Network Security Analyst study plan
Network Security Analyst · Give each week a clear focus.
8 weeks · About 7 hours per week
Network Security Fundamentals
Map the OSI and TCP/IP models layer by layer and state, for each layer, one control and one attack that targets it
Explain the CIA triad plus authentication, authorization, and accounting, and classify ten security controls (firewall, IDS, MFA, encryption, backups, and similar) by the property each protects
Differentiate symmetric from asymmetric cryptography and identify where TLS, IPsec, and SSH each apply them
Describe how a PKI chain of trust works from root CA to leaf certificate and list three common certificate failures
Your checkpoint
A one-page layered reference table (layer, protocol examples, control, attack, mitigation) covering at least six layers, written from memory and then corrected against notes
Network Security Fundamentals & Threat Detection and Monitoring
Compare stateful packet filtering, proxy, and next-generation firewall behavior and select the right placement for each in a segmented network
Design a network segmentation scheme (DMZ, user VLANs, management plane) and justify each boundary with a threat it blocks
Explain how IDS and IPS differ in placement and response, and describe signature versus anomaly detection trade-offs
Identify what common log sources (firewall, DNS, proxy, endpoint, authentication) can and cannot reveal
Your checkpoint
A labeled network diagram with at least four zones, the enforcement point at each boundary, and the log source that would detect a lateral-movement attempt across each boundary
Threat Detection and Monitoring
Trace a full TCP handshake and a DNS resolution in packet captures and label each field used in detection
Write three detection ideas as pseudo-rules (for example, repeated failed logins, unusual outbound volume, rare parent-child process pairs) and state the false-positive risk of each
Explain how the MITRE ATT&CK tactics chain maps onto the log sources you listed in week 2
Configure and run a small lab (packet capture plus a log platform) and confirm each of your three detection ideas fires on simulated activity
Your checkpoint
A detection worksheet listing three pseudo-rules, the log source each depends on, the ATT&CK technique each covers, and the result of a live test of each rule
Threat Detection and Monitoring
Characterize common malware families by behavior (persistence, propagation, command and control) rather than by name
Describe the indicators that distinguish phishing, credential stuffing, and password spraying in authentication and mail logs
Explain how beaconing traffic and DNS tunneling appear in flow data and name one analytic that surfaces each
Build a triage checklist that turns an alert into a severity decision using asset criticality and confidence
Your checkpoint
A triage checklist applied to five written alert scenarios, each with a severity, an evidence citation, and a next action
Incident Analysis and Response
Order the incident response lifecycle phases and state the entry and exit criteria for each
Draft containment options for a compromised endpoint and rank them by blast radius and evidence preservation
Explain the difference between eradication and recovery and list the verification step before returning a host to service
Identify the evidence sources to preserve first on a host and in cloud logs, and describe chain-of-custody basics
Your checkpoint
An incident response runbook for one scenario (compromised workstation with suspected lateral movement) covering all lifecycle phases with named owners and decision points
Incident Analysis and Response & Security Operations and Reporting
Analyze a provided or self-built log set to reconstruct a timeline of an intrusion from first access to detection
Write an incident report with summary, timeline, impact, root cause, and remediation, keeping speculation separate from evidence
Define three containment metrics (time to detect, time to contain, time to recover) and compute them from your timeline
Map each finding to a remediation action with an owner and a priority
Your checkpoint
A complete incident report on the reconstructed intrusion, including a timeline of at least eight timestamped events and computed containment metrics
Security Operations and Reporting
Describe how a SOC tier structure, escalation path, and shift handover work, and write a handover note
Explain vulnerability management flow from scan to prioritized remediation using exploitability and asset exposure
Summarize the purpose and audience of common compliance and reporting frameworks without overstating what they guarantee
Design two security metrics that drive decisions rather than count activity, and state what each would change
Your checkpoint
A weekly SOC operations package: one shift handover note, one prioritized vulnerability remediation list, and two decision-driving metrics with rationale
Network Security Fundamentals & Threat Detection and Monitoring & Incident Analysis and Response & Security Operations and Reporting
Take a full-length timed practice exam and record per-domain scores to find weak areas
Re-study the two weakest domains using the artifacts you produced in weeks 1 through 7
Re-derive from memory the layered reference table, the triage checklist, and the incident lifecycle criteria
Review every missed practice question and write the reason for the correct answer in your own words
Your checkpoint
A scored practice exam with per-domain results, a list of corrected misconceptions, and a one-page final review sheet
Milestones
Week 2: Explain the layered reference table and the segmentation diagram aloud without notes, and correctly classify ten controls by the security property they protect
Week 4: All three detection pseudo-rules fire on simulated activity, and the triage checklist produces consistent severities when applied to the five scenarios
Week 6: The incident report timeline is fully supported by cited log evidence, and time-to-detect and time-to-contain are computed and defensible
Week 8: Practice exam score is at or above your target with no domain below 60 percent, and every missed question has a written correction