You know cybersecurity.
Can you work the problem?

Five scenarios. Five decisions. No tools required.

Work through situations involving suspicious network traffic, a vulnerability finding, account access, incident response, and recovery. See your score immediately, then get the answer explanations and a sample practice exercise by email.

Built for IT professionals developing their security skills and Security+ or CEH holders looking for their next practical training step.

Start the skills check

No email required to see your score. This informal check is not an RCCE exam, certification assessment, or predictor of exam success.

Make your next decision.

Choose the best next action using the facts provided. One answer per scenario. Take your time; this is not timed.

Comments

This field is for validation purposes and should be left unchanged.

Scenario 1: Is the outbound connection suspicious?(Required)

You are reviewing a workstation alert. Every 60 seconds, the workstation makes a small HTTPS connection to an unfamiliar external IP address. The destination is not on your approved-services list. No malware has been confirmed, and the workstation otherwise appears normal.

What is the best next investigative step?

A. Close the alert because HTTPS encrypts the traffic.

B. Correlate the connection with endpoint process information, DNS and proxy records, and expected business activity.

C. Reimage the workstation immediately and discard its local logs.

D. Block all outbound HTTPS across the organization.

Scenario 2: Which vulnerability comes first?(Required)

You can remediate only one finding immediately. Compensating controls and business impact have been considered. You have no evidence that any of these systems has already been compromised.

Which finding should take priority?

A. A CVSS 9.8 issue on a powered-off training server disconnected from all networks.

B. A CVSS 6.5 issue requiring local access on a restricted kiosk.

C. A CVSS 8.1 issue under active exploitation affecting your internet-facing VPN appliance, with no effective mitigating control in place.

D. A CVSS 4.3 information-disclosure issue on an isolated test application containing synthetic data.

Scenario 3: How do you contain an active incident?(Required)

An endpoint detection alert and user report confirm that a workstation is actively encrypting files. The workstation can access shared drives. Your incident-response procedure authorizes you to isolate affected endpoints, and network isolation will not interrupt a safety-critical process.

What should you do first?

A. Isolate the workstation from the network using your approved response method, preserving the powered-on state where feasible, and activate incident response.

B. Wait for the encryption to finish so you can determine its full scope.

C. Delete all security logs to free space for recovery.

D. Restore the shared drives immediately while leaving the workstation connected.

Scenario 4: MFA passed. Is the session trustworthy?(Required)

A user reports that they approved an MFA prompt they did not initiate. Identity logs show a new session followed by creation of an external mailbox-forwarding rule. Your procedure authorizes account containment. Existing investigation records can be preserved without delaying containment.

What is the best response?

A. Treat the session as legitimate because MFA succeeded.

B. Remove only the forwarding rule and close the case.

C. Ask the user to approve the next prompt to see whether it happens again.

D. Revoke sessions and tokens using available identity controls, restrict the affected account as appropriate, and investigate access and mailbox changes.

Scenario 5: Are you ready to restore?(Required)

After a server compromise, the team has contained the incident, identified the initial access path, closed that path, and rebuilt the affected server from a trusted image. A backup from before the earliest known compromise is available, but it has not been tested or inspected.

What should happen before the server returns to production?

A. Restore immediately because a successful backup job proves the data is clean.

B. Validate the backup and restoration in an isolated environment, check for compromise indicators, and confirm security controls and monitoring before an approved production return.

C. Disable monitoring to make the restoration faster.

D. Reuse the compromised server image because its applications were already configured.