INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(657, 362, '## Log Parsing & Normalization: The Regex Dojo\n\nYou cannot be a Senior Analyst without knowing Regex (Regular Expressions). When standard parsers fail, you must write your own.\n\n### The Problem: Unstructured Data\nA developer writes a custom app that logs errors like this:\n`[ERROR] User:bob | IP:10.0.0.1 | Msg:Login Failed`\n\nYour SIEM doesn\'t know what \"User:bob\" means. You need to extract \"bob\" into the `user` field.\n\n### Regex Basics\n*   `d`: Any digit (0-9).\n*   `w`: Any word character (a-z, 0-9, _).\n*   `s`: Whitespace.\n*   `+`: One or more.\n*   `*`: Zero or more.\n*   `?`: Optional.\n*   `( )`: Capture group (The part you want to extract).\n\n### Example Extraction\nLog: `[ERROR] User:bob | IP:10.0.0.1`\n\n**Bad Regex**: `User:.* |`\n*   Why? `.*` is greedy. It matches everything until the end. Precise matching is efficient.\n\n**Good Regex**: `User:(w+)s|sIP:(d{1,3}.d{1,3}.d{1,3}.d{1,3})`\n*   Group 1 (`w+`) matches \"bob\".\n*   Group 2 matches the IP.\n\n### Splunk Field Extraction (props.conf / transforms.conf)\nIn Splunk, you define these in config files.\n*   `[my_custom_app]`\n*   `EXTRACT-user = User:(w+)`\n\n### Field Aliasing (CIM Compliance)\n*   Your app logs it as `client_ip`.\n*   Splunk CIM expects `src`.\n*   **Alias**: `FIELDALIAS-c_ip = client_ip AS src`\n*   Now, a search for `src=10.0.0.1` will find your logs automatically.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 16:13:12'),
(658, 363, '## Advanced Correlation: Risk-Based Alerting (RBA)\n\nTraditional correlation (\"3 failed logins = Alert\") generates too much noise. **RBA** is the modern approach managed by Advanced SOCs.\n\n### The Concept\nInstead of triggering an alert *immediately*, we assign **Risk Points** to an entity (User or System).\n\n*   **Rule 1**: User triggered \"Possible Phishing Link\". (Confidence: Low).\n    *   Current Logic: Alert Analyst -> False Positive 90%.\n    *   RBA Logic: Add **+10 Risk Points** to User. (No Alert).\n*   **Rule 2**: User triggered \"Unusual PowerShell\". (Confidence: Medium).\n    *   RBA Logic: Add **+30 Risk Points** to User.\n*   **Rule 3**: User triggered \"Data Upload to Personal Cloud\". (Confidence: Low).\n    *   RBA Logic: Add **+20 Risk Points** to User.\n\n### The Threshold Alert\n*   **Total Risk Score**: 10 + 30 + 20 = **60**.\n*   **Threshold Rule**: \"Alert when Risk Score > 50\".\n*   **Result**: The analyst gets ONE high-fidelity alert (\"User with Risk 60\") that tells the whole story, instead of 3 low-fidelity alerts.\n\n### Implementing Kill Chains\nAdvanced correlation tracks the sequence.\n`transaction` command in Splunk loops events together by ID.\n*   If `Event A` (Firewall Permit) AND `Event B` (IDS SQL Injection) occur within 10 seconds...\n*   Combine them into a generic \"Exploit Attempt\" meta-event.\n\n### Statistical Anomaly Detection (Standard Deviation)\n*   Calculate the average daily outbound traffic for `Payroll_Server` over 30 days (`avg=50MB`, `stdev=10MB`).\n*   **Rule**: Alert if Today > `avg + (3 * stdev)`.\n*   (If today represents 80MB, that\'s 3 sigmas away—statistically extremely rare).\n*   *Advantage*: You don\'t need to know the *exact* number; the math finds the outlier for you.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 16:13:12'),
(659, 364, '## Query Optimization: Speed is Survival\n\nIn a crisis, waiting 15 minutes for a search to complete is unacceptable. You must write efficient queries.\n\n### 1. The \"Left-to-Right\" Rule (Pipeline Processing)\nMost SIEMs process data in a pipeline. You want to filter the massive dataset **as early as possible** (on the left side).\n\n*   **Bad Splunk Query**:\n    `index=main | regex \"password\" | where status=200`\n    *   Why? The index contains 1 Billion events. It pulls ALL of them, runs a heavy Regex on ALL of them, and *then* checks status.\n*   **Good Splunk Query**:\n    `index=main status=200 \"password\"`\n    *   Why? It effectively uses the \"index\" to only retrieve events that already have `status=200` and the string \"password\". It might retrieve only 100 events.\n\n### 2. Avoid \"Leading Wildcards\"\n*   `index=main user=*bob`\n*   Why is this bad? The database is indexed alphabetically.\n    *   `abc`\n    *   `bob`\n    *   `zack`\n    *   If you search `bob*`, it jumps to \"B\" instantly.\n    *   If you search `*bob`, it must scan `abc`, `bob`, `zack`... literally every single word in the dictionary to see if it ends in \"bob\". It destroys CPU.\n\n### 3. Specify Time Ranges\n*   Never search \"All Time\".\n*   Always narrow down to \"Last 60 minutes\" or \"Specific Date Window\".\n\n### 4. Fast Mode vs. Verbose Mode\n*   **Fast Mode**: Returns only field summary/statistics. (Super fast).\n*   **Verbose Mode**: Returns every raw event text. (Slow).\n*   If you just need a count (`stats count`), use Fast Mode.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 16:13:12'),
(660, 365, '## Building Detection-as-Code (DaC)\n\nThe old way: Click \"Create Rule\" in the GUI. Type stuff. Save.\nThe new way: Rules are logic. Logic is Code.\n\n### Why Code?\n1.  **Version Control (Git)**:\n    *   \"Who changed the Ransomware rule yesterday?\" -> Check Git Commit History.\n    *   \"The new rule broke the SIEM.\" -> `git revert`.\n2.  **Testing (CI/CD)**:\n    *   Before deploying a rule to Production, run it in a pipeline against a test dataset.\n    *   \"Does this rule trigger on this sample `malware.evtx`?\" (Unit Test).\n\n### Sigma: The Standard Format\n**Sigma** is a generic signature format for SIEMs (like Snort is for IDS). It is written in YAML.\n\n```yaml\ntitle: Suspicious PowerShell Download\nstatus: experimental\nlogsource:\n    product: windows\n    service: powershell\ndetection:\n    selection:\n        EventID: 4104\n        ScriptBlockText|contains:\n            - \'Net.WebClient\'\n            - \'DownloadString\'\n    condition: selection\nlevel: high\n```\n\n### The Workflow\n1.  Analyst writes triggers in Sigma (YAML).\n2.  Commits to GitHub.\n3.  **Sigmac** (Compiler) converts the YAML into:\n    *   Splunk SPL (`index=windows EventID=4104 ...`)\n    *   Elastic Query (Lucene)\n    *   Azure Sentinel (KQL)\n4.  Automation pushes the query to the SIEM API.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 16:13:12'),
(661, 366, '## Module 36 Review\nAdvanced SIEM is Engineering.\n*   **Architecture**: How data flows.\n*   **RBA**: Reducing noise by scoring.\n*   **Optimization**: Writing fast queries.\n*   **DaC**: Managing rules via Git.\n\nNext: Digging into RAM with Memory Forensics.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 14:22:44'),
(662, 371, '## Why Memory Forensics?\n\nDisk Forensics is great, but it has limits.\n*   **Encryption**: If the disk is BitLocker encrypted and the computer is off, the data is gone.\n*   **Fileless Malware**: Some malware lives *only* in RAM. It never touches the hard drive. If you pull the plug, the evidence vanishes.\n*   **Rootkits**: Kernel-level rootkits can lie to the OS, but they cannot hide from memory analysis (mostly).\n\n### What lives in RAM?\nEverything the computer is thinking about *right now*.\n1.  **Running Processes** (and their injected DLLs).\n2.  **Network Connections** (Active sockets).\n3.  **Command History** (cmd.exe / powershell.exe buffers).\n4.  **Passwords/Keys**:\n    *   BitLocker keys.\n    *   Mimikatz output.\n    *   User passwords (sometimes in cleartext if poorly coded apps are running).\n5.  **Clipboard Contents**: What did the user just Copy/Paste?\n\n### The Principle of Exchange\nRAM is extremely volatile. Every second the computer is on, thousands of pages of memory are being overwritten. Speed is essential.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(663, 372, '## Memory Acquisition Techniques\n\nTaking a \"picture\" of RAM is trickier than disk.\n\n### 1. Hardware-Based Acquisition (DMA)\n*   **FireWire / Thunderbolt**: These ports have Direct Memory Access (DMA).\n*   **Method**: Plug in a specialized device. It can read RAM directly without the CPU even knowing.\n*   **Pros**: Undetectable by malware.\n*   **Cons**: Requires physical ports; modern OS protections (DMA Mapping) often block this.\n\n### 2. Software-Based Acquisition (Kernel Driver)\n*   **Method**: Run a tool (Administrator privileges required) that loads a Kernel Driver to read physical memory.\n*   **Tools**:\n    *   **WinPMEM**: Part of the Rekall framework.\n    *   **DumpIt**: Simple, one-click dumper.\n    *   **FTK Imager**: GUI-based.\n*   **Risk**: Loading a driver *changes* the memory you are trying to measure (Heisenberg Uncertainty Principle). It might trigger a Blue Screen of Death (BSOD) if the system is unstable.\n\n### 3. Virtual Machine Snapshots\n*   If the target is a VM (VMware/Hyper-V), you are lucky.\n*   **Method**: Just take a Snapshot \"with memory\".\n*   **File**: `.vmem` file. This is a perfect, uncorrupted copy of the RAM. No tools needed on the guest.\n\n### The Hyberfil.sys file\n*   When a laptop hibernates (sleeps), Windows writes the entire contents of RAM to `C:hiberfil.sys`.\n*   **Forensic Gold**: You can convert this file into a raw memory image and analyze it, even if the computer is currently off.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(664, 373, '## Volatility Framework Deep Dive\n\n**Volatility** is the industry-standard (Command Line) tool for analyzing memory dumps. It supports Windows, Linux, and Mac.\n\n### The Profile (Volatility 2 vs 3)\n*   **Volatility 2**: Required you to specify the \"Profile\" manually (e.g., `Win10x64_1909`). If you got it wrong, it output garbage.\n*   **Volatility 3**: Modern version. It detects the OS automatically using Symbol Tables.\n\n### Essential Commands (Plugins)\nAssuming you have a distinct memory image `mem.dmp`:\n\n1.  **pslist / psscan**: List processes.\n    *   `pslist`: Walks the \"Active Process Head\" (What Windows *admits* is running).\n    *   `psscan`: Scans raw memory bytes for EPROCESS structures. (Finds \"Hidden\" processes that unlinked themselves from the list).\n    *   *Comparison*: If a PID shows up in `psscan` but NOT `pslist`, it is a **Rootkit**.\n2.  **netscan**: List network connections.\n    *   Shows Protocol, Local IP, Remote IP, State (ESTABLISHED), and PID.\n    *   \"Why is `notepad.exe` connected to Russia on Port 4444?\"\n3.  **malfind**: Detects code injection.\n    *   It looks for memory pages that are:\n        *   Executable (RWX permissions).\n        *   Start with `MZ` header (Executable file) OR generic Shellcode patterns.\n    *   Output: Hex dump of the injection.\n4.  **dlllist**: List loaded DLLs for a process.\n    *   \"Why does `svchost.exe` have `cryptominer.dll` loaded?\"\n5.  **cmdline**: Shows the command line arguments.\n    *   `powershell.exe -w hidden -enc JABz...` (Base64 encoded evil script).\n\n### Workflow\n1.  Identify rogue networking (`netscan`). -> Found PID 1234.\n2.  Investigate process (`pslist`). -> PID 1234 is `svchost.exe`.\n3.  Check parent (`pstree`). -> Parent is `explorer.exe`. (BAD. `svchost` should come from `services.exe`).\n4.  Check injection (`malfind -p 1234`). -> Found RWX memory segment.\n5.  