ECSS study plan

Map every Network Defense Essentials objective into a personal checklist and rate your confidence 1-5 on each item.

Explain the CIA triad and defense-in-depth layering using three concrete controls you would deploy on a small office network.

Compare symmetric and asymmetric encryption, hashing, and digital signatures, and state one realistic use case for each.

Describe how PKI, certificates, and TLS protect data in transit, including what a certificate authority actually vouches for.

Diagram the TCP/IP and OSI models side by side and place five common attacks (ARP spoofing, SYN flood, DNS poisoning, VLAN hopping, on-path interception) at the layer where each occurs.

Differentiate firewalls, IDS, and IPS by placement, traffic handling, and typical alert versus block behavior.

Configure and read a host-based firewall rule set on a lab VM, then verify allowed and denied traffic with a packet capture.

Identify what a SIEM correlates and why log normalization matters for detection.

Classify network security controls into administrative, technical, and physical categories and give two examples of each.

Explain network segmentation, DMZ design, and zero-trust principles in terms of what each reduces.

Summarize common compliance and framework drivers (ISO 27001, NIST CSF, PCI DSS, GDPR) at a level where you can match a control to a driver.

Walk through incident response phases (preparation, detection, containment, eradication, recovery, lessons learned) and assign one action per phase for a ransomware scenario.

Complete a timed 40-question Domain 1 self-test and score at least 80 percent.

Review every missed Domain 1 question and write the underlying concept, not just the correct answer.

Define the ethical hacking phases (reconnaissance, scanning, exploitation, post-exploitation, reporting) and state the authorization and scope documents required before any testing.

Distinguish black-box, white-box, and gray-box testing and when each is appropriate.

Perform passive and active reconnaissance against a deliberately vulnerable lab target you own, recording DNS, WHOIS, and service discovery results.

Run a port and service scan in the lab, interpret the output, and explain how a defender would detect that scan in logs.

Describe common web application weaknesses (injection, broken access control, XSS, misconfiguration) and the input-validation and output-encoding defenses against each.

Explain password attack types and the account-lockout, MFA, and rate-limiting controls that mitigate them.

Summarize exploitation and post-exploitation concepts (privilege escalation, persistence, lateral movement) and map each to a detection opportunity.

Draft the sections of a penetration test report: scope, methodology, findings with severity, evidence, remediation, and executive summary.

Explain malware categories and how social engineering and phishing campaigns are structured and defended against.

Identify the legal and ethical boundaries of testing, including written authorization, rules of engagement, and data handling.

Describe the digital forensics process and the order of volatility, and explain why each step preserves evidentiary value.

Explain chain of custody, hashing for integrity, and write-blocking, and state what makes evidence admissible or challenged.

Compare disk, memory, network, and mobile forensic acquisition and name one artifact of interest from each source.

Outline the phases of a forensic investigation from identification through reporting and describe how findings support a legal or HR outcome.

Complete a full timed practice exam across all three domains and score at least 80 percent overall with no domain below 70 percent.

Re-review weak objectives from all three domains and rewrite your confidence checklist with final ratings.

Rehearse explaining ten key concepts aloud in under two minutes each to confirm recall without notes.

Finalize exam-day logistics: scheduling, identification requirements, and a review sheet of the highest-risk facts.