CSAT (USAF Cyber Test) study plan

Label every OSI and TCP/IP layer with its PDU, addressing scheme, and two representative protocols, without notes.

Map 25 common ports and protocols (22, 25, 53, 67/68, 80, 110, 143, 161, 389, 443, 445, 3389 and others) to service name and transport protocol.

Trace a packet from browser click to web server response, naming the device and forwarding decision at each hop.

Convert IPv4 addresses among binary, decimal, and dotted-decimal forms and identify private, loopback, and reserved ranges.

Compute network address, broadcast address, and usable host range for CIDR prefixes /16 through /30, solving 20 problems in under 40 minutes.

Contrast distance-vector and link-state routing, and static versus dynamic routing, with one worked example of each.

Explain the CIA triad and supply two concrete technical controls for each leg.

Classify authentication factors (know, have, are, do) across 10 given login scenarios.

Distinguish vulnerability, threat, risk, and exploit by writing a short original scenario for each term.

Classify 15 attack types (phishing, man-in-the-middle, DoS, SQL injection, XSS, privilege escalation, credential stuffing) by vector, target asset, and primary countermeasure.

Sequence the phases of an intrusion kill chain and attach at least one defensive control to each phase.

Sort 12 given security controls into preventive, detective, and corrective categories and justify each placement in one sentence.

Apply least privilege, defense in depth, and network segmentation to explain which principle failed in three short breach narratives.

Describe social engineering techniques and write detection guidance a help desk could follow for each.

Execute 20 Linux and Windows command-line tasks (navigation, file operations, permissions, process listing, pipes, redirection) and record exact syntax with observed output.

Interpret rwx and octal permission strings and predict the effect of specific chmod and chown changes.

Explain process states, virtual memory, scheduling, and the file system hierarchy in your own words.

Draw valid conclusions from syllogisms and if-then conditional statements, and identify converse and inverse errors.

Identify unstated assumptions and logical flaws in 10 short arguments.

Trace variable scope, loops, and branching in pseudocode and predict exact output for 15 snippets.

Write three working scripts (bash or Python) that read input, branch, loop, and process a list of values.

Debug eight faulty scripts by locating logic errors, off-by-one errors, and type mismatches.

Convert values among binary, hexadecimal, decimal, and ASCII, and compute two's complement for positive and negative signed integers.

Explain the fetch-decode-execute cycle and the memory hierarchy, and compute storage size or addressable range from a given bit width.

Map offensive and defensive cyberspace operation terms (red team, blue team, OCO, DCO, DCO-IDM, hunt, incident response) to definitions and concrete examples.

Compare hashing, symmetric encryption, and asymmetric encryption by purpose, key handling, and relative speed.

Separate encoding (Base64, hex, URL encoding) from encryption, and decode 10 sample strings by hand or with a tool.

Explain digital signatures, certificates, and the PKI trust chain, including what each guarantees and does not guarantee.

State the authorization, rules-of-engagement, and attribution considerations that distinguish lawful defensive action from unauthorized activity.

Write 10 SELECT queries using WHERE, JOIN, GROUP BY, HAVING, and ORDER BY against a small multi-table scratch database.

Identify primary keys, foreign keys, and redundancy in a messy dataset and restate it in normalized form.

Compute mean, median, and mode for a small dataset and flag outliers and anomalies with a stated rule.

Given a 30-row table, state one conclusion the data supports and one it does not, citing the specific rows.

Solve 15 analytical reasoning items (number and letter sequences, ordering constraints, deductive puzzles) under a time limit.

Take two full-length timed practice tests spanning all nine domains and log every missed item by domain and error type.

Re-teach your three lowest-scoring domains from memory, then re-test each until you reach 85%.

Compile a 20-entry error log pairing each recurring mistake with the correct rule or procedure.

Simulate exam pacing by answering 60 mixed questions in 75 minutes with no notes.