Open Zero Trust Project  ·  Absolute Zero Academy
Study Guide  ·  oztp.org
Published Draft Open for Practitioner Feedback 103 Objectives · 4 Domains
AZ Foundations
Learning Objectives & Exam Blueprint — the entry-tier certification of the Absolute Zero Academy, the Open Zero Trust Project's education and certification program.
About This Study Guide

This document lists every learning objective currently proposed for the AZ Foundations certification, organized by domain and section, with the Bloom's Taxonomy level and exam question type noted for each. It is meant as a study companion — print it, mark it up, and use it to track your own readiness domain by domain.

You Are Reading a Snapshot This is the current version of the AZ Foundations objectives as of the date below. The web version at oztp.org/objectives/ is always the source of truth — objectives are still in draft and open for feedback, so content may be revised before the exam launches. Re-download before your exam date to confirm you're studying the latest version.
How to Read This Guide
  • L1 Remember — recall a fact or definition
  • L2 Understand — explain or describe a concept
  • L3 Apply — use a concept in a given scenario
  • L4 Analyze — compare, contrast, or break down
  • PBQ Performance-Based Question candidate — flagged objectives are more likely to appear as a scenario-based, multi-step exam question rather than a single multiple-choice item
AZ Foundations Study Guide  ·  Absolute Zero Academy Snapshot: July 5, 2026  ·  Page 1 of 2
Open Zero Trust Project  ·  Absolute Zero Academy
AZ Foundations  ·  Study Guide
Exam Blueprint — Domain Weighting
DomainWeightObjectivesPBQ Candidates
D1 — What is Zero Trust?
20%		 214
D2 — Controls, Layered Defense, Modern Threats
23%		 245
D3 — Frameworks and the Five Pillars
36%		 373
D4 — Reading and Assessing Environments
21%		 216
Total100%10318
Exam Format — Not Yet Finalized Domain weighting is derived directly from the objective counts above and will guide how the exam is built. Question count, time limit, and passing score have not been set and will be announced when the AZ Foundations exam opens for registration. This blueprint reflects the current draft and is subject to change based on feedback gathered at oztp.org/objectives/.
Table of Contents
Domain 1 — What is Zero Trust?
  • 1.1 Defining Zero Trust 9 objectives
  • 1.2 ZT Across the Computing Environment 8 objectives
  • 1.3 ZT vs. What Came Before 4 objectives
Domain 2 — Controls, Layered Defense, and the Modern Threat Landscape
  • 2.1 Control Types and Their Roles 7 objectives
  • 2.2 Layered Defense and Assume Breach 7 objectives
  • 2.3 The Modern Threat Landscape 10 objectives
Domain 3 — ZT Frameworks and the Five Pillars
  • 3.1 Why Frameworks Matter 4 objectives
  • 3.2 NIST SP 800-207: The ZT Tenets 4 objectives
  • 3.3 CISA ZTMM v2: The Five Pillars 13 objectives
  • 3.4 CIS Controls v8 3 objectives
  • 3.5 ISO/IEC 27001: Awareness Level 3 objectives
  • 3.6 Networking and Identity Fundamentals 10 objectives
Domain 4 — Reading and Assessing Environments
  • 4.1 What a ZT Assessment Is 4 objectives
  • 4.2 Reading Posture Reports and Findings 5 objectives
  • 4.3 Mapping Findings to Pillars and Control Types 4 objectives
  • 4.4 Risk Prioritization Basics 4 objectives
  • 4.5 Using Assessment Tools 4 objectives
AZ Foundations Study Guide  ·  Absolute Zero Academy Snapshot: July 5, 2026  ·  Page 2 of 2
Open Zero Trust Project  ·  Absolute Zero Academy
AZ Foundations Learning Objectives
Domain 1  ·  20% of Exam
What is Zero Trust?
Foundational definitions, the three core tenets, and how Zero Trust differs from the perimeter-based security that came before it.
