CPIT InfoSec study plan

Map each element of the CPIT InfoSec exam blueprint to its domain weight and identify the three highest-weighted domains for prioritization.

Explain the difference between policies, standards, procedures, and guidelines, and give one original example of each for a fictional organization.

Describe the risk management process (identification, analysis, evaluation, treatment) and apply it to a simple scenario involving a lost laptop.

List at least five common security frameworks (e.g., ISO 27001, NIST CSF, CIS Controls) and state one primary purpose of each without copying descriptions.

Define key compliance concepts such as scope, applicability, audit evidence, and control testing, and explain how they differ.

Compare three security architecture models (e.g., perimeter-based, zero trust, defense in depth) and list one strength and one weakness of each.

Explain the purpose of reference architectures and how they guide secure design decisions.

Describe the role of threat modeling in the design phase and apply a simple threat modeling method (e.g., STRIDE) to a login feature.

Identify at least four secure design principles (e.g., least privilege, separation of duties, fail-safe defaults) and give a concrete example of each in a system design.

Explain how virtualization, containerization, and cloud shared responsibility affect security architecture choices.

Diagram a network segmentation scheme that separates user, server, and management traffic, and explain the security rationale for each zone.

Compare stateful inspection, application-layer firewalls, and intrusion prevention systems in terms of what they inspect and where they are deployed.

Explain how VPNs, TLS inspection, and network access control (NAC) contribute to perimeter security, including one limitation of each.

Describe the identity lifecycle (provisioning, authentication, authorization, deprovisioning) and identify a control at each stage.

Compare authentication factors and methods (passwords, MFA, biometrics, certificates) and explain when each is appropriate.

Explain access control models (RBAC, ABAC, MAC, DAC) and select one for a given scenario with justification.

Describe the hardening process for an operating system and list at least five specific configuration items to harden (e.g., disable unused services, enforce password policy, enable logging).

Explain the difference between application whitelisting, blacklisting, and sandboxing, and state a use case for each.

Identify common web application vulnerabilities (e.g., injection, broken authentication, XSS) and describe one preventive control for each.

Explain how endpoint detection and response (EDR) differs from traditional antivirus and what telemetry EDR collects.

Outline a secure software development lifecycle (SSDLC) and place at least three security activities (e.g., code review, SAST, penetration testing) in the correct phase.

Explain symmetric and asymmetric encryption, including one appropriate use case for each and one key management challenge.

Describe the purpose of hashing, salting, and key derivation functions, and explain why hashing is not encryption.

Outline a key management lifecycle (generation, distribution, storage, rotation, destruction) and identify a control at each stage.

Explain the core principles of privacy by design and how they influence system requirements.

Identify at least three legal or ethical issues in security work (e.g., data breach notification, unauthorized access, whistleblowing) and describe the appropriate response for each.

Describe the components of a security operations center (SOC) and the roles of tier 1, tier 2, and tier 3 analysts.

Explain the incident response lifecycle (preparation, detection, containment, eradication, recovery, lessons learned) and list one action for each phase.

Differentiate between log collection, correlation, and alerting, and explain how SIEM supports each.

Define key monitoring metrics (e.g., mean time to detect, mean time to respond) and explain how they are used to improve operations.

Outline the steps for handling a suspected phishing incident, from user report to containment and communication.

Distinguish between business continuity (BC) and disaster recovery (DR), and explain how each contributes to resilience.

Define recovery time objective (RTO) and recovery point objective (RPO) and apply them to a given system to determine backup frequency.

Describe the components of a business impact analysis (BIA) and list the steps to conduct one.

Explain the purpose of tabletop exercises and list three elements of an effective exercise scenario.

Identify at least three backup strategies (e.g., full, incremental, differential) and state one advantage and one disadvantage of each.

Synthesize governance, risk, and compliance concepts by mapping a given control to a risk, a policy, and a monitoring activity.

Explain how security metrics and reporting support continuous improvement and executive decision-making.

Review the exam blueprint and identify any remaining weak areas by domain weight, then prioritize review accordingly.

Complete a timed practice set of at least 30 original questions covering all domains, and analyze incorrect answers to identify knowledge gaps.

Create a personal one-page exam-day strategy that includes time management per domain and a plan for flagging uncertain questions.