CASSPT study plan
CASSPT · Give each week a clear focus.
8 weeks · About 7 hours per week
Threat and Vulnerability Assessment
Map the Threat and Vulnerability Assessment domain objectives into a personal checklist and rate current confidence per objective on a 1-5 scale
Explain the difference between threat, vulnerability, and risk, and classify ten example scenarios into the correct category
Describe how asset criticality and business context change vulnerability prioritization, using two contrasting examples
Build a reusable asset inventory template that captures owner, data classification, exposure, and business function
Your checkpoint
A one-page domain 1 objective checklist with confidence ratings plus a completed asset inventory template for a fictional 15-asset organization
Threat and Vulnerability Assessment
Compare qualitative and quantitative risk methods, and compute a single-year loss expectancy from given asset value, exposure factor, and annualized rate of occurrence inputs
Sequence the phases of a vulnerability management lifecycle from discovery through remediation and verification
Select scanning approaches for authenticated versus unauthenticated hosts and justify the choice for three scenarios
Interpret a CVSS vector string and explain which components reflect exploitability versus impact
Your checkpoint
A worked risk register of ten entries with computed risk scores, treatment decisions, and a written rationale for each prioritization
Threat and Vulnerability Assessment & Security Architecture and Design
Evaluate threat intelligence sources and distinguish strategic, operational, and tactical feeds by consumer and refresh cadence
Diagram a defense-in-depth architecture for a hybrid environment showing segmentation, control placement, and trust boundaries
Compare perimeter, zero trust, and microsegmentation models on identity assumptions and failure modes
Apply secure design principles such as least privilege, separation of duties, and fail-safe defaults to a proposed design
Your checkpoint
An annotated architecture diagram of a hybrid environment with at least six labeled trust boundaries and a control-to-threat mapping table
Security Architecture and Design
Classify data states and select appropriate controls for data at rest, in transit, and in use
Differentiate symmetric, asymmetric, and hashing primitives and choose the right one for confidentiality, integrity, and key exchange needs
Explain key management lifecycle activities including generation, rotation, escrow, and destruction
Identify common cryptographic implementation failures such as weak modes, reused nonces, and improper certificate validation
Your checkpoint
A cryptography decision guide mapping eight common requirements to recommended primitives, key lengths, and lifecycle rules
Implementation and Operations
Configure and validate identity controls including multifactor authentication, conditional access, and privileged access management in a lab tenant or equivalent environment
Harden a host baseline against a published benchmark and document each deviation with justification
Automate one repetitive security task with a script and add input validation and logging to it
Describe secure deployment practices including infrastructure as code review and secrets management
Your checkpoint
A hardening report for one lab system showing benchmark score before and after, plus a working automation script with sample output
Implementation and Operations & Monitoring, Detection, and Incident Response
Design a logging pipeline that captures identity, endpoint, network, and cloud control-plane telemetry with defined retention
Write detection logic for three attack techniques and state the data source each rule depends on
Triage simulated alerts using a structured process that separates true positives from benign triggers
Outline containment, eradication, and recovery steps for a credential compromise scenario
Your checkpoint
Three tested detection rules with sample true-positive and false-positive output, plus a written triage record for each
Monitoring, Detection, and Incident Response & Governance, Risk, and Compliance
Sequence the incident response lifecycle and assign decision authority at each phase
Build a tabletop exercise scenario with three escalating injects and expected response actions
Map a control set to a recognized framework and identify gaps against a target maturity level
Distinguish policy, standard, procedure, and guideline, and draft one of each for a single control area
Your checkpoint
A tabletop exercise package containing the scenario, three injects, facilitator notes, and a gap analysis table mapping ten controls to framework requirements
Governance, Risk, and Compliance & Threat and Vulnerability Assessment & Implementation and Operations
Interpret audit evidence requirements and assemble an evidence package for three sample controls
Explain third-party and supply chain risk assessment steps from onboarding through continuous monitoring
Re-rate confidence on every domain objective and concentrate review on the lowest-scoring areas
Complete two timed practice sets and analyze every missed item by root cause category
Your checkpoint
A final readiness report with updated confidence ratings per domain, a prioritized list of remaining weak objectives, and a root-cause log from practice misses
Milestones
Week 2: Can compute a risk score from asset value, exposure factor, and annualized rate of occurrence without notes, and justify a remediation priority order for ten findings
Week 4: Can draw a segmented architecture with labeled trust boundaries and select correct cryptographic primitives for eight stated requirements, scoring at least 7 of 8
Week 6: Can write a working detection rule for a given technique, name its required log source, and describe the first three triage steps for the resulting alert
Week 8: Scores at least 80 percent on two timed practice sets, with every missed item assigned a root cause and a scheduled review date