21 Objectives 4 PBQ Candidates
1.1 — Defining Zero Trust
#ObjectiveBloom'sExam Type
1.1.1Define Zero Trust in three sentences or fewer, without vendor or product referencesL2Knowledge
1.1.2State the three core ZT tenets: Never Trust Always Verify, Least Privilege, Assume BreachL1Knowledge
1.1.3Explain why "never trust, always verify" applies to users, devices, and network traffic equallyL2Knowledge
1.1.4Contrast Zero Trust with perimeter-based security and explain why the perimeter model is insufficient in modern environmentsL4Compare/contrastPBQ
1.1.5Identify the factors that dissolved the traditional perimeter: cloud adoption, remote work, BYOD, SaaS proliferationL1Knowledge
1.1.6Explain Default Deny as a foundational ZT posture and contrast it with Default AllowL2/L4Compare/contrast
1.1.7Define Least Privilege and describe how it limits blast radius when a breach occursL1/L2Knowledge
1.1.8Explain the Assume Breach mindset and describe how it changes security design decisionsL2Knowledge
1.1.9Define the "Fail-Closed" paradigm and contrast it with legacy "Fail-Open" architectures regarding confidentiality versus availabilityL2Knowledge
1.2 — ZT Across the Computing Environment
#ObjectiveBloom'sExam Type
1.2.1Describe how ZT principles apply at the device level for both physical and virtual machinesL2Knowledge
1.2.2Explain how ZT applies within a network segment and identify why lateral movement is a primary concern at this scopeL2/L3Scenario
1.2.3Describe ZT considerations specific to wireless networks (WLAN) including device trust and traffic inspectionL2Knowledge
1.2.4Explain how ZT extends across a WAN and describe why VPN alone is insufficient as a ZT controlL2/L4Compare/contrast
1.2.5Describe what org-wide Zero Trust looks like and identify the five pillars that must be addressed at organizational scopeL2/L1Knowledge
1.2.6Explain why ZT is a philosophy applied consistently across all scopes rather than a product deployed at one layerL2Knowledge
1.2.7Identify a Single Point of Failure (SPOF) in a described environment and explain why ZT architecture is designed to survive individual control failuresL1/L2ScenarioPBQ
1.2.8Describe how legacy Layer 2 infrastructure behaves under confusion (e.g., Unicast Flooding via MAC Flooding) and explain why Zero Trust requires hardware-enforced port security containmentL2/L3ScenarioPBQ
1.3 — ZT vs. What Came Before
#ObjectiveBloom'sExam Type
1.3.1Explain Defense in Depth and describe how ZT extends rather than replaces itL2Knowledge
1.3.2Contrast implicit trust (perimeter model) with explicit verification (ZT model) in a given access scenarioL4ScenarioPBQ
1.3.3Describe the trust assumptions that made perimeter security work historically and explain why those assumptions no longer holdL2Knowledge
1.3.4Explain why cloud-hosted services and remote users cannot be protected by a network perimeterL2Knowledge
Domain 2  ·  23% of Exam
Controls, Layered Defense, and the Modern Threat Landscape
Control types and classification, why layered/assume-breach architecture matters, and how today's attacks — including supply chain compromise — are defeated by simple controls applied consistently.
