CIT Exam #3 Study guide

Study Plan Overview and Methodology

  • Core Objective: Build interview-ready foundations for cybersecurity, Security Operations Center (SOC) operations, threat intelligence, and security engineering.
  • Study Guidelines:
    • Focus on deep understanding rather than simple memorization.
    • For every concept covered, achieve the ability to:
      • Define it simply in plain English.
      • Explain why it matters in an operational context.
      • Provide a concrete real-world example.
      • Connect it to another core security concept.
  • Recommended Pace and Schedule:
    • Duration: 6–8 weeks6\text{--}8\,\text{weeks}
    • Session Duration: 45–75 minutes45\text{--}75\,\text{minutes} per study session
    • Frequency: 4–5 sessions4\text{--}5\,\text{sessions} per week
    • Pacing Rule: If extra time is available, expand study depth rather than accelerating through the material.
  • Core Learning Outcome: Conversational mastery of core cybersecurity concepts and the capability to reason through basic security scenarios.
  • Five-Step Study Method:
    1. Learn: Read or watch a concise explanation to grasp the foundational idea.
    2. Explain: Close all reference notes and explain the concept completely in your own words.
    3. Apply: Formulate a realistic practical example or pinpoint where the concept functions within a network or security scenario.
    4. Connect: Articulate how the concept relates to or interacts with another previously learned security concept.
    5. Test: Answer 3–5 questions3\text{--}5\,\text{questions} without referring to notes, marking any weak areas for follow-up review.

Week 1 — Networking Foundations

  • Weekly Objective: Explain each concept without reading directly from notes and successfully connect at least 2–3 concepts2\text{--}3\,\text{concepts} within a realistic operational scenario.
  • Core Concepts:
    • IP Addresses: Numerical addresses used to identify network interfaces for communication. Requires mastery of IPv4 vs. IPv6 structures and the operational differences between private and public IP addresses.
    • MAC Addresses: Hardware and link-layer addresses assigned to network interface controllers for local network communication. Operates at a distinct network layer from IP addresses.
    • DNS (Domain Name System): System that translates human-readable domain names into machine-routable IP addresses. Essential for internet functionality; critical to understand how malicious actors abuse or manipulate DNS protocols.
    • DHCP (Dynamic Host Configuration Protocol): Network management protocol that automatically assigns network configurations to devices, including IP addresses, default gateways, and DNS servers.
    • Routers vs. Switches:
      • Switches: Devices operating primarily to connect endpoints and manage traffic within a local network.
      • Routers: Devices designed to forward data traffic between separate, distinct networks.
    • NAT (Network Address Translation): Method of remapping an IP address space into another by modifying network address information in IP header packets; commonly used to translate private network addresses to public addressing.
  • Practice Questions:
    • What is an IP address? Why is it useful to a defender?
    • What is the difference between a private and public IP address?
    • What does DNS do when you type a website name into a browser?
    • What information might DHCP provide to a new device?

Week 2 — Transport & Web Networking

  • Weekly Objective: Explain each concept without reading directly from notes and connect at least 2–3 concepts2\text{--}3\,\text{concepts} within a realistic operational scenario.
  • Core Concepts:
    • TCP (Transmission Control Protocol): Connection-oriented transport protocol providing reliable, ordered, and error-checked delivery of data streams. Features a formal three-way handshake connection setup process.
    • UDP (User Datagram Protocol): Connectionless transport protocol designed for low-latency transmission without guaranteed delivery overhead; heavily utilized for DNS, media streaming, gaming, and real-time traffic.
    • Ports: Logical endpoints within an operating system used by specific network services and communications. Essential common ports to master:
      • Port 2222 (SSH)
      • Port 5353 (DNS)
      • Port 8080 (HTTP)
      • Port 443443 (HTTPS)
      • Port 33893389 (RDP)
    • HTTP / HTTPS: Hypertext Transfer Protocols used for web communications. HTTPS extends standard HTTP by adding TLS (Transport Layer Security) encryption and server authentication.
    • Packets: Formatted units of data carried across packet-switched networks. Composed of control information (source/destination IPs and ports) and user data (payload); fundamental to packet inspection techniques.
    • VPN (Virtual Private Network): Encrypted connection tunnel established across a network to protect data transmission or route client traffic through an external remote network.
  • Practice Questions:
    • Explain TCP vs UDP without using only the words 'connection-oriented' and 'connectionless'.
    • What is a port, and why might a SOC analyst care about open ports?
    • What happens at a high level when you connect to an HTTPS website?
    • Why might a company use a VPN?

