Cybersecurity Expert

Explain how the CPU, memory, persistent storage, operating system, and processes interact when a program runs.

Distinguish volatile from non-volatile evidence and order common evidence sources by collection urgency.

Navigate, create, copy, move, and remove files and directories with PowerShell.

Interpret Windows paths, filename extensions, timestamps, ownership, and other basic file metadata.

Configure an isolated virtual network for Windows and Linux practice machines.

Create and restore virtual-machine snapshots to reset a practice environment safely.

Calculate and compare SHA-256 hashes to verify that evidence has not changed.

Record lab actions and observations in a timestamped investigation notebook using UTC.

Explain how data is encapsulated and transmitted through the TCP/IP model.

Determine the network and host portions of an IPv4 address using CIDR notation.

Distinguish MAC addresses, IP addresses, ports, protocols, and network sockets.

Explain how ARP, DHCP, and DNS support communication on a local network and the internet.

Compare TCP and UDP and interpret the stages of a TCP connection.

Interpret the security-relevant fields of HTTP requests and responses and explain what TLS encrypts.

Use ipconfig, ping, tracert, nslookup, and netstat to investigate connectivity.

Capture traffic and apply display filters in Wireshark to isolate a specified conversation.

Distinguish local users, groups, privileges, and security identifiers on Windows.

Interpret NTFS ownership, inheritance, and access-control permissions for a file or directory.

Explain the security relevance of Windows processes, services, drivers, and user sessions.

Locate and interpret security-relevant values in the Windows Registry.

Identify common Windows autostart locations used by legitimate software and persistence mechanisms.

Explain how Windows event channels, providers, event IDs, and audit policies relate to system activity.

Use Process Explorer to inspect a process tree, executable path, signer, user, and active connections.

Use Autoruns to distinguish expected startup entries from entries requiring investigation.

Use Get-Help, Get-Command, and Get-Member to discover PowerShell commands and object properties.

Use the PowerShell pipeline to select, filter, sort, group, and format objects.

Query files, processes, services, network connections, event logs, and Registry values with PowerShell.

Import and export structured investigation data in CSV and JSON formats.

Use regular expressions in PowerShell to extract IP addresses, domains, hashes, and other indicators.

Write a parameterized PowerShell script that validates input and handles errors.

Collect system facts remotely or locally without unnecessarily altering potential evidence.

Write a PowerShell triage script that timestamps results and hashes its output files.

Navigate the Linux filesystem and explain the purpose of security-relevant system directories.

Interpret Linux users, groups, ownership, permissions, and sudo privileges.

Use shell pipelines with grep, cut, sort, uniq, and related utilities to examine text evidence.

Inspect Linux processes, services, scheduled jobs, and active network connections.

Use journalctl and common log files to investigate authentication and service activity.

Use ip, ss, ping, traceroute, dig, and curl to investigate Linux network activity.

Use SSH securely to access a practice host and transfer a specified evidence file.

Identify common Linux persistence locations that warrant investigation.

Apply confidentiality, integrity, and availability to assess the security impact of a scenario.

Distinguish preventive, detective, corrective, and compensating security controls.

Distinguish authentication, authorization, accounting, and common multi-factor authentication methods.

Differentiate threats, vulnerabilities, exploits, likelihood, impact, and risk in an incident scenario.

Classify common malware by behavior, including ransomware, trojans, worms, spyware, and rootkits.

Distinguish indicators of compromise, indicators of attack, and adversary tactics, techniques, and procedures.

Map observed attacker behavior to the appropriate MITRE ATT&CK tactic and technique.

Explain how defense-in-depth can interrupt an attack at multiple stages.

Normalize timestamps, hostnames, usernames, IP addresses, and action fields across heterogeneous logs.

Identify which endpoint, identity, network, DNS, web, email, and application logs can answer a given investigation question.

Configure Sysmon in a practice Windows machine to record security-relevant process and network activity.

Interpret Windows logon, account-management, process-creation, and PowerShell events.

Interpret Linux authentication logs and common web-server access-log fields.

Use SIEM searches to filter, aggregate, and visualize security events over time.

Correlate events from multiple log sources by time, host, user, process, or network indicator.

Translate a simple behavioral detection requirement into a Sigma rule and test it against sample events.

Validate whether an alert represents expected activity, a benign anomaly, or suspicious behavior.

Prioritize an alert using confidence, asset criticality, exposure, and potential business impact.

Enrich an IP address, domain, URL, or file hash using reputable intelligence sources without exposing sensitive data.

Pivot from an initial indicator across endpoint, identity, and network records to determine preliminary scope.

Form an investigation hypothesis and identify evidence that would confirm or disprove it.

Acquire and label a specified digital artifact while preserving its integrity and chain-of-custody record.

Assign an incident category, severity, and escalation path using a defined response matrix.

Write a concise triage update that separates confirmed facts, assumptions, open questions, and next actions.

Use Wireshark filters to isolate suspicious DNS, TCP, HTTP, and TLS activity in a packet capture.

Reconstruct the sequence of events in a network conversation from packet timestamps and protocol fields.

Recognize network patterns consistent with scanning, password attacks, command-and-control beaconing, and data exfiltration.

Investigate suspicious DNS activity using query types, response codes, domain patterns, and resolution history.

Correlate firewall, proxy, DNS, and endpoint connection records for a specified host.

Distinguish inbound exploitation, lateral movement, and outbound command-and-control from network evidence.

Estimate the affected hosts and time window of a network intrusion using a small evidence set.

Document defensible network findings while distinguishing observations from conclusions.

Collect a defined set of volatile Windows triage data while minimizing changes to the host.

Analyze parent-child process relationships, command lines, signer information, and network connections for suspicious execution.

Investigate interactive, remote, service, and failed logons using Windows event records.

Examine services, scheduled tasks, Registry run keys, and startup folders for persistence.

Use Prefetch and selected execution artifacts to assess whether and when a program ran.

Analyze file creation, modification, download, and deletion evidence for a suspicious executable.

Build a concise endpoint timeline by combining event logs, filesystem metadata, and execution artifacts.

Determine the likely entry point, persistence method, actions taken, and affected user for a bounded endpoint scenario.

Analyze email headers and SPF, DKIM, and DMARC results for signs of spoofing or message tampering.

Extract and assess links, attachment metadata, sender details, and social-engineering cues from a suspicious email safely.

Investigate suspected account compromise using sign-in, multi-factor authentication, mailbox, and audit records.

Determine the likely blast radius of a compromised account by examining sessions, permissions, forwarding rules, and accessed resources.

Select containment actions for affected accounts, hosts, and network indicators while preserving required evidence.

Distinguish eradication from recovery and choose appropriate actions for a specified incident.

Define validation checks and heightened monitoring needed before and after returning a system or account to service.

Prepare an evidence-based handoff that states containment status, operational risk, and outstanding actions.

Construct an incident timeline from a small mixed set of endpoint, identity, email, and network evidence.

Classify and scope a simulated incident and justify its severity using documented evidence.

Write a concise incident report containing an executive summary, technical findings, timeline, impact, actions, and recommendations.

Deliver a structured verbal incident handoff that communicates urgency without overstating certainty.

Conduct a lessons-learned analysis that identifies a root cause, control gap, and measurable improvement.

Convert an investigation finding into a practical recommendation for logging, detection, prevention, or response.

Sanitize a simulated case report for a portfolio without exposing credentials, personal data, or sensitive indicators.

Answer an incident-response interview scenario using a structured triage, investigation, containment, and communication approach.