Dump the malware (`procdump -p 1234`). -> Save to disk for Reverse Engineering.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(665, 374, '## Process Analysis & Injection Detection\n\nMalware rarely runs as `virus.exe`. It hides inside legitimate processes. This is **Process Injection**.\n\n### 1. DLL Injection\n*   **Concept**: Force a legitimate process (e.g., Chrome) to load a malicious DLL.\n*   **Mechanism**:\n    1.  Malware runs.\n    2.  Allocates memory in Chrome (VirtualAllocEx).\n    3.  Writes path to evil DLL (WriteProcessMemory).\n    4.  CreateRemoteThread starting at LoadLibrary(\"evil.dll\").\n*   **Result**: The malware code runs *inside* Chrome\'s memory space. Firewalls allow Chrome.\n\n### 2. Process Hollowing (RunPE)\n*   **Concept**: A zombie suit.\n*   **Mechanism**:\n    1.  Start a legitimate process (e.g., `svchost.exe`) in \"Suspended Mode\".\n    2.  Unmap (Hollow out) the legitimate code from memory.\n    3.  Write the malware code into that empty space.\n    4.  Resume the thread.\n*   **Result**: Task Manager says \"svchost.exe\". The Hash on disk is clean (Microsoft signed). But the memory is pure malware.\n*   **Detection**: **Volatility `malfind`** spots this mismatch between the file on disk (VAD) and the content in RAM.\n\n### 3. Reflective DLL Injection\n*   Loading a DLL directly from memory without it ever touching the disk.\n*   Extremely hard to detect with traditional AV.\n*   Used heavily by tools like **Cobalt Strike** and **Metasploit** (Meterpreter).\n\n### 4. Atom Bombing / Propagate\n*   Using obscure Windows API mechanisms (Atom Tables, GUI Event Hooks) to trigger code execution in other processes without using the noisy \"CreateRemoteThread\" call.\n\n### The Analyst\'s Eye\nIn Memory Forensics, you look for **Inconsistencies**.\n*   The PEB (Process Environment Block) says the path is `C:WindowsSystem32svchost.exe`.\n*   The VAD (Virtual Address Descriptor) says the memory map is Private Commit (not maximizing a file).\n*   This discrepancy confirms Hollowing.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(666, 375, '## Hunting Rootkits & Hidden Processes\n\n**Rootkits** are the ninjas of malware. They modify the Kernel (Ring 0) to intercept the reality presented to the OS.\n\n### Direct Kernel Object Manipulation (DKOM)\n*   Windows keeps a list of processes in a Doubly Linked List (ActiveProcessLinks).\n*   Task Manager iterates this list to show you what runs.\n*   **The Attack**: A Rootkit simply \"unlinks\" its process node from the list.\n    *   Previous -> Next.\n    *   It literally disconnects itself.\n    *   The OS still schedules CPU time for it (because the Scheduler uses a different list), so it runs. But tools (TaskMgr, Sysinternals) that rely on the API list cannot see it.\n\n### Hunting with Cross-View Analysis\nThe technique of comparing different \"views\" of the system to find lies.\n*   **View 1**: The API List (`pslist`). (Modified by Rootkit).\n*   **View 2**: The Scheduler / Thread List (`thrdscan`). (Harder to modify without crashing).\n*   **View 3**: CSRSS Handles (`handles`).\n*   **Method**: `psscan` (Volatility) scans the raw physical RAM for structures that *look* like processes (EPROCESS blocks).\n    *   If `psscan` finds it, but `pslist` misses it -> **Rootkit Confirmed**.\n\n### Hooks (SSDT Hooking)\n*   **SSDT (System Service Descriptor Table)**: The map of System Calls.\n*   **Attack**: Malicious driver overwrites the address of `NtQuanryDirectoryFile`.\n    *   Original: Points to `ntoskrnl.exe`.\n    *   Hooked: Points to `evil_rootkit.sys`.\n*   When you ask for a file list, the Rootkit code runs first, filters the results, and then passes the request to the real Kernel.\n*   **Detection**: **`ssdt`** plugin in Volatility checks if any function pointer points outside the valid Kernel memory range.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(667, 376, '## Module 37 Review\nMemory Forensics is the ultimate truth.\n*   **Volatility**: The tool.\n*   **Injection**: Looking for RWX pages (`malfind`).\n*   **Rootkits**: Using Cross-View analysis (`pslist` vs `psscan`) to find hidden threats.\n\nNext: Reverse Engineering (Understanding the code itself).', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 14:22:44'),
(668, 381, '## RE Fundamentals: The Art of Dissection\n\n**Reverse Engineering (RE)** is taking apart a system to understand how it works. In malware analysis, it means turning a compiled binary (`.exe`) back into readable logic (Assembly/C).\n\n### Compiled vs. Interpreted\n*   **Interpreted (Python/JS)**: You receive the source code. Analysis is just \"reading\".\n*   **Compiled (C/C++/Go)**: The source code is translated into **Machine Code** (0s and 1s) by a compiler. You cannot see variable names or comments.\n\n### The Tools of the Trade\n1.  **Disassembler**: Translates Machine Code (Hex) into **Assembly Language** (ASM).\n    *   *Tool*: IDA Pro, Ghidra (Free, by NSA).\n    *   *Output*: `MOV EAX, 1` (Move 1 into Register EAX).\n2.  **Decompiler**: Attempts to translate ASM back into pseudo-C code.\n    *   *Tool*: Ghidra, Hex-Rays.\n    *   *Output*: `if (variable1 == 1) { download_virus(); }`\n    *   *Note*: It is never 100% accurate, but it is much easier to read than ASM.\n3.  **Debugger**: Runs the code step-by-step (Dynamic).\n    *   *Tool*: x64dbg (Windows), GDB (Linux).\n    *   *Action*: \"Pause execution right before it encrypts the file so I can see the key in memory.\"\n\n### The Goal of RE\nYou are not trying to re-write the source code. You are trying to answer specific questions:\n1.  Does it contain a Domain Generation Algorithm (DGA)?\n2.  What is the hardcoded C2 IP?\n3.  How does it bypass the Anti-Virus?', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(669, 382, '## x86/x64 Assembly Essentials\n\nYou don\'t need to write Assembly, but you must read it.\n\n### Registers (The CPU\'s pockets)\nThe CPU has small storage slots called Registers.\n*   **EAX / RAX**: The \"Accumulator\". Used for math and **Return Values**. (If a function returns \"Success\", EAX is usually 1 or 0).\n*   **EBX / RBX**: Base.\n*   **ECX / RCX**: Counter. Used in loops.\n*   **EDX / RDX**: Data.\n*   **EIP / RIP**: **Instruction Pointer**. This is the most important register. It points to the *next instruction* the CPU will execute.\n    *   *Buffer Overflow*: If you can overwrite EIP, you control the CPU.\n*   **ESP / RSP**: Stack Pointer. Points to the top of the stack.\n\n### Common Instructions\n1.  **MOV destination, source**: Copy data.\n    *   `MOV EAX, 5` -> Put 5 into EAX.\n2.  **ADD / SUB**: Math.\n3.  **CMP A, B**: Compare A and B.\n4.  **JMP / JZ / JNZ** (Jumps): The logic flow (If statements).\n    *   `CMP EAX, 0` (Check if EAX is 0)\n    *   `JZ 402000` (Jump if Zero to memory address 402000).\n    *   *Hacking Tip*: If you change `JZ` (Jump if Zero) to `JNZ` (Jump if NOT Zero), you can flip the logic of the program. (e.g., \"Is Password Correct?\" -> \"No\" -> \"Login Anyway\").\n\n### The Stack (LIFO)\nTemporary memory for functions.\n*   **PUSH**: Put something on top of the stack.\n*   **POP**: Take it off.\n*   Think of it like a stack of plates.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(670, 383, '## Static Analysis with Ghidra\n\n**Ghidra** is the NSA\'s gift to the community. It is a powerful, free Disassembler/Decompiler.\n\n### The Interface\n1.  **Program Tree**: Sections of the file (.text, .data, .rsrc).\n2.  **Listing View**: The Assembly code (linear view).\n3.  **Decompiler View**: The C-like pseudo-code. **(This is where you live)**.\n4.  **Symbol Tree**: List of Functions and Imports.\n\n### The Workflow\n1.  **Import**: Drag and Drop the malware.\n2.  **Analyze**: Run the auto-analysis (identifies functions, strings).\n3.  **Search Strings**: Find \"http\". Double click it.\n4.  **X-Ref (Cross Reference)**: Right-Click the string -> \"References\".\n    *   This shows *where in the code* that string is used.\n    *   Clicking it takes you to the `Main()` function that calls the C2.\n5.  **Rename**: Ghidra names variables `DAT_12345` or `FUN_401000`.\n    *   Your job is to read the logic.\n    *   \"This function takes a URL and downloads a file.\" -> Press `L`. Rename to `Download_File`.\n    *   \"This variable holds the IP.\" -> Rename to `C2_IP`.\n    *   Slowly, the code becomes readable.\n\n### Graph View\nVisualizes the flow control.\n*   Boxes are blocks of code.\n*   Arrows are Jumps (Green for Yes, Red for No).\n*   If you see a complex knot of arrows, it\'s a loop.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(671, 384, '## Debugging with x64dbg\n\nStatic analysis is hard when the code is obfuscated. A **Debugger** lets you run it and watch.\n\n### Key Concepts\n1.  **Breakpoints (BP)**: Trapwires using Software Interrupts (INT 3).\n    *   You tell the debugger: \"Run until you hit address 401050, then PAUSE.\"\n    *   *Use*: Put a BP on `CreateFileW`. The malware will run until it tries to create a file, then freeze. You can then look at the stack to see *filename* it is trying to write.\n2.  **Stepping**:\n    *   **Step Into (F7)**: Go inside the function call.\n    *   **Step Over (F8)**: Run the function and pause after it returns. (Use this to skip boring library functions like `printf`).\n3.  **Register/Memory View**:\n    *   Watch the EAX register change as you step.\n    *   Watch the memory dump to see encrypted strings suddenly become decrypted.\n\n### Patching\nYou can modify the binary in memory.\n*   **Scenario**: The malware checks `If (Year == 2023)`. It is 2025, so it quits.\n*   **Fix**:\n    1.  Find the `CMP Year, 2023` and `JNE Exit` instructions.\n    2.  Change the `JNE` (Jump Not Equal) to `NOP` (No Operation - Do nothing).\n    3.  The malware continues running.\n\n### Anti-Debugging\nMalware hates debuggers.\n*   **IsDebuggerPresent()**: A Windows API function that returns 1 if being debugged.\n*   **RDTSC**: Read Time Stamp Counter. Measures CPU cycles.\n    *   \"It took 5,000,000 cycles to run this instruction. Humans are slow. A debugger must be attached.\" -> *Self Destruct*.\n*   **Bypass**: Use plugins like **ScyllaHide** to hide your debugger from these checks.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(672, 385, '## Unpacking & Anti-Analysis\n\nMost malware is \"Packed\" (Compressed/Encrypted) to hide from AV signatures.\n\n### The Packer Lifecycle\n1.  **The Stub**: The small piece of code you actually see.\n2.  **Unpacking**: The Stub decrypts the *real* malware (Payload) from its data section and writes it into memory.\n    *   *Technique*: Uses `VirtualAlloc` (Get memory) -> `RtlDecompressBuffer` -> `VirtualProtect` (Make executable).\n3.  **Transfer (OEP)**: The Stub jumps to the **Original Entry Point** (OEP) of the payload.\n4.  **Execution**: The real malware runs.\n\n### Manual Unpacking Technique\n1.  Load packed malware into x64dbg.\n2.  Set breakpoints on `VirtualAlloc` and `VirtualProtect`.\n3.  Run code. It breaks when it allocates memory.\n4.  Watch that memory region. Step over until you see the PE Header (`MZ`) appear in the memory dump.\n5.  **Dump It**: Use \"Scylla\" (plugin) to save that memory region to a file (`unpacked.exe`).\n6.  Now open `unpacked.exe` in Ghidra. You will see the real strings and logic.\n\n### Dealing with Obfuscation\n*   **Dead Code**: Junk instructions that do nothing (`ADD EAX, 0`) just to confuse you.\n*   **Control Flow Flattening**: Breaking linear code into a confusing switch-statement mess.\n*   **String Encryption**: Strings are stored as `XOR 0x55`. The malware decrypts them only when needed.\n*   *Solution*: FLOSS (FireEye Labs Obfuscated String Solver). It runs code heuristics to find and extract obfuscated strings automatically.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(673, 386, '## Module 38 Review\nReverse Engineering is the deepest level of analysis.\n*   **Assembly**: The language of the CPU.\n*   **Ghidra**: The static map.\n*   **x64dbg**: The dynamic probe.\n*   **Unpacking**: Removing the armor to see the code.\n\nNext: Applying this knowledge to Threat Intelligence.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 14:22:44'),
