NICA CCCA study guide
NICA CCCA · Work through your exam, one topic at a time.
The NICA Certified Cybersecurity Analyst (CCCA) is a vendor-neutral credential aimed at practitioners who detect, investigate, and respond to security events rather than purely design controls or manage programs. It suits SOC analysts, security engineers moving into detection work, IT administrators taking on monitoring duties, and early-career professionals building a defensible analyst skill set. The NICA CCCA study guide has 8 sections and about 2,520 words.
01Security Fundamentals and Risk Management
This domain tests whether you can reason about security as business risk: the CIA triad, control selection, and the vocabulary used to justify or refuse spending. CIA triad (confidentiality, integrity, availability) plus authenticity, non-repudiation and safety.
302 words, about 2 min02Network Security and Architecture
This domain tests segmentation, control placement, and whether you can choose the right enforcement point for a specific traffic flow rather than stacking appliances. Map traffic first: north-south (client to data center) versus east-west (server to server).
340 words, about 2 min03Threat Detection and Monitoring
This domain tests how detection actually works: log pipelines, correlation logic, tuning, and the analyst judgement that separates a real signal from noise. SIEM pipeline: collection, parsing and normalization, correlation, alerting, retention.
298 words, about 1 min04Incident Response and Handling
This domain tests the incident lifecycle, evidence handling, and the containment decisions that protect both the business and the investigation. NIST SP 800-61 lifecycle: preparation; detection and analysis; containment, eradication and recovery; post-incident activity.
291 words, about 1 min05Vulnerability Management and Security Assessment
This domain tests whether you can find, validate, prioritize and close vulnerabilities using risk rather than raw scanner output, and whether you know how assessment types differ. Asset inventory and scan coverage come first; you cannot manage what you have not enumerated.
317 words, about 2 min06Identity and Access Management
This domain tests the identity lifecycle, authentication strength, and authorization models that enforce least privilege in practice. Authentication proves identity; authorization decides access; accounting records what happened.
305 words, about 2 min07Cryptography and Data Protection
This domain tests whether you can select the right primitive for a purpose, manage keys properly, and protect data across all three states. Symmetric encryption (AES-256-GCM) is fast and provides confidentiality plus integrity via AEAD.
333 words, about 2 min08Governance, Compliance, and Security Operations
This domain tests the management layer: how policy, frameworks, metrics and continuity planning turn security activity into accountable, auditable operations. Policy hierarchy: policy states intent and is mandatory; standards specify requirements; procedures give step-by-step instructions; guidelines are advisory.
334 words, about 2 min