Week 3 — Security Fundamentals

  • Weekly Objective: Explain each concept without reading directly from notes and connect at least 2–3 concepts2\text{--}3\,\text{concepts} within a realistic operational scenario.
  • Core Concepts:
    • CIA Triad: The foundational framework of information security composed of Confidentiality, Integrity, and Availability.
    • Authentication vs. Authorization:
      • Authentication: The verification mechanism used to confirm the identity of a user or system.
      • Authorization: The security decision determining the specific rights, actions, or data an authenticated entity is permitted to access.
    • Accounting / Auditing: The practice of tracking, recording, and reviewing actions and events to enable forensic investigation and regulatory review.
    • Least Privilege: The security principle requiring that users, applications, and processes be granted only the minimum permissions necessary to perform their legitimate duties.
    • Defense in Depth: Defensive strategy employing multiple overlapping layers of security controls so that the failure of a single control does not compromise the entire environment.
    • Zero Trust: Architecture model operating on the premise that no user or device should be implicitly trusted based on physical or network location; requires continuous validation and dynamic enforcement of access controls.
    • Threat, Vulnerability, Risk, Exploit:
      • Threat: Any potential source of harm or unwanted intent directed at a system.
      • Vulnerability: A flaw or weakness in system design, implementation, or operation.
      • Exploit: The code, technique, or action leveraged to capitalize on a vulnerability.
      • Risk: The calculated potential for loss or harm based on threat likelihood and impact.
  • Practice Questions:
    • Give one example of a confidentiality problem, an integrity problem, and an availability problem.
    • Explain authentication vs authorization with a real example.
    • Differentiate threat, vulnerability, exploit, and risk.
    • Explain defense in depth as if speaking to a nontechnical manager.

Week 4 — Attacks & Common Adversary Techniques

  • Weekly Objective: Explain each concept without reading directly from notes and connect at least 2–3 concepts2\text{--}3\,\text{concepts} within a realistic operational scenario.
  • Core Concepts:
    • Phishing: A social engineering attack vector using deceptive communications to manipulate individuals into disclosing sensitive data, clicking malicious links, downloading malware, or performing actions.
    • Malware: Generic term for malicious software designed to cause harm, exfiltrate data, or subvert operating system functions; includes trojans, worms, spyware, and ransomware.
    • Brute Force Attack: An automated attack method systematically attempting all possible combinations of credentials or cryptographic keys until the correct one is discovered.
    • Password Spraying: An attack technique attempting a small set of commonly used passwords against a high volume of accounts to circumvent account lockouts.
    • Credential Stuffing: The automated injection of stolen username and password pairs into login forms across multiple sites to exploit credential reuse.
    • SQL Injection (SQLi): An application vulnerability allowing malicious SQL statements to be injected into entry fields, executing unauthorized commands against the underlying database.
    • Cross-Site Scripting (XSS): A vulnerability that allows attackers to inject malicious client-side script into web pages viewed by other users.
    • DDoS (Distributed Denial of Service): An attack flooding a system, server, or network resource with distributed traffic from numerous compromised devices to induce service failure for legitimate users.
    • Privilege Escalation: Techniques used by adversaries to gain higher level privileges (such as administrator or root) than initially assigned.
    • Lateral Movement: Methods employed by attackers to move deeper into a network host-by-host after securing initial access.
  • Practice Questions:
    • How is password spraying different from brute force?
    • What makes credential stuffing different from guessing passwords?
    • What is lateral movement and why is it dangerous after an initial compromise?
    • Explain phishing without saying simply 'a fake email'.

Week 5 — Defensive Security & SOC Fundamentals

  • Weekly Objective: Explain each concept without reading directly from notes and connect at least 2–3 concepts2\text{--}3\,\text{concepts} within a realistic operational scenario.
  • Core Concepts:
    • Firewall: Network security hardware or software device that filters inbound and outbound traffic according to predetermined rules, facilitating network segmentation.
    • IDS (Intrusion Detection System): Monitoring system that inspects network or system activities for policy violations or malicious behavior and generates security alerts.
    • IPS (Intrusion Prevention System): Security appliance with active inline capabilities to detect, alert on, and automatically block identified malicious traffic.
    • EDR (Endpoint Detection and Response): Endpoint security software engineered to continuously monitor host activity, gather telemetry, perform behavioral analysis, and support immediate incident response actions.
    • Logging: The automated collection and storage of historical activity records generated by systems, applications, hosts, and network devices.
    • SIEM (Security Information and Event Management): Centralized platform that aggregates, normalizes, and analyzes log telemetry across enterprise sources to correlate event data and trigger actionable security alerts.
    • Alert Triage: The initial SOC assessment phase where analysts determine whether an incoming security alert is a false positive, benign action, or true positive security incident requiring further escalation.
    • Incident Response: A structured organizational process consisting of preparation, identification/detection, containment, eradication, and post-incident recovery.
    • Threat Hunting: The proactive, hypothesis-driven human process of searching through enterprise telemetry to uncover undetected compromise or malicious activity.
  • Practice Questions:
    • What is the difference between IDS and IPS?
    • What does a SIEM actually do with logs?
    • What might a SOC analyst do after receiving an alert?
    • How are EDR and SIEM different?

