What is it?

Every security control has a category — who/what implements it (Technical, Managerial, Operational, Physical) — and a type — what it does to a threat (Preventive, Deterrent, Detective, Corrective, Compensating, Directive). Exam questions often hinge on telling these apart.

Exercise: classify 12 controls

Choose a category and a type for each control, then check. Where two answers are defensible, both are accepted.

What is it?

Zero Trust means "never trust, always verify": every request is evaluated on identity, device and context. In the control plane, the Policy Engine decides and the Policy Administrator issues the instruction; together they form the Policy Decision Point (PDP). In the data plane, the Policy Enforcement Point (PEP) allows or blocks the session. Deception technology (honeypots, honeyfiles, honeytokens) plants decoys that no legitimate user should touch — any access is a high-fidelity alert.

Exercise: Zero Trust access decision

Exercise: honeytoken tripwire

You are an intruder on a fictional file share. Browse the items — the SOC console on the right shows what the defenders see.

What is it?

Hashing gives a fixed-length fingerprint for integrity; salting makes identical passwords hash differently; symmetric encryption (AES) uses one shared key; asymmetric cryptography (RSA/ECC) uses a key pair for key exchange and digital signatures; PKI binds public keys to identities with certificates signed by a chain of trust. Everything below runs locally — nothing leaves your browser.

1. Hashing & the avalanche effect

Hash of your input:

Hash after changing just the last character ():

2. Salting password hashes

Two fictional users chose the same password. Compare stored hashes with and without a per-user random salt.

Unsalted hashes match, so one rainbow-table lookup cracks both. Production systems also add key stretching (PBKDF2, bcrypt, scrypt, Argon2) to slow guessing.

3. AES-256-GCM encrypt / decrypt

Key derived from a passphrase with PBKDF2-SHA-256 (100,000 iterations, random salt). GCM is authenticated encryption — any tampering or wrong key is detected.

(not encrypted yet)

4. Toy RSA digital signature

Tiny textbook key (p=61, q=53, n=3233, e=17, d=2753) so you can follow the maths. Real keys are 2048+ bits with padding such as RSA-PSS.

Sign the message, then edit it and verify again.

5. Certificate chain validator

You are the browser. Inspect the chain presented by each fictional site and choose a verdict.

What is it?

SY0-701 names six threat actors — nation-state, unskilled attacker, hacktivist, insider threat, organized crime, shadow IT — that differ in being internal or external, in resources/funding and in sophistication. Their motivations include data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical/political beliefs, ethical, revenge, disruption/chaos and war. MITRE ATT&CK catalogues the tactics and techniques they use.

Exercise: profile the attacker

What is Phishing?

Phishing is a social-engineering attack where attackers impersonate trusted senders to trick victims into revealing credentials, clicking malicious links, or downloading harmful attachments.

Simulation: Is this email Safe or Phishing?

🔎 Annotated Walkthrough: Spot the Red Flags

Step through a fictional phishing email one clue at a time.

🔗 Suspicious URL Inspector

Paste any URL (real or made-up). The inspector explains what to check — it does not visit the URL.

What is Cross-Site Scripting?

XSS occurs when an application renders user input as HTML/JavaScript without proper escaping, allowing attackers to inject content that could steal sessions or deface pages.

Try It (Conceptual Demo)

Type any text. We'll show how it would render in an unsafe vs safe app.

What is SQL Injection?

SQL injection happens when user input is concatenated into a SQL query, letting attackers alter the query's logic. This demo uses mock data — no real database is queried.

Mock Login (Vulnerable Mode)

Hint: Try username admin with password ' OR '1'='1

SELECT * FROM users WHERE username='' AND password=''

Test Your Password

What is Malware?

Malware is any malicious software designed to harm, exploit, or otherwise compromise a system. Common types include trojans, spyware, adware, and worms.

What is a Computer Virus?

A virus is a type of malware that attaches itself to clean files and spreads through systems, often when users execute infected files.

What is Ransomware?

Ransomware encrypts files and demands payment to restore access. Attackers often exploit phishing or unpatched systems for entry.

What is Social Engineering?

Social engineering manipulates people into giving up confidential information. It targets the human element rather than technical vulnerabilities.

Decision Trainer: What would you do?

🎭 Tactic Reference

Quick definitions of the most common social-engineering techniques.

Top Weak Passwords vs Strong Alternatives

What is Data Leakage?

Data leakage is the unauthorized transmission of data from inside an organization to an external destination. It can be accidental (misconfigured cloud storage) or malicious (insider exfiltration).

