Choose from practical cybersecurity exams covering threat intelligence, incident response, cloud security, malware analysis and defensive research.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Free, independent knowledge assessments. Review the scope, preparation and scoring before you begin. Suggested times are study guidance; passing can earn a Threat Intelligence Lab platform certificate, not an accredited or third-party vendor qualification.
Start with a course check, a source-based investigation or a specialist topic.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
22 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
28 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsResearch Medusa's broker model, discovery ports, PowerShell evasion, lateral movement, encryption artifacts, and extortion process from documented investigations.
Review assessment : AA25-071A Medusa Ransomware Operations InvestigationResearch fast-flux infrastructure as a CTI collection problem, distinguish single from double flux, and evaluate DNS evidence without misclassifying legitimate CDNs.
Review assessment : AA25-093A Fast-Flux DNS Infrastructure InvestigationAnalyze LummaC2's delivery, host checks, command configuration, browser theft, download execution, and memory-resident behavior using the FBI and CISA report.
Review assessment : AA25-141B LummaC2 Configuration and Execution ResearchTrace GRU Unit 26165's credential attacks, vulnerability use, Active Directory collection, logistics intelligence requirements, and IP-camera reconnaissance.
Review assessment : AA25-141A GRU Logistics and Camera Targeting InvestigationInvestigate how an unpatched remote-management component exposed a software provider's downstream customers and determine the correct discovery and response steps.
Review assessment : AA25-163A SimpleHelp Downstream-Exposure InvestigationReconstruct Interlock's unusual initial access, persistence, credential theft, Azure exfiltration, and virtual-machine encryption from the joint advisory.
Review assessment : AA25-203A Interlock Ransomware Attack-Chain ResearchInvestigate the joint government report on PRC-linked compromises of telecommunications and edge infrastructure, then distinguish vulnerable-device activity from normal router behavior.
Review assessment : AA25-239A Network-Device Espionage InvestigationResearch official YARA rule syntax to interpret string types, modifiers, hex wildcards and jumps, Boolean conditions, occurrence counts, identifiers, and output behavior for malware-focused collection.
Review assessment : YARA Rule Technical InvestigationResearch Sigma's official rule format to interpret log sources, detection selections, conditions, field modifiers, status, severity, false positives, and portable rule intent.
Review assessment : Sigma Detection Rule Technical InvestigationResearch IETF Certificate Transparency v2 to interpret signed certificate timestamps, tree heads, inclusion and consistency proofs, monitor behavior, and the evidentiary limits of public certificate logs.
Review assessment : Certificate Transparency RFC InvestigationResearch IETF RDAP JSON to interpret domain, network, autonomous-system, entity, event, status, notice, remark, and extension data without overclaiming what registration records prove.
Review assessment : RDAP Registration Data Technical InvestigationResearch GitHub's official APIs to retrieve security advisories, apply vulnerability filters, export dependency evidence, and interpret SPDX package and relationship data for supply-chain decisions.
Review assessment : GitHub Advisory and SBOM InvestigationResearch Kubernetes auditing to identify event stages, select policy levels, understand first-match evaluation, configure the API server, and balance investigative detail with sensitive-data exposure.
Review assessment : Kubernetes Audit Policy Technical InvestigationResearch Google Cloud's official audit-log structure to identify log classes, principals, services, methods, resources, policy denials, and the correct filters for security investigations.
Review assessment : Google Cloud Audit Log Evidence InvestigationResearch AWS CloudTrail's official event schema to attribute API activity, interpret assumed-role sessions, preserve source identity, and distinguish reliable event fields from contextual clues.
Review assessment : AWS CloudTrail Event Attribution Investigation