Challenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Pick a focused route instead of searching through internal categories and advisory tags.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
21 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
27 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsAssess practical cloud-security judgment across responsibility, boundaries, configuration, telemetry, resilience, workload runtime, SaaS governance, and connected applications.
Review Cloud Security Foundations: Applied Decisions ExamAssess incident-response judgment across preparation, triage, evidence, scoping, containment, communication, recovery, identity compromise, cloud control incidents, and ransomware.
Review Incident Response Foundations: Evidence-Led Decisions ExamA learner-centered assessment of scams, verification, accounts, devices, browsing, personal information, backups, and incident recovery.
Review Cyber Security Awareness Fundamentals ExamA learner-centered assessment of how generative AI works, safe input, provider research, agents, verification, synthetic media, and incident recovery.
Review AI Awareness Fundamentals ExamAn advanced professional exam testing knowledge of systemic ransomware recovery, Minimum Viable Factory Recovery (MVF), and critical-infrastructure cyber resilience based on real-world incidents and academic frameworks.
Review Systemic Ransomware Recovery and Cyber ResilienceTest your ability to fuse incident evidence with external intelligence, build defensible timelines, separate observations from hypotheses, reconstruct campaign scope, generate intelligence leads, and feed lessons back into response and analysis.
Review CTI in Incident Response & Campaign ReconstructionTest your ability to apply Cyber Threat Intelligence to detection engineering and threat hunting, including hypothesis development, telemetry selection, indicator use, behavioral detection, ATT&CK mapping, detection gaps, hunt prioritization, and translating intelligence into operational security actions.
Review CTI for Detection & Threat HuntingUse the CISA and U.S. Coast Guard hunt report to decide which observed configuration and logging gaps would prevent defensible incident analysis in an IT/OT environment.
Review AA25-212A Critical-Infrastructure Hunt Gap AnalysisAnalyze appliance-side webshell, privilege, staging, persistence, and anti-forensic artifacts from exploitation of Citrix NetScaler ADC and Gateway systems.
Review AA23-201A Citrix NetScaler Artifact AnalysisInvestigate a vulnerability chain against Ivanti EPMM and use API, log, user-agent, certificate, and webshell evidence to design defensible hunting conclusions.
Review AA23-213A Ivanti EPMM Forensic HuntingReconstruct two nation-state intrusion paths at an aeronautical organization and connect account, malware, credential, and network evidence to the correct phase of the investigation.
Review AA23-250A Aeronautical Intrusion Timeline AnalysisInvestigate Snatch's RDP entry, bulletproof-hosted command-and-control, long dwell time, service manipulation, Safe Mode boot, shadow-copy removal, filename masquerading, and recovery note.
Review AA23-263A Snatch Safe-Mode Encryption and Dwell-Time AnalysisInvestigate exploitation of Confluence setup state, unauthorized administrator creation, Rclone configuration, observed user agents, product scope, and post-compromise recovery decisions.
Review AA23-289A Confluence Administrator-Creation and Exfiltration HuntInvestigate Rhysida's valid-account access, MFT evidence, Windows staging, remote execution, Azure storage utilities, process injection, cryptographic design, and ransom-note artifact.
Review AA23-319A Rhysida Staging, Cloud Transfer, and Encryptor ResearchTrace a Phobos intrusion from exposed RDP and loader behavior through firewall changes, credential access, exfiltration, recovery inhibition, and ransom-note execution.
Review AA24-060A Phobos Intrusion Command and Exfiltration Research
