You know the exam. This is the practice around it.
You set up three facts: which certification, your exam date, and how many hours you have in a week. Everything after that is built from the exam’s published outline and recorded as work you have shown.
01THE METHOD
Three stages, the same road.
01守FOLLOW · SCOPED TO THE BLUEPRINT
Built from your exam’s own outline.
Your plan comes from the exam’s published outline (the blueprint), domain by domain — not from a course that happens to overlap it. As your test date gets closer, your remaining hours go to the areas where you’ve shown the least. They do not go back through material you finished months ago.
02破BREAK · WORKED, THEN SPARRED
One mission at a time, then a spar with the reasoning shown.
A mission is one piece of hands-on work in a practice lab, sized to fit your week. Your coach tells you why it’s next. Then you spar: your coach questions your answers on the objectives you choose, and you defend them.
03離TRANSCEND · RECORDED AS EVIDENCE
Four marks. Nothing predicted.
Everything your map says about you is one of four marks: Not observed, Developing, Demonstrated, or Revisit. Each mark records something you did. There is no score and no predicted pass chance. A mark can move backward when your coach sees a skill slipping — that’s the map doing its job. You never walk into the exam trusting stale strengths.
02THE VOCABULARY
Four marks, and no fifth one.
Every domain, every concept, every mission outcome resolves to one of these four marks. Nothing here is a grade, a rank, or a predicted pass chance.
- ○Not observed
- ◐Developing
- ●Demonstrated
- ◍Revisit
03A MISSION
Sized to the week you have.
SAMPLE MISSION
Subnet under time pressure
Domain 3.0 — your IP addressing is solid. Deciding how to segment a network is where you’ve shown the least. Place these services into zones, then explain why you drew the lines where you did.
≈ 25 MINSANDBOX + TERMINALDOMAIN 3.0
04A SPAR
Your coach questions the answer, not you.
ILLUSTRATIVE — NOT A LIVE SESSION
- COACH
You said the first move is to block the IP. What does that cost you if the address is a shared proxy?
- YOU
Then I block every user behind it. I should rate-limit the login endpoint first and confirm the source.
- COACH
Good. Which log tells you it is one proxy and not one attacker?
05THE MAP
What your map looks like.
| DOMAIN | EVIDENCE | CONCEPTS OBSERVED |
|---|
| 1.0 General Security Concepts | ●Demonstrated | 21 / 24 |
| 2.0 Threats, Vulnerabilities & Mitigations | ◐Developing | 11 / 26 |
| 3.0 Security Architecture | ◐Developing | 8 / 21 |
| 4.0 Security Operations | ○Not observed | 0 / 28 |
| 5.0 Security Program Management | ◍Revisit | 3 / 15 |
ILLUSTRATIVE SAMPLE — YOUR MAP STARTS EMPTY.