NCJOSI study guide
NCJOSI · Work through your exam, one topic at a time.
NCJOSI is a vendor-neutral, multiple-choice certification aimed at practitioners who need a working, cross-domain command of defensive security rather than deep specialization in one tool. It suits SOC analysts, junior security engineers, IT administrators moving into security, and compliance or risk staff who must speak credibly with technical teams. The NCJOSI study guide has 8 sections and about 3,112 words.
01Network Security Fundamentals
Network Security Fundamentals tests whether you can explain how traffic actually moves and where a control can be inserted to stop it. Expect questions on layering, segmentation, firewall behaviour, and secure protocol choices rather than product trivia.
396 words, about 2 min02Threat Landscape and Attack Vectors
Threat Landscape and Attack Vectors tests whether you can name the actor, the technique, and the observable evidence for a short scenario. Questions usually give a narrative and ask you to classify the activity, not to recall marketing names for malware families.
389 words, about 2 min03Security Operations and Monitoring
Security Operations and Monitoring tests how alerts are produced, triaged, and turned into action. Expect questions on log sources, correlation, detection trade-offs, and the operational metrics a SOC is measured by.
422 words, about 2 min04Incident Response and Forensics
Incident Response and Forensics tests the lifecycle you follow under pressure and the evidence handling that survives scrutiny. Questions often hinge on sequencing: what you do first, and what you must not destroy.
371 words, about 2 min05Vulnerability Management and Risk Assessment
Vulnerability Management and Risk Assessment tests whether you can find weaknesses, score them honestly, and justify treatment in business terms. It rewards people who know that severity is not priority.
353 words, about 2 min06Cryptography and Data Protection
Cryptography and Data Protection tests whether you can select the right primitive for a stated goal and explain what it does and does not guarantee. The exam favours correct usage over algorithm history.
387 words, about 2 min07Identity and Access Management
Identity and Access Management tests the lifecycle of an identity and the mechanisms that prove and limit what it can do. Expect questions on federated protocols, authorisation models, and the operational failures that create orphan accounts.
392 words, about 2 min08Security Policies, Compliance, and Governance
Security Policies, Compliance, and Governance tests whether you can turn an obligation into a documented, auditable control. Expect questions on hierarchy of documents, framework structure, and the difference between being compliant and being secure.
402 words, about 2 min