EC-Council CBP study plan

Explain how public-key cryptography, hash functions, and Merkle trees combine to secure transaction integrity and block linkage, writing the explanation from memory without notes.

Distinguish symmetric from asymmetric cryptography and identify which primitives (ECDSA, SHA-256, Keccak-256) appear in Bitcoin versus Ethereum transaction signing.

Derive a Bitcoin-style address from a public key by hand-tracing Base58Check steps, including checksum computation and version-byte handling.

Describe digital signature lifecycle: key generation, signing, verification, and the consequences of nonce reuse in ECDSA.

Compare consensus families (PoW, PoS, PBFT-style BFT) on finality, energy, and failure tolerance, and state one attack each is vulnerable to.

Diagram the lifecycle of a transaction from wallet signing through mempool, block inclusion, and confirmation, labeling where validation occurs at each stage.

Differentiate account-based and UTXO models and predict how each handles double-spend attempts and balance queries.

Compare layer-1 platform characteristics (Ethereum, Bitcoin, and at least two enterprise platforms such as Hyperledger Fabric or Corda) on permissioning, consensus, and smart-contract support.

Explain the role of nodes, miners/validators, and light clients, and identify which trust assumptions each introduces.

Trace how a smart contract is deployed and invoked, noting gas accounting and state storage costs.

Re-derive key management practices: HD wallets, BIP-32/39/44 derivation paths, seed phrase handling, and multi-signature schemes.

Analyze how forks (soft versus hard) affect state, replay protection, and user funds.

Map interoperability and oracle mechanisms to the trust boundaries they create between chains and external data.

Solve at least 15 practice problems mixing cryptography and architecture topics, then categorize every miss by root cause.

Explain zero-knowledge proofs and their role in privacy-preserving transactions at a conceptual level, including what they do and do not hide.

Enumerate the major smart-contract vulnerability classes (reentrancy, integer overflow, access-control flaws, oracle manipulation, front-running) and describe the exploit path for each.

Explain common blockchain attacks: 51% attacks, Sybil, eclipse, selfish mining, and long-range attacks on PoS, including preconditions and mitigations.

Analyze wallet and key-management risks: phishing, malicious approvals, private-key exposure, and custody trade-offs.

Describe security assessment practices for smart contracts, including static analysis, fuzzing, formal verification, and audit scoping.

Draft incident-response steps for a suspected bridge or contract exploit, from detection through containment and disclosure.

Apply a risk-management framework to blockchain deployments: identify, assess, treat, and monitor risks across technical, operational, legal, and third-party categories.

Explain privacy and compliance intersections, including pseudonymity limits, on-chain analytics, and data-protection obligations for immutable ledgers.

Evaluate governance and supply-chain risks: key-holder collusion, upgradeability backdoors, dependency risk, and consortium member trust.

Compare security controls for public versus permissioned networks and justify each control choice.

Complete a timed 40-question security-domain practice set and review every explanation, including correct answers.

Match blockchain use cases to the properties that justify them (disintermediation, provenance, auditability, tokenization) and identify cases where a traditional database is the better choice.

Explain token standards and their business implications, including fungible versus non-fungible tokens and their compliance considerations.

Describe supply-chain traceability, identity, payments, and trade-finance scenarios end to end, naming the participants and the trust problem solved.

Assess a proposed use case for feasibility using cost, throughput, privacy, and regulatory criteria, and recommend go or no-go.

Identify key performance and scalability constraints (throughput, latency, storage growth) and the layer-2 or off-chain options that address them.

Consolidate all four domains into a single outline you can reproduce from memory, with each subtopic linked to at least one concrete example.

Re-run your week-3 and week-5 error logs and confirm every previously missed concept now resolves correctly.

Complete a full-length timed mock exam under test conditions and record per-domain scores.

Convert every mock-exam miss into a flashcard or a rewritten explanation within 24 hours.

Close remaining gaps by re-teaching the two weakest subtopics aloud or in writing without reference material.

Drill the highest-yield security and use-case content through spaced repetition until recall is immediate.

Retake a second full-length mock and compare per-domain results against week 7 to confirm improvement.

Practice scenario-style questions that require choosing among competing controls or use-case justifications, and articulate why each distractor fails.

Finalize a one-page exam-day reference covering formulas, standards, attack names, and decision heuristics.

Verify logistics: exam format, timing, permitted materials, and a rested pre-exam schedule.