CCIS study plan

Map the CCIS exam blueprint to your own notes, tagging each subdomain with a confidence rating from 1 to 5

Explain the difference between a policy, a standard, a procedure, and a guideline, and give an original example of each for a fictional company

Define risk, threat, vulnerability, and exposure, and distinguish them in a written scenario

Describe the main risk treatment options (avoid, mitigate, transfer, accept) and select one for each of five sample risks

Identify the components of a risk register and draft five entries with likelihood, impact, and owner

Compare the OSI and TCP/IP models and identify where common attacks occur at each layer

Explain the purpose and placement of firewalls, IDS, IPS, and proxies in a network diagram you draw yourself

Describe network segmentation, VLANs, and the principle of least privilege at the network level

List the phases of incident response and write a short playbook for a suspected phishing incident

Distinguish indicators of compromise from indicators of attack and classify ten sample events

Outline the main security frameworks and regulations (for example ISO 27001, NIST CSF, GDPR, HIPAA) and state what each governs

Explain authentication, authorization, and accounting and show how they interact in a login flow

Compare authentication factors (something you know, have, are) and give two examples of each

Describe MFA, SSO, and federation at a conceptual level and identify the risks each mitigates

Draft an access control matrix for a small application with three roles and four resources

Explain endpoint hardening measures such as patching, application allowlisting, and disabling unnecessary services

Describe the role of EDR and antivirus and how they differ in detection capability

Explain the vulnerability management lifecycle from discovery through remediation and verification

Differentiate vulnerability scanning from penetration testing and state when each is appropriate

Interpret a CVSS score and prioritize five vulnerabilities using severity, exploitability, and asset criticality

Explain symmetric versus asymmetric encryption and name one appropriate use case for each

Describe hashing, salting, and digital signatures and explain what each provides and does not provide

Compare TLS, IPsec, and SSH in terms of what they protect and where they operate

Explain PKI, certificate authorities, and certificate lifecycle at a conceptual level

Describe data classification, data-at-rest versus in-transit protection, and tokenization or masking

Explain threat intelligence sources and how to distinguish tactical from strategic intelligence

Describe common attack techniques such as phishing, credential stuffing, ransomware, and lateral movement, and the controls that counter each

Outline log sources and monitoring approaches used in a SOC, including SIEM basics

Explain containment, eradication, recovery, and lessons learned with concrete actions for each

Draft a tabletop exercise scenario and list the decisions responders must make

Explain shared responsibility in cloud models (IaaS, PaaS, SaaS) and identify who secures what

Describe cloud identity, logging, and configuration baseline concepts and why misconfiguration is a leading risk

List key security metrics and explain how they support governance and reporting

Explain the purpose of audits, assessments, and continuous monitoring in a security program

Describe change management and its role in preventing security regressions

Review your confidence map from week 1 and re-rate every subdomain

Complete at least 60 original practice questions across all domains and log every miss by domain

Re-teach the three weakest subdomains in your own words without notes

Build a one-page exam-day reference sheet of formulas, frameworks, and distinctions you keep confusing

Simulate a timed 40-question mixed-domain set and review every answer