Cambridge SC study plan

Define the CIA triad plus authenticity, non-repudiation, and accountability, and give one concrete failure example for each

Classify at least 15 threat types (phishing, ransomware, supply-chain compromise, insider misuse, DDoS, on-path attack) by actor motive and primary target asset

Map the kill chain and MITRE ATT&CK-style tactic stages onto a single worked intrusion scenario you write yourself

Explain vulnerability, exposure, risk, and threat in a way that distinguishes each term without overlap

Build a personal glossary of 40 security terms with one-line definitions you can recall unaided

Diagram the OSI and TCP/IP layers and state which attacks and controls live at each layer

Compare stateful firewalls, WAFs, IDS/IPS, and proxies by what traffic they can and cannot inspect

Explain TLS handshake steps, certificate validation, and three common misconfiguration failures

Describe segmentation, VLANs, DMZs, and zero-trust network access with a use case for each

Analyze three attack scenarios (ARP spoofing, DNS poisoning, on-path interception) and select a mitigating control for each

Compare authentication factors and select an appropriate MFA scheme for three different user populations

Differentiate DAC, MAC, RBAC, and ABAC and apply the correct model to four given access scenarios

Explain federated identity concepts (SAML, OIDC, SSO) and where trust boundaries sit

Walk through a password-storage design covering hashing, salting, and work factors, and explain why each element matters

Identify three common authentication failures (credential stuffing, session fixation, weak reset flows) and the control that prevents each

Distinguish symmetric, asymmetric, and hashing primitives by use case and state one weakness of each

Explain key management lifecycle stages from generation through destruction and where keys commonly leak

Compare encryption at rest, in transit, and in use, naming a realistic control for each state

Describe digital signatures and certificate chains well enough to explain why a self-signed certificate triggers a warning

Select appropriate algorithms for four given data-protection scenarios and reject weak or deprecated choices with a reason

Trace the SSDLC phases and name the security activity that belongs in each

Explain how SAST, DAST, SCA, and secret scanning differ in what they detect and when they run

Describe how to prioritize findings by exploitability and business impact rather than raw severity score

Outline secure configuration and patch management for containers and CI/CD pipelines

Identify three classes of injection or input-validation flaws and the coding practice that prevents each

Order the incident response lifecycle phases and state the entry and exit criteria for each

Draft triage criteria that separate true incidents from benign anomalies using severity and scope

Explain the purpose of logs, SIEM correlation, and indicators of compromise in detection

Describe containment, eradication, and recovery trade-offs, including when to isolate versus monitor

Outline a post-incident review that produces corrective actions with owners and dates

Map the risk management process from asset identification through treatment and residual risk acceptance

Compare qualitative and quantitative risk approaches and compute a simple annualized loss expectancy example

Distinguish policies, standards, procedures, and guidelines and place each in a governance structure

Explain how ISO 27001-style management systems and SOC 2-style attestations differ in scope and audience

Identify compliance obligations that drive technical controls and link three controls back to their requirement

Apply data classification tiers and map handling rules to each tier

Explain privacy principles such as minimization, purpose limitation, and retention limits using concrete system examples

Compare anonymization, pseudonymization, and masking by reversibility and residual risk

Revisit domain 1 weak areas identified in earlier self-quizzes and close at least three gaps

Complete two timed mixed-domain practice sets and log every missed concept by domain