NISP Level 2 study plan

Build a one-page concept map linking confidentiality, integrity, availability, and the risk-management cycle, and write a 150-word summary of how each ISO/IEC 27001 control family supports them.

Define the components of an information security management system (ISMS) and list at least eight control objectives from a recognized framework, matching each to a concrete organizational process.

Classify the main network topologies and the OSI and TCP/IP layer models, then map at least six common attacks (e.g., ARP spoofing, SYN flood, DNS poisoning) to the layer where each operates.

Explain the difference between a security policy, standard, procedure, and guideline, and draft a short sample policy clause for password management.

Describe how firewalls, IDS/IPS, VPNs, and network segmentation each reduce attack surface, and state one limitation of each control.

Trace a packet through a typical perimeter (NAT, firewall, DMZ, internal switch) and annotate where filtering, logging, and inspection occur.

Compare symmetric and asymmetric encryption and hash functions in terms of speed, key distribution, and typical network use (TLS, IPsec, SSH).

Analyze at least five network attacks (e.g., MITM, DDoS, VLAN hopping, session hijacking, DNS cache poisoning) and write a mitigation for each.

Harden a host by configuring account policies, patch management, service minimization, and logging, and record the before/after configuration state.

Explain the role of the operating system security kernel, access control models (DAC, MAC, RBAC), and how each is enforced on a modern OS.

Differentiate authentication factors and mechanisms (passwords, tokens, biometrics, MFA, SSO, Kerberos) and identify the weaknesses of each.

Describe the lifecycle of a symmetric key and a public-key certificate, including generation, distribution, storage, rotation, and revocation (CRL vs. OCSP).

Identify the OWASP Top 10 categories and explain the root cause and defense for injection, broken access control, and insecure deserialization.

Describe secure coding practices for input validation, output encoding, error handling, and secrets management, with a code-level example of each.

Explain data classification, data-at-rest vs. data-in-transit protection, and the role of DLP, backups, and retention policies.

Map a sample web application's data flow and mark where authentication, authorization, encryption, and logging should occur.

Define the incident response lifecycle (preparation, detection, containment, eradication, recovery, lessons learned) and assign roles for a sample incident.

Draft a 1-page incident response playbook for a suspected ransomware event, including escalation, evidence preservation, and communication steps.

Explain the purpose and outputs of vulnerability scanning, penetration testing, and risk assessment, and distinguish a vulnerability from a risk.

Perform a qualitative risk assessment using a likelihood-impact matrix on five sample assets and rank the resulting risks.

Summarize the scope and key obligations of major security laws and regulations applicable to Chinese organizations, including the Cybersecurity Law, Data Security Law, and Personal Information Protection Law.

Explain the multi-level protection scheme (MLPS/等级保护) process and how a system's protection level is determined and assessed.

Identify the roles of standards bodies and the purpose of ISO/IEC 27001, ISO/IEC 27701, and common national standards, and map them to compliance activities.

Describe data-subject rights and organizational duties for personal information handling, including consent, cross-border transfer, and breach notification.

Explain the security implications of cloud, container, and serverless architectures, including shared responsibility and misconfiguration risks.

Describe how AI/ML systems introduce new attack surfaces (data poisoning, model theft, prompt injection) and list at least three mitigations.

Outline zero-trust principles and contrast them with perimeter-based security in terms of identity, segmentation, and continuous verification.

Explain how SIEM, log correlation, and threat intelligence support detection and response, and describe one detection use case end to end.

Review all nine domains using the earlier deliverables and close gaps flagged during self-assessment.

Complete at least two full-length timed practice exams and record the score per domain.

Re-study the two weakest domains and rewrite the relevant study-sheet sections from memory.

Build a final one-page summary of key definitions, formulas, and control mappings for last-minute review.