OSDA study plan

Map the SOC tier model (Tier 1 triage, Tier 2 investigation, Tier 3 threat hunting, engineering) and write one paragraph per role describing decision authority and escalation triggers.

Diagram the alert lifecycle from log source through SIEM correlation, triage, ticket creation, and closure, labeling where false-positive suppression and tuning feedback enter the loop.

Define the core telemetry categories a SOC depends on (endpoint process, network flow, DNS, authentication, cloud audit) and list one concrete example event for each.

Draft a personal glossary of 25 SOC terms (MTTD, MTTA, MTTR, true/false positive, runbook, playbook, IOC, TTP) with a one-line definition you wrote yourself.

Explain how the cyber kill chain and MITRE ATT&CK differ in purpose, and place five sample adversary behaviors into both frameworks.

Walk through the Pyramid of Pain and rank five indicator types by defender durability.

Identify which log source would surface each of six given behaviors (e.g., credential dumping, scheduled task persistence, DNS tunneling) and state the field that would carry the signal.

Practice writing a triage note for two synthetic alerts that records verdict, evidence, and next action in under 150 words each.

Decompose the detection pipeline into collection, normalization, correlation, and alerting, and describe one failure mode at each stage.

Compare signature, anomaly, and behavioral detection logic, giving one realistic use case and one blind spot for each.

Write three SIEM-style correlation rules in pseudocode (brute force, impossible travel, rare parent-child process) and specify thresholds and suppression windows.

Analyze two synthetic alert triage scenarios end to end, distinguishing benign true positive from false positive and justifying containment versus monitoring.

Describe how to enrich an alert with threat intelligence and when enrichment adds noise rather than value.

Build a threat-hunting hypothesis from a named ATT&CK technique and list the data needed to test it.

Explain the vulnerability management lifecycle from asset discovery through remediation verification, naming the owner of each stage.

Interpret CVSS base, temporal, and environmental metrics and argue why a CVSS 9.8 may rank below a 7.5 for a given asset.

Prioritize a 12-item vulnerability list using exploitability, exposure, asset criticality, and compensating controls, and defend the top three choices.

Describe how threat intelligence feeds vulnerability prioritization through known exploited vulnerability data.

Perform a qualitative risk assessment on three synthetic scenarios using likelihood and impact, and assign a risk rating with a documented rationale.

Select a risk treatment (mitigate, transfer, avoid, accept) for each scenario and state the residual risk after treatment.

Map five given controls to the risk they reduce and classify each as preventive, detective, or corrective.

Draft a risk register entry template with fields for asset, threat, vulnerability, rating, owner, treatment, and review date, then populate it for the three scenarios.

Explain how EDR collects process, file, registry, and network telemetry, and name the artifact that would reveal each of five given attack behaviors.

Compare host-based and network-based detection for the same intrusion and state which gives earlier warning and why.

Describe network segmentation, DMZ design, and egress filtering as containment controls, and predict what each blocks in a ransomware scenario.

Walk through a firewall and IDS/IPS rule review, explaining how to reduce false positives without widening exposure.

Outline an endpoint hardening baseline covering patching, application control, and least-privilege local accounts.

Differentiate authentication, authorization, and accounting, and place each in a concrete SOC investigation.

Compare RBAC, ABAC, and least-privilege models, and choose one for a given multi-team environment with justification.

Explain MFA, privileged access management, and just-in-time elevation, and describe the attack path each disrupts.

Analyze three synthetic privilege-escalation and credential-misuse scenarios, identifying the control gap and the log evidence that would confirm it.

Describe how to review access recertification and detect orphaned or excessive accounts.

Synthesize a full incident narrative across all five domains for one synthetic breach, from initial access to containment and lessons learned.

Re-quiz every missed item from weeks 1-7 and rewrite weak explanations in your own words.

Complete two timed mixed-domain practice sets and log error causes by domain rather than by question.

Build a one-page exam-day reference of decision rules (risk treatment logic, detection selection, control layering) from memory.