(674, 391, '## The Threat Intel Lifecycle\n\nThreat Intelligence (CTI) is knowledge about adversaries. It moves security from \"What is hitting me?\" to \"Who is hitting me and why?\"\n\n### The Lifecycle\n1.  **Planning & Direction**: The \"Requirements\".\n    *   \"We are a Bank. We care about Fin7 (Credit Card thieves). We don\'t care about APTs targeting Aerospace.\"\n2.  **Collection**: Gathering raw data.\n    *   Open Source (OSINT): Twitter, GitHub, Blogs.\n    *   Closed Source: Vendor feeds (CrowdStrike, Mandiant), Deep Web forums.\n    *   Technical: HoneyPots, Malware Sandboxes.\n3.  **Processing**: Cleaning and normalizing.\n    *   Converting a PDF report into a list of IPs (STIX format).\n4.  **Analysis**: Making sense of it.\n    *   \"This new IP belongs to the same subnet used by Lazarus Group last year. It implies Lazarus is back.\"\n5.  **Dissemination**: Sending it to the right people.\n    *   **Strategic**: To the CISO (\"Risk is elevated\").\n    *   **Tactical**: To the SOC (\"Block these IPs\").\n6.  **Feedback**: \"Was this useful?\"\n\n### Types of CTI\n*   **Strategic**: High-level trends for Executives. (\"Ransomware is up 200%\").\n*   **Operational**: TTPs for Hunters. (\"They use PowerShell Empire\").\n*   **Tactical**: IOCs for SIEMs. (Hashes, IPs).', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(675, 392, '## Collection & Sources (OSINT vs. INT)\n\nWhere do we get the dirt?\n\n### OSINT (Open Source Intelligence)\n*   **Twitter (InfoSec Twitter)**: Often the fastest source. Researchers post \"I just found this C2\" minutes after detection.\n*   **VirusTotal**: The world\'s malware database.\n    *   *Hunting*: \"Search for all files that communicate with `bad-domain.com`.\"\n*   **Shodan/Censys**: Search engines for the Internet of Things.\n    *   \"Show me all servers running vulnerable Exchange 2016 in Germany.\"\n*   **AlienVault OTX (Open Threat Exchange)**: Crowd-sourced pulses.\n\n### Paid Feeds (Commercial)\n*   Companies like Recorded Future, Mandiant, Proofpoint.\n*   They have spies in Dark Web forums.\n*   Value: **Context**. Not just \"Block IP X\", but \"IP X is a Cobalt Strike server rented by Ryuk Ransomware affiliates.\"\n\n### ISACs (Information Sharing and Analysis Centers)\n*   Industry groups (FS-ISAC for Finance, H-ISAC for Health).\n*   \"We (Bank A) got hit by this. Here are the IOCs so you (Bank B) can block it.\"\n*   *Trust*: High.\n\n### Dark Web (Tor)\n*   Monitoring Ransomware leak sites.\n*   \"Company X has 2 days to pay.\" -> If Company X is your vendor, you have a Third-Party Risk problem.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(676, 393, '## Analysis & Attribution: The \"Who\"\n\nAttribution (Naming the actor) is hard and often political.\n\n### Levels of Attribution\n1.  **Infrastructure**: \"This attack came from IP 1.2.3.4 (DigitalOcean VPN).\" (Low value).\n2.  **Tooling**: \"They used \'PoisonIvy\', which is often used by Chinese groups.\" (Medium).\n3.  **TTPs**: \"They used the exact same 5-step process as APT10.\" (High).\n4.  **Strategic**: \"The attack targeted a dissident journalist critical of Country X.\" (Motivation).\n\n### The Diamond Model of Intrusion Analysis\nA simple shape to map attacks.\n1.  **Adversary**: Who? (Russia).\n2.  **Infrastructure**: What? (IPs/Domains).\n3.  **Capability**: How? (Malware/Exploits).\n4.  **Victim**: Whom? (You).\n*   *Pivot*: If you find a Malware sample (Capability) used by an Adversary, you can pivot to find their Infrastructure.\n\n### Cognitive Biases\nAnalysts must avoid traps.\n*   **Confirmation Bias**: Looking for evidence that supports your theory (\"It\'s Russia\") and ignoring evidence that contradicts it.\n*   **Mirror Imaging**: Assuming the attacker thinks like you. (\"They wouldn\'t attack on Christmas.\" Yes, they would).\n*   **False Flag**: Attackers verify sophisticated. The \"Olympic Destroyer\" malware (Russia) contained code snippets from North Korea to confuse analysts.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(677, 394, '## STIX/TAXII & Sharing\n\nWe need a standard language to share Intel between machines.\n\n### STIX (Structured Threat Information Expression)\nA JSON format for describing threats.\n*   **Objects**:\n    *   `Threat Actor`: The bad guy.\n    *   `Attack Pattern`: The TTP (CAPEC/ATT&CK).\n    *   `Indicator`: The Regex/Rule to find it.\n    *   `Observed Data`: The IP/Hash.\n*   *Example*: \"Actor A (STIX) uses Malware B (STIX) which connects to IP C (STIX).\"\n\n### TAXII (Trusted Automated Exchange of Intelligence Information)\nThe transport protocol (HTTPS API) to move STIX objects.\n*   **Server**: Host the feed (e.g., Anomali Limo).\n*   **Client**: Your SIEM polls the server.\n*   \"Hey Server, give me all new High-Confidence Ransomware IPs since yesterday.\"\n*   Server responds with STIX JSON.\n\n### MISP (Malware Information Sharing Platform)\nThe most popular Open Source Threat Intel Platform (TIP).\n*   Org A puts malware data into MISP.\n*   Org B\'s MISP syncs with Org A.\n*   Your SIEM connects to MISP and downloads the blocklist automatically.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(678, 395, '## Operationalizing Intel\n\nIntel is useless if it sits in a PDF. It must \"Drive Operations\".\n\n### 1. Alert Enrichment (Context)\n*   **Without Intel**: SIEM Alert \"Connection to 1.2.3.4\". Priority: Unknown.\n*   **With Intel**: SIEM Alert \"Connection to 1.2.3.4 (Known Conti Ransomware Node)\". Priority: **CRITICAL**.\n*   *How*: Connect your SIEM to a TIP.\n\n### 2. Retroactive Hunting\n*   Intel Report: \"In Jan 2024, Actor X used `evil.com`.\"\n*   Today is March 2024. Blocking it now helps, but...\n*   **Action**: Search your *Historical Logs* (Cold Storage). Did anyone talk to `evil.com` back in January?\n    *   If Yes: You have been compromised for 3 months. **Incident Response Start**.\n\n### 3. Vulnerability Prioritization\n*   Scanner says: \"You have 10,000 unpatched bugs.\"\n*   Intel says: \"Only CVE-2023-1234 is being actively exploited in the wild by Ransomware.\"\n*   **Action**: Patch CVE-2023-1234 *tonight*. The rest can wait.\n\n### 4. TTP-Based Defense\n*   Intel says: \"Lazarus is using LNK files in ZIP Archives.\"\n*   **Action**: Update Email Gateway to block `.lnk` attachments. Update EDR to alert on `cmd.exe` spawned from `explorer.exe` via LNK.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(679, 396, '## Module 39 Review\nThreat Intel gives you the \"Heads Up\".\n*   **Lifecycle**: Planning to Feedback.\n*   **Standards**: STIX (Language) / TAXII (Truck).\n*   **Attribution**: The Diamond Model.\n\nNext: Testing your defenses with Red and Purple Teams.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 14:23:36'),
(680, 401, '## Red, Blue, and Purple Teams\n\nThe color spectrum of information security.\n\n### Red Team (The Offensive)\n*   **Goal**: Simulate a real adversary to test defenses.\n*   **Mindset**: \"There is always a way in.\"\n*   **Method**: Zero-day exploits, Phishing, Social Engineering, Physical Intrusion.\n*   **Outcome**: A report saying \"We stole the Domain Admin password in 4 hours.\"\n\n### Blue Team (The Defensive)\n*   **Goal**: Detect and Respond.\n*   **Mindset**: \"Protect the Crown Jewels.\"\n*   **Method**: SIEM, EDR, Firewalls, Patching, Threat Hunting.\n*   **Outcome**: \"We blocked the Phishing email. We detected the scanner.\"\n\n### Purple Team (The Collaborative)\n*   **The Problem**: Red Teams and Blue Teams often hate each other.\n    *   Red: \"Blue team is useless, I pawned them easily.\"\n    *   Blue: \"Red team cheated, they used a vulnerability for a system we don\'t own.\"\n    *   *Result*: No learning happens.\n*   **The Solution**: Purple Teaming.\n    *   Red Team executes an attack (T1059 PowerShell).\n    *   Blue Team watches *in real-time*.\n    *   Red: \"Did you see that?\"\n    *   Blue: \"No.\"\n    *   Red: \"Okay, I will run it again. Tune your SIEM to look for X.\"\n    *   Blue: \"Got it! Alert triggered.\"\n\n### Why Purple is the Future\nIt moves from \"Win/Lose\" to \"Improvement\". The goal isn\'t to hack the company; the goal is to verify the detection logic.', 'markdown', 20, '2025-12-27 02:22:23', '2025-12-29 16:15:02'),
(681, 402, '## Red Team Operations\n\nRed Teaming is not just \"Running Nmap\". It is a full-scope simulation.\n\n### 1. Reconnaissance (OSINT)\n*   Scraping LinkedIn to find system admins.\n*   Looking for leaked credentials on the Dark Web.\n*   Mapping external IP ranges (Shodan).\n\n### 2. Weaponization & Delivery\n*   Creating custom malware (avoiding signature detection).\n*   Buying a look-alike domain (`cornpany.com`).\n*   Sending the Spearphishing email.\n\n### 3. Exploitation & Install\n*   User clicks link.\n*   Browser exploit runs.\n*   Beacon (C2) installed.\n\n### 4. Privilege Escalation\n*   Local Admin -> Domain Admin.\n*   Techniques: Kerberoasting, PrintNightmare.\n\n### 5. Lateral Movement\n*   Moving from \"Bob from Accounting\" to the \"Swift Payment Server\".\n\n### 6. Actions on Objectives\n*   Stealing the money. Encrypting the drive.\n\n### Rules of Engagement (ROE)\nA legal contract defining what Red Team is allowed to do.\n*   **Limits**: \"Do not attack the Production Database.\" \"Do not phish the CEO.\"\n*   **Emergency Contact**: If Red Team accidentally crashes a server, who do they call at 3 AM?', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 16:15:03'),
(682, 403, '## Blue Team Defense\n\nThe Blue Team has the harder job. The Red Team only needs to be right *once*. The Blue Team needs to be right *every time*.\n\n### 1. Prevention (Hardening)\n*   \"Reduce the attack surface.\"\n*   Disable macros.\n*   Patch vulnerabilities.\n*   Enforce MFA.\n\n### 2. Detection (Monitoring)\n*   SIEM rules.\n*   Honeypots (Traps).\n*   Canary Tokens (Fake files that alert when opened).\n\n### 3. Response (IR)\n*   The fire brigade.\n\n### The \"Assume Breach\" Mentality\nModern Blue Teams assume the perimeter has failed. They focus on **Internal Monitoring**.\n*   \"I don\'t care if they get in. I care if they can move to the database without me seeing them.\"', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 16:15:03'),
