NCCSA study plan

Define the CIA triad plus authenticity, non-repudiation, and availability trade-offs, and classify 10 real incidents you recall from news into these categories

Distinguish symmetric vs asymmetric encryption, hashing, and digital signatures, and state one correct use case for each

Explain defense in depth, least privilege, separation of duties, and zero trust, and map each to a concrete control in an organization you know

Build a personal glossary of 40 security terms with one-sentence definitions written in your own words

Differentiate threat, vulnerability, likelihood, impact, and risk, and rewrite 5 vague statements into properly framed risk statements

Compare qualitative and quantitative risk assessment and calculate a single-year loss expectancy for a worked example

Classify the major threat actor types and their typical motivations, resources, and targeting patterns

Describe common malware families and attack stages using a kill-chain style model

Identify 6 vulnerability sources such as misconfiguration, unpatched software, and weak authentication

Explain the OSI and TCP/IP layer models and place 12 common protocols at the correct layer

Compare stateful inspection, application-layer firewalls, and next-generation firewall features, and justify a placement decision

Differentiate IDS vs IPS and signature vs anomaly detection, and state where each belongs in a network

Describe how TLS establishes a session and what it does and does not protect

Explain segmentation, VLANs, DMZs, and network access control as containment mechanisms

Explain how VPNs, wireless security standards, and DNS protections reduce exposure, and name one weakness of each

Compare host-based controls: antivirus, EDR, application allowlisting, and host firewalls

Describe patch management and secure baseline configuration as endpoint controls, including why baselines matter

Outline how disk and database encryption protect data at rest, and where key management fits

Compare authentication factors and select appropriate multi-factor combinations for three user populations

Differentiate identification, authentication, authorization, and accounting, and give an example of each

Explain access control models (DAC, MAC, RBAC, ABAC) and choose one for a given scenario with justification

Describe federation, SSO, and common token standards at a conceptual level

Identify identity lifecycle steps from provisioning to deprovisioning and the risk of stale accounts

Order the incident response lifecycle phases and list one concrete action and one artifact per phase

Explain the purpose of log collection, SIEM correlation, and time synchronization in detection

Distinguish evidence handling concepts such as chain of custody, order of volatility, and forensic imaging

Describe business continuity and disaster recovery basics, including RTO and RPO, and compute them for a sample system

Explain how vulnerability scanning and remediation tracking feed security operations

Map common control frameworks and standards to policy, procedure, and technical control types

Explain how laws and regulations on privacy and breach notification shape security obligations at a high level

Distinguish policies, standards, procedures, and guidelines, and draft one short acceptable use policy

Describe third-party and supply chain risk review steps, and audit and assurance concepts such as evidence and sampling

Connect governance requirements back to the risk register and control set you built earlier

Re-derive from memory the key facts for each domain using your own glossary and diagrams, flagging gaps

Complete timed practice sets across all domains and log every miss with its root cause

Re-teach the three weakest topics aloud or in writing as if explaining to a colleague

Review your risk register, hardening checklist, access design, runbook, and governance package for consistency