, and name two common deployment weaknesses.

Explain DNS, DHCP, and ARP poisoning attacks and the monitoring signals (logs, flow data, alerts) that would reveal each one.

Outline the incident response lifecycle (prepare, detect, contain, eradicate, recover, lessons learned) and place a network intrusion scenario into each phase.

Compare SIEM, EDR, and SOAR tooling by function, and explain how correlation rules and log normalization turn raw events into actionable alerts.

Identify the key fields in Windows Event Log, Linux syslog/auth.log, and firewall logs that matter for triage, and explain what each field tells an analyst.

Harden a Windows and a Linux host baseline: patch management, service minimization, local firewall, account restrictions, and audit policy, and justify each setting.

Explain endpoint attacks such as ransomware, fileless malware, and living-off-the-land binaries, and name the endpoint telemetry that exposes each.

Triage a provided alert narrative by assigning severity, stating containment steps, and listing evidence to preserve for forensics.

Compare authentication factors, MFA, and passwordless approaches, and evaluate the risk trade-offs of each for a workforce of 500 users.

Explain AAA, RADIUS, TACACS+, LDAP, SAML, OAuth 2.0, and OIDC by the problem each solves, and describe a typical SSO login flow step by step.

Design a role-based access control scheme with least privilege and periodic recertification, and identify where orphaned and excessive accounts typically appear.

Explain symmetric versus asymmetric encryption, hashing, digital signatures, and certificates, and match each to a use case such as data at rest, TLS, or code signing.

Describe key lifecycle management (generation, distribution, rotation, storage, destruction) and explain the risks of key reuse and weak key storage.

Summarize the purpose and scope of core security and privacy law categories (data protection, breach notification, critical infrastructure, and sector rules) and state one operational obligation each imposes.

Explain how ISO/IEC 27001, the CIS Controls, NIST CSF, and PCI DSS differ in structure and audience, and pick the right framework for a given organization profile.

Map the OWASP Top 10 categories to concrete secure-coding and testing controls, and describe how injection and broken access control are prevented.

Explain the software development lifecycle security gates (requirements, design review, code review, SAST/DAST, dependency scanning) and where each fits.

Classify data by sensitivity and describe controls for data at rest, in transit, and in use, including masking, tokenization, and DLP.

Explain the risk assessment process (asset identification, threat and vulnerability pairing, likelihood, impact, treatment options) and compute a simple risk score for three scenarios.

Distinguish vulnerability scanning from penetration testing and from configuration auditing, and state what each does and does not prove.

Interpret CVSS base metrics and explain how EPSS, exploit availability, and asset criticality modify prioritization in practice.

Describe the vulnerability management lifecycle from discovery through remediation, verification, and exception handling with documented risk acceptance.

Explain audit evidence, sampling, and findings classification, and describe how an auditor verifies that a control is operating effectively.

Distinguish BCP from DR, define RTO, RPO, MTD, and MTTR, and derive target values for three business functions with different criticality.

Compare backup types (full, incremental, differential, snapshot, immutable/air-gapped) by recovery speed and storage cost, and design a 3-2-1 backup scheme.

Explain DR site strategies from cold to hot and active-active, and select one for a stated budget and downtime tolerance.

Draft tabletop exercise injects for a ransomware scenario and describe the decisions each inject forces.

Explain how BCP/DR testing (backup restore tests, failover tests, tabletop) validates recovery capability and what evidence each produces.

Integrate all ten domains into a single incident scenario, tracing detection, containment, legal notification obligations, and post-incident review.

Answer timed practice questions across all domains and classify each miss by domain and by cause (knowledge gap, misread, or reasoning error).

Re-drill the two weakest domains using targeted notes and a short self-quiz until recall is consistent.

Produce a personal one-page exam-day reference sheet of formulas, frameworks, and acronyms that you must not confuse.