(683, 404, '## Purple Team Exercises\n\nA structured Purple Team exercise follows a script.\n\n### Phase 1: Planning\n*   **Objective**: \"Verify detection of Credential Dumping (T1003).\"\n*   **Tool**: Mimikatz.\n*   **Target**: Test Workstation A.\n\n### Phase 2: Execution (Round 1)\n*   Red: Runs `mimikatz.exe privilege::debug`.\n*   Blue: Checks SIEM. \"No Alert.\"\n*   Red: \"Okay, running `sekurlsa::logonpasswords`.\"\n*   Blue: \"No Alert.\"\n\n### Phase 3: Tuning\n*   Blue: \"Why did we miss it?\"\n    *   Investigation: \"We don\'t ingest Sysmon Event ID 10 (Process Access).\"\n*   **Fix**: Enable Sysmon config. Forward logs to Splunk. Write Search.\n\n### Phase 4: Execution (Round 2)\n*   Red: Runs `mimikatz.exe`.\n*   Blue: \"ALERT! Critical Severity - Credential Dumping detected.\"\n*   **Verdict**: Success.\n\n### Phase 5: Reporting\n*   \"We improved detection coverage for T1003 from 0% to 100%.\"', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 16:15:03'),
(684, 405, '## Adversary Emulation\n\nRather than \"Generic Hacking\", we emulate specific Threat Groups.\n\n### Why?\n*   If you are a Bank, you care about **Carbanak**.\n*   If you are a Hospital, you care about **Ryuk**.\n\n### Tools\n1.  **Atomic Red Team (Red Canary)**: A library of simple scripts to test one technique.\n    *   `atomic-red-team.exe T1003` -> Runs a safe mimikatz command.\n2.  **CALDERA (MITRE)**: Automated adversary emulation platform.\n    *   Build a \"Profile\" (e.g., APT29).\n    *   Click \"Start\".\n    *   Caldera agents connect to C2 and execute the APT29 commands automatically.\n\n### The Value\nIt proves resilience against *relevant* threats.\n\"We know we can stop script kiddies. But can we stop the group that hacked our competitor last week?\"', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 16:15:03'),
(685, 406, '## Module 40 Review\n*   **Red**: Attack.\n*   **Blue**: Defend.\n*   **Purple**: Collaborate.\n*   Adversary Emulation ensures your defense is relevant to real-world threats.\n\nNext: Running a Purple Team exercise step-by-step.', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 14:23:36'),
(686, 411, '## Exercise Framework Setup\n\nTo run a Purple Team exercise in your lab or company, you don\'t need expensive tools.\n\n### 1. The Target\nA standard Windows 10/11 VM.\n*   **Requirement**: It must have logging enabled (Sysmon) and forwarding to your SIEM.\n\n### 2. The Attack Tool\n**Atomic Red Team** is the gold standard for beginners.\n*   It is a folder of YAML files.\n*   Each file contains a command (PowerShell/CMD).\n*   No C2 infrastructure needed. It runs locally.\n\n### 3. The Execution\n*   Install `Invoke-AtomicRedTeam` (PowerShell module).\n*   Command: `Invoke-AtomicTest T1003 -CheckPrereqs`\n*   Command: `Invoke-AtomicTest T1003` (Runs the attack).\n\n### 4. The Tracker\nUse a spreadsheet (VECTR is a good free tool, but Excel works).\n*   Columns: Technique | Status | Detected? | Blocked? | Notes.\n*   Fill it out as you go.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(687, 412, '## Exercise: Credential Dumping (T1003)\n\n**Objective**: Detect extraction of passwords from memory.\n\n### The Attack (Atomic T1003.001)\n*   **Command**: `procdump -ma lsass.exe lsass_dump.dmp`\n*   **Context**: `lsass.exe` (Local Security Authority Subsystem Service) holds active credentials in RAM.\n*   **Tool**: Sysinternals ProcDump (legitimate Microsoft tool).\n\n### The Detection\n1.  **Process Name**: `procdump.exe` or `procdump64.exe`.\n2.  **Target Process**: `lsass.exe`.\n3.  **Command Line**: Contains `lsass`.\n\n### SIEM Search (Splunk)\n`index=windows EventCode=10 TargetImage=\"*lsass.exe\" GrantedAccess=\"0x1F0FFF\"`\n(Event 10 is Process Access. 0x1F0FFF is Full Access).\n\n### The Fix\nIf you missed it:\n1.  Install Sysmon.\n2.  Configure Sysmon to log Event ID 10 for Target `lsass.exe`.\n3.  Ingest logs.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(688, 413, '## Exercise: Lateral Movement (T1021)\n\n**Objective**: Detect movement between machines using SMB/Windows Admin Shares.\n\n### The Attack (Atomic T1021.002)\n*   **Command**: `net use \\TargetIPC$ /user:Admin Pa$$word`\n*   **Context**: Mapping the C: drive of a remote computer.\n\n### The Detection\n1.  **Event ID**: 4624 (Logon) Type 3 (Network).\n2.  **Event ID**: 5140 (Share Access).\n3.  **Share Name**: `\\*C$`, `\\*ADMIN$`, `\\*IPC$`.\n\n### SIEM Search\n`index=windows EventCode=5140 ShareName=\"*C$\" AccountName!=\"*$\" `\n(Exclude computer accounts ending in $).\n\n### Analysis\nWhy is \"Mary\" mapping the C$ drive of \"Bob\"?\n*   If Mary is HelpDesk -> Maybe okay.\n*   If Mary is HR -> **Malicious**.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(689, 414, '## Exercise: Data Exfiltration (T1048)\n\n**Objective**: Detect data leaving the network.\n\n### The Attack\n*   **Command**: Compress a folder into a ZIP and send it to an external FTP/HTTP server.\n*   **Atomic**: `7z a -t7z -mx=9 stolen_data.7z C:UsersPublicSecrets*`\n\n### The Detection\n1.  **Archiving**: Event 4688 (Process Create) -> `7z.exe` or `rar.exe` or `tar.exe`.\n    *   *Suspicious*: Running from a Temp directory.\n2.  **Network**: Firewall allow log to a non-business IP.\n    *   High Upload volume (> 10 MB).\n\n### SIEM Search\n`index=firewall action=allow bytes_out > 10000000 dest_port NOT IN (80, 443)`\n(Looking for FTP, SSH, or odd ports).\n\n### The Fix\n*   Block outbound connections on servers by default.\n*   Alert on large archive creation.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(690, 415, '## Metrics & Reporting\n\nHow do you prove Purple Teaming works?\n\n### The Scorecard\n*   **Detection Rate**: \"We detected 5/10 attacks (50%).\" -> \"Next month: 8/10 (80%).\"\n*   **Data Quality**: \"We had logs for 9/10 attacks, but no rule.\"\n*   **Alert Fidelity**: \"We had an alert, but it was classified as \'Info\' instead of \'Critical\'.\"\n\n### The Executive Report\n\"We simulated a Ransomware attack.\n*   Result: We successfully blocked execution.\n*   Gap: It took us 4 hours to detect the initial phishing email.\n*   Plan: Tune email gateway filter.\"\n\nThis creates a dashboard of **Continuous Improvement**.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(691, 416, '## Module 41 Review\nYou simulated an attack chain:\n*   Credentials Stolen -> Lateral Movement -> Exfiltration.\n*   You validated detections.\n\nNext: Modern security in Containers and Cloud.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 14:23:36'),
(692, 421, '## Container Security Fundamentals\n\n\"But it works on my machine!\" - The Developer.\n\n### What is a Container?\nA container (Docker) is a lightweight package of software that includes everything needed to run it: code, runtime, system tools, libraries.\n*   **Advantage**: Portability. It runs the same on a laptop as in the cloud.\n*   **Difference from VM**: It shares the **Host Kernel**. A VM has its own Kernel.\n    *   *Security Implication*: If you escape a VM, you hit the Hypervisor. If you escape a Container, you are on the Host Linux OS root.\n\n### The Attack Surface\n1.  **The Image**: Is the software (Nginx, Python) vulnerable?\n2.  **The Registry**: Where do you download images from? (Docker Hub).\n3.  **The Orchestrator**: Kubernetes (K8s) configuration.\n4.  **The Runtime**: The Docker daemon running on the host.\n\n### Ephemeral Nature\nContainers live for minutes.\n*   **SOC Nightmare**: \"Alert: TCP scan from Container ID a1b2c3d4.\"\n*   Analyst checks 10 minutes later. Container a1b2c3d4 is gone. Deleted.\n*   *Solution*: You need specialized Container Security tools that log events *instantly* to a central database.', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(693, 422, '## Docker Security Hardening\n\nDocker is not secure by default.\n\n### 1. Rootless Mode\n*   **Risk**: By default, the Docker daemon runs as **root**.\n*   **Fix**: Configure Docker to run in \"Rootless Mode\" (User Namespace Remapping).\n*   *Why*: If a hacker breaks out of the container, they are \"nobody\" on the host, not \"root\".\n\n### 2. Capabilities (Linux Capabilities)\n*   Linux decomposes \"Root\" privileges into small slices (CAP_NET_ADMIN, CAP_SYS_BOOT, etc.).\n*   **Hardening**: Drop all capabilities, then add back only what you need.\n    *   `docker run --cap-drop=all --cap-add=NET_BIND_SERVICE ...`\n\n### 3. Read-Only Filesystem\n*   Containers should be **Immutable**. You shouldn\'t patch a running container; you deploy a new one.\n*   **Flag**: `--read-only`.\n*   *Why*: Attackers cannot download malware or modify `/etc/passwd`.\n\n### 4. Do not expose the Docker Socket\n*   `/var/run/docker.sock` is the API key to the kingdom. If you mount this into a container, that container has full root control over the host.\n*   **Rule**: Never mount the socket unless absolutely necessary (e.g., for a monitoring agent).', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(694, 423, '## Kubernetes Security (K8s)\n\nKubernetes manages thousands of containers. It is complex (\"K8s is hard\").\n\n### 1. The API Server\nThe brain of K8s. Port 6443.\n*   **Attack**: If this is open to the internet with no auth, anyone can delete your cluster.\n*   **Fix**: Private access only.\n\n### 2. RBAC (Role-Based Access Control)\n*   **Service Accounts**: Every pod has an identity.\n*   **Risk**: Default Service Account often has too many permissions.\n*   **Fix**: Create specific ServiceAccounts. \"This Web Pod can ONLY talk to the Database Pod.\"\n\n### 3. Pod Security Standards (PSS)\n*   **Privileged Pods**: A pod with `privileged: true` is basically a root shell on the host.\n*   **Policy**: Use OPA Gatekeeper or Kyverno to **Block** any deployment that asks for `privileged: true`.\n\n### 4. Network Policies\n*   By default, in K8s, **all pods can talk to all pods**. (Flat network).\n*   **Attack**: Hacker compromises Web Pod. Moves laterally to Database Pod easily.\n*   **Fix**: Implement Network Policies (Firewall rules) to deny traffic by default.', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(695, 424, '## Container Image Security\n\n\"Supply Chain Security.\"\n\n### Scanning Images\nBefore you deploy, scan the image.\n*   **Tools**: Trivy, Grype, Clair.\n*   **Process**: CI/CD Pipeline.\n    *   Developer commits code.\n    *   Jenkins builds image.\n    *   Trivy scans image.\n    *   If `Critical Vulnerabilities > 0`: **Fail Build**. (Do not deploy).\n    *   Else: Deploy.\n\n### Minimal Base Images\n*   **Bloat**: Using `ubuntu:latest` (700MB) includes Curl, Wget, Netcat, Grep. Hackers love these tools (\"Living off the Land\").\n*   **Minimal**: Using `alpine` (5MB) or Google `distroless`.\n    *   Contains *only* the application binary. No Shell. No Curl.\n    *   *Result*: Beating the hacker by removing their weapons.\n\n### Signing Images (Notary)\nHow do you know this image actually came from your developer and wasn\'t injected by a hacker?\n*   **Cosign / Notary**: Digitally sign images. Kubernetes verifies the signature before running.', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(696, 425, '## Runtime Protection\n\nScanning images is \"Static\". We also need \"Dynamic\" protection (EDR for Containers).\n\n### Falco (The Runtime Camera)\n**Falco** is an open-source tool (CNCF) that watches the Kernel.\n*   **Rule**: \"Alert if a Shell is spawned in a container.\"\n*   **Rule**: \"Alert if a container modifies `/etc/shadow`.\"\n*   **Rule**: \"Alert if a container connects to a crypto-mining pool.\"\n\n### Sidecars\nSecurity tools often run as a \"Sidecar\" container next to the main app container in the same Pod. They share the network view and can inspect localhost traffic.\n\n### eBPF (Extended Berkeley Packet Filter)\nThe modern magic technology.\n*   allows running sandboxed programs in the Linux Kernel without changing kernel source code.\n*   **Cilium / Tetragon**: Uses eBPF to monitor network and process execution with near-zero performance overhead.\n*   This is the future of Linux security.', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(697, 426, '## Module 42 Review\n*   **Containers**: Shared Kernel = High Risk.\n*   **Roots**: Avoid running as Root.\n*   **Images**: Scan before you run.\n*   **Runtime**: Watch for drift and shells (`Falco`).\n\nNext: Zero Trust (The modern architecture).', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 14:24:24'),
