NISP L1 PT study plan
NISP L1 PT · Give each week a clear focus.
8 weeks · About 6 hours per week
Information Security Fundamentals and Security Awareness
Define confidentiality, integrity and availability and give one concrete failure example of each from a workplace scenario
Classify ten common threats (phishing, tailgating, ransomware, insider misuse, social engineering) by the security objective each mainly harms
Explain the difference between a vulnerability, a threat and a risk, and apply the three terms correctly to five short scenarios
List the elements of a workable security awareness programme and explain why policy alone rarely changes behaviour
Your checkpoint
A one-page threat classification table covering ten threats with the CIA objective harmed, the attacker method and one preventive control for each
Information Security Fundamentals and Security Awareness & Network Security Basics
Describe the TCP/IP model layers and state which layer each of five common attacks targets
Distinguish between a DoS and a DDoS attack and explain the role of a botnet in amplification
Explain how ARP spoofing, DNS cache poisoning and on-path interception differ in mechanism and detection difficulty
Identify the purpose of a firewall, an IDS and a WAF and state one traffic type each handles poorly
Summarise the security role of network segmentation and VLANs in limiting lateral movement
Your checkpoint
A labelled diagram of a small office network marking where a firewall, IDS, WAF and DMZ sit, plus a half-page note on which attack each control does and does not stop
Network Security Basics & Host and Endpoint Security
Compare stateful packet filtering, application proxy and next-generation firewall inspection in terms of what they can and cannot see
Configure or simulate host hardening steps: disabling unused services, applying least-privilege accounts and enabling a host firewall
Explain how endpoint detection and response differs from traditional antivirus in detection method and response capability
Describe patch management as a lifecycle and identify the two points where delay most often occurs
Explain how malware persistence mechanisms (startup entries, scheduled tasks, services) can be found on a Windows host
Your checkpoint
A host hardening checklist of at least fifteen items with a pass/fail column, applied to one real or virtual machine you own
Host and Endpoint Security & Application and Data Security
Map the OWASP Top 10 categories to concrete code or configuration weaknesses and state one mitigation for each
Explain injection and cross-site scripting by tracing how untrusted input reaches a dangerous sink
Distinguish input validation, output encoding and parameterised queries and state which problem each solves
Describe a data classification scheme with three levels and the handling rules that follow from each level
Explain encryption at rest versus in transit and name a realistic failure of each
Your checkpoint
A written walkthrough of one injection-style attack against a deliberately vulnerable practice application you set up locally, including the mitigation you applied and the result
Identity, Authentication and Access Control & Cryptography and PKI Fundamentals
Distinguish identification, authentication, authorisation and accountability and place each step in a login sequence
Compare knowledge, possession and inherence factors and explain why multi-factor authentication must combine different factor types
Explain role-based and attribute-based access control and state a scenario where each fits better
Describe symmetric versus asymmetric encryption, including the key distribution problem each solves or creates
Explain what a digital certificate binds, what a certificate authority signs, and what happens when a certificate expires or is revoked
Your checkpoint
A table of six access-control scenarios naming the model, the authentication factors used and the single weakest link in each
Cryptography and PKI Fundamentals & Security Operations, Monitoring and Incident Response
Trace the TLS handshake and identify where authentication, key exchange and confidentiality each begin
Explain hashing versus encryption and state why password storage requires a salted, slow hash
Describe the purpose of a security operations centre and the difference between tier 1 triage and deeper investigation
Explain what log sources (endpoint, network, authentication, application) reveal and which attacks each is blind to
Order the incident response phases and state the key decision made in each phase
Your checkpoint
A one-page incident response runbook for a suspected phishing compromise listing detection source, containment action, evidence to preserve and notification trigger
Security Operations, Monitoring and Incident Response & Laws, Regulations, Standards and Compliance
Explain the difference between an event, an alert and an incident and apply the distinction to five log excerpts
Identify the indicators of compromise visible in authentication logs, such as impossible travel, brute force patterns and off-hours privileged logins
Summarise the main obligations of a data protection law in terms of lawful basis, breach notification and data subject rights
Distinguish a standard, a framework and a regulation and give one example of each with its enforcement mechanism
Explain the purpose of an information security management system and how an audit cycle supports it
Your checkpoint
A two-page incident report for a tabletop scenario you invent, covering timeline, affected assets, containment, root cause and the notification decision with justification
Information Security Fundamentals and Security Awareness & Application and Data Security & Laws, Regulations, Standards and Compliance
Consolidate the weakest three domains using your own error log rather than re-reading all material
Explain to a non-technical colleague, in under two minutes, what a phishing-resistant login looks like and why it matters
Reconcile conflicting requirements between a compliance obligation and a technical control, and state how to document the residual risk
Complete timed practice sets across all eight domains and record accuracy per domain
Build a final one-page summary sheet of formulas, models and legal duties you must recall
Your checkpoint
A scored practice exam result per domain plus a one-page summary sheet listing every item you got wrong and the corrected fact
Milestones
Week 2: You can name the OSI or TCP/IP layer of any attack in your week 1 threat table without notes, and explain what a firewall cannot stop
Week 4: You can explain injection and XSS to someone else in plain language and your hardening checklist scores at least twelve passes out of fifteen
Week 6: You can draw the TLS handshake from memory and correctly order the incident response phases; practice accuracy across domains 1 to 6 is at or above 70 percent
Week 8: Overall timed practice accuracy is at or above 80 percent, no single domain below 65 percent, and every logged error has a corrected fact written next to it