CNSP Certification study plan

Map the OWASP Top 10 categories to concrete request/response evidence you could capture in a proxy, writing one example per category

Configure an intercepting proxy and a browser profile, then capture and annotate five distinct vulnerability classes against a deliberately vulnerable practice app

Explain and demonstrate the difference between reflected, stored, and DOM-based cross-site scripting using three separate payload contexts

Describe how parameterized queries, output encoding, and Content Security Policy each mitigate a different failure mode, and state one bypass for each mitigation

Walk through the server-side request forgery, insecure deserialization, and broken access control failure modes and identify the trust boundary each one crosses

Practice testing for horizontal and vertical privilege escalation by manipulating identifiers, cookies, and hidden fields in a practice app

Compare session management designs: cookie flags, token rotation, and logout invalidation, and list the specific test you would run for each

Draft a short remediation writeup for one finding that a developer could act on without further questions

Enumerate an internal lab subnet with host discovery and service scanning, then record which scan type produced which result and why

Identify and safely validate three common internal weaknesses such as SMB signing disabled, LLMNR enabled, or anonymous LDAP bind, without performing exploitation

Describe Active Directory authentication flows for Kerberos and NTLM and list the log or artifact each leaves behind

Explain segmentation and egress filtering as controls and describe how you would verify them from a compromised host perspective

Compare credentialed versus uncredentialed scanning and state when each is appropriate for an internal assessment

Map external attack surface discovery steps: certificate transparency, DNS enumeration, and cloud asset identification, and run at least two of them against an authorized target

Explain how a perimeter service differs in risk from the same service internally, using at least two concrete examples

Summarize how TLS configuration weaknesses and exposed management interfaces are detected and reported

Perform static review of a small code sample and locate at least three injection or authentication flaws by tracing data from source to sink

Explain the difference between taint analysis and pattern matching, and state a false positive each approach tends to produce

Identify hardcoded secrets, weak cryptography choices, and unsafe deserialization in code and describe the safer alternative for each

Correlate a static finding with a dynamic test to confirm exploitability, and document the confirmation step

Describe the mobile threat model differences between iOS and Android, including storage, inter-process communication, and code signing, and list the test for each

Explain what insecure data storage, improper platform usage, and weak transport security look like on a mobile app and how you would verify them on a test device

Map cloud shared responsibility boundaries for IaaS, PaaS, and SaaS and state which controls remain the customer's in each model

Identify common cloud misconfigurations such as public storage buckets, over-permissive identity policies, and exposed metadata services, and describe the detection method for each

Explain how a red team engagement differs from a penetration test in scope, rules of engagement, and reporting audience

Draft the rules-of-engagement elements that must be agreed before testing: targets, time windows, escalation contacts, and prohibited actions

Describe how adversary emulation maps to a threat model and why objective-based testing changes success criteria

Outline how findings from a red team exercise are translated into detection engineering improvements

Describe the AI/ML attack surface across the model lifecycle: data poisoning, prompt injection, model extraction, and adversarial input, and name one control per stage

Explain why prompt injection is an input-handling problem rather than a model bug, and describe how output handling and tool permissions reduce impact

Complete a timed mixed-domain practice set and categorize every missed question by domain to target final review

Re-derive the top three weak areas from your error log and write a one-paragraph remediation summary for each