PSAA study plan

Map the AI/ML lifecycle (data collection, training, fine-tuning, inference, RAG pipelines) and label where each attack class applies

Explain prompt injection, jailbreaking, and indirect injection through retrieved or tool-fed content, and describe two mitigations for each

Describe training-data poisoning and model-supply-chain risks including untrusted model artifacts and unsafe deserialization

List controls for AI systems: input/output filtering, least-privilege tool access, human approval gates, and logging of model interactions

Compare SASE architecture components (SWG, CASB, ZTNA, SD-WAN, FWaaS) and state what each does and does not cover

Distinguish inline versus API-based CASB deployment and pick the right one for given data types

Explain how zero-trust principles (per-request verification, least privilege, assume breach) map onto SASE policy design

Trace a user-to-SaaS and a user-to-private-app traffic flow through a SASE stack and identify enforcement points

Explain segmentation, microsegmentation, and DMZ design and when each is appropriate

Describe IDS/IPS placement, detection versus prevention tradeoffs, and signature versus anomaly approaches

Summarize VPN and IPsec/TLS tunnel fundamentals, including common misconfigurations that expose internal networks

Identify DNS-layer and email-layer attacks (tunneling, spoofing, phishing infrastructure) and their network-level defenses

Differentiate authentication, authorization, and federation, and place SAML, OIDC, and OAuth 2.0 correctly in that model

Describe MFA methods by phishing resistance and justify conditional access policies for risky sign-ins

Explain privilege escalation paths through misconfigured roles, service accounts, and token handling

Interpret identity logs to distinguish impossible travel, credential stuffing, and token replay

Map the shared responsibility model across IaaS, PaaS, and SaaS and identify who owns which control in each

Explain cloud storage exposure causes (public buckets, misconfigured ACLs, signed URL leakage) and how to detect them

Describe workload identity and secrets management patterns versus long-lived access keys

Summarize cloud-native logging sources (control plane audit logs, flow logs, workload logs) and what each answers

Walk through the incident response lifecycle and state the decision criteria at each phase transition

Triage a set of alerts by severity using asset criticality, confidence, and blast radius

Explain how SIEM correlation rules and SOAR playbooks reduce mean time to detect and respond

Describe containment options for endpoint, identity, and cloud incidents and their operational side effects

Distinguish logs, metrics, and traces and state which question each answers during an investigation

Explain how detection coverage is measured and identify gaps against the MITRE ATT&CK techniques reviewed in earlier weeks

Describe remediation workflow: validation, scoping, fix, verification, and post-incident review

Explain how observability data supports root-cause analysis versus alerting

Re-test every weak area flagged in weeks 1-7 using timed practice sets and log miss reasons by domain

Integrate cross-domain scenarios (for example, an AI service in the cloud hit by an identity attack) and reason through them end to end

Review the deliverables from weeks 1-7 and correct any factual errors found

Build a one-page pre-exam reference of key distinctions you repeatedly confuse