SecurityX study plan

Diagram the full key lifecycle for an enterprise PKI - generation, distribution, rotation, escrow, revocation - and tag each stage with the control that enforces it.

Harden one server OS and one cloud service to a documented baseline, recording the business rationale for every deviation you accept.

Compare symmetric encryption, asymmetric encryption, and hashing by use case, key size, performance cost, and the specific way each fails when misapplied.

Build a 25-card spaced-repetition deck covering cryptographic primitives, key management pitfalls, and baseline drift symptoms.

Threat-model a CI/CD pipeline end to end and enumerate at least six paths for secret leakage, dependency compromise, or artifact tampering.

Write one policy-as-code check that fails a build on a public storage bucket or a hardcoded credential, and confirm it blocks a deliberately bad commit.

Sequence secure SDLC gates - design review, SAST, DAST, dependency scanning, artifact signing - into a single release workflow with entry and exit criteria per gate.

Automate one recurring security task with a script and measure the manual time it replaces.

Engineer a federation flow using SAML or OIDC and annotate every point where a token is validated, signed, or rejected.

Design a zero trust segmentation model for a three-tier application and name the enforcement point at each boundary.

Rank authentication options - FIDO2, certificate-based, push MFA, SMS OTP - by resistance to phishing, replay, and adversary-in-the-middle attacks.

Answer 40 mixed engineering questions timed and log every miss with a written root cause, not just the correct answer.

Evaluate three candidate architectures - hub-and-spoke, microsegmentation, and SASE - against a fixed set of requirements and justify a recommendation.

Draw a trust-boundary diagram for a hybrid workload with every data flow labeled by direction, protocol, and sensitivity.

Run a formal threat model (STRIDE or attack trees) against that diagram and rank the output by risk rather than by novelty.

Write five architecture trade-off recommendations that each name what you are giving up, not only what you gain.

Design a BCDR architecture that meets stated RTO and RPO targets and spell out the recovery sequence and dependencies.

Classify a representative data set by sensitivity and prescribe encryption, tokenization, or masking per class.

Map organizational obligations to a chosen framework (ISO 27001 or NIST CSF 2.0) at the control-family level and flag the gaps.

Draft a risk register with eight entries scored by likelihood and impact, each tied to an owner and a response strategy.

Build one detection use case end to end: log source, normalization, correlation rule, alert threshold, and triage criteria.

Facilitate a tabletop incident response exercise across all five phases and capture every decision point and gap identified.

Tune a rule set against a labeled sample of events to reduce false positives while proving detection coverage is retained.

Define four operational metrics - MTTD, MTTR, patch latency, coverage - and state exactly how each is measured.

Prioritize a 50-item vulnerability backlog using exploitability and asset criticality instead of raw severity score alone.

Outline the order of volatility for evidence acquisition on one physical host and one cloud workload, naming the artifact captured at each step.

Assess a third-party vendor against a security questionnaire and issue a risk rating with explicit conditions for approval.

Map the evidence an auditor would request for one in-scope system to the specific controls that generate it.

Reconcile the policy, standard, and procedure hierarchy with one concrete example drawn from each of the four domains.

Complete two timed full-length practice exams and categorize every miss by domain, objective, and root cause.

Re-drill your 30 weakest objectives using targeted labs, flashcards, and re-reading, then re-test each one.

Write a one-page exam-day plan covering time per question, the flag-and-return rule, and the order you will attack flagged items.