Cybersecurity

Distinguish encoding, hashing, encryption, and digital signing by their security purpose.

Select symmetric or asymmetric cryptography for a given use case.

Verify file integrity and message authenticity using hashes and keyed hashes.

Explain how key exchange and digital signatures establish a trusted encrypted channel.

Inspect a certificate and validate its chain of trust with command-line tools.

Trace a TLS connection and identify what TLS does and does not protect.

Identify insecure secret-handling practices and recommend appropriate storage and rotation controls.

Distinguish identification, authentication, authorization, and accounting in an access flow.

Apply least privilege using Linux ownership, permissions, groups, and sudo rules.

Choose between role-based and attribute-based access control for a stated requirement.

Evaluate a password and multifactor-authentication design against common account attacks.

Trace a federated web login to distinguish the roles of OAuth 2.0, OpenID Connect, and the identity provider.

Assess web cookies and session controls for fixation, theft, and expiration risks.

Identify excessive privileges and plausible escalation paths in a sample access configuration.

Identify security-relevant protocol behavior in a packet capture.

Reconstruct a TCP or application-layer exchange using tcpdump or Wireshark.

Configure a Linux host firewall to allow only explicitly required traffic.

Design network segmentation and a DMZ for a small internet-facing service.

Distinguish the defensive roles of firewalls, proxies, WAFs, IDSs, and IPSs.

Analyze how an ARP- or DNS-spoofing scenario can redirect traffic and select controls that protect resolution integrity.

Choose appropriate secure-wireless, VPN, or zero-trust access controls for a stated access scenario.

Profile a threat actor by motivation, capability, opportunity, and likely targets.

Apply STRIDE to identify threats at the trust boundaries of a simple service architecture.

Map observed attacker behavior to relevant MITRE ATT&CK tactics and techniques.

Run an authorized Nmap scan and interpret exposed services and scan limitations.

Use CVE, CWE, and CVSS information to interpret a reported vulnerability.

Run a vulnerability scanner against the isolated lab and validate one finding manually.

Triage automated security-scan results by filtering likely false positives and prioritizing actionable findings.

Trace untrusted input through a web request and identify where validation or encoding is required.

Demonstrate SQL injection in an intentionally vulnerable lab application.

Prevent SQL injection by applying parameterized queries and suitable input constraints.

Exploit and remediate a cross-site scripting flaw in an intentionally vulnerable lab using contextual output encoding.

Test an API for object-level and function-level authorization failures.

Assess API authentication and rate-limiting mechanisms against credential and automated abuse.

Run static application security testing and software composition analysis tools against a backend codebase.

Harden Linux user accounts and SSH remote-access settings according to a defined security baseline.

Restrict Linux system services and filesystem permissions to minimize host attack surface.

Verify patch status and prioritize endpoint updates by exposure and severity.

Establish a baseline of expected processes, services, ports, and scheduled tasks.

Identify suspicious persistence, execution, and command-and-control indicators in host evidence.

Investigate a suspicious process and network connection in a safe lab scenario.

Distinguish antivirus, EDR, application allowlisting, and host intrusion-prevention capabilities.

Select appropriate log sources for an authentication, network, or application threat.

Explain how collection, normalization, enrichment, correlation, and retention support monitoring.

Query centralized logs to isolate a suspicious sequence of events.

Write a simple detection rule for a defined attacker behavior.

Triage an alert by validating evidence, scope, confidence, and likely impact.

Analyze email headers, links, and content for phishing indicators.

Write an escalation note containing evidence, severity, affected assets, and recommended action.

Place incident-response activities into preparation, detection, containment, eradication, recovery, and lessons learned.

Preserve a digital artifact using cryptographic hashes and a chain-of-custody record.

Collect and document volatile Linux evidence, including running processes, active connections, and logged-in users.

Gather nonvolatile evidence including system logs, scheduled tasks, and modified configuration files from a Linux host.

Construct a timeline by correlating timestamps from multiple evidence sources.

Choose containment and recovery actions that balance security with service availability.

Produce a concise root-cause and lessons-learned report from a simulated incident.

Assign security responsibilities between a cloud provider and customer for a stated service model.

Apply least privilege to a sample cloud identity and resource policy.

Identify unintended public exposure in cloud storage and network configurations.

Review infrastructure as code for a defined set of security misconfigurations.

Scan a container image and triage vulnerable packages and embedded secrets.

Harden a container using a non-root user, reduced capabilities, and externalized secrets.

Select controls that protect source code, dependencies, build artifacts, and deployment credentials in CI/CD.

Record a security risk with its owner, likelihood, impact, treatment, and review date.

Map a small set of safeguards to the functions of the NIST Cybersecurity Framework.

Distinguish policies, standards, procedures, guidelines, and evidence of compliance.

Assign handling and retention controls to different data classifications.

Evaluate a third-party service using a concise security questionnaire and evidence checklist.

Derive recovery time and recovery point objectives from a business-impact scenario.

Configure a protected backup and verify recovery of a selected file.

Document the architecture, data flows, and trust boundaries of the capstone backend service.

Apply a threat-modeling framework to identify and prioritize threats and mitigations for the capstone backend service.

Implement and document two high-priority security controls selected from the capstone threat model.

Execute authorized validation tests and capture reproducible evidence of the results.

Write a detection rule for a simulated security event and triage the resulting alert using capstone logs.

Draft a concise assessment report that separates evidence, risk, remediation, and residual risk.

Produce a transition matrix that maps capstone evidence and remaining gaps to a target cybersecurity role and Security+ exam domains.