Forensic Artifact Analysis and Timeline Reconstruction

Extracting meaning from acquired forensic data. Covers file system forensics, memory forensics and volatile-data analysis, forensic artifact identification and interpretation, deleted-file and unallocated-space recovery, log-based forensic investigation, and timeline construction and event reconstruction. The analytical core of turning raw images into a defensible account of what happened.

86 questions

Security Fundamentals and Core Concepts

The foundational vocabulary and principles of information security: the CIA triad (confidentiality, integrity, availability) and related properties (authenticity, non-repudiation), defense in depth, least privilege, and the distinction between threats, vulnerabilities, and risk. Establishes the mental model every practitioner reasons from before diving into any specialized domain. Concept-level fundamentals, not tool usage or governance frameworks.

0 questions

Secure Software Delivery: DevSecOps, Pipeline, and Supply Chain Security

Embedding security into how software is built, assembled from dependencies, and shipped. Covers shift-left and secure-SDLC practices, infrastructure-as-code security, CI/CD pipeline and secrets management, integrating security scanning into build and deploy, and configuration and secret management across environments, together with software supply chain security: software composition analysis (SCA), dependency and open-source vulnerability management, build-provenance and artifact integrity, and mitigating supply-chain attack vectors. The 'secure the delivery pipeline and everything it pulls in' discipline, distinct from vendor-risk governance.

0 questions

Security Automation, Tooling, and Operations at Scale

Engineering and operating security capabilities at scale. Covers security automation and scripting (e.g. Python for security), building and engineering internal security tools, security-stack integration and tool consolidation, security tool evaluation and selection, security metrics and observability, and running enterprise security operations reliably at scale. The 'make security repeatable, measurable, and operable' engineering layer.

0 questions

Network Security and Defense

Securing networks at the infrastructure layer. Covers firewalls, ACLs and rule design, network device hardening and secure configuration, intrusion detection and prevention systems, VPN and remote-access encryption, network protocols and their security properties, and packet-level traffic analysis. The hands-on network-defense layer, distinct from zero-trust architecture strategy.

0 questions

Reverse Engineering and Malware Analysis

Analyzing malicious code and unknown binaries. Covers static and dynamic malware analysis, behavioral analysis and indicator extraction, reverse engineering of binaries and firmware, and code obfuscation and deobfuscation. The deep-technical capability to understand what a piece of hostile or unknown code actually does.

22 questions

Exploitation, Post-Exploitation, and Red Team Operations

The hands-on offensive tradecraft of compromising, pivoting through, and persisting in systems while evading defenses. Covers exploit development, privilege escalation, Active Directory and Windows exploitation, lateral movement, persistence, command-and-control, and attack chaining, extending into adversary-emulation campaigns: red-team engagement planning and objectives, multi-stage attack planning, operational security for offensive operators, and detection and defense evasion including web application firewall detection and bypass. The advanced offensive-operations layer executed against real targets, where staying undetected is itself an objective, distinct from the methodical scoped-assessment workflow of a penetration test.

8 questions

Digital Evidence Law, Admissibility, and Expert Testimony

The legal framework surrounding digital evidence. Covers evidence admissibility standards and legal requirements, jurisdictional and regulatory requirements for digital evidence, the legal and ethical considerations of forensic work, and presenting findings as an expert witness including testimony and cross-examination. The law-and-courtroom slice of forensics absorbed from the retired legal-compliance-hr category, scoped to the Digital Forensic Examiner role.

60 questions

Incident Response and Containment

Managing security incidents from detection through recovery. Covers incident response process and playbooks, containment and remediation, data-breach investigation methodology, data-exfiltration detection and analysis, root-cause and post-incident analysis, and fraud and complex-attack investigation. The operational 'a compromise is happening, now what' discipline, distinct from broader production-outage incident management.

39 questions

Social Engineering and Human-Factor Attacks

The human dimension of offense and defense. Covers social engineering techniques and pretexting, phishing campaigns and their detection and response, human factors in security, and building organizational resistance to manipulation-based attacks. Focuses on attacks that target people rather than systems, and the operational response to them.

0 questions

Data Protection and Encryption in Practice

Protecting data at rest and in transit across real systems from an engineering rather than pure-cryptography standpoint. Covers encryption strategy and key management for stored and transmitted data, secrets and sensitive-data handling, tokenization and secure elements for payment and sensitive data, and secure data handling in application code. Applied data-protection controls, distinct from cryptographic primitive design and from privacy-regulation compliance.