(698, 431, '## Zero Trust Principles\n\n\"Never Trust. Always Verify.\"\n\n### The Old Model: Castle and Moat\n*   Hard shell (Firewall). Soft gooey center (Internal Network).\n*   If you VPN in, you are \"Trusted\". You can access everything.\n\n### The Zero Trust Model\n*   Assume the network is **Hostile**.\n*   Assume the attacker is **already inside**.\n*   Therefore: Verify *every single request*.\n    1.  **Identity**: Who are you? (MFA).\n    2.  **Device**: Is your laptop patched? (Health).\n    3.  **Context**: Are you in a weird location?\n    4.  **Resource**: Do you need access to *this specific* file?\n\n### Pillars of Zero Trust (CISA)\n1.  **Identity**: Users.\n2.  **Devices**: Endpoints.\n3.  **Network**: Segmentation.\n4.  **Applications**: Workloads.\n5.  **Data**: Encryption/Tagging.', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 16:15:13'),
(699, 432, '## Identity as the Perimeter\n\nThe new firewall is the Login Screen.\n\n### Authentication vs Authorization\n*   **AuthN**: Who are you? (MFA).\n*   **AuthZ**: What can you do? (Roles).\n\n### The Signal\nZero Trust creates a \"Risk Signal\" based on context:\n*   **User**: Is Bob.\n*   **Device**: Corporate Laptop (Managed).\n*   **Location**: Office IP.\n*   **Behavior**: Normal hours.\n*   **Result**: Allow Access.\n\n*   **Change**: Bob logs in from an unmanaged iPad in Russia.\n*   **Result**: Block (even if password is correct).', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 14:24:24'),
(700, 433, '## Microsegmentation\n\nThe technique to stop Lateral Movement.\n\n### Concept\nInstead of one big \"Internal\" VLAN, break the network into tiny islands.\n*   **Macro-Segmentation**: VLANs. (HR, Finance, IT).\n*   **Micro-Segmentation**: Host-level firewalls.\n    *   \"Server A can talk to Server B on Port 443.\"\n    *   \"Server A can talk to Server C on Port 3306.\"\n    *   \"Server A **cannot** talk to Server D.\"\n\n### Implementation\n1.  **Tagging**: Map the application flow. \"Web calls App calls DB\".\n2.  **Policy**: Write \"Allow\" rules for valid flows.\n3.  **Default Deny**: Block everything else.\n\n### The Effect\nIf an attacker compromises the Web Server, they are trapped in a small padded cell. They cannot scan the network (blocked). They cannot SSH to the DB (blocked).', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 16:15:13'),
(701, 434, '## Continuous Verification\n\nTrust is ephemeral.\n\n### Posture Checks\nBefore granting access, check the device health.\n*   Is the OS patched?\n*   Is EDR running?\n*   Is Disk Encrypted?\nIf NO -> Quarantine the device until fixed.\n\n### Session Times\n*   **Old**: Login lasts 30 days.\n*   **Zero Trust**: Login lasts 1 hour. Or 15 minutes for critical apps.\nRe-verify constantly.', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 14:24:24');
INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(702, 435, '## Implementation\n\nHow do we actually build this?\n\n1.  **Define Protect Surface**: Identify the critical data (DAAS - Data, Assets, Applications, Services).\n2.  **Map Transaction Flows**: How does data move today? (Who talks to whom?).\n3.  **Build Policy**: Write the \"Allow\" rules based on business need.\n4.  **Monitor**: Watch logs.\n5.  **Enforce**: Turn on blocking mode.\n\n*Warning*: Don\'t turn on blocking on Day 1. You will break production.', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 14:24:24'),
(703, 436, '## Module 43 Review\n*   **Identity**: The core control.\n*   **Context**: Time, Device, Location.\n*   **Segmentation**: Keeping zones small.\n\nNext: Compliance (The rules we must follow).', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 14:24:24'),
(704, 441, '## Security Frameworks Overview\n\nWhy do we follow frameworks?\n1.  **Guidance**: Don\'t reinvent the wheel. Best practices exist.\n2.  **Compliance**: It\'s the law (or contract).\n3.  **Trust**: Customers trust you if you have a badge (ISO/SOC2).\n\n### Types\n*   **Regulatory**: HIPAA (Health), GDPR (Privacy). Essential.\n*   **Voluntary**: NIST CSF, CIS Controls. Best practice.', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 14:24:24'),
(705, 442, '## NIST Cybersecurity Framework (CSF)\n\nThe gold standard for US organizations.\n\n### The 5 Functions\n1.  **Identify**: Asset Management, Risk Assessment. \"Know what you have.\"\n2.  **Protect**: Access Control, Awareness, Data Security. \"Lock the doors.\"\n3.  **Detect**: Anomalies, Monitoring. \"Install cameras.\"\n4.  **Respond**: Mitigation, Analysis. \"Call the fire department.\"\n5.  **Recover**: Planning, Improvements. \"Rebuild.\"\n\n*(2.0 added \"Govern\" as the 6th function).*', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 14:24:24'),
(706, 443, '## ISO 27001 & 27002\n\nThe International Standard.\n\n### ISMS (Information Security Management System)\nISO 27001 focuses on the **Management System**, not just the tech.\n*   \"Do you have a process to identify risks?\"\n*   \"Do you have management support?\"\n*   \"Do you continuously improve?\"\n\n### Annex A (Controls)\nList of 114 specific controls (Access Control, Cryptography, Physical Security).\n*   You don\'t have to implement all 114, but you must explain why if you exclude one (Statement of Applicability - SOA).\n\n### Usage\n*   Common in Europe and Asia.\n*   Rigorous certification process.', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 16:15:13'),
(707, 444, '## SOC 2 Compliance\n\n**SOC 2 (Service Organization Control 2)** is the gold standard for SaaS companies.\n\n### The Trust Services Criteria (TSC)\n1.  **Security** (Mandatory): Firewalls, IDS, MFA.\n2.  **Availability**: Uptime, DR.\n3.  **Processing Integrity**: Data is accurate.\n4.  **Confidentiality**: Encryption.\n5.  **Privacy**: Consents.\n\n### Type 1 vs Type 2\n*   **Type 1**: \"Design\". A snapshot in time. \"On Jan 1st, they had a firewall.\"\n*   **Type 2**: \"Operating Effectiveness\". Observation over 6-12 months. \"For the entire year, they kept the firewall running and reviewed logs daily.\"\n*   *Note*: Enterprise customers demand SOC 2 Type 2 reports.\n\n### The Analyst\'s Role\nEvidence Collection.\n*   Auditor: \"Prove you review access logs.\"\n*   Analyst: \"Here is the ticket #1234 where I reviewed the logs.\"', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 16:15:13'),
(708, 445, '## PCI-DSS & HIPAA\n\n### PCI-DSS (Payment Card Industry Data Security Standard)\n*   **Scope**: Anyone protecting credit card numbers.\n*   **Rules**: Very technical.\n    *   \"Install a firewall.\"\n    *   \"Encrypt data in transit.\"\n    *   \"Use Anti-Virus.\"\n\n### HIPAA (Health Insurance Portability and Accountability Act)\n*   **Scope**: US Healthcare (Hospitals, Insurance).\n*   **Focus**: Protecting PHI (Personal Health Information).\n*   **Rule**: More flexible/vague than PCI, but huge fines for breaches.', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 14:24:24'),
(709, 446, '## Module 44 Review\n*   **NIST CSF**: The operational guide (Identify -> Recover).\n*   **ISO 27001**: The management standard.\n*   **SOC 2**: The SaaS standard.\n*   **PCI/HIPAA**: The industry laws.\n\nYou have completed Path 4: Advanced SOC & Threat Hunting.\nYou are now ready to tackle the hardest challenges in Cyber Defense.', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 14:24:24'),
(978, 765, '## What is Cyber Threat Intelligence?\n\n**Cyber Threat Intelligence (CTI)** is evidence-based knowledge, including context, mechanisms, indicators, implications, and action-oriented advice about an existing or emerging menace or hazard to assets.\n\nIn simpler terms: **CTI is the art of knowing your enemy.**\n\nIt transforms raw data into a narrative that helps you make better security decisions. It answers questions like:\n*   \"Who is attacking us?\"\n*   \"Why are they attacking us?\"\n*   \"How do they get in?\"\n*   \"What are they after?\"\n\n---\n\n### The Pyramid of Value\nTo understand CTI, you must understand the difference between Data, Information, and Intelligence.\n\n#### 1. Data (The Raw Material)\nData is simple, raw indicators. It has no context.\n*   **Example**: `IP Address: 192.168.1.5` or `Hash: a1b2c3d4...`\n*   **Value**: Low. Seeing an IP address tells you nothing about *why* it is there or if it is bad.\n\n#### 2. Information (Processed)\nInformation is data that has been aggregated or enriched. It answers \"What is this?\"\n*   **Example**: \"The IP `192.168.1.5` belongs to a known VPN provider and was seen scanning port 445 on our firewall.\"\n*   **Value**: Medium. You know what it is, but not if it\'s a targeted threat.\n\n#### 3. Intelligence (Actionable Insight)\nIntelligence is the analysis of information to provide specific direction. It answers \"What should we do?\"\n*   **Example**: \"APT29 is actively using the VPN IP `192.168.1.5` to exploit the Log4j vulnerability in financial institutions to deploy Cobalt Strike. **Recommendation**: Block this IP and patch Log4j immediately.\"\n*   **Value**: High. This captures the intent, the capability, and the necessary action.\n\n> 💡 **Key Takeaway**: If you cannot act on it, it is not intelligence; it is just news.\n\n---\n\n### Why Do We Need CTI?\nMany organizations operate in a functional \"Firefighting\" mode—reacting to alerts as they happen. CTI shifts this to a **Proactive** stance.\n\n#### 1. Proactive Defense (The \"Hunt\")\nInstead of waiting for the SIEM to beep, CTI tells us what to look for. If we know a specific ransomware group uses \"RDP Brute Force\" followed by \"PsExec\", we can go *look* for those signs before the ransomware is deployed.\n\n#### 2. Decision Advantage\nSecurity budgets are finite. CTI helps leaders decide where to spend money.\n*   *Without CTI*: \"We need to fix everything.\" (Impossible).\n*   *With CTI*: \"Our threat landscape is dominated by Phishing and Ransomware. We should invest 80% of our budget in Email Security and Offline Backups, and less on physical security.\"\n\n#### 3. Alert Triage\nA SOC Analyst sees 1,000 alerts a day. Which one matters?\nCTI provides the context. An alert for \"Powershell Execution\" might be normal for a SysAdmin. But CTI tells us: \"This specific Powershell command matches the exact syntax used by the Emotet Trojan.\" Suddenly, that alert becomes Priority 1.\n\n---\n\n### Case Study: The Target Breach (2013)\nOne of the most famous examples of failed intelligence.\n*   **The Attack**: Hackers compromised a third-party HVAC vendor just to get into Target\'s network.\n*   **The Warning**: FireEye (security vendor) detected the malware and flagged it.\n*   **The Failure**: Target\'s security team saw the alert but ignored it because they lacked the **Strategic Intelligence** to understand that retail was being aggressively targeted by POS (Point of Sale) RAM scrapers.\n*   **The Result**: 40 million credit cards stolen. CEO fired.\n*   **Lesson**: Detection tools are not enough. You need the intelligence to understand the *severity* and *context* of what you are seeing.\n\n---\n\n### Summary\n*   **Data** is raw numbers. **Information** is context. **Intelligence** is actionable advice.\n*   CTI moves you from **Reactive** (Firefighting) to **Proactive** (Hunting).\n*   The goal is to reduce risk and speed up response times.', 'markdown', NULL, '2025-12-29 13:30:44', '2025-12-29 13:41:22'),
