Security+ study plan

Inventory the asset categories you must manage, then classify ten example systems by data sensitivity, criticality, and ownership.

Sequence the vulnerability management lifecycle from discovery through reporting, and identify where each step can fail.

Describe how a SIEM correlates log sources, and write three example correlation rules for common attack patterns.

Compare firewall, proxy, and network segmentation placements by explaining which attack traffic each control stops.

Apply a hardening baseline to a fictional server, listing ten configuration changes and the risk each mitigates.

Differentiate authentication, authorization, and accounting controls, then select appropriate factors for three user populations.

Contrast SOAR playbooks with manual response by drafting the automated steps that would fire for a suspicious-login alert.

Order the incident response phases and map each phase to at least two concrete actions for a ransomware scenario.

Distinguish volatile from non-volatile evidence and state the order of collection for a compromised workstation.

Plan a backup strategy that satisfies a stated RTO and RPO, choosing between full, incremental, and differential jobs.

Classify threat actors by motivation, capability, and typical targeting, using at least five distinct actor types.

Map the attack surface of a fictional organization by listing entry points an external and internal attacker could use.

Identify at least eight social engineering techniques and state the control that defeats each one.

Distinguish malware families by propagation and payload behavior rather than by name alone.

Extract indicators of compromise from a described intrusion and state which are durable versus easily changed.

Score five sample vulnerabilities using CVSS metrics and justify each base-score input.

Rank a vulnerability list by combined severity, exploitability, and asset criticality, then justify the remediation order.

Select mitigations that address root cause, compensating controls that reduce exposure where patching is impossible, and identify when each is acceptable.

Contrast preventive, detective, and corrective controls, and label ten given controls by category and function.

Explain the security implications of a stated change-management failure and describe the approval gate that would have prevented it.

Compare on-premises, IaaS, PaaS, and SaaS models by stating where the customer retains control in each.

Design a zero-trust access decision by identifying the policy enforcement point, the policy decision point, and the signals each consumes.

Differentiate virtual machine, container, and serverless isolation boundaries and the escape risks unique to each.

Diagram the resilience pattern for a stated availability target, selecting redundancy, failover, and geographic distribution as needed.

Select data protection techniques for data at rest, in transit, and in use, and justify each choice against a stated threat.

Distinguish policy, standard, procedure, and guideline, and write one example of each for a stated scenario.

Perform a qualitative risk assessment by scoring five identified risks on likelihood and impact, then plot them on a heat map.

Assess a fictional vendor's security posture and state the contractual clauses and monitoring obligations that reduce third-party risk.

Map a control set to a compliance framework and identify at least three gaps requiring remediation.

Design a security awareness program with two measurable behavior outcomes rather than completion metrics alone.

Apply the CIA triad and non-repudiation to five described incidents, naming the property violated in each.

Classify cryptographic algorithms by symmetric, asymmetric, and hashing use, and state which requirement each satisfies.

Trace a certificate's path from issuance through validation and revocation, identifying where trust is anchored.

Compare obfuscation, encryption, and hashing by stating the reversibility and use case for each.

Distinguish authentication, authorization, and accounting failures in three given log excerpts.

Complete two full-length timed practice exams and record per-domain accuracy for each attempt.

Re-study only the three lowest-scoring objectives, then re-test each with focused question sets.

Diagnose recurring error patterns by categorizing each missed question as knowledge gap, misread, or process error.

Reconstruct from memory the six IR phases, the vulnerability management lifecycle, and the risk assessment steps.