ATSA study plan

Map every objective in Domains 2 and 3 to a one-line summary you write yourself, so you can state each in your own words

Diagram the OSI and TCP/IP models side by side and label where each common attack (ARP spoofing, VLAN hopping, SYN flood, DNS poisoning) lands

Configure and capture traffic for one segmented lab network (VLAN plus firewall rule) and explain each rule's purpose in a log

List the log sources an analyst would need for network detection (flow, DNS, proxy, IDS) and note what each reveals that the others miss

Write ten detection hypotheses for common network attacks and state the evidence each would leave

Build a segmented lab with a DMZ, internal zone, and management zone, and apply least-privilege firewall rules between them

Deploy a free IDS/NSM tool and generate three alerts you can explain from packet to rule

Compare signature, anomaly, and behavior-based detection and write when each fails

Practice reading a PCAP to reconstruct one session and identify the protocol and payload

Draft an escalation note for a suspected lateral-movement alert using only observable evidence

Write an incident response runbook for one scenario (ransomware or credential theft) with roles, triggers, and containment decisions

Map each IR phase (preparation, detection, containment, eradication, recovery, lessons learned) to concrete artifacts you would collect

Build a vulnerability prioritization method that combines CVSS, exploitability, and asset criticality, and apply it to ten sample findings

Explain the difference between a vulnerability scan and a penetration test and when each is appropriate

Draft a remediation SLA table by severity and justify each threshold

Run an authenticated scan against a lab host, triage the results, and remove false positives with evidence

Write a threat-hunting hypothesis, then execute it against a log dataset and document the query and result

Map one real attack technique to detection coverage and identify the gap you cannot currently see

Produce a vulnerability report written for a non-technical manager: risk, impact, and recommended action

Rehearse a tabletop incident and record the decisions made at each phase

Explain confidentiality, integrity, and availability with one concrete control for each in a real architecture

Compare symmetric, asymmetric, and hashing primitives and state where each belongs in a design

Design a defense-in-depth architecture for a small company and label the trust boundaries

Describe how a PKI issues, validates, and revokes certificates, including what happens on revocation failure

Evaluate one cloud shared-responsibility scenario and state which controls belong to the customer

Compare authentication factors and select a multi-factor approach for two different user populations

Design a role-based access model for a sample organization and show how least privilege and separation of duties are enforced

Trace a federated login (SAML or OIDC) end to end and identify the trust assumptions at each step

Explain how to detect and respond to access anomalies such as impossible travel or privilege creep

Review a sample joiners-movers-leavers process and list the failure points

Perform a qualitative risk assessment on five sample assets and record likelihood, impact, and treatment

Map a control set to a recognized framework and note where evidence would come from

Distinguish risk avoidance, transfer, mitigation, and acceptance with one example each

Draft a policy exception request with compensating controls and a review date

Explain how governance, audit, and compliance obligations differ in practice

Re-derive the weakest three domains from practice-test scores and rebuild notes for each

Complete two timed mixed-domain practice sets and log every missed question by domain and cause

Rewrite any objective you cannot explain aloud in under a minute without notes

Build a one-page pre-exam sheet of formulas, frameworks, and decision rules

Simulate exam conditions once end to end and review pacing