24 Objectives 5 PBQ Candidates
2.1 — Control Types and Their Roles
#ObjectiveBloom'sExam Type
2.1.1Define preventative, detective, and corrective controls and provide a real-world example of eachL1/L2Knowledge
2.1.2Classify a given control as preventative, detective, or corrective when presented in a scenarioL2Scenario
2.1.3Classify a given control as technical, administrative, or physicalL2Scenario
2.1.4Explain why a preventative control that fails without a detective control behind it allows a breach to go undetectedL2Knowledge
2.1.5Contrast application control (allowlisting) and application containment as preventative controls, and explain the difference in their approachL4Compare/contrast
2.1.6Explain how Default Deny implemented at the application layer defeats entire classes of attack without requiring threat signaturesL2Knowledge
2.1.7Define a protocol downgrade attack and explain how a strict, non-backwards-compatible cryptographic policy enforces a Fail-Closed posture at the edgeL2Knowledge
2.2 — Layered Defense and Assume Breach
#ObjectiveBloom'sExam Type
2.2.1Explain why no single control is sufficient and describe how layered controls reduce overall riskL2Knowledge
2.2.2Describe the relationship between preventative and detective controls in an assume-breach architectureL2Knowledge
2.2.3Explain the assume-breach mindset and identify how it changes the role of detective controlsL2/L1Knowledge
2.2.4Apply the assume-breach mindset to a described environment and identify which control layers are absentL3ScenarioPBQ
2.2.5Explain why complexity in security architecture increases risk and describe how simple controls applied consistently reduce attack surfaceL2Knowledge
2.2.6Identify a control gap in a described layered security stack and classify what type of control is missingL3ScenarioPBQ
2.2.7Explain how to protect a Fail-Closed architecture from intentional weaponization (e.g., malicious trigger-DDoS) using micro-segmentation to isolate blast radius and high-availability redundancy to maintain operationsL3/L4ScenarioPBQ
2.3 — The Modern Threat Landscape
#ObjectiveBloom'sExam Type
2.3.1Describe how cloud adoption, remote work, and SaaS expansion have increased the attack surface organizations must defendL2Knowledge
2.3.2Explain Living off the Land (LOtL) attacks and describe why they evade signature-based detectionL2Knowledge
2.3.3Explain how application control and Default Deny defeat LOtL attacks at the preventative layerL2Knowledge
2.3.4Describe how AI-accelerated threats increase attack velocity and explain why assume-breach is the appropriate response postureL2Knowledge
2.3.5Explain the role of threat hunting as a detective control and describe why it is necessary in an assume-breach environmentL2Knowledge (awareness only)
2.3.6Contrast reactive security (respond after detection) with proactive security (assume breach, hunt continuously)L4Compare/contrast
2.3.7Describe edge infrastructure exploitation methodologies (e.g., VPNFilter or Volt Typhoon router manipulation) and identify the specific logging and account lockout controls required to expose ongoing stealth attacksL2/L3ScenarioPBQ
2.3.8Define a supply chain attack and explain how it differs from a direct attack against an organization's own infrastructureL1/L2Knowledge
2.3.9Explain why supply chain attacks evade perimeter and signature-based detection by arriving through a trusted update mechanism or dependencyL2Knowledge
2.3.10Explain how application control (Default Deny / allowlisting) defeats supply chain payloads regardless of their delivery mechanism, using the SolarWinds Orion and XZ Utils incidents as anchoring examplesL2/L3ScenarioPBQ
Domain 3  ·  36% of Exam
ZT Frameworks and the Five Pillars
NIST SP 800-207, the CISA ZTMM five pillars, CIS Controls v8, ISO/IEC 27001, OS-native application control, and the networking/identity fundamentals underneath them. The largest domain by design.