(979, 766, '## The Intelligence Cycle\n\nIntelligence does not just \"happen.\" It is the result of a rigorous, repeatable process called the **Intelligence Cycle**. This 6-step loop ensures that the intel produced effectively meets the needs of the consumer.\n\n---\n\n### Phase 1: Direction (Planning)\nThis is the most critical phase. Before you collect a single log, you must ask: **\"What do we want to know?\"**\n*   **Defining Requirements**: We create **Intelligence Requirements (IRs)**.\n    *   *Bad IR*: \"Tell me about hackers.\" (Too vague).\n    *   *Good IR*: \"Is our organization vulnerable to the specific ransomware strains currently targeting the healthcare sector?\"\n*   **Stakeholders**: Who needs this? The CISO? The SOC? The Patch team?\n\n### Phase 2: Collection\nGathering the raw data to answer the question.\n*   **Internal Sources**: Firewall logs, EDR telemetry, SIEM events, past incident reports.\n*   **External Sources (OSINT)**: Twitter, Github, News reports, Pastebin.\n*   **Closed Sources**: Dark web forums, paid vendor feeds (e.g., CrowdStrike, Mandiant), ISACs (Information Sharing and Analysis Centers).\n\n### Phase 3: Processing\nRaw data is often unusable (messy, encrypted, or foreign language). Processing turns it into a readable format.\n*   **Normalization**: Converting 10 different log formats into one standard (like JSON or STIX).\n*   **Translation**: Translating Russian forum posts into English.\n*   **Decryption**: Decrypting malware configs.\n*   **Filtering**: Throwing away the noise (false positives) to focus on the signal.\n\n### Phase 4: Analysis\nThis is the \"Brain\" of the operation. Analysts connect the dots.\n*   **Correlation**: \"We saw this file hash in our network, and this report says it belongs to APT28.\"\n*   **Attribution**: \"Based on the TTPs, we assess with High Confidence this is a state-sponsored attack.\"\n*   **Assessment**: \"What does this mean for us?\" The analyst validates the truthfulness of the data and estimates the potential impact.\n*   **Structured Analytic Techniques (SATs)**: Methods like \"Analysis of Competing Hypotheses\" are used to avoid cognitive biases (like Confirmation Bias).\n\n### Phase 5: Dissemination\nDelivering the finished product to the right person, in the right format, at the right time.\n*   **Strategic**: A 1-page PDF summary for the CEO. (No technical jargon).\n*   **Tactical**: A machine-readable list of IOCs (STIX/TAXII) pushed directly to the Firewall.\n*   **Operational**: A detailed report on TTPs for the Threat Hunting team.\n*   **Rule of Thumb**: \"The right intel to the wrong person is useless.\"\n\n### Phase 6: Feedback\nThe cycle closes. Did we answer the question?\n*   \"Was this report helpful?\"\n*   \"Did it lead to a detection?\"\n*   \"Was it too late?\"\n*   Based on feedback, we adjust our **Direction** for the next cycle. If the SOC says \"These IOCs were all false positives,\" we need to change our Collection or Analysis phase.\n\n---\n\n### Summary\nThe cycle never stops. As threats evolve, our requirements change, and the wheel keeps turning.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:41:22'),
(980, 767, '## Types of Threat Intelligence\n\nNot all intelligence is created equal. We categorize CTI into three (sometimes four) main types based on the **Consumer** (who reads it) and the **Horizon** (how long it matters).\n\n---\n\n### 1. Strategic Intelligence\n*   **Audience**: Executives, Board of Directors, CISO.\n*   **Focus**: High-level trends, financial risk, brand reputation, and geopolitics.\n*   **Time Horizon**: Long-term (Years).\n*   **Example Content**:\n    *   \"Ransomware attacks in our industry increased by 200% this quarter.\"\n    *   \"New regulations in the EU will impact our data privacy compliance.\"\n    *   \"The conflict in Region X increases the risk of nation-state cyber retaliation.\"\n*   **Goal**: To inform business decisions, budget allocation, and risk management. **No technical terms.**\n\n### 2. Operational Intelligence\n*   **Audience**: Security Managers, Threat Hunters, Incident Responders.\n*   **Focus**: **TTPs** (Tactics, Techniques, and Procedures). The \"How\" and \"Why\" of an attack.\n*   **Time Horizon**: Mid-term (Weeks to Months).\n*   **Example Content**:\n    *   \"APT29 is using a new technique to bypass Multi-Factor Authentication (MFA).\"\n    *   \"The \'Emotet\' botnet sends phishing emails with subject lines regarding invoices.\"\n    *   \"Adversaries are actively exploiting the PrintNightmare vulnerability.\"\n*   **Goal**: To update security posture, prioritize patching, and guide threat hunting.\n\n### 3. Tactical Intelligence\n*   **Audience**: SOC Analysts, SIEM Administrators, Automated Systems (Firewalls).\n*   **Focus**: **IOCs** (Indicators of Compromise). The specific artifacts left behind.\n*   **Time Horizon**: Short-term (Hours to Days).\n*   **Example Content**:\n    *   **IP Addresses**: `104.22.1.1`\n    *   **File Hashes**: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`\n    *   **Domains**: `evil-phishing-site.com`\n*   **Goal**: Immediate detection and blocking. Tactical intel is often automated because it expires quickly (attackers change IPs cheaply).\n\n---\n\n### Comparison Table\n\n| Feature | Strategic | Operational | Tactical |\n| :--- | :--- | :--- | :--- |\n| **Consumer** | C-Suite / Board | SOC Mgr / Hunters | Analysts / Machines |\n| **Content** | Trends / Risk | TTPs / Campaigns | IOCs (Artifacts) |\n| **Lifespan** | Years | Weeks/Months | Hours/Days |\n| **Volume** | Low | Medium | High |\n| **Automated?** | Never | Rarely | Often |\n\n---\n\n### The \"Fourth\" Type: Technical Intelligence\nSome frameworks include a 4th type focused purely on technical tools and malware analysis results (e.g., \"This malware uses XOR encryption with key 0x55\"). This often blends into Operational/Tactical.\n\n### Scenario: The Ransomware Attack\n*   **Tactical**: The Firewall blocks 10 IPs associated with the C2 server.\n*   **Operational**: The Threat Hunter looks for the \"Double Pulsar\" exploit tool because they know this group uses it.\n*   **Strategic**: The CISO presents a report to the Board requesting $2M for offline backups because reliance on cloud sync is a strategic weakness against this specific threat actor.\n\nAll three types work together to protect the organization.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:41:22'),
(981, 768, '## Module 1 Assessment\nPass this quiz to complete the module.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:30:45'),
(982, 769, '## Open Source Intelligence (OSINT)\n\n**OSINT** is data collected from publicly available sources to be used in an intelligence context. \"Open Source\" does not mean \"Open Source Software\" (like Linux). It means **Publicly Accessible Information (PAI)**.\n\nIf it is on the internet and you can access it without hacking a password, it is OSINT.\n\n---\n\n### The OSINT Landscape\nOSINT is vast. It covers:\n1.  **The Surface Web**: Google, News, Company Websites. (4% of web).\n2.  **The Deep Web**: Content not indexed by Search Engines (Databases, Court Records, Wayback Machine).\n3.  **The Dark Web**: Networks requiring specific software (Tor/I2P) to access. Marketplace for stolen data.\n4.  **Social Media**: Twitter, LinkedIn, Instagram, Reddit.\n5.  **Technical Data**: DNS records, WHOIS, SSL Certificates, IP Geolocation.\n\n---\n\n### Passive vs Active Reconnaissance\nThis distinction keeps you out of jail.\n\n#### Passive Reconnaissance (Safe)\nGathering info **without** interacting directly with the target\'s systems.\n*   **Method**: You query Google, Shodan, or Whois.\n*   **Visibility**: The target sees traffic from Google/Shodan, not YOU.\n*   **Risk**: Near Zero.\n*   *Example*: Searching `site:target.com` on Google.\n\n#### Active Reconnaissance (Risky)\nGathering info by **touching** the target.\n*   **Method**: Port Scanning (Nmap), Vulnerability Scanning (Nessus), connecting to their web server.\n*   **Visibility**: Your IP address appears in their Firewall/Web logs.\n*   **Risk**: High. You can be blocked or flagged as an attacker.\n*   *Example*: Running `nmap -sS -p- target.com`.\n\n---\n\n### OPSEC: Operations Security\n\"If you stare into the abyss, the abyss stares back.\"\nWhen you research a Threat Actor or a malicious domain, you must assume they are watching their logs. If they see a request from \"My-Corporate-Laptop\", they know you are on to them.\n\n#### The Golden Rules of Intelligence OPSEC\n1.  **Never Use Your Real Identity**: Do not use your personal Gmail or corporate email to register for forums.\n2.  **Use a Sock Puppet**: A fake online persona.\n    *   *Name*: Generic but realistic.\n    *   *Photo*: AI Generated (thispersondoesnotexist.com) - avoid reverse image search hits.\n    *   *History*: An empty account looks suspicious. A good sock puppet has months of benign activity.\n3.  **Manage Attribution**:\n    *   **VPN**: Hides your IP.\n    *   **Tor**: Anonymizes your traffic (but beware, Tor exit nodes are public).\n    *   **Virtual Machines (VM)**: Always browse from a disposable VM (like Whonix or Kali). If you get infected, you just delete the VM.\n    *   **User Agents**: Spoof your browser string to blend in.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:43:25'),
