The CDP Study Plan

The Certified DevSecOps Professional doesn't hand you a domain-weight table the way a multiple-choice exam does — Practical DevSecOps has never published "chapter 4 is worth 20%" for its five live challenges, and this course's own blueprint says so directly. So this plan can't do what a weighted study plan does; it does the next best thing. It takes the nine chapters this course organizes the CDP's hands-on scope into, across eight blueprint pages, and pairs every single one with the lesson that explains the idea and the capstone lab part that makes you build it. The one deliberate exception to "one chapter, one week" is the first week: chapters 1 and 2 — the toolchain — get front-loaded before any graded chapter starts, not because they're worth more, but because every later chapter assumes your hands already do them without thinking. Nine weeks, then a full sitting inside the exam's actual six-hour window before you book the real thing.

What the CDP actually tests, before you plan a single week

☺ Like you're 10: No quiz to fall back on. You get a broken environment, five challenges, a six-hour clock, and then you have to write down what you did.

The Certified DevSecOps Professional is a vendor certification from Practical DevSecOps: 100% practical and task-based, five challenges against a live environment, no multiple choice anywhere. That format is exactly why this plan is shaped the way it is — reading about a Semgrep rule teaches you the concept, but the exam scores whether the rule actually blocks the merge.

Place yourself first — the readiness self-assessment

☺ Like you're 10: Before you plan nine weeks of building, find out how much you can already build. Reading about a tool and having used it under pressure feel the same right up until the clock starts.

Score one point per statement that's true right now, hands on a keyboard — not "I've read about it," but "I have done this, cold, without a tab open to remind me."

• ① Toolchain (Ch. 1–2)
• I can write a five-line Ansible playbook and an InSpec control from a blank file, and I know which one changes state and which one only asserts it
• I can explain blue-green, canary, and rolling deployments by rollback speed and blast radius without looking anything up
• ② Gates & SDLC (Ch. 3)
• I can name the five points in a real pipeline where a security gate can physically live, and tell a gate that's merely present from one that's actually blocking
• I can describe what OWASP's DSOMM scores an activity on, without treating "do we have a scanner" as a yes/no answer
• ③ Composition & static analysis (Ch. 4–5)
• I can read a CVSS vector and an EPSS score and explain what each one is actually claiming, not just quote the headline number
• I can tune a SAST rule set to survive contact with a real team without disabling the rule that would've caught the next real finding
• ④ Dynamic analysis & IaC (Ch. 6–7)
• I can run an authenticated ZAP scan against a running target and read alert risk versus confidence, not just the alert count
• I can write an OPA/Conftest Rego policy that fails a broken Terraform plan and passes the fixed one
• ⑤ Compliance & triage (Ch. 8–9)
• I can encode a fix as a re-runnable compliance control, not just a merged pull request
• I can deduplicate the same finding reported by two different scanners and assign it one severity/SLA-driven priority

The shape of this plan — front-load the gate, then one chapter a week

☺ Like you're 10: Nine boxes in a row. The first one and the last one look different from the middle seven — the first is a warm-up, the last is the real thing rehearsed.

With no published weighting to divide hours by, the fairest default is equal time per chapter — and this plan follows that default for seven of its nine weeks. The one place it deviates on purpose is the front: chapters 1 and 2 build no new, gradable skill of their own. They exist, in the blueprint page's own words, to make sure "the vocabulary and the commands underneath all of that are already reflexes, not lookups" before chapter 3 asks you to do something new with them. Skip that gate and every later week pays a tax — a Kyverno policy that should take five minutes takes fifteen because the Ansible syntax next to it needed a lookup first.

The nine-chapter map — every blueprint page, its lesson, its lab

☺ Like you're 10: One row per week. Read the lesson to get the idea, then go build the matching part of the capstone so your hands agree with your head.

This is the plan's reference table — the week-by-week notes further down are a calendar wrapped around these eight rows. The lab column points at the capstone's seven parts, which build one pipeline — Vulnerly, a deliberately vulnerable Node.js/Postgres app — across the whole plan.

Week 1 — the toolchain gate

☺ Like you're 10: Nothing new to learn here — just making sure six old skills come out instantly, with no browser tab and no assistant to lean on.

Read DevOps Foundations & the CDP Toolchain once, then close it and drill the six tool categories cold: a multi-stage Dockerfile, an idempotent Ansible task, an InSpec control, a ZAP baseline scan, a rebase, and reading CI pipeline YAML well enough to spot where a secret gets injected. None of this is new material — it's the fluency gate every later chapter assumes is already automatic.

# the six-tool cold drill — no notes, no browser tab, time yourself
git rebase -i HEAD~3                                    # Git platform
docker build -t vulnerly:dev . && docker run --rm -p 8080:8080 vulnerly:dev   # container runtime
ansible-playbook -i inventory.ini site.yml --check       # config management, dry-run first
inspec exec profile/ -t ssh://host --sudo                # compliance as code
zap-baseline.py -t http://localhost:8080 -r report.html  # DAST scanner

If any one of those five lines needed a second thought, that's your actual study list for the week — not the whole blueprint page, just the specific command that hesitated. Know It Cold and the command & tool reference exist to close exactly that gap.

