NCCS study plan
NCCS · Give each week a clear focus.
8 weeks · About 6 hours per week
Security Fundamentals and Threat Landscape
Define the CIA triad and map each element to two concrete control examples
Classify the major threat actor types by motivation, capability, and typical access vector
Explain common malware categories including ransomware, fileless, and living-off-the-land techniques
Diagram the phases of a social engineering attack and identify the human control that interrupts each phase
Your checkpoint
A one-page threat taxonomy table listing 12 threat types with actor, vector, impact, and one mitigating control for each
Security Fundamentals and Threat Landscape & Network Security and Perimeter Defense
Compare network segmentation, DMZ design, and microsegmentation for containing lateral movement
Describe how stateful firewalls, WAFs, IDS, and IPS differ in what they inspect and where they sit
Explain the handshake and risk implications of TLS inspection and encrypted traffic blind spots
Identify common network attacks such as spoofing, ARP poisoning, and DDoS and match each to a defense
Your checkpoint
A labeled perimeter architecture sketch showing firewall, WAF, IDS/IPS, DMZ, and segmentation boundaries with a short note on what each device blocks
Network Security and Perimeter Defense & Endpoint and Host Security
Configure and interpret host hardening baselines covering patching, service minimization, and least privilege
Compare EDR, antivirus, application allowlisting, and host firewalls by detection mechanism and gap
Describe endpoint detection telemetry sources and how to triage an alert from process, file, and network events
Explain patch management and vulnerability remediation prioritization using exploitability and exposure
Your checkpoint
A hardening checklist for one Windows and one Linux host with 15 verified settings and the command or path used to check each
Access Control and Identity Management
Compare authentication factors and select appropriate MFA methods for high-risk versus standard accounts
Explain AAA, federation, SSO, and the role of SAML and OIDC in identity flows
Differentiate RBAC, ABAC, and MAC and justify a model for a given access scenario
Describe privileged access management controls including vaulting, just-in-time access, and session recording
Identify common identity attacks such as credential stuffing, pass-the-hash, and MFA fatigue
Your checkpoint
A written access control design for a 200-user organization naming the model, MFA policy, privileged access rules, and three identity attack mitigations
Cryptography and Data Protection
Distinguish symmetric, asymmetric, and hashing primitives by use case and property
Select appropriate cipher modes and key lengths and explain why deprecated algorithms fail
Explain PKI components including CA hierarchy, certificate lifecycle, revocation, and pinning risks
Describe data protection across states at rest, in transit, and in use with tokenization and DLP examples
Your checkpoint
A cryptography decision matrix matching eight scenarios such as data at rest, code signing, and password storage to algorithm, key management, and rationale
Security Operations and Incident Response
Order the incident response lifecycle and state the decision criteria at each phase gate
Build a detection-to-triage workflow using log sources, SIEM correlation, and severity scoring
Explain containment, eradication, and recovery tradeoffs including evidence preservation
Draft post-incident review outputs that feed measurable control improvements
Your checkpoint
A tabletop incident response runbook for a ransomware scenario with timeline, roles, escalation triggers, and containment decision points
Risk Management, Compliance, and Governance
Perform a qualitative risk assessment using likelihood, impact, and a defined risk appetite
Compare risk treatment options and map controls to a recognized framework
Identify compliance obligations and how audit evidence differs from operational security
Explain BCP and DR concepts including RTO, RPO, and tabletop validation
Your checkpoint
A risk register with 10 risks scored, each with owner, treatment choice, and mapped control or framework reference
Cloud and Emerging Technology Security & Security Operations and Incident Response & Risk Management, Compliance, and Governance
Describe the shared responsibility model and identify misconfiguration risks in IaaS, PaaS, and SaaS
Explain cloud identity, workload, and secrets management controls and common exposure paths
Evaluate emerging technology risks such as AI-assisted attacks, containers, and OT convergence
Integrate all domains through timed mixed-topic practice and targeted review of missed concepts
Your checkpoint
A full-length timed practice exam with a scored error log categorizing each miss by domain and a written remediation plan for the two weakest domains
Milestones
Week 2: Explain from memory how a packet traverses the perimeter stack and which control stops a spoofed and a DDoS attack without notes
Week 4: Score at least 75 percent on a 40-question mixed quiz covering domains 1 through 4
Week 6: Walk through the incident response lifecycle and correctly place five given actions into phases with no reference material
Week 7: Produce a defensible risk score for three scenarios and justify each treatment choice against a stated risk appetite
Week 8: Achieve at least 80 percent on the timed practice exam with no domain scoring below 65 percent