Mission 05 / DEFENSE / RESPONSE
Defensive Cybersecurity
Read a synthetic alert, establish scope, and choose a defensive containment step for an authorized scenario.
Briefing
Review a synthetic incident
Defensive response starts with evidence, scope, and safe containment. This scenario is entirely invented and does not target a real network or system.
Establish what is known
A network flow pairs source and destination addresses, ports, protocol, and timing. An alert is a signal to investigate, not proof of compromise. Compare it with a known baseline and preserve timestamps, sources, and the analyst's actions.
Contain without destroying evidence
If a workstation is actively generating suspicious traffic, follow the organization's incident plan to isolate that affected host from the network while preserving power and evidence. Notify the response lead, record the action, and avoid broad blocking or retaliation.
Harden and learn
Least privilege, supported updates, multifactor authentication, and carefully reviewed firewall rules reduce exposure. Lab-only artifacts should be synthetic or explicitly authorized. These learning materials make no certification, accreditation, or government endorsement claim.
Practical exercise
Run the mission
In one short response, name the first containment action for the affected workstation. Use the synthetic incident scope.
Progressive hint
Keep the action narrow, authorized, and evidence-preserving.
Need another hint?
The response phrase to submit is `isolate the affected host`.
Synthetic incident / host lab-07
A monitored workstation generated a repeated outbound connection alert. The training record confirms the workstation is affected. Preserve evidence and follow the response plan.
Authorized defensive scenario · no live target or network traffic
Knowledge check