CyberOps Associate study plan
CyberOps Associate · Give each week a clear focus.
8 weeks · About 7 hours per week
Security Concepts
Define the CIA triad and apply each principle to five realistic enterprise scenarios
Classify threat actor types (insider, organized crime, nation-state, hacktivist) by motive, capability, and typical indicators
Categorize ten common vulnerabilities (misconfiguration, weak credentials, unpatched software, injection) by root cause and control type
Differentiate symmetric encryption, asymmetric encryption, hashing, and digital signatures by purpose and use case
Compare access control models (DAC, MAC, RBAC, least privilege) and select the appropriate model for three given environments
Your checkpoint
A one-page reference sheet covering the CIA triad, threat actor categories, and crypto primitives, plus 30 self-written flashcards scored at 90% or better on a self-quiz
Security Concepts & Network Intrusion Analysis
Explain the TCP/IP stack layers and map at least eight protocols (HTTP, DNS, TLS, DHCP, ARP, ICMP, SMTP, SSH) to their layer and default port
Trace a full TCP three-way handshake and graceful teardown using a packet capture, labeling flags and sequence numbers
Identify the top ten indicators of compromise visible in host and network telemetry
Distinguish vulnerability, exploit, and risk, and describe how each feeds into an analyst's daily triage
Your checkpoint
An annotated packet-capture walkthrough (screenshots replaced by written field-by-field notes) documenting one HTTP session from handshake to close, plus a 25-question Domain 1 practice set at 80% or better
Network Intrusion Analysis & Security Monitoring
Analyze packet, session, and flow data to distinguish scanning, brute force, and data exfiltration patterns
Interpret DNS, HTTP, proxy, and firewall log fields and state what each field proves versus suggests
Explain how IDS, IPS, and network taps differ in placement, detection method, and impact on traffic
Describe SIEM log aggregation, correlation rules, and alert tuning, and explain why false positives erode analyst effectiveness
Your checkpoint
A written triage report on three synthetic alert scenarios (port scan, beaconing, credential stuffing) each with evidence cited from named log or packet fields and a stated disposition
Security Monitoring
Compare signature-based, anomaly-based, and behavior-based detection and state a strength and weakness for each
Explain the role of NetFlow, full packet capture, endpoint telemetry, and honeypots in a monitoring architecture
Map the 5-tuple and common metadata fields to the questions an analyst must answer during alert triage
Prioritize a queue of ten alerts using severity, asset criticality, and confidence, and justify the ordering
Your checkpoint
A monitoring architecture diagram with a written rationale for each sensor placement, plus a 40-question timed mixed Domain 1/2/5 practice set scored at 80% or better with every miss logged and explained
Security Policies and Procedures
Outline the NIST Cybersecurity Framework functions and explain how they connect policy to daily operations
Classify data into sensitivity tiers and assign handling, retention, and destruction requirements to each tier
Describe the purpose of an acceptable use policy, an incident response policy, and a BYOD policy, and identify who owns each
Explain chain of custody and evidence handling requirements well enough to state what an analyst must do before touching a device
Identify the compliance drivers (PCI DSS, HIPAA, GDPR, SOX) most likely to shape an organization's procedures
Your checkpoint
A draft one-page incident response policy excerpt for a fictional company covering data classification, escalation path, and evidence handling, reviewed against a self-made checklist of ten required elements
Incident Response
Sequence the incident response lifecycle phases (prepare, detect and analyze, contain, eradicate, recover, post-incident) and state the exit criteria for each
Select an appropriate containment strategy (isolate host, block IP, disable account, segment network) for four given scenarios and justify the tradeoff
Draft a post-incident report structure that captures timeline, root cause, blast radius, and lessons learned
Distinguish when to escalate to legal, HR, or law enforcement and identify the trigger conditions
Describe basic forensic acquisition concepts including volatile data order of volatility and hashing for integrity
Your checkpoint
A complete written incident report for a synthetic ransomware scenario, including a timestamped timeline of at least eight events, containment decisions with rationale, and three concrete remediation recommendations
Security Monitoring & Incident Response & Network Intrusion Analysis
Re-run every previously missed practice question and articulate in writing why the correct answer is correct
Work through three end-to-end cross-domain scenarios that require detection, analysis, policy reference, and response in sequence
Name and close the two weakest sub-topics identified by practice-test analytics
Practice explaining technical findings in plain language suitable for a non-technical manager
Your checkpoint
A remediation log showing every prior miss resolved with a written justification, plus two full scenario walkthroughs completed without notes at 85% or better on the paired question sets
Security Concepts & Security Monitoring & Security Policies and Procedures & Incident Response & Network Intrusion Analysis
Complete two full-length timed practice exams under test-day conditions with no notes or pausing
Review every missed item from both exams and re-study the underlying concept rather than the answer
Rehearse exam logistics: question pacing, flag-and-return strategy, and time allocation per question
Confirm readiness by scoring consistently above target on the final two attempts
Your checkpoint
Two completed timed practice exams with score reports and a final one-page weak-spot summary listing every remaining gap and the specific action taken to close it
Milestones
Week 4: Score at least 80% on the 40-question mixed Domain 1/2/5 practice set, and be able to explain the CIA triad, TCP/IP protocol mapping, and log-field interpretation without notes
Week 6: Produce the full synthetic incident report with a correct lifecycle phase sequence, justified containment choice, and evidence-handling steps that match chain-of-custody requirements
Week 7: Remediation log shows zero unresolved misses from earlier practice sets, and both cross-domain scenario walkthroughs score 85% or higher without notes
Week 8: Two consecutive full-length timed exams at or above the target passing score, with the final weak-spot summary containing no unaddressed items