NSA Assessment study guide
NSA Assessment · Work through your exam, one topic at a time.
The NSA Assessment is a multiple-choice examination covering network security fundamentals, security architecture and design, cryptography, network protocols and analysis, threat detection and incident response, security operations and monitoring, and access control and identity management. The domain weightings suggest where the emphasis falls: network security fundamentals carry the largest share, followed by architecture, cryptography, protocols, and threat detection at roughly equal weight, with operations and access control rounding out the exam. The NSA Assessment study guide has 7 sections and about 2,073 words.
01Network Security Fundamentals
Network Security Fundamentals tests whether you can translate a business flow into enforceable network controls. Expect questions on the CIA triad, defense in depth, least privilege, trust boundaries, DMZ design, VLAN segmentation, ACLs, stateful firewalls, and egress filtering.
319 words, about 2 min02Security Architecture and Design
Security Architecture and Design tests secure design principles and models: trust boundaries, reference monitor, trusted computing base, defense in depth, fail-safe defaults, separation of duties, least privilege, and mediated access. Expect Bell-LaPadula, Biba, Clark-Wilson, and zoning questions.
305 words, about 2 min03Cryptography and Encryption
Cryptography and Encryption tests correct primitive selection and key lifecycle: symmetric encryption, asymmetric encryption, hashing, HMAC, digital signatures, PKI, TLS, and key management. Expect questions on modes, IV and nonce handling, forward secrecy, and why a hash is not encryption.
311 words, about 2 min04Network Protocols and Analysis
Network Protocols and Analysis tests packet-level reasoning across TCP/IP: TCP handshake and flags, UDP, DNS, HTTP, ARP, DHCP, ICMP, routing, NAT, and capture analysis. Expect questions that ask what a capture or flow proves, not just what a protocol does.
302 words, about 2 min05Threat Detection and Incident Response
Threat Detection and Incident Response tests the detect-respond-learn cycle: indicators, SIEM and EDR correlation, triage, containment, eradication, recovery, evidence handling, and lessons learned. Expect kill-chain and MITRE ATT&CK mapping questions and decisions about what to do first.
262 words, about 1 min06Security Operations and Monitoring
Security Operations and Monitoring tests how a SOC turns telemetry into reliable action: logging pipelines, SIEM correlation, IDS and IPS tuning, EDR, vulnerability and configuration management, baselines, playbooks, and metrics. Expect questions on alert quality and operational tradeoffs.
292 words, about 1 min07Access Control and Identity Management
Access Control and Identity Management tests authentication, authorization, and accounting across users, services, and federated identities. Expect MFA, SSO, SAML, OIDC, OAuth scopes, RBAC and ABAC, least privilege, privileged access management, joiner-mover-leaver, and conditional access.
282 words, about 1 min