Week 6 — Threat Intelligence & MITRE ATT&CK

  • Weekly Objective: Explain each concept without reading directly from notes and connect at least 2–3 concepts2\text{--}3\,\text{concepts} within a realistic operational scenario.
  • Core Concepts:
    • IOC (Indicator of Compromise): Forensic artifact observed on a network or host that serves as high-confidence evidence of a security breach (e.g., file hashes, malicious IP addresses, domain names).
    • IOA (Indicator of Attack): Behavioral metrics focused on identifying intent and active adversary techniques in real time regardless of specific tools used.
    • TTPs (Tactics, Techniques, and Procedures): Structural frameworks describing what an adversary aims to achieve (Tactic), how they achieve it (Technique), and their specific operational methodology (Procedure).
    • Threat Actor: An individual, organized cybercrime group, or state-sponsored entity engaged in unauthorized cyber activity.
    • Campaign: A coordinated sequence of malicious operations targeting specific organizations or sectors over a defined time frame.
    • Threat Intelligence: Operational information that has been collected, processed, and analyzed to provide actionable context regarding threat capabilities and intentions.
    • MITRE ATT&CK: A globally accessible matrix knowledge base detailing real-world adversary tactics and techniques based on observed empirical data.
    • ATT&CK Reasoning: The analytical practice of mapping raw attack telemetry to corresponding ATT&CK tactics and techniques to deduce gaps in logging, detections, and security controls.
  • Practice Questions:
    • What is an IOC? Give three examples.
    • What are TTPs?
    • What problem does MITRE ATT&CK help security teams solve?
    • If you observe an attacker dumping credentials, what would you want to investigate next?

Week 7 — Digital Forensics

  • Weekly Objective: Explain each concept without reading directly from notes and connect at least 2–3 concepts2\text{--}3\,\text{concepts} within a realistic operational scenario.
  • Core Concepts:
    • Digital Evidence: Any information stored or transmitted in digital form that can be analyzed to establish facts regarding an incident.
    • Windows Event Logs: Operating system log files detailing critical system, operational, authentication, and application security events.
    • File Artifacts: Discrete elements of residual file system data, metadata, timestamps, user profiles, and web browser traces that track user and application activity.
    • Memory Forensics: Forensic analysis of volatile RAM artifacts to inspect active running processes, injected code, active sockets, unencrypted credentials, and volatile malware components.
    • Disk Forensics: Analysis of persistent storage systems to recover non-volatile files, system structures, deleted content, and master file table artifacts.
    • Timeline Analysis: The forensic methodology of organizing heterogeneous artifact timestamps sequentially to reconstruct exact malicious action sequences.
    • Chain of Custody: Complete chronological documentation establishing the legal collection, handling, transfer, analysis, and preservation of physical and digital evidence.
  • Practice Questions:
    • Why are timestamps and event logs useful during an investigation?
    • What is the difference between disk and memory forensics?
    • Why does chain of custody matter?
    • How could you build a timeline after a suspected compromise?

Week 8 — Cryptography, Systems & Practical Integration

  • Weekly Objective: Explain each concept without reading directly from notes and connect at least 2–3 concepts2\text{--}3\,\text{concepts} within a realistic operational scenario.
  • Core Concepts:
    • Symmetric Encryption: Cryptographic algorithms relying on a single shared secret key for both data encryption and decryption operations.
    • Asymmetric Encryption: Cryptographic frameworks utilizing mathematically linked key pairs (public key and private key) for secure communications and digital signatures.
    • Hashing: One-way deterministic mathematical algorithms mapping arbitrary data inputs to fixed-size string outputs; used for data integrity validation and password storage rather than confidentiality.
    • Salting: The security practice of appending unique random data inputs to passwords prior to hashing to negate precomputed rainbow table attacks.
    • Digital Signatures: Cryptographic verification mechanisms providing data authenticity, integrity confirmation, and non-repudiation.
    • Certificates / TLS: Public Key Infrastructure digital documents verifying server identity, utilizing TLS protocols to secure end-to-end network communications.
    • Linux Fundamentals: Mastery over system directories, privilege modes, permission sets, process signals, user/group operations, basic shell utilities, and system logs.
    • Windows Fundamentals: Operational command of processes, services, local security accounts, privilege structures, Event Viewer log structures, PowerShell automation, and system registry artifacts.
    • Python / SQL / Bash: Scripting and query capabilities leveraged to automate security operations, parse security log telemetry, analyze relational datasets, and investigate systems.
  • Practice Questions:
    • Explain encryption vs hashing.
    • Why is a password hash normally salted?
    • What is the role of a TLS certificate?
    • Why are Linux and Windows fundamentals valuable to a cybersecurity analyst?