(983, 770, '## Infrastructure OSINT\n\nAdversaries need infrastructure to attack you. They need Domains for Phishing and IPs for Command & Control (C2). By analyzing this infrastructure, we can pivot and find more of their network.\n\n---\n\n### 1. WHOIS Data\nWHOIS is the registration record for a domain. It tells you:\n*   **Registrar**: GoDaddy, Namecheap, etc.\n*   **Dates**: Creation Date (New domains are suspicious!), Expiry Date.\n*   **Registrant**: Name, Email, Phone.\n*   **Name Servers**: `ns1.hosting.com`.\n\n> ⚠️ **The GDPR Problem**: Since 2018 (GDPR), most personal WHOIS data is \"Redacted for Privacy\". However, historical WHOIS services (like Whoxy or various paid tools) often cached the record *before* it was redacted.\n\n### 2. DNS Enumeration\nDNS is the phonebook of the internet. We want to find every subdomain associated with a target.\n*   **A Record**: Maps `domain.com` -> `1.2.3.4` (IPv4).\n*   **CNAME Record**: Alias. `blog.target.com` -> `wordpress.com`.\n*   **MX Record**: Mail Exchange. Tells you who hosts their email (e.g., `protection.outlook.com` means they use Microsoft 365).\n*   **TXT Record**: Often reveals trust relationships. `include:sending.service.com` in SPF records tells you they use that vendor for marketing emails.\n\n### 3. Certificate Transparency (CT)\nThis is a goldmine for OSINT.\nWhen a Certificate Authority (like Let\'s Encrypt) issues an SSL/TLS certificate, they MUST publish it to a public **Certificate Transparency Log**.\n*   **Why it helps**: If an attacker sets up `phishing.target-login.com` and gets an SSL cert to make it \"secure\", that hostname appears in the public CT logs **immediately**.\n*   **Tool**: `crt.sh`. Just search `%target.com` to see every sub-domain they have ever secured.\n\n### Pivot Techniques\n*   **Reverse DNS**: \"What other domains are hosted on this IP?\" (Shared hosting vs Dedicated C2).\n*   **Reverse Analytics**: \"What other websites share this Google Analytics ID?\" (Links attacker sites together).\n*   **Reverse WHOIS**: \"Show me all domains registered by `badguy@evil.com`.\"', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:43:25'),
(984, 771, '## Social Media Intelligence (SOCMINT)\n\nPeople are the weakest link. They overshare. SOCMINT exploits this to gather intelligence on targets (employees) or threats (hackers).\n\n---\n\n### Key Platforms\n1.  **LinkedIn**: The #1 source for corporate recon.\n    *   *Attacker View*: \"I need to phish the SysAdmin. I\'ll search LinkedIn for `System Administrator` at `Target Company`. Oh, here is Bob. Bob lists `Cisco ASA` in his skills. Now I know they use Cisco firewalls.\"\n2.  **Twitter / X**: Real-time news ticker.\n    *   Security researchers post 0-days here first.\n    *   Hacktivists announce DDoS attacks here.\n    *   *Search*: `(from:user) until:2023-01-01` (Time travel).\n3.  **Telegram**: The modern \"Dark Web\".\n    *   Ransomware groups run public \"News Channels\" to name-and-shame victims.\n    *   Cybercrime markets sell access and tools in group chats.\n\n### Username Enumeration\nWe are creatures of habit. If my handle is `hacker_123` on Reddit, it is probably `hacker_123` on GitHub and Instagram.\n*   **Concept**: Identity Resolution. Connecting a digital persona across different platforms to build a full profile.\n*   **Tool**: **Sherlock** or **WhatsMyName**. These scripts query hundreds of websites: \"Does `user/hacker_123` exist?\"\n\n### HUMINT (Human Intelligence)\nIn the digital world, this means interacting with people to get info.\n*   **Scenario**: An analyst joins a discord server for a hacking tool and asks \"Does this allow persistence?\" to understand its capabilities.\n*   **Risk**: **Extreme**. Interacting with threat actors can legally verify them, tip them off, or violate specific laws (like providing material support if you buy something).\n*   **Policy**: Most SOCs have a strict \"Passive Only\" policy. You can watch, but you cannot talk.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:43:25'),
(985, 772, '## OSINT Tools Workshop\n\nLet\'s get hands-on with the essential toolkit.\n\n### 1. Google Dorking\nUsing advanced search operators to uncover hidden data.\n*   `site:`: Limit results to a domain.\n*   `filetype:`: Look for specific files (pdf, docx, xlsx).\n*   `inurl:`: Look for text in the URL.\n*   `intitle:`: Look for text in the page title.\n\n**recipes**:\n*   *Find Sensitive Files*: `site:target.com filetype:xlsx \"password\"`\n*   *Find Login Portals*: `site:target.com inurl:login`\n*   *Find Open Directories*: `intitle:\"index of /\" \"parent directory\"`\n*   *Public Trello Boards*: `site:trello.com \"password\" OR \"credentials\"`\n\n### 2. Shodan.io\n\"Google for the Internet of Things\". It scans the entire internet (IPv4) 24/7.\n*   **Webcam**: `Server: SQ-WEBCAM`\n*   **Industrial Control Systems**: `port:502` (Modbus)\n*   **RDP (Remote Desktop)**: `port:3389`\n*   **Vulnerability**: `vuln:CVE-2017-0144` (Finds EternalBlue vulnerable hosts).\n*   **Filter**: `org:\"Target Corp\" port:443`\n\n### 3. Maltego\nA link analysis tool used to visualize relationships.\n*   **Input**: A domain (e.g., `google.com`).\n*   **Transform**: A script that runs on the input (e.g., \"To MX Record\").\n*   **Output**: The mail server node.\n*   **Use Case**: Mapping an entire criminal infrastructure from a single email address.\n\n### 4. The Wayback Machine (Archive.org)\nThe internet never forgets.\n*   **Defacement**: See if a site was hacked in the past.\n*   **Job Posts**: Find old job descriptions listing specific software versions that are now vulnerable.\n*   **Deleted Code**: Developers often post secrets (API Keys) to Pastebin or Github and then delete them. Archive sites might catch them.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:43:25'),
(986, 773, '## Module 2 Assessment\nPass this quiz to complete the module.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:30:45'),
(987, 774, '## Introduction to Malware Analysis\n\nMalware Analysis is the study of malicious software. Our goal is to understand:\n1.  **Capability**: What can this malware do? (Steal passwords? Encrypt files?).\n2.  **Indicators**: How can we detect it? (Files created, network traffic).\n3.  **Attribution**: Who wrote it? (Rarely successful, but possible).\n\n---\n\n### Static Analysis (Safe & Fast)\nAnalyzing the file **without executing it**. It is like looking at a bomb through an X-ray machine.\n*   **Pros**: Safe. Fast. Can analyze \"dead\" malware (C2 is offline).\n*   **Cons**: Modern malware is \"packed\" (obfuscated) and hides its secrets until runtime.\n*   **Techniques**:\n    *   File Hashing (Fingerprinting).\n    *   Strings Analysis (Finding text).\n    *   PE Header Analysis (Import Table - what DLLs does it need?).\n\n### Dynamic Analysis (Risky & Detailed)\n**Running** the malware in a controlled environment (Sandbox) to watch it explode.\n*   **Pros**: Shows true behavior. Unpacks itself automatically.\n*   **Cons**: Risk of infection/escape. Some malware detects the sandbox and \"plays dead\" (Anti-VM techniques).\n*   **Techniques**:\n    *   Process Monitoring (ProcMon).\n    *   Network Sniffing (Wireshark/Fiddler).\n    *   Registry Watchers.\n\n### The Golden Rule\n**NEVER** analyze malware on your host machine.\n**ALWAYS** use an isolated Virtual Machine (VM) with no shared folders and (preferably) a routed network interface that simulates the internet (like INetSim).', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:43:25'),
(988, 775, '## Key Indicators: Strings & Hashes\n\nThis is \"Basic Static Analysis\". It takes 5 minutes and solves 50% of cases.\n\n### 1. File Hashing\nA hash is a one-way mathematical fingerprint changes. If you change 1 bit of the file, the hash changes completely.\n*   **MD5**: 32 chars. Fast. Broken (Collisions possible). OK for database lookups.\n*   **SHA-256**: 64 chars. Standard. Unique.\n*   **Workflow**:\n    1.  Get Sample.\n    2.  `sha256sum malware.exe`.\n    3.  Paste hash into **VirusTotal.com**.\n    4.  If 50/70 vendors say \"Malicious\", you are done.\n\n### 2. Strings Analysis\nProgrammers leave text in code: URLs, IP addresses, Error Messages, Passwords.\nThe `strings` command extracts all ASCII and Unicode readable text.\n*   **Suspicious Strings**:\n    *   `CreateRemoteThread` (Used for Injection).\n    *   `URLDownloadToFile` (Dropper behavior).\n    *   `192.168.x.x` (Internal IPs).\n    *   `cmd.exe /c` (Command execution).\n    *   `C:UsersTarget...` (PDB Paths showing the author\'s username!).\n\n### 3. Packing & Entropy\nMalware authors \"Pack\" their code (like a ZIP file) to hide these strings from antivirus.\n*   **Entropy**: Randomness.\n*   **Low Entropy**: Standard English text (lots of repeated patterns like \"the\").\n*   **High Entropy**: Encrypted or Compressed data (looks like random noise).\n*   **Detection**: If a file has Entropy > 7.0 (out of 8), it is likely Packed. You won\'t see any strings until you unpack it.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:43:25'),
(989, 776, '## Module 3 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(990, 777, '## Indicators: IOCs vs IOAs\n\nIn Cyber Threat Intelligence, an **Indicator** is a piece of information that suggests a potential compromise or attack. But not all indicators are created equal.\n\n### 1. Indicators of Compromise (IOC)\nEvidence that a breach has **already occurred**. These are static artifacts.\n*   **The \"Forensic\" Approach**.\n*   **Examples**:\n    *   **MD5 Hash**: `a1b2c3d4...` (A known malware file).\n    *   **IP Address**: `192.168.1.5` (A known C2 server).\n    *   **Domain**: `update-microsoft-support.com` (A phishing site).\n*   **Use Case**: You load these into your Firewall/EDR to **Block** bad things.\n*   **Weakness**: They are easy to change. An attacker can change a file hash in 1 second by adding a null byte.\n\n### 2. Indicators of Attack (IOA)\nEvidence of the **intent** or **behavior** of an attack in progress.\n*   **The \"Real-time\" Approach**.\n*   **Examples**:\n    *   **Lateral Movement**: A user logging into 50 servers in 1 minute.\n    *   **Credential Dumping**: Accessing the `lsass.exe` process memory.\n    *   **Persistence**: Creating a Scheduled Task named \"Updater\" that runs a script in `C:Temp`.\n*   **Use Case**: You write behavioral rules (SIEM/EDR) to detect the *technique*, not the specific file.\n*   **Strength**: Behaviors are hard to change. If an attacker wants to dump credentials, they *must* touch memory somehow.\n\n---\n\n### The Pyramid of Pain\nCreated by David Bianco, this concept illustrates how much pain you cause the adversary when you deny them each indicator type.\n\n1.  **Hash Values (Trivial)**: Attacker just recompiles. NO PAIN.\n2.  **IP Addresses (Easy)**: Attacker rents a new VPS. LOW PAIN.\n3.  **Domain Names (Simple)**: Attacker registers a new domain. LOW PAIN.\n4.  **Network / Host Artifacts (Annoying)**: e.g., \"User Agent String\". Attacker must recode their tool. MEDIUM PAIN.\n5.  **Tools (Challenging)**: e.g., \"Mimikatz\". If you detect the *tool*, they must write a new one. HIGH PAIN.\n6.  **TTPs (Tough!)**: Tactics, Techniques, and Procedures. If you detect *how* they behave (e.g., \"Pass the Hash\"), they have to relearn how to hack. **MAXIMUM PAIN**.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(991, 778, '## Traffic Light Protocol (TLP)\n\nIntelligence is useless if not shared, but dangerous if shared too widely. The **Traffic Light Protocol (TLP)** is the global standard for defining \"Who can see this?\"\n\nIt was updated to TLP 2.0 in 2022.\n\n---\n\n### TLP Levels\n\n#### 🔴 TLP:RED (For Your Eyes Only)\n*   **Definition**: Not for disclosure, restricted to participants only.\n*   **Scenario**: A partner sends you a list of compromised employees involved in an internal investigation.\n*   **Action**: You cannot share this with *anyone* outside the specific meeting/email thread. Not even your boss, unless they were named.