30-day Cybersecurity Analyst exam study plan

Updated 16 September 2026 · 2 min read

This plan dedicates most of a month to cybersecurity itself, reflecting how heavily analyst tests weigh it, while keeping regular time for networking fundamentals and for ports and protocols. Linux and cloud get smaller slots. The plan assumes about an hour a day and encourages short hands-on exercises, because security knowledge only becomes usable through practice.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

The 30-day plan

Day	Focus	What to do
Week 1
1	Cybersecurity	Study, then answer 20 questions untimed and read every explanation, including for the ones you got right.
2	Networking fundamentals	Study, then answer 20 questions untimed and read every explanation, including for the ones you got right.
3	Ports and protocols	Study, then answer 20 questions untimed and read every explanation, including for the ones you got right.
4	Linux command line	Study, then answer 20 questions untimed and read every explanation, including for the ones you got right.
5	Cloud and emerging technology	Study, then answer 20 questions untimed and read every explanation, including for the ones you got right.
6	Cybersecurity	Study, then answer 20 questions untimed and read every explanation, including for the ones you got right.
7	Review the week	Redo every question you got wrong this week, without looking at the explanations first.
Week 2
8	Networking fundamentals	Study, then answer 30 questions untimed and read every explanation, including for the ones you got right.
9	Ports and protocols	Study, then answer 30 questions untimed and read every explanation, including for the ones you got right.
10	Linux command line	Study, then answer 30 questions untimed and read every explanation, including for the ones you got right.
11	Cloud and emerging technology	Study, then answer 30 questions untimed and read every explanation, including for the ones you got right.
12	Cybersecurity	Study, then answer 30 questions untimed and read every explanation, including for the ones you got right.
13	Networking fundamentals	Study, then answer 30 questions untimed and read every explanation, including for the ones you got right.
14	Timed mock 1	50 questions in 60 minutes, in one sitting. Mark it, then list the areas you lost marks in.
Week 3
15	Ports and protocols	Study, then answer 40 questions untimed and read every explanation, including for the ones you got right.
16	Cybersecurity	Study, then answer 40 questions untimed and read every explanation, including for the ones you got right.
17	Cybersecurity	Study, then answer 40 questions untimed and read every explanation, including for the ones you got right.
18	Cybersecurity	Study, then answer 40 questions untimed and read every explanation, including for the ones you got right.
19	Cybersecurity	Study, then answer 40 questions untimed and read every explanation, including for the ones you got right.
20	Cybersecurity	Study, then answer 40 questions untimed and read every explanation, including for the ones you got right.
21	Review the week	Redo every question you got wrong this week, without looking at the explanations first.
Final stretch
22	Revise: Cybersecurity	40 mixed questions on cybersecurity, timed at about a minute each.
23	Revise: Cybersecurity	40 mixed questions on cybersecurity, timed at about a minute each.
24	Revise: Networking fundamentals	40 mixed questions on networking fundamentals, timed at about a minute each.
25	Revise: Ports and protocols	40 mixed questions on ports and protocols, timed at about a minute each.
26	Revise: Linux command line	40 mixed questions on linux command line, timed at about a minute each.
27	Revise: Cloud and emerging technology	40 mixed questions on cloud and emerging technology, timed at about a minute each.
28	Timed mock 2	50 questions in 60 minutes, in one sitting. Mark it, then list the areas you lost marks in.
29	Mock mistakes	Work through every wrong answer from both mocks until you can explain why the right option is right.
30	Light review	Skim your notes and formulas for an hour, then stop. Sleep matters more than one more set tonight.

How the plan is weighted

Cybersecurity carries the highest weight for this position by a wide margin, so most learning days in the table below go to its domains: threats, controls, identity, cryptography, monitoring and incident response. Networking fundamentals and ports and protocols follow, because analysts read network evidence constantly. Linux and cloud each get time of their own, and the closing week returns to security under timed conditions.

Where to spend your study time

The suggested emphasis reflects what this position works with day to day. It is a study guide, not a published exam blueprint.

Area	Suggested emphasis	Questions in the bank	Practise
Cybersecurity	45%	541	Security
Networking fundamentals	18%	2,636	Networking
Ports and protocols	18%	264	Networking
Linux command line	9%	360	In the full bank
Cloud and emerging technology	9%	188	In the full bank

Hands-on in small doses

Pair each security topic with a short practical task. On a monitoring day, read a sample log and find the suspicious entries. On a cryptography day, hash a file, change one character, and watch the hash change completely. On a network day, open a packet capture and identify the protocols in it. Twenty minutes of practice fixes a concept far better than an extra hour of reading.

Building a personal reference

Keep one document listing attacks, the evidence they leave and the controls that stop them, and add to it daily. In the final week it becomes your fastest revision tool, and it stays useful long after the exam.

Common questions

Is one month enough to prepare for a security analyst test?

It is enough to structure your revision if you already have IT experience. If security is new to you, start earlier and follow a full certificate syllabus such as Security+.

What should I look for when reviewing a mock?

Look for patterns: questions where you identified the attack wrongly, or chose a control that did not fit. Those patterns show which domains need more days before the second mock.