Capstone — the whole loop

Scenario questions that need every level: detect, investigate, contain, recover and learn.

← Training·Level 9 of 9 · Siddhidatri — completion·Mastery·about 12 minutes

1Putting it together

Every real incident uses more than one skill. A credential attack is found in logs (level 7), confirmed by spotting the success among the failures (level 5), scoped by following what the account did next (level 6), contained in proportion (level 1), recovered and verified (level 8), and turned into a better detection (level 7 again).

These questions are scenarios. Read each one as a defender would: what do I know, what don't I know yet, and what is the proportionate next step?

Test what you learned

8 questions · pass mark 80% · every answer explains itself after you submit.

1.412 failed sign-ins from one new network, then one success. What comes first?
2.A workstation beacons every 60 s to a rare domain and has new SMB peers. What do you do?
3.A user approved an OAuth consent on a phishing page, and a token read their mailbox. What must be revoked?
4.Two vulnerabilities: one CVSS 9.8 with no known exploitation, one CVSS 7.5 listed in CISA KEV. Patch which first?
5.Ransomware hits; the backups were on a file share in the same domain. What is the likely problem?
6.An alert matches an IP from an 18-month-old threat feed. What is it?
7.You find T1053.005 on a host. What has the attacker done?
8.Before isolating a production database server, what must be ready?

1Putting it together

These questions are scenarios. Read each one as a defender would: what do I know, what don't I know yet, and what is the proportionate next step?

Test what you learned

8 questions · pass mark 80% · every answer explains itself after you submit.

1.412 failed sign-ins from one new network, then one success. What comes first?
2.A workstation beacons every 60 s to a rare domain and has new SMB peers. What do you do?
3.A user approved an OAuth consent on a phishing page, and a token read their mailbox. What must be revoked?
4.Two vulnerabilities: one CVSS 9.8 with no known exploitation, one CVSS 7.5 listed in CISA KEV. Patch which first?
5.Ransomware hits; the backups were on a file share in the same domain. What is the likely problem?
6.An alert matches an IP from an 18-month-old threat feed. What is it?
7.You find T1053.005 on a host. What has the attacker done?
8.Before isolating a production database server, what must be ready?