Topics

A reported message is a header and a sender, not a verdict. Read the Received chain and the authentication results before you tell anyone it is phishing. Then look at domains that resemble yours, and at the report that says who is sending as you.

1. 01A message that looks internalRead this first
2. 02A file the email asked you to openSituation
3. 03Email securityWorkbench
4. 04Phishing header analyzerLab
5. 05DMARC aggregate report readerLab
6. 06Lookalike domain triageLab

A capture is a list of conversations, not a pile of hex. Start with who talked, which protocol carried it, and whether the payload is still readable. The packet lab asks you to put one page load in order. You are not sending traffic.

1. 01A host that keeps connectingRead this first
2. 02WiresharkWorkbench
3. 03Network toolsWorkbench
4. 04Packet flow puzzleLab
5. 05Which tool for this questionCompare

A logon is an account, a type, and a source. The Active Directory and identity lessons name which record shows that a password was used, and which record does not. The labs hand you a push-bombing queue and a token so you can say what you would trust.

1. 01A sign-in from somewhere newRead this first
2. 02A cloud key showed up in the openSituation
3. 03Active Directory defenseWorkbench
4. 04Identity defenseWorkbench
5. 05MFA fatigue triage queueLab
6. 06JWT inspectorLab

A scan report is a list of what answered. Read it from the side that was scanned, on a host you are allowed to look at. Then decide which of those answers should have been reachable, and which firewall rule should have stopped the rest.

1. 01Nmap and network discoveryWorkbench
2. 02Firewall rule order simulatorLab

A disk and a memory image are evidence with a clock. The forensics workbench is how you read them. Triage is how you collect and order what you found. The timeline lab is five events you have to put in one sequence.

1. 01The first hour of a ransom noteRead this first
2. 02Forensics toolsWorkbench
3. 03Triage collection and timelinesWorkbench
4. 04Incident timeline builderLab
5. 05Which tool for this questionCompare

An alert is a claim with a clock. Read the title, who it names, when it fired, what the rule was written to catch, and what ordinary work would look the same. Then write the note.

1. 01One alert, before you escalateRead this first
2. 02SIEM and detection engineeringWorkbench
3. 03Sigma rule builderLab
4. 04Sign-in log query labLab

One exam is enough vocabulary. After that, you need a lab you can describe without the hint open. The certification lessons are the names. The career paths are the short lists that end in that lab.

1. 01Security certification study guidesWorkbench
2. 02How to write a findingNote
3. 03Career pathsPaths