SNAP study plan

Map the OSI and TCP/IP models layer by layer, then place at least 15 common protocols (ARP, IP, TCP, UDP, TLS, DNS, DHCP, HTTP, SMB, LDAP, Kerberos, ICMP, SNMP, SSH, RDP) on the correct layer and note the port each uses.

Explain the TCP three-way handshake and teardown, and describe how a SYN flood or session-hijacking attempt differs from normal traffic at the packet level.

Distinguish stateful inspection, proxy, and next-generation firewall behavior, and state one scenario where each is the better fit.

Summarize how IPsec (AH/ESP, transport vs. tunnel mode) and TLS protect data in transit, including what each does not protect.

Classify the main network topologies and segmentation approaches (VLAN, DMZ, screened subnet, microsegmentation) and give one security benefit and one limitation of each.

Describe how a proxy-based secure web gateway differs from a passthrough inspection device, and list the traffic types each can and cannot inspect (for example, pinned TLS or non-HTTP protocols).

Explain the role of a management center versus a managed endpoint in a centrally administered security deployment, and trace the policy-push path from console to endpoint.

Compare on-premises, virtual, and cloud-delivered deployments of endpoint and gateway security, listing one trade-off for each.

Identify the main components of a Symantec endpoint protection deployment (management console, endpoint agent, content/definition updates, reputation services) and state what each component depends on.

Draw the data flow for a file downloaded over HTTPS from the internet to an endpoint, marking where TLS inspection, reputation lookup, and endpoint scanning occur.

Define and differentiate malware categories - virus, worm, trojan, ransomware, rootkit, botnet, fileless and living-off-the-land techniques - with one concrete behavioral indicator for each.

Explain the MITRE ATT&CK tactic flow from initial access through exfiltration and name at least two techniques per stage that an endpoint agent could detect.

Describe how reputation-based detection (file, URL, and IP reputation) complements signature and heuristic detection, and state the weakness of each method alone.

Outline the stages of a targeted intrusion (reconnaissance, initial access, execution, persistence, privilege escalation, lateral movement, exfiltration) and the log or telemetry source that would reveal each stage.

Explain why signature-only detection fails against polymorphic and fileless threats, and describe one behavioral or sandbox technique that closes the gap.

Install or walk through a lab endpoint agent deployment end to end: agent install, console registration, policy assignment, and confirmation that the policy is enforced.

Configure at least three endpoint policy areas (file scanning, web/URL filtering, device control, or firewall) and document the setting, default, and security impact of each.

Explain how content and definition updates propagate, how to verify an endpoint is current, and what happens when updates fail.

Describe quarantine, block, and log-only actions, and choose the correct action for three given scenarios.

Summarize how endpoint management handles unmanaged or rogue devices and how it reports compliance state back to the console.

Compare 802.1X, MAC authentication bypass, and captive-portal NAC, and state the deployment context where each is appropriate.

Explain the roles of supplicant, authenticator, and authentication server in 802.1X, and describe how EAP methods differ in the credentials they protect.

Trace how a posture check (patch level, antivirus state, disk encryption) results in permit, quarantine, or deny, and where each decision is enforced.

Describe how a network access policy integrates with endpoint management so that a noncompliant device is remediated rather than simply blocked.

Identify three failure modes of NAC deployments (for example, misconfigured supplicants, certificate expiry, fallback loops) and one mitigation for each.

Explain the purpose of SIEM, log collection, and correlation, and distinguish logs, events, and alerts.

List the log sources that matter most for endpoint and network incidents (endpoint agent, firewall, proxy, DNS, authentication, IDS/IPS) and the key fields each provides.

Walk through the incident response lifecycle (prepare, identify, contain, eradicate, recover, lessons learned) and assign at least two concrete actions to each phase for a ransomware scenario.

Describe how to triage an alert: severity, scope, false-positive assessment, and escalation criteria.

Explain chain of custody and evidence handling for a suspected endpoint compromise, including what to capture before remediation.

Distinguish symmetric from asymmetric encryption, name common algorithms for each, and state where each is used in practice (TLS, disk encryption, email, key exchange).

Explain full-disk, file/folder, and removable-media encryption, and compare their threat coverage and operational cost.

Describe how key management, escrow, and recovery work for encrypted endpoints, and why lost keys are a business risk.

Summarize data classification and DLP policy concepts: what data is protected, where it can flow, and how policy violations are detected and blocked.

Explain how TLS interception interacts with data protection and privacy obligations, and state one control that limits the exposure it creates.

Map common compliance frameworks (ISO 27001, PCI DSS, HIPAA, GDPR, SOX) to the technical controls studied in weeks 1–7, naming at least two controls per framework.

Perform a qualitative risk assessment on three scenarios using likelihood and impact, and propose a treatment (mitigate, transfer, accept, avoid) for each.

Explain defense in depth and least privilege using concrete examples from the endpoint, network, and NAC material.

Complete a timed 60-question practice set spanning all eight domains and score at least 80%.

Review every missed practice question, write the correct concept in your own words, and re-test those items until each is answered correctly twice.