Military Cyber Test study plan

Define cyberspace operations doctrine, key terms (OCO, DCO, DCO-IDM), and the mission-planning cycle from memory without notes.

Map each phase of the joint targeting/cyber mission planning cycle to its inputs and outputs, and identify where legal review and intelligence support are injected.

Compare offensive mission planning constraints (authorities, deconfliction, collateral effects) against defensive planning constraints using a two-column matrix you build yourself.

Explain how cyber operations are integrated into a combined/joint campaign and list three doctrinal reasons why synchronization with kinetic operations matters.

Trace a full offensive cyber kill chain from access development through objective and describe the decision point at each stage.

Analyze packet captures of at least three protocols (TCP handshake, DNS, HTTP) and identify anomalies that indicate tunneling or exfiltration.

Diagram a target network from a notional reconnaissance report and mark ingress, pivot, and exfiltration paths.

Write mission success criteria and a measures-of-effectiveness list for a notional operation against a designated target set.

Execute the incident-response lifecycle (prepare, detect, contain, eradicate, recover, lessons learned) against a tabletop scenario and justify each containment decision.

Collect and preserve volatile evidence from a compromised endpoint in correct order of volatility, and document chain of custody.

Harden a Windows and a Linux endpoint against a given attack technique checklist and verify each control.

Correlate endpoint telemetry (process creation, registry, file integrity) with network logs to reconstruct an intrusion timeline.

Reconcile doctrinal DCO concepts with hands-on IR practice by mapping each IR phase to the corresponding defensive cyberspace operation mission.

Build a detection rule (Sigma or equivalent) for a chosen technique and test it against sample logs.

Draft a commander's decision brief that translates technical incident findings into operational impact and recommended actions.

Identify and correct three common mistakes in incident escalation and reporting chains.

Explain symmetric vs. asymmetric encryption, hashing, digital signatures, and key exchange, and select the correct primitive for five stated military communications requirements.

Diagnose common TLS/PKI failures (expired cert, name mismatch, weak cipher) from configuration and handshake data.

Profile an adversary using a structured framework (campaign, capability, infrastructure, victimology) and map observed TTPs to ATT&CK techniques.

Assess the reliability of threat intelligence sources and state confidence levels for each judgment.

Apply the law of armed conflict principles (distinction, proportionality, necessity, humanity) to three cyber operation scenarios and defend each conclusion.

Draft rules of engagement for a notional cyber mission that specify authorized targets, prohibited effects, and escalation triggers.

Determine when a cyber operation crosses the threshold of use of force or armed attack under international law frameworks, and justify the reasoning.

Integrate legal review checkpoints into an offensive mission plan and identify where a plan would be rejected.

Perform traffic analysis on a sample capture to identify beaconing, lateral movement, and data staging.

Analyze host artifacts for persistence mechanisms on Windows and Linux and produce a removal procedure for each.

Compare adversary tradecraft across two threat actors and predict their likely next technique from observed patterns.

Reconstruct an attack from mixed network and endpoint evidence and attribute activity with stated confidence.

Complete a timed 100-question mixed-domain practice exam and score every missed item by domain and root cause.

Re-teach the three weakest domains from memory using a blank page and a five-minute verbal explanation each.

Review all prior deliverables and correct at least five factual or reasoning errors you find.

Build a final one-page reference sheet of formulas, frameworks, and thresholds you must recall under pressure.