CNDA study plan

Define the CIA triad, defense in depth, and least privilege, and explain in writing how each shapes a layered network defense decision.

Map the OSI and TCP/IP models layer by layer, listing at least two defensive controls that operate at each layer.

Compare perimeter, endpoint, and data-centric defense strategies and state one realistic failure mode for each.

Classify common attack categories (reconnaissance, exploitation, lateral movement, exfiltration) by the layer where defenders can first detect them.

Explain how stateful inspection, stateless ACLs, and application-layer proxies differ in what they can and cannot block.

Diagram a segmented network with DMZ, internal zones, and a management VLAN, and justify each trust boundary.

Describe NAT, PAT, and port forwarding behavior and identify the visibility gaps each introduces for monitoring.

Summarize how TLS inspection, DNS filtering, and egress control reduce outbound risk.

Configure and test a host or virtual firewall rule set that enforces default-deny inbound with explicit allow rules.

Compare IDS and IPS placement options (inline, span port, tap) and state the tradeoff for each.

Explain VPN types (site-to-site, remote access) and the authentication and encryption choices that matter for each.

Evaluate wireless and remote-access boundary controls, including rogue AP risk and 802.1X concepts.

Harden a host baseline covering patch management, service minimization, and local account control, and record each setting.

Explain endpoint detection and response telemetry sources (process creation, file writes, network connections, registry changes) and what each reveals.

Compare signature-based, heuristic, and behavior-based malware detection and state when each fails.

Describe application allowlisting and script-blocking controls and identify their operational tradeoffs.

Summarize disk, file, and transport encryption choices for endpoint data protection.

Explain how centralized logging, time synchronization, and log integrity support later detection and analysis.

Map endpoint telemetry to detection use cases, naming the log source and the event that would trigger each alert.

Distinguish IOC-based detection from behavioral/TTP-based detection and give a concrete example of each.

Describe log retention, normalization, and enrichment needs for a small SOC workflow.

Write three detection rules (for example, suspicious PowerShell, unusual outbound beaconing, brute-force authentication) and state their false-positive sources.

Explain the analysis workflow from alert triage through scoping, correlation, and escalation.

Interpret common artifacts: authentication logs, DNS query patterns, proxy logs, and process ancestry.

Describe network traffic analysis basics, including flow records versus full packet capture and when each is appropriate.

Apply the MITRE ATT&CK-style tactic ordering to place a hypothetical intrusion along the kill chain.

Order the incident response phases (preparation, identification, containment, eradication, recovery, lessons learned) and list the key decision at each.

Draft containment criteria that distinguish short-term isolation from long-term remediation.

Explain evidence handling basics: chain of custody, volatile data order of collection, and hashing for integrity.

Describe communication and escalation paths, including who declares an incident and when to notify stakeholders.

Walk one tabletop scenario end to end and identify at least three control gaps in the layered defense.

Explain how lessons learned feed back into prevention, detection, and response improvements.

Revisit the domain weighting and rate your confidence per domain, then target the two weakest.

Complete a timed mixed-domain practice set and review every missed item to its root concept.