CSA (EC-Council Certifications) study plan
CSA · Give each week a clear focus.
8 weeks · About 6 hours per week
Security Operations and Management
Map each sub-topic of security operations and management to a one-line definition in your own words
Draft a sample incident-response policy outline covering roles, escalation, and communication triggers
Compare preventive, detective, and corrective controls and classify ten examples you generate yourself
Build a personal glossary of 25 operations and management terms with plain-language definitions
Your checkpoint
A one-page security operations reference sheet plus a 25-term glossary you can self-quiz from
Understanding Cyber Threats, IoCs, and Attack Methodology
Categorize at least eight attack types (phishing, ransomware, insider, supply chain, DDoS, etc.) by motive and vector
Explain the stages of a representative intrusion chain from initial access to impact
List indicators of compromise for each stage and note where each is observable
Write a short comparison of host-based versus network-based detection signals
Your checkpoint
An attack-methodology matrix mapping attack types to stages, IoCs, and observation points
Incident Detection with SIEM, Log Management, Network and Endpoint Security
Describe how a SIEM ingests, normalizes, correlates, and alerts on log data
Differentiate log source categories (network, endpoint, application, identity) and their detection value
Design three correlation rules in plain logic (condition, threshold, alert)
Explain endpoint detection and response telemetry versus traditional antivirus signals
Your checkpoint
Three written correlation rules with rationale and expected false-positive sources
Security Operations and Management & Incident Detection with SIEM, Log Management, Network and Endpoint Security
Trace a hypothetical alert from log generation through triage to escalation
Identify which log sources would confirm or refute three separate attack hypotheses
Draft a triage checklist for prioritizing alerts by severity and business impact
Reconcile operations-management concepts with detection workflows in a written summary
Your checkpoint
A triage checklist plus a worked end-to-end alert walkthrough
Incident Response and Forensics
Sequence the incident-response lifecycle phases and state the objective of each
Outline evidence-handling steps that preserve integrity from collection to storage
Distinguish volatile from non-volatile evidence and rank collection order
Draft a post-incident review template capturing root cause and lessons learned
Your checkpoint
An incident-response playbook skeleton with an evidence-handling and chain-of-custody section
Understanding Network Security and Analysis
Interpret common network traffic artifacts (flows, DNS queries, HTTP headers) for signs of compromise
Explain how segmentation, proxies, and monitoring points affect visibility
Compare signature-based and anomaly-based network detection with strengths and blind spots
Describe how to read packet-capture summaries to confirm a suspected connection
Your checkpoint
A network-analysis cheat sheet linking observable artifacts to likely attack activity
Incident Reporting and Communication & Incident Response and Forensics
Draft incident notifications tailored to technical, executive, and external audiences
Identify what information to withhold and why during an active investigation
Build an escalation and stakeholder-communication matrix by incident severity
Practice writing a concise status update under time pressure
Your checkpoint
A communication matrix plus three audience-specific sample incident notifications
Security Operations and Management & Understanding Cyber Threats, IoCs, and Attack Methodology & Incident Detection with SIEM, Log Management, Network and Endpoint Security & Incident Response and Forensics & Understanding Network Security and Analysis & Incident Reporting and Communication
Synthesize all six domains into a single integrated incident scenario you author yourself
Self-test with timed practice questions and log weak areas by domain
Re-review the two lowest-scoring domains using your own notes and glossaries
Finalize a one-page pre-exam review sheet
Your checkpoint
A completed integrated scenario walkthrough plus a scored self-assessment with a prioritized weak-area list
Milestones
Week 2: Can explain the intrusion chain and name an IoC for each stage without notes
Week 4: Can walk an alert from log to escalation and justify the triage decision
Week 6: Can interpret a described traffic artifact and state whether it suggests compromise
Week 8: Score at or above your target on a timed self-assessment and have a written weak-area plan