CND study plan

Diagram the seven phases of a network attack lifecycle and label at least two defensive controls that interrupt each phase

Classify 20 given attack techniques (recon, spoofing, MITM, DoS/DDoS, session hijacking, password, malware-based) into their correct category and phase

Build a one-page defense-in-depth map that pairs each attack class with a countermeasure category (preventive, detective, corrective)

Explain the CND security model - defend, detect, respond - and match each of the eight exam domains to it

Distinguish firewall types (packet-filtering, stateful, proxy, NGFW) and state the deployment position best suited to each

Configure and validate a sample ACL rule set that enforces a default-deny posture for a three-zone network

Describe IDS vs IPS placement, detection methods (signature, anomaly, protocol) and the trade-offs of each

Sequence the steps of a DMZ design and justify which services belong in each zone

Compare VPN technologies (IPsec, SSL/TLS, site-to-site vs remote access) and select the appropriate one for three stated business scenarios

Apply hardening baselines to network devices: disable unused services and ports, enforce AAA, lock down management access

Implement network segmentation and VLAN design that separates user, server, and management traffic

Explain identity and access management controls - least privilege, role separation, MFA, and privileged access management

Harden a Windows host baseline: patch policy, service reduction, local policy, AppLocker/allowlisting, and logging

Harden a Linux host baseline: file permissions, sudo policy, service minimization, kernel and SSH configuration

Compare endpoint protection approaches - signature AV, EDR, application allowlisting, and patching - and state the gap each one leaves

List the controls specific to mobile (MDM, containerization, BYOD policy) and IoT/OT (network isolation, default-credential elimination, firmware management)

Explain endpoint hardening for servers, BYOD endpoints, and endpoints used for remote work

Apply secure coding and application security principles: input validation, output encoding, authentication and session management, error handling

Explain database security controls - encryption at rest and in transit, least-privilege accounts, and injection defenses

Describe data classification, handling, retention, masking, and DLP controls across data states (at rest, in motion, in use)

Illustrate how web-application attacks (XSS, SQLi, CSRF, file inclusion) map to defenses at the WAF, code, and database layers

Differentiate the shared-responsibility split between provider and customer across IaaS, PaaS, and SaaS

Describe virtualization security controls: hypervisor hardening, VM isolation, snapshot and image governance, and sprawl control

Explain wireless security: WPA2/WPA3 vs legacy WEP/WPA, 802.1X/EAP authentication, rogue AP and evil-twin detection, and guest network separation

Select controls for securing a hybrid cloud network edge - segmentation, encryption in transit, and logging

Explain SDN/NFV and virtual network security implications

Identify the log sources that matter (firewall, IDS/IPS, proxy, DNS, DHCP, authentication, endpoint, cloud audit) and what each uniquely reveals

Explain SIEM workflow: collection, normalization, correlation rules, alerting, and tuning to reduce false positives

Read a packet capture and distinguish normal from suspicious patterns (port scans, beaconing, data exfiltration, ARP spoofing)

Apply traffic-analysis baselines and anomaly thresholds to detect deviations

Describe network behavior analysis metrics and how to escalate an alert into an incident

Sequence the incident response lifecycle and produce a role-assigned task list for the first 24 hours of a ransomware incident

Describe forensic process: evidence identification, order of volatility, chain of custody, imaging, and hashing

Explain business continuity and disaster recovery components - BIA, RTO, RPO, backup strategy, and alternate site types

Perform a qualitative risk assessment: identify assets, threats, vulnerabilities, and score risk with a defined matrix

Apply threat modeling and threat intelligence fusion to prioritize remediation