ScenarioObjective 1.1
Security control matching
Match safeguards with their primary functions.
Performance-based exercises
Apply your knowledge to realistic security decisions. Simulated practice, not actual exam replicas.
Domain 1: General Security Concepts · 5 scenarios
ScenarioObjective 1.4
Certificate troubleshooting
A browser reports a TLS name mismatch when visiting portal.company.example.
ScenarioObjective 1.2
Authentication factor design
A clinic wants stronger sign-in for remote staff without adding hardware for every user.
ScenarioObjective 1.3
Change management approval
An admin wants to patch the production database server during business hours today.
ScenarioObjective 1.4
Cryptography selection
A team must protect laptop disks, verify downloaded files, and sign software releases.
Domain 2: Threats, Vulnerabilities, and Mitigations · 5 scenarios
ScenarioObjective 2.2
Phishing analysis
From: helpdesk@company-support.example. “URGENT: Send your MFA code now or your account will close.”
ScenarioObjective 2.4
Malware indicator triage
A workstation shows encrypted files with a .locked extension and a ransom note.
ScenarioObjective 2.3
Application attack identification
Web logs show the login field receiving: ' OR 1=1 --
ScenarioObjective 2.3
Vulnerability scan interpretation
A scan flags an outdated TLS 1.0 service on an internal server and a missing patch with a public exploit on a web server.
ScenarioObjective 2.4
Wireless attack response
Users report a second Wi-Fi network with the company's SSID in the lobby.
Domain 3: Security Architecture · 5 scenarios
ScenarioObjective 3.2
Firewall rule configuration
An internet-facing web server (10.0.2.10) serves HTTPS only. Choose the narrowest permitted inbound service.
ScenarioObjective 3.2
Network segmentation
Place a public web server and confidential payroll database into appropriate trust zones.
ScenarioObjective 3.4
Backup & recovery planning
A service tolerates at most 15 minutes of lost data and must recover in two hours.
ScenarioObjective 3.1
Cloud responsibility matrix
The company moves a custom app to IaaS virtual machines.
ScenarioObjective 3.3
Data protection placement
Credit card numbers are stored in a database and sent to a payment processor.
Domain 4: Security Operations · 5 scenarios
ScenarioObjective 4.8
Incident response sequencing
A confirmed infected endpoint is sending confidential files to an attacker.
ScenarioObjective 4.9
Log investigation
02:58 auth failures: 38 accounts, same password. 03:00 auth success: finance-user, unfamiliar source.
ScenarioObjective 4.6
Access permission selection
A support analyst only needs to read application logs for the next seven days.
ScenarioObjective 4.3
Remediation prioritization
An actively exploited internet-facing payment server and an isolated lab both have high-severity findings.
ScenarioObjective 4.1
Endpoint hardening baseline
New laptops are being deployed to a field sales team.
Domain 5: Security Program Management and Oversight · 6 scenarios
ScenarioObjective 5.2
Risk treatment decisions
Leadership reviews three risks: flood damage, a legacy app with known flaws, and a low-impact kiosk issue.
ScenarioObjective 5.2
Quantitative risk calculation
A server worth $50,000 loses 40% of value per incident; incidents occur twice a year.
ScenarioObjective 5.3
Vendor agreement selection
You are onboarding a managed service provider that will host customer data.
ScenarioObjective 5.1
Policy document hierarchy
HR asks where to place rules about acceptable use, password length, and the steps to reset an account.
ScenarioObjective 5.6
Security awareness program
Phishing simulation click rates remain at 25% after annual training.
ScenarioObjective 5.5
Compliance and audit evidence
An external auditor requests proof that quarterly access reviews occur.