Question 1

Section 1: Network Security and Cloud Essentials

Accepted Answer

OverviewEvery organization operates under the same reality: not every attack will be prevented, so detection depends on understanding how the network communicates. This section establishes defensible network architecture, then builds fluency in protocols and packet analysis, including writing custom tcpdump filters to isolate traffic of interest rather than relying on default captures. DNS architecture receives dedicated attention because DNS remains one of the most consistently abused protocols in modern intrusions, and understanding it is foundational to the DNS threat hunting introduced later in the course. NDR data sources and the practical issues analysts face in NDR/NSM programs round out the network-focused portion of this section, before extending into virtualization and cloud essentials, including software supply chain security, and closing with wireless network security, one of the most pervasive and least understood parts of most organizations' infrastructure.Topic DetailsAn Introduction to MIL401N Defensible Network Architecture Protocols and Packet Analysis Writing tcpdump Filters DNS Architecture Network Detection and Response (NDR) Data Sources Practical NDR/NSM Issues Virtualization and Cloud Essentials Software Supply Chain Security Securing Wireless NetworksLabs TcpdumpWriting tcpdump FiltersSecurity Onion Service-Side AnalysisWiresharkAWS VPC Flow Logs

Question 2

Section 2: Defense-in-Depth

Accepted Answer

OverviewThe section opens with information assurance: the foundational commitment to protecting the confidentiality, integrity, and availability of organizational systems. These properties are what adversaries specifically target, and understanding how large-scale threats attack each one makes the rest of this section actionable rather than theoretical. Identity and access management follows directly, since IAM is increasingly the security perimeter for cloud-based systems. Passwords remain the dominant authentication factor despite years of effort to move beyond them, and credential theft remains one of the most common entry points for attackers, so this module covers modern authentication methods, password security, and the role of IAM in a cloud-first environment. From there, the section turns to the frameworks that structure defensive decision-making: the CIS Controls, the NIST Cybersecurity Framework, and the MITRE ATT&CK knowledge base. Network defensibility then returns to focus through data loss prevention, examining how sensitive data moves and what controls reduce that risk in transit and at rest. Mobile devices close the section as a deliberate final statement about the scope of modern defense-in-depth. BYOD and MDM are examined as the practical intersection of individual convenience and organizational risk.Topics covered Defense-in-DepthIAM, Authentication and Password SecuritySecurity FrameworksData Loss PreventionMobile Device SecurityLabs Password AuditingData Loss PreventionMobile Device Backup Recovery

Question 3

Section 3: Vulnerability Management and Response

Accepted Answer

Overview Every compromise begins somewhere, and this section traces the full arc from vulnerability to response. It opens with vulnerability assessments and penetration testing, then examines modern attacks and malicious software with real-world examples of compromise. Web application security receives dedicated attention given the scale of risk web applications introduce. Security operations and log management address what happens after a foothold is gained: adversaries who gain access do not stop moving, and logging is the detection infrastructure that makes that movement visible. DNS threat hunting extends this detection focus directly into DNS traffic, where a meaningful share of command-and-control and exfiltration activity hides in plain sight. The section closes with digital forensics and incident response, the structured methodology for handling a compromise once it is found.Topics coveredVulnerability Assessments and Penetration TestingAttacks and Malicious SoftwareWeb Application SecuritySecurity Operations and Log ManagementDigital Forensics, Incident Response and DNS Threat HuntingLabs Network DiscoveryBinary File Analysis and CharacterizationWeb App ExploitationSIEM Log Analysis

Question 4

Section 4: Data Security Technologies

Accepted Answer

OverviewThere is no single technology that guarantees complete security, but cryptography addresses more security challenges than almost any other, when it is deployed correctly. This section opens with cryptographic concepts, algorithms, and deployment, then moves into applying cryptography to protect data in transit and at rest. The second half shifts to prevention and detection technologies at the network and endpoint level, including firewalls and intrusion prevention and detection systems. Network security monitoring tools such as Snort3 and Zeek are examined directly, including how they surface the presence of adversary emulation frameworks such as Cobalt Strike inside network traffic, a capability that sits at the center of the Network Analyst's detection role.Topics coveredCryptographyCryptography Algorithms and DeploymentApplying CryptographyNetwork Security Devices & Detecting Cobalt StrikeEndpoint SecurityLabsHashing and Cryptographic ValidationEncryption and DecryptionAnalyzing HTTPSIntrusion Detection and Network Security Monitoring with Snort3 and Zeek

Question 5

Section 5: Windows and Azure Security

Accepted Answer

OverviewThe Windows ecosystem has expanded well beyond simple desktop workgroups, now spanning on-premises Active Directory, Azure, PowerShell, Microsoft 365, Hyper-V, and more. This section builds a solid foundation in Windows security architecture, including Windows as a Service and the patch and update mechanisms that keep a modern Windows environment current. Access controls receive dedicated attention: NTFS and Active Directory permissions, privileges, and where implementation fails to match intent, along with BitLocker and hardware-based protections. Enforcing security configurations at scale follows, using Group Policy Objects and security templates to apply controls consistently across an environment. From there, the section shifts into Microsoft Azure, where many familiar on-premises concepts have direct cloud equivalents that behave, and fail, differently. Advanced authentication attacks are examined directly, connecting the access control discussion to the techniques adversaries use to defeat it. The section closes with scripting, automation, logging, and auditing, since manual administration does not scale to enterprise Windows environments, and PowerShell is the tool that closes that gap.Topics coveredWindows Security ArchitectureWindows as a ServiceWindows Access ControlsEnforcing Security ConfigurationMicrosoft Cloud ComputingAdvanced Authentication AttacksAutomation, Logging, and AuditingScripting and AutomationLabs Windows Process ExplorationWindows Filesystem PermissionsApplying Windows System Security PoliciesUsing PowerShell for Speed and Scale

Question 6

Section 6: Containers, Linux, and Mac Security

Accepted Answer

OverviewLinux systems are often fewer in number than Windows systems in a given environment, but they are frequently the most critical: database servers, web servers, and cloud infrastructure components disproportionately run on Linux. This section opens with Linux fundamentals and the command line, providing foundational grounding for those newer to the platform alongside practical guidance for administrators who manage it daily. Containers enter the discussion because Linux is where they were born. Built on the principle of minimization, containers offer deployment flexibility that has made them central to modern cloud computing, and this module examines what they represent for information security, what they do not, and how to manage them with appropriate security discipline. The section then extends into Linux security enhancements and infrastructure, including hardening, logging, and the utilities that extend what Linux provides by default. macOS closes the section with a review of its native security features and the genuine limitations that come with them, built on its UNIX foundation.Topics coveredLinux FundamentalsLinux Command LineContainerized SecurityLinux Security Enhancements and InfrastructuremacOS SecurityLabsLinux PermissionsLinux ContainersLinux Logging and Auditing

SEC536: Adversarial AI - Penetration Testing AI Systems

MIL401N: Security Essentials for Network Analysts

Course Features

GIAC Security Essentials (GSEC)

46 CPE

Essential Skill Level

23 Hands-On Lab(s)

MIL401N prepares Network Analysts through role-aligned, workflow-driven training mapped to DCWF/8140 requirements, covering packet analysis, DNS, NDR/NSM, and network defense.

A Purpose-Built Course for Network Analysts

What You’ll Learn

Business Takeaways

Author Statement

Meet Your Authors

Bryan Simon

Eric Conrad

Seth Misenar

Andrew Laman

Course Syllabus

Virtual (OnDemand) | Self-Paced, 4 Months Access | $8,780 USD

Things You Need To Know

Benefits of Learning with SANS