1 questions

Evidence Acquisition, Handling, and Chain of Custody

Soundly collecting, preserving, and maintaining the provenance of digital evidence throughout its lifecycle. Covers forensic imaging and disk-acquisition techniques, write-blocking, device-specific collection procedures, evidence-acquisition planning and strategy, forensic tools and equipment, and recovering data from damaged or corrupted media, together with chain-of-custody procedures and documentation, evidence preservation and handling, evidence and discovery management, and the audit trail that proves evidence was not altered from seizure to presentation. The technical and procedural discipline that produces a defensible, unaltered copy of the source and keeps it usable, distinct from downstream analysis and from courtroom admissibility law.

114 questions

Network, Mobile, and Cloud Forensics

Forensics across specialized evidence sources. Covers network forensics and traffic-log analysis, mobile device forensics, cloud and virtual-environment investigation, cloud storage and synchronization forensics, and Internet-of-Things device forensics. The specialization layer for evidence that does not live on a single seized disk.

96 questions

Anti-Forensics and Evasion Techniques

Anti-forensic techniques and countermeasures: wiping and secure deletion, timestomping and other timestamp manipulation, log tampering, obfuscation, encryption used as an obstacle to examination, and detecting or defeating evidence tampering and other counter-forensic technique. Distinct from routine acquisition, artifact analysis, and timeline work covered elsewhere -- the subject here is an adversary actively working against the examiner.

37 questions

Digital Forensics Methodology, Investigation, and Reporting

The end-to-end methodology of a digital forensic investigation. Covers forensic investigation frameworks, structuring and scoping an investigation, forensic reasoning and hypothesis testing, evidence-driven critical thinking, handling incomplete or ambiguous evidence, and forensic documentation and reporting of findings. The investigative backbone that governs how a Digital Forensic Examiner works a case.

10 questions

Security Monitoring, SIEM, and Detection Engineering

Building and operating the detection stack: the SOC and detection-engineering practice that answers 'can we see an attack happening.' Covers SIEM platform selection and architecture, use-case and detection-rule query development (for example Splunk SPL, KQL, or Sigma), alert triage and tuning to reduce false positives, detection engineering and closing coverage gaps, mapping detections to the MITRE ATT&CK framework and scoring detection coverage, log analysis and anomaly and baseline development, network and endpoint telemetry sourcing, malware and compromise-indicator recognition, and security operations center (SOC) alert escalation workflows. Distinct from the reactive work of containing, remediating, and communicating during a confirmed incident (incident response and postmortem topics own that ground; this topic stops at 'the alert fired and here is the detection logic', not 'here is how we contained and recovered from it'). Distinct from generic system-reliability monitoring and observability (SLOs, error budgets, uptime dashboards), a separate discipline even when the underlying ingestion mechanics look similar; the anomaly or signal here must be framed as adversarial or security-relevant. Distinct from hardening a software delivery pipeline against supply-chain compromise (SBOM generation, artifact signing, dependency and build-permission controls); this topic only touches the delivery pipeline from the detection side, spotting a compromised build or tainted artifact via telemetry, not the preventive-controls side. Distinct from designing security control architecture and governance (security architecture and cloud security architecture topics own the design-time question of what controls should exist); this topic is the run-time operation of the detection stack once those controls are in place.

0 questions

IoT, Embedded, and Mobile Device Security

Securing constrained, physical, and mobile devices. Covers embedded and IoT systems security, hardware security and secure-enclave integration, firmware security, and mobile device and platform security fundamentals. The security concerns specific to devices operating outside conventional server and endpoint environments.

0 questions

Threat Hunting and Threat Intelligence

Proactively pursuing adversaries and operationalizing knowledge of them. Covers threat hunting and hypothesis-driven investigation, threat intelligence collection and integration, indicators of compromise, the MITRE ATT&CK framework, advanced persistent threats, and situating activity within the current threat landscape. The 'go find what the alerts missed, informed by adversary knowledge' discipline.

1 questions

Security Engineering & Operations Topics

Forensic Artifact Analysis and Timeline Reconstruction

Security Fundamentals and Core Concepts

Secure Software Delivery: DevSecOps, Pipeline, and Supply Chain Security

Security Automation, Tooling, and Operations at Scale

Network Security and Defense

Reverse Engineering and Malware Analysis

Exploitation, Post-Exploitation, and Red Team Operations

Digital Evidence Law, Admissibility, and Expert Testimony

Incident Response and Containment

Social Engineering and Human-Factor Attacks

Data Protection and Encryption in Practice

Evidence Acquisition, Handling, and Chain of Custody

Network, Mobile, and Cloud Forensics

Anti-Forensics and Evasion Techniques

Digital Forensics Methodology, Investigation, and Reporting

Security Monitoring, SIEM, and Detection Engineering

IoT, Embedded, and Mobile Device Security

Threat Hunting and Threat Intelligence