Choose from practical cybersecurity exams covering threat intelligence, incident response, cloud security, malware analysis and defensive research.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Free, independent knowledge assessments. Review the scope, preparation and scoring before you begin. Suggested times are study guidance; passing can earn a Threat Intelligence Lab platform certificate, not an accredited or third-party vendor qualification.
Start with a course check, a source-based investigation or a specialist topic.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
22 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
28 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsTest your understanding of foundational Cyber Threat Intelligence concepts, terminology, analytical thinking, threat information sharing, indicators, adversary behavior, and structured intelligence standards.
Review assessment : Cyber Threat Intelligence FundamentalsTry a short introductory knowledge check on Go programming fundamentals. Review the question count and scope before you begin.
Review assessment : Introduction to Go ProgrammingUse the CISA and U.S. Coast Guard hunt report to decide which observed configuration and logging gaps would prevent defensible incident analysis in an IT/OT environment.
Review assessment : AA25-212A Critical-Infrastructure Hunt Gap AnalysisResearch how APT28 used weak SNMP configuration and a known Cisco vulnerability to enumerate routers, deploy Jaguar Tooth, collect network data, and maintain covert access.
Review assessment : AA23-108 APT28 Router Exploitation AnalysisExamine the Snake implant's Windows persistence, encrypted artifacts, Queue structure, modular protocol stack, layered encryption, and global peer-to-peer relay design.
Review assessment : AA23-129A Snake Implant ArchitectureResearch BianLian's access, proxying, privilege escalation, discovery, credential theft, defense evasion, and changing extortion model from the joint advisory.
Review assessment : AA23-136A BianLian Intrusion TradecraftInvestigate CL0P's MOVEit Transfer campaign by connecting the exploited SQL injection to LEMURLOOT authentication, database access, privileged-account behavior, and data theft.
Review assessment : AA23-158A MOVEit LEMURLOOT ResearchTrace Truebot from delivery and environment checks through FlawedGrace execution, in-memory follow-on activity, encoded collection, and Teleport exfiltration.
Review assessment : AA23-187A Truebot Toolchain InvestigationUse official reporting to distinguish normal Exchange Online access from forged-token activity and choose logging and retention measures that preserve investigative evidence.
Review assessment : AA23-193A Outlook Online Audit InvestigationAnalyze appliance-side webshell, privilege, staging, persistence, and anti-forensic artifacts from exploitation of Citrix NetScaler ADC and Gateway systems.
Review assessment : AA23-201A Citrix NetScaler Artifact AnalysisInvestigate a vulnerability chain against Ivanti EPMM and use API, log, user-agent, certificate, and webshell evidence to design defensible hunting conclusions.
Review assessment : AA23-213A Ivanti EPMM Forensic HuntingResearch QakBot's evolution, tiered command-and-control design, registry persistence, and the operational limits of the 2023 disruption.
Review assessment : AA23-242A QakBot Infrastructure ResearchReconstruct two nation-state intrusion paths at an aeronautical organization and connect account, malware, credential, and network evidence to the correct phase of the investigation.
Review assessment : AA23-250A Aeronautical Intrusion Timeline AnalysisInvestigate Snatch's RDP entry, bulletproof-hosted command-and-control, long dwell time, service manipulation, Safe Mode boot, shadow-copy removal, filename masquerading, and recovery note.
Review assessment : AA23-263A Snatch Safe-Mode Encryption and Dwell-Time AnalysisAnalyze BlackTech's subsidiary-to-headquarters pivots, router firmware replacement, ROMMON bypass, unlogged SSH backdoors, EEM output manipulation, and magic-packet activation.
Review assessment : AA23-270A BlackTech Router Firmware and Trusted-Pivot Investigation