Military Cyber Test study guide
Military Cyber Test · Work through your exam, one topic at a time.
The Military Cyber Test is a vendor-neutral, independent study resource for candidates preparing for military cyber operator and cyber workforce assessment exams. It suits service members, government civilians, and defence-adjacent professionals who need to demonstrate competence across both offensive and defensive cyber operations rather than a single tool or platform. The Military Cyber Test study guide has 8 sections and about 2,633 words.
01Cyber Operations Fundamentals and Doctrine
Cyberspace operations doctrine treats cyberspace as a global domain within the information environment built from interdependent networks of information technology infrastructure, computer systems, and embedded processors and controllers (JP 3-12). The exam tests whether you can classify an activity into the correct doctrinal category and name the authority that goes with it.
332 words, about 2 min02Offensive Cyber Operations and Mission Planning
The exam expects you to nest cyber mission planning inside the six-phase Joint Targeting Cycle: (1) end state and commander's objectives, (2) target development and prioritization, (3) capabilities analysis, (4) commander's decision and force assignment, (5) mission planning and force execution, (6) assessment. Cyber adds prerequisites conventional fires lack: access development, payload validation on a representative range, collateral-effects estimation for shared infrastructure, and a deconfliction line to the DCO and intelligence communities.
361 words, about 2 min03Defensive Cyber Operations and Incident Response
CJCSM 6510.01B governs DoD cyber incident handling with six phases: preparation, identification, containment, eradication, recovery, and follow-up. NIST SP 800-61 uses four: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.
319 words, about 2 min04Network Architecture, Protocols, and Traffic Analysis
TCP opens with SYN, SYN/ACK, ACK; sequence and acknowledgment numbers let you spot retransmissions, resets, and injected packets. RST mid-session often means a middlebox or a hostile teardown; PSH flags push data to the application.
330 words, about 2 min05Operating System and Endpoint Security
4624 successful logon, with logon type 2 interactive, 3 network, 10 remote interactive; 4625 failed logon; 4672 special privileges assigned; 4688 process creation; 7045 new service installed. Sysmon events: 1 process create, 3 network connect, 7 image load, 11 file create, 13 registry set.
300 words, about 2 min06Cryptography and Secure Communications
AES-GCM provides confidentiality and integrity in one pass. AES-CBC and CTR provide confidentiality only and need a separate MAC; ECB leaks plaintext structure and should never be used for anything variable.
321 words, about 2 min07Cyber Threat Intelligence and Adversary Tradecraft
Intelligence runs the cycle: planning and direction, collection, processing, analysis and production, dissemination. Threat intelligence has tiers - strategic (intent and posture of a state actor), operational (campaigns), tactical (TTPs), and technical (indicators).
324 words, about 2 min08Law, Policy, and Rules of Engagement for Cyberspace Operations
Title 10 covers military operations, including most OCO and DCO; Title 50 covers covert action, which requires a presidential finding. NSPM-13 delegates approval of certain OCO to the Secretary of Defense.
346 words, about 2 min