CPA ISC study plan

Diagram the IT governance hierarchy (board of directors → IT steering committee → CIO/IT management → process owners) and label the decision rights at each layer

Map three given business scenarios to the COBIT domains and to the COSO ERM components that apply

Identify and classify 20 IT risks into a register with likelihood, impact, and one treatment (avoid, mitigate, transfer, accept) each

Distinguish IT strategic planning from IT tactical planning and write a two-paragraph comparison in your own words

Draw the data lifecycle (capture → validate → store → use → share → archive → destroy) and annotate one control at each stage

Compare relational, hierarchical, and NoSQL data models by writing out structure, strengths, and a use case for each

Write and explain 10 SQL statements covering SELECT, JOIN, GROUP BY, and aggregate filtering

Define data governance roles (owner, steward, custodian) and assign them for a hypothetical sales database

Explain how data quality dimensions (completeness, accuracy, timeliness) are measured and reported

Compare authentication factors and access control models (DAC, MAC, RBAC, ABAC) in a written table with one example attack each defends against

Differentiate symmetric and asymmetric encryption, hashing, and digital signatures, and state where each is used in a transaction flow

Categorize 15 controls as preventive, detective, or corrective and as administrative, physical, or technical

Trace a network attack path across firewall, DMZ, and internal segments and name the control that stops it at each hop

Outline an incident response lifecycle (prepare, detect, contain, eradicate, recover, lessons learned) and assign an owner and artifact to each phase

Compare confidentiality and privacy obligations and map three data types to required handling rules

Apply privacy principles (notice, consent, minimization, retention, breach notification) to a scenario and flag every gap

Draft a 1-page breach-notification decision tree covering internal escalation and external reporting triggers

Sequence the SDLC phases and state the primary control and key deliverable produced at each phase

Differentiate waterfall, iterative, and agile delivery and identify where requirements sign-off and testing gates land in each

Explain segregation-of-duties conflicts in a development environment and propose compensating controls for three conflicts

Classify 12 change types (standard, normal, emergency) and assign the required approval path to each

Build a business impact analysis for a hypothetical system: rank three processes by RTO and RPO and justify each number

Compare hot, warm, and cold recovery sites and match each to a stated RTO

Distinguish backup types (full, incremental, differential) and calculate restore time and storage for a worked example

Explain job scheduling, output controls, and IT operations monitoring and list one failure mode for each

Re-attempt every missed item from weeks 1–6 and write the underlying rule for each miss

Reconstruct the governance, data lifecycle, and incident response diagrams from blank paper without notes

Drill 40 mixed questions weighted toward governance, risk, and security under timed conditions

Consolidate a personal error log of 20 recurring concepts with a one-line correction for each

Complete two full-length timed practice exams and score both by domain

Re-study only the two lowest-scoring domains and re-test each with 20 fresh items

Rehearse the exam-day plan: question triage, time-per-item budget, and flag-and-return rules

Verify readiness by scoring at or above your target on the final timed set