NCCSI study plan

Define the CIA triad and map each element to at least two concrete controls you have seen in real systems

Write out the difference between a policy, a standard, a procedure, and a guideline, and classify five documents from a sample organization

Explain the principle of least privilege and separation of duties, then identify where each appears in a typical identity lifecycle

Draft a one-page security governance structure showing who owns risk decisions, who approves policy, and who operates controls

Compare discretionary, mandatory, role-based, and attribute-based access control and select the best fit for three described scenarios

Diagram an authentication flow that combines password, MFA, and federation using SAML or OIDC at a conceptual level

Walk through the joiner-mover-leaver process and list the access changes triggered at each stage

Identify three access control weaknesses in a written scenario and propose a compensating control for each

Place the OSI and TCP/IP layers side by side and state which security control operates at each layer

Distinguish stateful inspection, application proxy, and next-generation firewall behavior and describe when each is appropriate

Explain how a VLAN, a DMZ, and network segmentation reduce lateral movement in a breach

Compare WPA3, IPsec, and TLS by what they protect and where they terminate

Identify common network attacks such as ARP spoofing, DNS poisoning, and VLAN hopping and state one mitigation for each

List the hardening steps for a Windows and a Linux endpoint and rank them by risk reduction

Explain how EDR differs from antivirus in detection method and response capability

Compare symmetric and asymmetric encryption and state a realistic use case for each

Describe how TLS establishes a session, including certificate validation and the role of the CA

Match hashing, salting, and key stretching to the password storage problem they solve

Order the incident response phases from preparation through lessons learned and state the key output of each

Classify five given events by severity and justify the escalation decision

Describe what a SIEM correlates and why log source coverage matters more than alert volume

Draft containment, eradication, and recovery actions for a ransomware scenario without causing data loss

Explain the purpose of a tabletop exercise and design three injects for one

Distinguish qualitative from quantitative risk assessment and compute a simple risk score from likelihood and impact

Explain risk treatment options (avoid, mitigate, transfer, accept) and apply each to a described finding

Map a control to a common framework such as ISO 27001 or NIST CSF and explain why mapping is not certification

Describe data classification, retention, and destruction requirements and how they drive encryption choices

Explain how key management and certificate lifecycle failures become compliance findings

Explain the shared responsibility model and locate five controls on the provider or customer side

Compare IaaS, PaaS, and SaaS by which security duties shift to the customer

Describe identity as the new perimeter in cloud environments, including federation and privileged access review

Identify misconfiguration risks such as public storage buckets and overly permissive roles and state the detection method for each

Summarize the security implications of one emerging technology such as container orchestration or generative AI use in the enterprise

Revisit every domain's weakest topic from prior weeks and close at least three gaps

Complete a timed 60-question mixed practice set and review every missed item to root cause

Recite the key definitions for access models, IR phases, and risk treatment from memory

Build a one-page formula and acronym sheet for last-minute review

Simulate exam pacing by completing two 30-question blocks under time pressure