Leakage Risk Estimator

Toggle practices and see your leak risk score.

What is it?

A firewall evaluates its access-control list top-down and applies the first rule that matches. If nothing matches, the implicit deny drops the packet. Segmentation places systems in zones (DMZ, internal, management) so that a compromise in one zone cannot reach everything else. A WAF adds Layer-7 inspection of HTTP content.

Segmentation zones (fictional network)

Security goals: the public may reach the web server on HTTPS only; only the web server and the jump host may reach the database (MySQL 3306); only the jump host may use SSH (22) anywhere internal; users may browse the Internet on HTTPS; DNS (UDP 53) to the internal resolver 10.0.20.53 is allowed from all internal zones; everything else is denied.

Exercise: fix the rule set

The starter rules contain mistakes. Edit, reorder, add or remove rules until every test packet gets the result the security goals require. Use any, an IP address or a CIDR such as 10.0.30.0/24.

Layer 7: WAF check

A network firewall sees ports and addresses; a WAF inspects the request itself. Pick a fictional request to see which signature-style rule (in the spirit of the OWASP Core Rule Set) would match.

What is it?

Data classification labels information by sensitivity (e.g. Public, Internal, Confidential, Restricted). Data Loss Prevention (DLP) inspects data in use, in motion and at rest for patterns such as national ID numbers or payment cards, then warns, blocks or encrypts. Masking hides part of a value; tokenisation replaces it with a random token whose real value lives only in a secure vault.

Exercise: scan a document

All samples are fictional. Card numbers are well-known test numbers; NRIC values are textbook examples.

What is it?

RAID spreads data across disks for performance and/or fault tolerance — but RAID is not a backup. Backups protect against deletion, corruption and ransomware. The Recovery Point Objective (RPO) is how much data you can afford to lose; the Recovery Time Objective (RTO) is how long you can afford to be down.

Exercise: RAID calculator

Click disks to fail or replace them and watch the array status.

Exercise: backup plan checker

Exercise: which backup sets do I need?

What is it?

The Common Vulnerability Scoring System rates a vulnerability's severity from 0.0 to 10.0. The base score combines exploitability (attack vector, complexity, privileges, user interaction) with impact on confidentiality, integrity and availability, adjusted for scope. This calculator implements the official v3.1 base-score formula.

Exercise: build a vector

Vulnerability management: prioritise the backlog

Severity alone is not priority. Exposure and known exploitation (e.g. a listing in CISA KEV) raise urgency.

What is it?

Investigations start with log data: authentication logs, web server logs, firewall and endpoint logs, aggregated in a SIEM. Analysts filter, correlate by IP, user and time, and reconstruct a timeline of what happened. All entries below are fictional, using documentation-only IP ranges.

Exercise: investigate

Questions

Incident timeline

1. Answer questions to build the timeline.

What is it?

Multifactor authentication combines different factor types: something you know, have, are, or somewhere you are. A TOTP authenticator app shares a secret with the server; both compute HMAC-SHA1(secret, floor(time / 30)), truncate it to 6 digits, and compare. No network connection is needed — just synchronised clocks.

Exercise: authenticator app

Provisioning URI (normally shown as a QR code):

Exercise: factor classifier

Assign each authenticator to its factor type.

Is it really MFA?

What is it?

The SY0-701 incident response process runs Preparation → Detection → Analysis → Containment → Eradication → Recovery → Lessons learned. During forensic acquisition, collect the most volatile evidence first (it disappears on power-off), hash every image, and keep a chain of custody.

Exercise: order the IR phases

Drag items, or use the arrow buttons (keyboard friendly).

Exercise: order of volatility (most → least volatile)

What is it?

Quantitative analysis puts a money value on risk: Single Loss Expectancy SLE = Asset Value × Exposure Factor and Annualised Loss Expectancy ALE = SLE × ARO (annualised rate of occurrence). Qualitative analysis rates likelihood and impact (here 1–5) on a heat map. Each risk is then accepted, avoided, transferred or mitigated and recorded in a risk register with an owner.

Exercise: SLE / ALE and control cost-benefit

Exercise: risk register & 5×5 heat map

What is it?

Penetration tests begin with reconnaissance within an agreed scope and rules of engagement. Passive recon (OSINT) gathers public information without touching the target; active recon interacts with it — for example, port scanning. Everything here is static, fictional data: nothing is sent anywhere.

How port-scan types differ

Exercise: review scan results for a fictional host

Target: files.acme-lab.test (192.0.2.50) — in scope per the signed rules of engagement. Select a row for analysis.

Exercise: passive or active?