NICA CCCA study plan
NICA CCCA · Give each week a clear focus.
8 weeks · About 7 hours per week
Security Fundamentals and Risk Management
Define the CIA triad and apply each leg to two concrete enterprise scenarios you invent
Differentiate qualitative and quantitative risk analysis, and compute SLE, ARO, and ALE for three sample assets
Classify the four common risk treatment options and justify a treatment choice for each scenario
Map threat actors (script kiddie, insider, organized crime, nation-state) to motivation and capability profiles
Your checkpoint
A one-page risk register with five assets, likelihood and impact scores, computed ALE values, and a chosen treatment for each
Network Security and Architecture
Diagram a segmented network with DMZ, internal zones, and a screened subnet, labeling each control at the boundary
Compare stateful inspection, proxy, and next-generation firewall behavior on the same traffic flow
Explain how VLANs, ACLs, and microsegmentation reduce lateral movement
Contrast hub-and-spoke and full-mesh VPN topologies for a hybrid workforce
Your checkpoint
A labeled network security architecture diagram plus a 300-word rationale for each boundary control placement
Threat Detection and Monitoring
Distinguish IDS signature, anomaly, and behavior-based detection methods with a tradeoff for each
Interpret log sources (firewall, EDR, DNS, authentication) and identify what each reveals about an intrusion
Describe how a SIEM correlates events and tune one rule to reduce false positives
Walk through the MITRE ATT&CK kill chain stages and name one detection opportunity per stage
Your checkpoint
A detection matrix mapping five ATT&CK techniques to the log source and alert logic that would catch each
Incident Response and Handling
Order the incident response lifecycle phases and state the exit criteria between them
Draft containment, eradication, and recovery actions for a ransomware scenario with a defined blast radius
Write evidence-handling steps that preserve chain of custody for a compromised endpoint
Classify incident severity levels and assign escalation paths and communication triggers
Your checkpoint
A tabletop incident response playbook for one scenario, covering escalation, containment, and post-incident review
Vulnerability Management and Security Assessment
Differentiate vulnerability scanning, penetration testing, and configuration assessment by purpose and output
Prioritize findings using CVSS base scores plus environmental context such as exposure and asset criticality
Explain false positive and false negative risk in scanners and how to validate a finding
Describe patch management workflow from discovery through verification
Your checkpoint
A prioritized remediation plan for ten sample findings with CVSS scores, business context, and target remediation dates
Identity and Access Management
Compare authentication factors and select MFA schemes appropriate to high-risk and low-risk access
Contrast RBAC, ABAC, and MAC with a use case for each
Apply least privilege and separation of duties to a sample admin workflow
Explain the access review and deprovisioning lifecycle, including orphaned account risk
Your checkpoint
A role-based access matrix for three job roles with justified permissions and a quarterly review checklist
Cryptography and Data Protection
Differentiate symmetric and asymmetric encryption and match each to a realistic use case
Explain hashing, salting, and digital signatures and how each supports integrity and authenticity
Compare TLS certificate validation failure modes and their security implications
Describe data states (at rest, in transit, in use) and select a protection control for each
Your checkpoint
A data protection summary table covering five data types, their state, chosen cryptographic control, and key management owner
Governance, Compliance, and Security Operations & Security Fundamentals and Risk Management & Incident Response and Handling
Map common frameworks and control categories to policy, standard, and procedure documents
Draft a policy outline that satisfies an audit evidence request for access control and logging
Revisit risk register and incident playbook to close gaps found in practice questions
Complete a timed mixed-domain practice set and log every missed concept for final review
Your checkpoint
A consolidated one-page gap analysis listing weak domains, corrective actions, and a final 48-hour review checklist
Milestones
Week 2: Explain the purpose of each boundary control in your architecture diagram without notes, and score 80% or higher on a 20-question mixed set covering domains 1 and 2
Week 4: Walk through your incident playbook end to end in under 15 minutes and correctly order all IR lifecycle phases in a self-quiz
Week 6: Score 75% or higher on a 30-question mixed set across domains 1 through 6, and confirm every missed item traces to a logged weak concept
Week 8: Score 85% or higher on a full-length timed practice exam and confirm each weak domain has a written corrective action