C|CT study plan

Map the C|CT domain weighting to a personal weakness list by scoring yourself 1-5 on each of the four domains

Diagram how a packet traverses a firewall, IDS, and proxy in a sample enterprise path, labeling where each control acts

Explain the difference between stateful inspection and stateless ACL filtering using a concrete example you write yourself

List the five phases of ethical hacking and write one sentence on the legal authorization needed before each

Compare IDS versus IPS placement options and justify three deployment choices in writing

Describe how VLAN segmentation, DMZ design, and least-privilege ACLs reduce lateral movement

Practice reading a sample firewall rule set and identify three overly permissive rules

Summarize common network attacks (spoofing, ARP poisoning, DDoS) and the control that mitigates each

Recon: enumerate passive and active information-gathering techniques and record what each reveals

Scanning: explain TCP connect, SYN, and UDP scans and when each is appropriate

Exploitation: describe how vulnerability validation differs from weaponized exploitation

Draft a rules-of-engagement and scope document for a hypothetical engagement

Walk through the OWASP-style web vulnerability classes and the test approach for each

Explain how findings are risk-rated and translated into remediation guidance

Describe the handoff from an offensive test to a defensive detection rule

Practice writing a finding with impact, evidence, and remediation in under 150 words

Explain order of volatility and justify a collection sequence for a compromised host

Describe chain of custody, hashing, and evidence integrity verification steps

Differentiate disk, memory, and network forensic artifacts and what each answers

Outline how to handle a live response versus a dead-box acquisition

Explain timeline analysis and how artifacts are correlated to reconstruct an intrusion

Describe common anti-forensics techniques and how an investigator counters each

Map a forensic finding to a detection or prevention improvement

Draft an incident timeline from a written scenario with at least six timestamped events

Describe the incident response lifecycle and the decision points at each stage

Explain log sources, SIEM correlation, and alert triage prioritization

Differentiate true positive, false positive, and benign true positive with examples

Outline containment, eradication, and recovery choices and their trade-offs

Re-score your domain weakness matrix and compare against week 1

Complete timed mixed-domain practice and review every missed item to root cause

Re-teach the two weakest concepts aloud or in writing without notes

Build a one-page quick-reference sheet of key terms, frameworks, and decision rules