3.2 Study Plan and Scenarios

Build Scenarios, Then Pick Controls

For CSA-C01, learn product names only after you can describe the scenario each one solves. The exam is 50 questions in 90 minutes (about 1.8 minutes per item) with a passing bar of 70 out of 100, so you need fast, confident pattern recognition, not slow definition recall. Because Network Security and Threat Mitigation is the largest domain, spend disproportionate review time here relative to the lighter Cloud Security Basics domain.

A Five-Pass Network Review Loop

1. Public web app: public access → Anti-DDoS → WAF → Server Load Balancer / Application Load Balancer → private ECS in security groups, with Security Center monitoring and access logs.
2. Private workload: no Elastic IP, private vSwitch, least-privilege security-group sources, controlled outbound (NAT gateway), and no publicly exposed database.
3. VPC segmentation: route tables, subnet boundaries via network ACLs, and Cloud Firewall for centralized east-west policy and IPS.
4. Attack response: WAF logs for L7 abuse, Cloud Firewall logs for traffic policy and intrusion events, Anti-DDoS events for volumetric floods, and ActionTrail for administrative API changes.
5. Contrast drill: security group vs network ACL, Cloud Firewall vs WAF, Anti-DDoS Origin vs Pro/Premium, Bot Management vs GameShield.

Draw each diagram from memory once per day in the final week. The act of placing a service at the right layer is exactly the skill the scenario questions reward.

Parse the Stem: Underline the Layer Noun

Every network scenario hides a keyword that fixes the layer. Train yourself to underline it before reading the options, because Alibaba Cloud writes plausible distractors for adjacent services.

Watch the cross-domain distractors too: a network question may list RAM policy, KMS encryption, or Security Center (host security) as options. Those belong to identity, data, and host domains respectively, so they are wrong whenever the threat is a network or availability problem. Recognizing the wrong domain is often faster than confirming the right service.

Time Management and the Over-Layering Trap

With roughly 1.8 minutes per question, use a two-pass strategy. Pass one: answer every item you recognize immediately and flag anything that needs a diagram. Do not burn three minutes on a single segmentation puzzle in pass one. Pass two: return to flagged items with the time you banked, sketch the traffic path on scratch material, and commit.

The single most common CSA-C01 mistake is over-layering. A real public-facing architecture genuinely needs Anti-DDoS plus WAF plus security groups plus Cloud Firewall. But a one-sentence question that says "scrapers and account-takeover bots are hitting our login page" is pointing at Bot Management alone — adding more services is the trap. Read whether the stem asks you to design (layered answer welcome) or to choose the single best control (one service only).

Final-Week Checklist

• Recite the five domains and which is largest (network).
• State exam logistics from memory: 50 questions, 90 minutes, 70/100 to pass.
• Explain stateful (security group) vs stateless (network ACL) with the dropped-return-traffic example.
• Distinguish Anti-DDoS Origin (keep IP) from Pro/Premium (CNAME to scrubbing center) and recall the free Origin Basic ~5 Gbit/s tier and blackhole behavior.
• Separate WAF (L7), Cloud Firewall (L3/L4 + IPS), Bot Management, and GameShield by protocol and traffic path.
• Reject cross-domain distractors (RAM, KMS, Security Center) on network items.

If you can complete this checklist without notes, the network domain — and the bulk of the exam — is in hand.

Worked scenario walkthrough

Consider a representative item: "A retailer runs a flash sale. Their login API is hammered by distributed clients reusing leaked passwords, while the storefront stays responsive. Pick the single best control." Parse it: traffic is HTTP, but the threat is automated credential reuse at scale, not injection and not bandwidth saturation. WAF rate rules are a partial fix; Anti-DDoS is wrong because bandwidth is fine; security groups cannot tell a real user from a bot. The keyword "reusing leaked passwords" is credential stuffing, so Bot Management is the answer.

Now flip one word: "The login API is hit by a 30 Gbit/s UDP flood from a botnet." Same endpoint, different layer — this is volumetric, so an Anti-DDoS tier wins, and Bot Management is now wrong. Practicing these one-word pivots trains the exact discrimination CSA-C01 measures. Build five such pairs yourself, each toggling one clue (protocol, direction, volume, or asset) so the correct service flips, and you will stop second-guessing under the 1.8-minute clock.