EXIN Cyber Security Foundation study plan
EXIN Cyber Security Foundation · Give each week a clear focus.
8 weeks · About 6 hours per week
Cyber Security Fundamentals & Cyber Security Threats and Attacks
Define the CIA triad and apply each component to three real-world scenarios
Explain the difference between vulnerability, threat, and risk with examples
List and describe at least five common cyber threats (e.g., malware, phishing, DoS)
Identify the three types of authentication factors and give two examples of each
Your checkpoint
A one-page summary sheet mapping each CIA component to a threat and a control, with definitions of vulnerability, threat, and risk.
Cyber Security Fundamentals & Cyber Security Threats and Attacks
Describe the OSI model layers and match common attacks to each layer
Explain how encryption, hashing, and digital signatures differ in purpose
Compare symmetric and asymmetric encryption and state one use case for each
Outline the phases of a cyber attack (reconnaissance, exploitation, etc.)
Your checkpoint
A table listing five attacks, the OSI layer they target, and the cryptographic concept that mitigates them.
Cyber Security Threats and Attacks
Differentiate between social engineering, phishing, and spear-phishing with examples
Explain how malware types (virus, worm, trojan, ransomware) propagate and their impact
Describe common network attacks (MITM, DDoS, SQL injection) and their indicators
Identify at least three signs of a compromised system or account
Your checkpoint
A threat catalog of 10 attack types with a brief description, typical target, and one detection indicator for each.
Cyber Security Threats and Attacks & Cyber Security Controls and Measures
Explain the purpose and components of an incident response plan
Describe the role of firewalls, IDS/IPS, and antivirus in defense-in-depth
Outline the concept of access control models (DAC, MAC, RBAC) and give a use case
Summarize the principle of least privilege and its implementation
Your checkpoint
A mock incident response checklist for a phishing attack, covering detection, containment, eradication, recovery, and lessons learned.
Cyber Security Controls and Measures
Explain how patch management and configuration management reduce risk
Describe the purpose of security awareness training and its key elements
List physical security controls (e.g., locks, biometrics, CCTV) and their role
Summarize the concept of business continuity and disaster recovery planning
Your checkpoint
A one-page security controls matrix mapping five controls to the threats they mitigate and the CIA component they support.
Cyber Security Controls and Measures & Cyber Security Governance and Awareness
Define information security governance and its key components
Explain the purpose of security policies, standards, procedures, and guidelines
Describe common risk management steps (identification, assessment, treatment)
Outline legal and regulatory requirements relevant to cybersecurity (e.g., GDPR)
Your checkpoint
A sample security policy outline for a small organization, including purpose, scope, roles, and review cycle.
Cyber Security Governance and Awareness
Explain the importance of security awareness and training programs
Describe how to measure the effectiveness of awareness initiatives
Identify key roles and responsibilities in cybersecurity (e.g., CISO, data owner)
Summarize the concept of security culture and its influence on behavior
Your checkpoint
A one-page security awareness campaign plan with target audience, key messages, delivery method, and success metrics.
Cyber Security Fundamentals & Cyber Security Threats and Attacks & Cyber Security Controls and Measures & Cyber Security Governance and Awareness
Review all domains using practice questions and self-assessment
Identify weak areas and create a focused revision list
Simulate exam conditions with a timed practice test
Reinforce key definitions and frameworks through flashcards
Your checkpoint
A completed practice exam with a score log and a prioritized list of three topics for final review.
Milestones
Week 2: Can explain CIA triad, threat vs vulnerability vs risk, and common attack types without notes.
Week 4: Can describe incident response phases and map at least five controls to threats.
Week 6: Can outline a security policy and explain governance and risk management steps.
Week 8: Achieves at least 75% on a timed practice exam covering all domains.