NSA Assessment study plan
NSA Assessment · Give each week a clear focus.
8 weeks · About 6 hours per week
Network Security Fundamentals & Network Protocols and Analysis
Map the OSI and TCP/IP models to specific security controls and attacks at each layer
Capture and analyze a TCP three-way handshake and TLS handshake in Wireshark, identifying each packet field
Explain ARP spoofing, VLAN hopping, and MAC flooding with the packet-level mechanism for each
Configure a segmented lab network with at least two VLANs and a firewall rule set
Your checkpoint
A 10-page annotated packet capture report with screenshots and field-level explanations for TCP, TLS, ARP, and DHCP traffic, plus a working lab topology diagram.
Network Security Fundamentals & Network Protocols and Analysis
Analyze DNS, HTTP/HTTPS, and DHCP traffic to identify exfiltration and tunneling indicators
Compare IPv4 and IPv6 security considerations, including neighbor discovery and RA guard
Evaluate common network attacks (MITM, DDoS, DNS cache poisoning) against specific countermeasures
Configure and test a network IDS rule that alerts on a simulated DNS tunneling pattern
Your checkpoint
A detection lab write-up containing at least three custom IDS rules, the traffic used to trigger each, and a false-positive analysis for each rule.
Network Security Fundamentals & Security Architecture and Design
Diagram a defense-in-depth architecture with DMZ, internal segmentation, and egress filtering
Apply Zero Trust principles to a sample enterprise network and identify gaps in the current design
Compare stateful inspection, proxy, and next-generation firewall placement strategies
Document data flows for a three-tier application and assign trust boundaries
Your checkpoint
A one-page architecture diagram with a trust-boundary table and a 500-word Zero Trust gap assessment for the sample enterprise.
Security Architecture and Design & Cryptography and Encryption
Compare symmetric and asymmetric encryption, hashing, and digital signatures by use case and failure mode
Explain TLS 1.3 handshake, cipher suite selection, and certificate validation steps in sequence
Evaluate key management practices including rotation, storage, and HSM use
Identify weak cryptographic implementations in a provided configuration checklist
Your checkpoint
A cryptographic control matrix covering at-rest, in-transit, and authentication use cases, with recommended algorithms, key lengths, and rotation intervals, plus a findings list from the configuration checklist.
Cryptography and Encryption & Threat Detection and Incident Response
Apply the incident response lifecycle to a simulated ransomware scenario from detection through lessons learned
Differentiate indicators of compromise from indicators of attack and map them to the MITRE ATT&CK framework
Analyze authentication logs and NetFlow data to reconstruct a lateral movement sequence
Write containment and eradication recommendations tied to specific evidence artifacts
Your checkpoint
An incident response report for the ransomware scenario containing a timeline, ATT&CK mapping, evidence list, and containment recommendations.
Threat Detection and Incident Response & Security Operations and Monitoring
Tune a SIEM correlation rule to reduce false positives while preserving true-positive detection
Design a log source inventory covering network, endpoint, identity, and cloud telemetry
Build a detection dashboard that tracks at least four security metrics over time
Practice threat hunting using a hypothesis-driven method against sample telemetry
Your checkpoint
A detection engineering package containing one tuned SIEM rule with before/after metrics, a log source inventory table, and a threat hunt report documenting hypothesis, queries, and findings.
Access Control and Identity Management & Security Operations and Monitoring
Compare authentication factors, MFA methods, and passwordless options by strength and usability
Implement role-based access control and least privilege in a sample application
Evaluate federation protocols (SAML, OAuth 2.0, OIDC) and identify common misconfiguration risks
Design an identity lifecycle process covering joiner, mover, and leaver events
Your checkpoint
An access control design document with an RBAC role matrix, an identity lifecycle flowchart, and a federation risk register listing at least five misconfigurations with mitigations.
Network Security Fundamentals & Security Architecture and Design & Cryptography and Encryption & Network Protocols and Analysis & Threat Detection and Incident Response & Security Operations and Monitoring & Access Control and Identity Management
Complete two timed practice assessments weighted by domain percentages and score each domain separately
Review every missed question and write a corrected explanation for each
Revisit the two lowest-scoring domains with targeted lab repetition
Build a one-page quick-reference sheet of key facts, ports, protocols, and formulas
Your checkpoint
A scored practice assessment report with per-domain breakdown, corrected explanations for all missed items, and the completed quick-reference sheet.
Milestones
Week 2: Score at least 70% on a 30-question mixed quiz covering Domains 1 and 4, and successfully trigger three custom IDS rules in the lab.
Week 4: Produce a complete architecture diagram with trust boundaries and a cryptographic control matrix; pass a peer or self-review checklist with no unresolved critical gaps.
Week 6: Demonstrate a tuned SIEM rule with documented false-positive reduction and complete one hypothesis-driven threat hunt with a written report.
Week 8: Score at least 80% overall on a full timed practice assessment, with no domain below 70%, and complete all corrected explanations.