SEC501: Applied Cyber Defense

A persistent anomaly begins with records of network availability, privileged access, and DNS activity that do not establish a common cause. Compare what network devices generate with what receiving systems retain, then test how device time, administrative access, network trust, and decoy activity affect a later investigation.

Trace an alert to the packet, protocol record, flow data, or host event that produced it. Reconstruct suspicious activity, test detection logic against captured traffic, and determine whether the combined records justify escalation or a change in incident scope.

Find the systems and services that respond now, compare them with the inventory, and validate which exposures can extend access. Test how credentials and command-and-control channels cross expected boundaries, then verify a controlled configuration change against each managed system.

Incident response begins before every record is available and often before scope is established. Recover host artifacts, test the claims in a handoff, reconstruct ransomware activity, and decide which systems or accounts require collection, containment, or recovery.

Connect a suspicious file with the incident around it. Use file properties, host changes, network requests, and program logic to refine detection and scope, identify failed controls, and make containment and recovery decisions that the available records support across the enterprise.

The final Applied Cyber Defense capstone draws on all five technical sections through independent challenges. Working individually or with a team, you must recover exact answers from the available artifacts and decide which challenge warrants the next block of time.