IBM Cybersecurity Analyst study plan

Define the CIA triad, non-repudiation, and defense-in-depth, then map each concept to one concrete control in a hypothetical retail company

Classify at least ten threat actors (script kiddie, hacktivist, insider, organized crime, nation-state, APT) by motive, capability, and typical target

Diagram the phases of a ransomware intrusion from initial access to extortion, labeling the technique used at each stage

Compare malware families (virus, worm, trojan, rootkit, ransomware, fileless) by propagation method and persistence mechanism

Explain how a SIEM ingests logs, normalizes fields, correlates events, and generates alerts, using the concepts of log source, parser, rule, and offense

Differentiate IDS versus IPS, signature versus anomaly detection, and HIDS versus NIDS with a worked example of each

Interpret the MITRE ATT&CK tactic sequence and locate three techniques relevant to credential access and lateral movement

Describe the function of a SOC tier structure (T1 triage, T2 investigation, T3 hunting) and the escalation criteria between tiers

Configure and justify a segmented network zone model (DMZ, internal, management) with firewall rule logic for each boundary

Compare stateful inspection, proxy, and next-generation firewall capabilities and state which threat each best mitigates

Explain how TLS inspection, VPN tunnels, and zero-trust network access differ in the protection they provide

Identify common wireless and DNS-layer attacks and the mitigation for each (WPA3, DNSSEC, DNS filtering, 802.1X)

Apply a hardening baseline to an operating system, covering patch cadence, service minimization, least-privilege accounts, and logging

Explain endpoint detection and response telemetry sources and how behavioral detection differs from signature antivirus

Distinguish authenticated versus unauthenticated scanning, false positive versus false negative, and CVSS base versus environmental scoring

Sequence a vulnerability management lifecycle from asset inventory through scan, prioritize, remediate, and verify

Interpret a vulnerability report and rank findings by exploitability, exposure, and business impact rather than raw score alone

Order the incident response lifecycle phases and state the decision criteria for declaring an incident and for moving to containment

Distinguish volatile from non-volatile evidence and apply order of volatility when collecting from a live host

Explain chain of custody, hashing for integrity, and why write blockers are required for forensic imaging

Compare forensic artifacts (memory, disk, logs, network capture) by the question each best answers

Draft containment, eradication, and recovery actions for a confirmed credential-theft incident

Compare authentication factors and select appropriate multi-factor methods for high-risk versus low-risk accounts

Explain access control models (DAC, MAC, RBAC, ABAC) and choose one for a given organizational scenario

Describe identity federation, SSO, and OAuth/OIDC/SAML roles in enabling least-privilege access across applications

Map data protection controls (classification, encryption at rest and in transit, tokenization, DLP, retention) to data lifecycle stages

Identify common identity attacks such as credential stuffing, pass-the-hash, and privilege escalation, with a mitigation for each

Explain the shared responsibility model and identify which controls remain the customer's duty in IaaS, PaaS, and SaaS

Describe the OWASP Top 10 risk categories and the secure coding or configuration control that mitigates each

Compare SAST, DAST, SCA, and IaC scanning by what they detect and where they fit in the development lifecycle

Explain container and cloud misconfiguration risks such as exposed storage, overly permissive IAM roles, and unpatched images

Distinguish governance, risk, and compliance functions and map common frameworks (ISO 27001, NIST CSF, PCI DSS, GDPR) to their purpose

Perform a qualitative risk assessment using likelihood and impact, and select a treatment (mitigate, transfer, avoid, accept)

Explain the analyst's ethical and legal obligations around authorized testing, evidence handling, and responsible disclosure

Revisit weak domains using missed practice questions and close the top three knowledge gaps with targeted review

Assemble a final one-page summary of key formulas, frameworks, and lifecycle models for last-week recall