NCCSA study guide
NCCSA · Work through your exam, one topic at a time.
The NCCSA is an entry-level cybersecurity certification. Its published blueprint is organized into seven domains, each carrying a stated weight: Security Principles and Concepts, Network Security Fundamentals, Endpoint and System Security, Identity and Access Management, Threats, Vulnerabilities, and Risk Management, Security Operations and Incident Response, and Governance, Risk, and Compliance. The NCCSA study guide has 7 sections and about 1,943 words.
01Security Principles and Concepts
Security Principles and Concepts is the foundation domain. It checks whether you can explain why a control exists before naming a product.
286 words, about 1 min02Network Security Fundamentals
Network Security Fundamentals tests whether you can place controls at the right layer and explain what each one actually inspects. Questions commonly cover segmentation, firewalls, IDS versus IPS, VPN and TLS, DNS security, and secure architecture patterns such as DMZs.
302 words, about 2 min03Endpoint and System Security
Endpoint and System Security tests how hosts are hardened, monitored, and contained. Expect questions on patching, configuration baselines, antivirus versus EDR, application allowlisting, disk encryption, secure boot, and container or mobile endpoints.
271 words, about 1 min04Identity and Access Management
Identity and Access Management tests how identities are proven, authorized, federated, and governed. Expect questions on MFA, phishing-resistant authenticators, SSO, SAML versus OIDC, RBAC and ABAC, privileged access management, and joiner-mover-leaver processes.
258 words, about 1 min05Threats, Vulnerabilities, and Risk Management
This domain tests whether you can distinguish threats, vulnerabilities, and risk, then prioritize defensibly. Expect CVSS, CVE, EPSS, threat modeling, attack frameworks, supply-chain risk, and risk treatment options.
271 words, about 1 min06Security Operations and Incident Response
Security Operations and Incident Response tests how alerts become validated incidents and how incidents are contained, eradicated, and learned from. Expect SIEM, log sources, triage, the incident-response lifecycle, evidence handling, and metrics.
266 words, about 1 min07Governance, Risk, and Compliance
Governance, Risk, and Compliance tests how security is directed, measured, and evidenced. Expect policy hierarchy, risk appetite, control frameworks, audit evidence, third-party risk, data classification, and breach-notification obligations.
289 words, about 1 min