Knowledge checks

Scenario quizzes

Quick checks that validate your understanding and feed the same point and badge progression system as labs and hubs.

1. In a CTF web lab, a normal user can access /admin by changing a role value in a request. What vulnerability is most likely present?
2. A SIEM correlation rule fires on impossible travel. Which fields are most important to validate?
3. Which control best reduces the risk of password spraying against cloud accounts?
4. What does the tcpdump flag "-C 100" do when writing a packet capture to disk?
5. A server is running an unknown service on port 8443. Which Nmap command best identifies its version?
6. Which Nmap flag attempts OS detection?
7. Which item should be included in a secure lab disclaimer?
8. In SQLMap, what is the purpose of the "--level" flag?
9. A SOC analyst sees many failed VPN logins followed by one success from the same IP. What should be triaged first?
10. Which MITRE ATT&CK tactic best matches an attacker trying to keep access after reboot?
Log in to submit