GCT-2A-324 study plan

Map all five GCT-2A-324 domains to their exam weights and mark Domain 1 as the anchor for the first two weeks

Define governance, risk, and compliance in your own words and distinguish each from the other two

List the standard control frameworks by name and state the purpose of each in one line

Classify controls by type (preventive, detective, corrective) and by category (technical, administrative, physical) using ten self-written examples

Explain the difference between a policy, a standard, a procedure, and a guideline and give one original example of each

Walk through the risk management lifecycle from asset identification to risk treatment and describe the output of each step

Compute a qualitative risk score from likelihood and impact for five original scenarios and rank them

Compare risk avoidance, mitigation, transfer, and acceptance and justify a choice for each of the five scenarios

Distinguish inherent risk, residual risk, and risk appetite and explain how each appears in a risk register

Identify the compliance obligations that commonly drive security programs and describe how evidence is collected for an audit

Apply a recognized security architecture framework to describe layers, trust boundaries, and reference models

Explain defense in depth and least privilege and show where each appears in a three-tier application design

Compare mandatory, discretionary, and role-based access control and select one for a given scenario with justification

Describe the identity lifecycle from provisioning through deprovisioning and name the control that fails most often at each stage

Explain authentication factors, multi-factor authentication, and federation concepts including assertions and trust relationships

Design a role-based access model for an organization with at least four roles and document role explosion risks

Explain privileged access management controls including vaulting, session recording, and just-in-time elevation

Describe network segmentation, the demilitarized zone concept, and where stateful inspection occurs on a packet path

Compare network security controls such as firewalls, proxies, and network access control by the threat each addresses

Explain how a virtual private network and a zero-trust approach differ in their assumptions about the network

Distinguish symmetric from asymmetric encryption and state one correct use case for each

Explain hashing, salting, and message authentication codes and identify which property each provides

Describe key management lifecycle steps including generation, distribution, storage, rotation, and destruction

Classify data by sensitivity and select appropriate protection for each class at rest and in transit

Explain how digital signatures provide integrity, authenticity, and non-repudiation and what they do not provide

Describe the incident response lifecycle and the decision criteria for declaring an incident

Distinguish indicators of compromise from indicators of attack and give two original examples of each

Explain log source categories, centralized logging, and the role of time synchronization in correlation

Compare detection approaches such as signature, anomaly, and behavior-based analysis and state a limitation of each

Outline containment, eradication, recovery, and lessons-learned activities for one original scenario

Explain vulnerability scoring, prioritization, and the difference between a vulnerability scan and a penetration test

Describe remediation workflow from discovery through verification and the role of exception handling

Apply secure development practices including input validation, output encoding, and secrets management to a code review checklist

Explain how threat modeling identifies design flaws before code is written

Describe how software composition analysis and dependency inventory support vulnerability management

Identify third-party risk assessment activities across onboarding, ongoing monitoring, and offboarding

Explain how to evaluate a vendor's security posture using questionnaires, attestations, and contractual controls

Describe supply chain risks in hardware, software, and services and one mitigation for each

Explain right-to-audit clauses, data processing terms, and breach notification obligations in vendor contracts

Rehearse the full exam blueprint by mapping every domain to your notes and flagging gaps