37 Objectives 3 PBQ Candidates
3.1 — Why Frameworks Matter
#ObjectiveBloom'sExam Type
3.1.1Explain the purpose of a security framework and describe how frameworks provide a common language for assessing and communicating ZT maturityL2Knowledge
3.1.2Identify the four primary frameworks used in ZT practice: NIST SP 800-207, CISA ZTMM v2, CIS Controls v8, ISO/IEC 27001L1Knowledge
3.1.3Describe how the four frameworks complement rather than compete with each otherL2Knowledge
3.1.4Explain the concept of ZT maturity and describe why it is a spectrum rather than a binary stateL2Knowledge
3.2 — NIST SP 800-207: The ZT Tenets
#ObjectiveBloom'sExam Type
3.2.1State the seven NIST ZT tenets from SP 800-207L1Knowledge
3.2.2Explain each NIST tenet in plain language and relate it to a real-world control or policyL2Knowledge
3.2.3Describe the NIST concept of a Policy Decision Point (PDP) and Policy Enforcement Point (PEP) and explain how they implement continuous verificationL2Knowledge
3.2.4Apply the NIST tenets to a described scenario and identify which tenets are satisfied or violatedL3ScenarioPBQ
3.3 — CISA ZTMM v2: The Five Pillars
#ObjectiveBloom'sExam Type
3.3.1Name and describe the five CISA ZTMM pillars: Identity, Devices, Networks, Applications, DataL1/L2Knowledge
3.3.2Explain the three CISA ZTMM maturity stages — Traditional, Advanced, Optimal — and describe what each looks like in practiceL2Knowledge
3.3.3Describe the Identity pillar and identify the key controls that advance maturity within itL2Knowledge
3.3.4Describe the Devices pillar and identify how device posture verification supports ZTL2Knowledge
3.3.5Describe the Networks pillar and explain how microsegmentation and default deny reduce lateral movementL2Knowledge
3.3.6Describe the Applications pillar and explain the role of least privilege access and continuous authorizationL2Knowledge
3.3.7Describe the Data pillar and identify how data classification and encryption support ZT data protectionL2Knowledge
3.3.8Map a described security control to its primary CISA ZTMM pillarL3ScenarioPBQ
3.3.9Explain why a single security event often crosses multiple pillars and provide an exampleL2Knowledge
3.3.10Identify OS-native application control mechanisms — Windows Defender Application Control (WDAC), Linux AppArmor/SELinux, and macOS Gatekeeper/System Integrity Protection (SIP) — as free, built-in Devices pillar controls present on most modern operating systemsL1/L2Knowledge
3.3.11Classify each OS-native mechanism (WDAC, AppArmor/SELinux, Gatekeeper/SIP) as primarily an allowlisting control or a containment controlL2/L3Scenario
3.3.12Explain the difference between audit mode and enforcement mode for OS-native application control and explain why audit mode alone does not represent Zero Trust postureL2Knowledge
3.3.13Explain why OS-native application control is a widely available but underused ZT control and describe how it defeats supply chain and Living off the Land payloads without requiring threat signaturesL2/L3ScenarioPBQ
3.4 — CIS Controls v8
#ObjectiveBloom'sExam Type
3.4.1Explain the purpose of the CIS Controls and describe how Implementation Groups (IG1, IG2, IG3) prioritize controls by organizational size and riskL2Knowledge
3.4.2Identify which CIS Controls are most directly aligned with ZT principlesL2Knowledge
3.4.3Describe IG1 as a minimum baseline and explain why it represents the floor, not the ceiling, for ZT-aligned organizationsL2Knowledge
3.5 — ISO/IEC 27001: Awareness Level
#ObjectiveBloom'sExam Type
3.5.1Describe the purpose of ISO/IEC 27001 and its role as an information security management frameworkL2Knowledge
3.5.2Explain how ISO 27001 complements ZT by providing governance and auditability structureL2Knowledge
3.5.3Distinguish between ISO 27001 certification (organizational) and ZT maturity (architectural) as different but compatible goalsL4Compare/contrast
3.6 — Networking and Identity Fundamentals Anchored to the Pillars
#ObjectiveBloom'sExam Type
3.6.1Identify the seven OSI layers and explain at which layers common ZT network controls operateL1/L2Knowledge
3.6.2Describe the TCP/IP model and map it to the OSI modelL2Knowledge
3.6.3Explain the role of MAC and IP addressing in device identity and network segmentationL2Knowledge
3.6.4Describe the function of DNS, TLS, SSH, and LDAP and explain their relevance to ZT network and identity controlsL2Knowledge
3.6.5Explain PKI — certificate authorities, public/private key pairs, certificate revocation — and describe how PKI underpins ZT identity verificationL2Knowledge
3.6.6Distinguish between authentication and authorization and apply the distinction to an access control scenarioL4/L3Scenario
3.6.7Describe the IAM lifecycle and explain the ZT risk posed by orphaned or over-privileged accountsL2Knowledge
3.6.8Define MFA, classify common factor types, and explain why MFA is a foundational Identity pillar controlL1/L2Knowledge
3.6.9Contrast Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) and identify which is more granularL4Compare/contrast
3.6.10Contrast a Fail-Open handshake protocol with a Fail-Closed handshake protocol during an abnormal negotiation session (e.g., invalid certificates or degraded ciphers)L4Compare/contrast
Domain 4  ·  21% of Exam
Reading and Assessing Environments
Interpreting posture reports, mapping findings to pillars and control types, and prioritizing remediation. The highest PBQ concentration of any domain — this is where the exam earns its credibility.
