NCJOSI study plan

Map the OSI and TCP/IP models layer by layer and state, for each layer, one protocol, one device or function, and one common attack that targets it

Explain how ARP, DNS, DHCP, and NAT behave in a normal network and describe the failure or spoofing mode of each

Differentiate stateful inspection, proxy, and next-generation firewall behavior and identify which traffic each fails to control

Classify at least 15 attack types (phishing, credential stuffing, pass-the-hash, SQL injection, lateral movement, ransomware, supply chain compromise) by vector, motive, and primary control that stops them

Build a personal glossary of 60 security terms with a one-sentence original definition for each

Trace a multi-stage intrusion from initial access through persistence, privilege escalation, and exfiltration, naming the log or telemetry source that would reveal each stage

Compare signature, anomaly, and behavioral detection and state one scenario where each is the correct choice

Interpret the fields of a firewall log, a web server access log, and a Windows or Linux authentication event and describe what each field proves and does not prove

Explain how a SIEM correlates events and why an alert is a hypothesis rather than a conclusion

Set up a free lab (virtual machines or a hosted SIEM trial) and generate three benign events that produce alerts

Define the phases of incident response and state the entry and exit criteria for each phase

Distinguish an event, an alert, an incident, and a breach and justify the classification of five short scenarios

Write containment, eradication, and recovery actions for a ransomware outbreak and for a compromised service account, noting the tradeoff between speed and evidence preservation

Explain order of volatility and list acquisition steps for memory, disk, and network capture

Describe chain of custody, hashing of evidence, and why a working copy is analyzed instead of the original

Re-derive the network fundamentals from week 1 without notes and correct every gap found

Analyze three practice log excerpts and write a triage note for each stating severity, next action, and escalation decision

Explain how EDR telemetry, DNS logs, and proxy logs complement each other during an investigation

Describe common anti-forensics moves (log clearing, timestomping, encrypted archives) and the artifact that still exposes each

Distinguish vulnerability, threat, and risk and compute a simple risk score from likelihood and impact for five given findings

Explain CVSS base, temporal, and environmental metrics and state when a high CVSS score is not the top remediation priority

Order remediation by exploitability, exposure, and business impact rather than score alone, and justify one exception

Compare symmetric and asymmetric encryption, hashing, and digital signatures by purpose and failure mode

Match TLS, IPsec, SSH, and at-rest encryption to the problem each solves and identify one common misconfiguration of each

Explain authentication, authorization, and accounting and place each control in the correct category

Compare MFA factors and describe why push-notification fatigue and token theft defeat some MFA implementations

Differentiate RBAC, ABAC, and least privilege with a concrete example of each in an enterprise directory

Describe the identity lifecycle from joiner to mover to leaver and name the control that most often fails at each transition

Explain key management basics: generation, storage, rotation, and revocation, and the consequence of skipping rotation

Classify controls as preventive, detective, or corrective and as administrative, technical, or physical for 12 given examples

Map a policy, a standard, a procedure, and a guideline to distinct documents you could actually write

Explain how a vulnerability management cycle feeds governance reporting and how exceptions are documented and time-limited

Describe the purpose of a tabletop exercise and the artifacts it should produce

Identify which evidence an auditor would request to prove a control operates, not just exists

Complete two full-length timed practice exams under exam conditions and record per-domain accuracy

Rank domains by accuracy and re-study only the two weakest using the notes already built

Re-teach each domain aloud in under five minutes without notes to expose remaining gaps

Review every previously missed question and confirm the corrected reasoning is now automatic