Weeks 2–8 — one graded chapter, one capstone part, every week

☺ Like you're 10: Same rhythm every week: read to understand the idea, then build the next slice of the same pipeline so it's real, not theoretical.

Each week follows the same shape: read the paired lesson for the concept, read the blueprint chapter for exam-specific depth, then work the matching capstone part or drill from the table above until Benny the Beaver's bar is met — something actually ran against Vulnerly, not just something you read about running.

Two weeks are worth flagging by name. Week 6 carries two capstone parts (container hardening/signing, then IaC and policy) because chapter 7's hardening habit applies to both the box and the infrastructure underneath it — split the week roughly 40/60 in that order if the load feels heavy. Week 8 closes out chapter 9 using the second half of Part 7, which is deliberately the last capstone part: DefectDojo aggregation and a Wazuh detection rule only mean something once every earlier week's findings exist to aggregate.

The report — the skill the fix alone won't earn you

☺ Like you're 10: Fixing the bug is only half the job. Writing down exactly what you found and what you did about it, clearly enough that a stranger could verify it, is the other half — and it's graded too.

Every CDP challenge window is followed by up to 24 hours to submit a written report — PDF, Markdown, or screenshots as evidence. Candidates who treat this as an afterthought lose points they'd already earned with their hands, because an examiner grades what the report shows, not what actually happened in a terminal nobody else saw. Practice this weekly, not for the first time in Week 9: after each capstone part, write two or three sentences — what was broken, what tool caught it, what the fix was, and the one command or screenshot that proves it's actually fixed. DefectDojo, which Week 8 wires in, is this habit turned into a system: one finding, one disposition, one piece of evidence, every time.

Week 9 — integrate, then sit a mock inside the real six-hour window

☺ Like you're 10: Everything you've built for eight weeks now has to work together, on a clock, with nobody telling you which challenge comes next.

New material this week should be limited to whatever gaps Week 1's drilling or the eight capstone parts exposed. Spend the first two or three days polishing: confirm Vulnerly's full pipeline — threat model, SAST/secrets, SCA, signed container, gated IaC, DAST-clean staging, compliance evidence, and monitoring — still runs end to end after eight weeks of changes. Re-read the triage playbook and skim the command & tool reference once, cover to cover, not for new facts but so the muscle memory is the last thing loaded before the timer starts.

Then block a genuine, uninterrupted six-hour window — the same length as the real exam, not a compressed version — and sit one full set from the practice challenge bank assembled into a mock, closed to any AI assistant, phone away, door closed. Immediately afterward, spend up to an hour writing the report exactly as you would for real — this is the rehearsal that catches "I fixed it but can't prove it in writing," which is a completely different failure mode from "I couldn't fix it."

Four mock exams, used without burning them

☺ Like you're 10: A practice run for "build the thing" is more like practicing scales on a piano than eating a bag of sweets — doing the same category of task again doesn't ruin it, it's the whole point.

The CDP is performance-based, so recognizing a mock's task shape in advance doesn't let you skip the work — it only saves you the few minutes you'd have spent reading the brief carefully. That's meaningfully different from a knowledge exam, where recognizing the right answer is the whole test. What genuinely wastes a sitting is narrower: re-sitting the identical numbered set inside a couple of weeks, drilling a bank task until you're typing memorized commands instead of reasoning from the brief, or reading a worked solution before you've honestly attempted the task yourself.

The objective gates — how you know you're ready

☺ Like you're 10: "I feel ready" isn't something you can check. These five things are.

Reading every lesson isn't a gate — reading is input, and this exam only ever scores output. If all five gates hold, book the exam.

The day before, and the six-hour window itself

☺ Like you're 10: The best thing to do the day before is stop building, check your setup, and sleep.

New material the day before costs more than it gains — it displaces consolidated muscle memory and eats the sleep protecting it. Run whatever system check Practical DevSecOps provides on the exact machine you'll use, confirm your ID matches your registration, re-read the CDP exam guide once for current logistics, and stop. One light pass of Know It Cold is fine; a new lab is not.

In the window itself: read all five challenges before committing deeply to any one of them, bank the ones you're confident on first, and don't let a single stubborn task eat hours that four easier ones could have banked instead. Verify every fix the same way the exam will — run the actual check, read the actual scan output — rather than assuming a change worked because the edit looked right. And budget real time for the report before the window closes; a perfect fix with no evidence to show for it is a fix nobody can grade.

Two companions worth reading alongside this page: the CDP exam guide for registration and exam-day logistics this page doesn't cover, and the certifications overview for how the CDP compares to CKS and the AWS Security Specialty if more than one credential is on your path. Ready to start? Begin at chapter 1.