Practical Projects

  • Project 1 — Home Network Map:
    • Diagram your local home or laboratory network environment.
    • Document all connected hosts, local routers, assigned private IP addresses, default gateway configurations, DNS servers, and external internet egress points.
    • Write a complete narrative detailing the exact network paths and transformations a single packet undergoes from local origin to external host.
  • Project 2 — Packet Analysis:
    • Execute packet captures using Wireshark within a dedicated lab context or on your authorized local traffic.
    • Inspect captures to extract and analyze IP headers, protocol flags, target ports, raw DNS query strings, and TLS/HTTPS session setups.
    • Document telemetry visibility boundaries by comparing unencrypted readable data against encrypted transport payloads.
  • Project 3 — Linux Security Lab:
    • Deploy a dedicated Linux Virtual Machine (VM).
    • Perform administrative management over users, groups, file ownership rights, standard permissions, active process states, and system logs.
    • Document 5 specific commands5\,\text{specific commands} alongside the precise security, diagnostic, or forensic question each command answers.
  • Project 4 — Windows Logs:
    • Deploy a Windows VM and generate test actions.
    • Utilize Event Viewer to locate, filter, and analyze specific authentication events, process creation events, and core system changes.
    • Build a precise chronological timeline detailing the actions performed during the testing session.
  • Project 5 — SIEM-Style Investigation:
    • Ingest sample event logs into a local log analysis environment or dedicated sandbox training platform.
    • Construct structured search queries to identify anomalous patterns, such as authentication floods, unauthorized IP interactions, or unexpected process execution.
    • Compile a formal incident investigation summary detailing findings, risk scope, and triage conclusions.
  • Project 6 — MITRE ATT&CK Mapping:
    • Analyze a realistic adversary scenario.
    • Map every observed adversary behavior directly to corresponding MITRE ATT&CK tactics, techniques, and sub-techniques.
    • Outline the critical log sources, detection strategies, and defensive hardening controls required to mitigate each mapped technique.

Interview Explanation Framework

  • Five-Part Structured Response Model:
    • Definition: Plain-English core explanation.
    • Purpose: Strategic rationale for existence and operational relevance.
    • Example: Concrete technical or operational usage scenario.
    • Security Angle: Attacker exploitation perspective alongside defender monitoring and mitigation strategies.
    • Connection: Integration point connecting the topic to another security control or concept.
  • Framework Demonstration: Explaining an Intrusion Detection System (IDS):
    • Definition & Purpose: An Intrusion Detection System (IDS) is a specialized monitoring application or device designed to analyze network traffic or system telemetry for signatures and anomalies indicating malicious activity, generating alerts when matches occur.
    • Example: For instance, an IDS deployed on a network segment will detect an internal host attempting sequential connection requests across multiple ports on adjacent servers, alerting analysts to potential port scanning activity.
    • Security Angle & Connection: While an IDS is purely analytical and focused on alert generation, an IPS actively intervenes to block malicious traffic flows inline. Furthermore, alert streams generated by an IDS serve as foundational data inputs that feed directly into SIEM correlation engines and SOC alert triage workflows.

Final Knowledge Check

  • Comprehensive Synthesis Scenarios:
    1. Trace every network interaction occurring when https://example.com is submitted in a browser address bar, fully accounting for DNS resolution, IP assignment, TCP handshake mechanisms, HTTPS/TLS negotiation, and port allocation.
    2. An employee falls victim to a credential harvesting phishing email. Detail a realistic end-to-end attack progression extending from initial access through internal recon, privilege escalation, and lateral movement.
    3. A SIEM system flags hundreds of failed authentication requests originating from a single external IP address over a short timeframe. Outline the systematic workflow required to triage, analyze, and remediate this alert.
    4. A SOC analyst discovers an anomalous executable process actively running on a Windows workstation endpoint. Enumerate all system logs, forensic artifacts, and memory components that must be analyzed to evaluate host security.
    5. Select a single specific MITRE ATT&CK technique and explain its overarching tactic, how an adversary leverages it, the forensic telemetry it generates, and an effective technical security control used to block or detect it.

Core Study Rule

  • Measurement of Mastery:
    • Do not gauge study progression by the volume of memorized definitions.
    • Evaluate readiness exclusively by the ability to:
      1. Explain complex concepts completely without reliance on reference notes.
      2. Identify and isolate concepts within dynamic real-world operational scenarios.
      3. Synthesize connections between individual concepts and the broader enterprise security framework.
    • Complete mastery is demonstrated when a concept can be effectively taught and communicated to a beginner.