21 Objectives 6 PBQ Candidates
4.1 — What a ZT Assessment Is
#ObjectiveBloom'sExam Type
4.1.1Explain the purpose of a ZT assessment and describe how it differs from a vulnerability scan or penetration testL2/L4Compare/contrast
4.1.2Describe the difference between a self-assessment and a third-party assessment and explain when each is appropriateL2Knowledge
4.1.3Explain what a ZT maturity assessment measures and describe how results map to the CISA ZTMM maturity stagesL2Knowledge
4.1.4Describe the role of continuous assessment in a ZT architecture and explain why point-in-time audits are insufficientL2Knowledge
4.2 — Reading Posture Reports and Findings
#ObjectiveBloom'sExam Type
4.2.1Interpret a device posture report and identify which findings represent ZT control gapsL3ScenarioPBQ
4.2.2Classify a posture finding as a pass, warning, or failure and explain the criteria for each classificationL2/L3Scenario
4.2.3Identify the difference between a misconfigured control and an absent control in a posture reportL3ScenarioPBQ
4.2.4Explain what a device health state (healthy, warning, attention) communicates and describe what conditions trigger each stateL2Knowledge
4.2.5Interpret an assessment result showing pillar-level maturity scores and identify which pillars require immediate attentionL3ScenarioPBQ
4.3 — Mapping Findings to Pillars and Control Types
#ObjectiveBloom'sExam Type
4.3.1Map a described finding or gap to its primary CISA ZTMM pillarL3Scenario
4.3.2Explain why a single gap often affects multiple pillars and provide an exampleL2Knowledge
4.3.3Classify a finding as a preventative, detective, or corrective control gapL3Scenario
4.3.4Apply the assume-breach mindset to a set of findings and identify which gaps most increase exposure if a breach is already in progressL3/L4ScenarioPBQ
4.4 — Risk Prioritization Basics
#ObjectiveBloom'sExam Type
4.4.1Explain basic risk prioritization and describe how likelihood and impact together determine which gaps to address firstL2Knowledge
4.4.2Apply a simple risk matrix to a set of ZT findings and rank them by remediation priorityL3ScenarioPBQ
4.4.3Explain why a missing preventative control with no detective fallback is higher priority than a misconfigured control with detective coverageL2Knowledge
4.4.4Describe the concept of a remediation roadmap and explain how it translates assessment findings into ordered actionsL2Knowledge
4.5 — Using Assessment Tools
#ObjectiveBloom'sExam Type
4.5.1Describe the role of automated posture checking in continuous ZT assessmentL2Knowledge
4.5.2Explain how a device agent contributes to ZT device pillar visibility and identify what data it provides to an assessmentL2Knowledge
4.5.3Describe how an AI-assisted ZT advisor supports assessment by mapping organization responses to framework maturity levelsL2Knowledge
4.5.4Distinguish between agent-based posture data (device-level, continuous) and survey-based assessment data (org-level, point-in-time) and explain the value of combining bothL4Compare/contrastPBQ

Have Feedback on These Objectives?

AZ Foundations is a published draft. Tell us what's missing, what's out of scope for an entry-level exam, or where the wording could be sharper — before this locks in.

oztp.org/contact Free  ·  No account required
© 2026 Some Technologists LLC  ·  Open Zero Trust Project  ·  Apache 2.0  ·  Published Draft, snapshot July 5, 2026  ·  Current version always at oztp.org/objectives/