\n\n#### 🟠 TLP:AMBER (Limited Disclosure)\n*   **Definition**: Limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients.\n*   **Scenario**: A vendor tells you about a vulnerability in their software that is actively exploited but no patch exists yet.\n*   **Action**: You can tell your System Admins to block the port. You CANNOT write a blog post about it.\n*   **TLP:AMBER+STRICT**: New in 2.0. Means \"Organization Only\" (No clients).\n\n#### 🟢 TLP:GREEN (Community Wide)\n*   **Definition**: Limited disclosure, restricted to the community.\n*   **Scenario**: An industry ISAC (e.g., Financial-ISAC) shares a list of Phishing domains targeting banks.\n*   **Action**: You can share this with partner organizations and peers. You CANNOT publish it on public Twitter.\n\n#### ⚪ TLP:CLEAR (Public)\n*   **Definition**: Subject to standard copyright rules, otherwise unrestricted.\n*   **Scenario**: A published whitepaper on APT29.\n*   **Action**: Post it on LinkedIn, print it, shout it from the rooftops.\n\n---\n\n### Sharing Standards: STIX & TAXII\nHow do we share this data technically?\n\n1.  **STIX (Structured Threat Information Expression)**: The **Language**.\n    *   It is a JSON format.\n    *   It defines objects like `Attack Pattern`, `Identity`, `Malware`, `Indicator`.\n2.  **TAXII (Trusted Automated eXchange of Intelligence Information)**: The **Transport**.\n    *   It is the API (HTTPS) that carries the STIX packages.\n    *   Think of STIX as the package and TAXII as the delivery truck.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(992, 779, '## Module 4 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(993, 780, '## MITRE ATT&CK Framework\n\n**Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)**.\nIt is the periodic table of hacker behavior. It moves us away from \"My antivirus blocked a virus\" to \"The adversary used **T1059.001 (PowerShell)** to execute code.\"\n\n### The Hierarchy\n1.  **Tactics (The Goal - \"Why\")**: The column headers. There are 14 tactics.\n    *   *Examples*: Initial Access, execution, Persistence, Privilege Escalation, Command and Control.\n2.  **Techniques (The Method - \"How\")**: The cells in the column.\n    *   *Example*: Under \"Initial Access\", you have \"Phishing\" (T1566) and \"Exploit Public-Facing Application\" (T1190).\n3.  **Procedures (The Implementation - \"Specifics\")**: The exact command or tool used.\n    *   *Example*: \"APT33 sent a spearphishing email with a malicious HTA file.\"\n\n### Deep Dive: Technique T1059 (Command and Scripting Interpreter)\nThis is one of the most common techniques.\n*   **Sub-Techniques**:\n    *   `.001 PowerShell`: Windows native automation tool. Loved by hackers because it is installed everywhere.\n    *   `.004 Unix Shell`: Bash/Zsh on Linux/Mac.\n*   **Detection**: You cannot just \"Block PowerShell\". You must look for *malicious use* of PowerShell (e.g., Encoded Commands, Downloads).\n\n### Why use ATT&CK?\n1.  **Common Language**: Red Team says \"I validated T1059\". Blue Team says \"I detected T1059\". Executive says \"We are protected against Scripting attacks\".\n2.  **Gap Analysis**: You can map your defenses against the matrix. \"We have great coverage for Malware (Execution) but zero coverage for Exfiltration\".', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(994, 781, '## MITRE ATT&CK Navigator\n\nThe **Navigator** is an open-source web tool tailored for annotating and visualizing the ATT&CK Matrix. It allows you to create \"Layers\".\n\n### Use Case 1: Threat Profiling\nScenario: You work for a Bank. You are worried about the \"Carbanak\" group.\n1.  Open Navigator.\n2.  Select \"Carbanak\" from the Threat Actor list.\n3.  The tool highlights every technique Carbanak has used in red.\n**Result**: A visual map of your enemy\'s playbook.\n\n### Use Case 2: Defensive Coverage Map\n1.  Create a new Layer.\n2.  Ask your SIEM engineers: \"Can we detect PowerShell?\" (Yes -> Color Green). \"Can we detect Exfiltration over USB?\" (No -> Color Red).\n3.  Fill in the matrix based on your actual capabilities.\n**Result**: A \"You Are Here\" map of your security posture.\n\n### Use Case 3: Overlay (The Gap Analysis)\n1.  Take the **Threat Layer** (Red).\n2.  Take the **Defense Layer** (Green).\n3.  Combine them.\n4.  **The Panic Zone**: Any technique that is colored Red (Threat uses it) but NOT Green (Defense covers it).\n**Result**: This is your immediate roadmap. \"We need to build detections for T1059 because Carbanak uses it and we can\'t see it.\"', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(995, 782, '## Module 5 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(996, 783, '## Introduction to Threat Hunting\n\n**Threat Hunting** is the process of proactively and iteratively searching through networks to detect and isolate advanced threats that avoid existing security solutions.\n\n### The \"Assume Breach\" Paradigm\nTraditional security assumes \"We are safe until the alarm rings.\"\nHunting assumes **\"We are already compromised, we just haven\'t found it yet.\"**\n\n### Types of Hunts\n1.  **Hypothesis Driven**: The scientific method.\n    *   *Hypothesis*: \"Attackers are traversing our network using `PsExec`.\"\n    *   *Test*: Search logs for Event ID 7045 (Service Install) matching PsExec patterns.\n2.  **Intelligence Driven**: Based on a new report.\n    *   *Input*: \"CISA releases report on Volt Typhoon using living-off-the-land binaries.\"\n    *   *Hunt*: Search for the specific behaviors mentioned in the report.\n3.  **Analytics Driven**: Using Math/ML.\n    *   *Input*: \"Show me any user who logged into more than 10 machines in 1 hour.\" (Outlier detection).\n\n### The Hunting Maturity Model (HMM)\n*   **HMM0 (Initial)**: relies primarily on automated alerting. No hunting.\n*   **HMM1 (Minimal)**: Incorporates threat intelligence to drive search.\n*   **HMM2 (Procedural)**: Follows established procedures for hunting. Routine.\n*   **HMM3 (Innovative)**: Creates new hunting methods and automates them.\n*   **HMM4 (Leading)**: Automates the entire process.\n\n### Success Metrics\nHow do you measure a Hunt?\n*   It is **NOT** just \"Finding Bad Guys\". If you hunt for 4 hours and find nothing, that is a success! You proved the network is clean of that specific threat.\n*   **Goal**: Improve Visibility. If you tried to hunt for `PsExec` and couldn\'t because you didn\'t have the right logs, the \"Success\" is identifying that logging gap.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(997, 784, '## Hunting Techniques: Stacking & Clustering\n\nWhen you have 100 Million log events, you can\'t read them all. You need data science techniques to find the needle in the haystack.\n\n### 1. Stacking (Frequency Analysis)\nAlso known as \"Least Frequency Analysis\".\n**Concept**: In a large network, \"Normal\" behaves the same way. \"Evil\" stands out because it is rare.\n\n**Scenario**:\nYou export the \"User Agent\" string from all web traffic in your company.\n1.  **Mozilla/5.0... (Chrome)**: 50,000 counts. (Normal employees).\n2.  **Mozilla/5.0... (Edge)**: 30,000 counts. (Normal employees).\n3.  ...\n4.  **Updates.exe**: 500 counts. (Windows Update).\n5.  **Python-urllib/3.8**: 2 counts. (**Suspicious!**)\n6.  **Kali-Linux**: 1 count. (**Malicious!**).\n\nYou ignore the \"Short Stack\" (High frequency) and investigate the \"Long Tail\" (Low frequency).\n\n### 2. Clustering\nGrouping data points by shared characteristics to find patterns.\n*   **Example**: Grouping all \"svchost.exe\" processes.\n    *   We know `svchost.exe` should usually be spawned by `services.exe`.\n    *   If we cluster by \"Parent Process\", we might see:\n        *   Cluster A: Parent = `services.exe` (Count: 9000).\n        *   Cluster B: Parent = `explorer.exe` (Count: 1). **MALICIOUS**. Services do not run from explorer.\n\n### 3. Box Plotting (Outliers)\nVisualizing data to see who is outside the norm.\n*   \"Average Data Upload per User per Day\": 50MB.\n*   \"User Bob\": 50GB.\nBob is an outlier. He is either backing up his PC or exfiltrating data.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(998, 785, '## Module 6 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(999, 786, '## Threat Intelligence Platform (TIP)\n\nA **TIP** is the heart of a CTI program. It is where you aggregate, analyze, and disseminate intelligence. Without a TIP, you are just managing Spreadsheets of Death.\n\n### Core Functions of a TIP\n\n#### 1. Maximum Aggregation\nYou have 50 sources of intel:\n*   Paid Feeds (CrowdStrike, Mandiant).\n*   Open Source Feeds (AlienVault OTX, Abuse.ch).\n*   ISAC Emails (Financial-ISAC).\n*   Twitter APIs.\nA TIP sucks all of these in automatically via API.\n\n#### 2. Normalization & Deduplication\nIf CrowdStrike reports `IP: 1.2.3.4` as \"Cobalt Strike\" and AlienVault reports `IP: 1.2.3.4` as \"Scanning\", you don\'t want two rows in your database.\nThe TIP merges these into one \"Object\" with two \"tags\".\n\n#### 3. Enrichment (Context)\nWhen an indicator arrives, the TIP asks questions automatically:\n*   **VirusTotal**: \"What is the detection ratio?\"\n*   **Whois**: \"When was this domain registered?\"\n*   **Passive DNS**: \"What domains resolved to this IP in the past?\"\nThis saves the analyst 20 minutes of manual searching per indicator.\n\n#### 4. Dissemination (Integration)\nThe most important part.\n*   **SIEM**: Push High Confidence IOCs to Splunk for detection.\n*   **Firewall**: Push High Confidence IPs to the Edge Firewall for blocking.\n*   **SOAR**: Trigger a playbook to scan endpoints for a file hash.\n\n---\n\n### The TIP Ecosystem\nThe TIP sits in the middle.\n*   **Input**: Feeds -> TIP\n*   **Output**: TIP -> SIEM / Firewall / EDR.\n\n> 💡 **Pro Tip**: Never push \"Raw Feed\" data directly to a Firewall. You block Google DNS by mistake once, and you lose your job. Always filter through a TIP first.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:47:47'),
(1000, 787, '## MISP (Malware Information Sharing Platform)\n\n**MISP** is the de-facto standard for sharing threat intelligence. It is free, open source, and used by NATO, Governments, and 6,000+ organizations.\n\n### The MISP Data Model\nUnderstanding MISP requires understanding its hierarchy:\n\n1.  **Event**: The \"Folder\".\n    *   *Example*: \"Emotet Phishing Campaign - Dec 2024\".\n    *   Contains metadata: Date, Org, TLP Level.\n2.  **Attribute**: The \"File\".\n    *   *Example*: `192.168.1.1` (ip-dst), `malware.exe` (filename).\n    *   **IDS Flag**: If checked, this attribute is exported to NIDS/SIEM.\n3.  **Object**: A template for complex data.\n    *   *Example*: A \"File\" object links `filename`, `md5`, `sha1`, and `size` together so context isn\'t lost.\n4.  **Galaxy (Tags)**: High level context.\n    *   *Threat Actor*: \"APT29\".\n    *   *Mitre technique*: \"T1566 - Phishing\".\n\n### The Sharing Graph\nMISP instances synchronize.\n*   **Pull**: You connect to `CIRCL.lu` (The main European node) and download 50,000 events.\n*   **Push**: You create an event about a new threat and \"Publish\" it. It replicates to all your partners instantly.\n*   **Filter**: You can say \"Pull everything EXCEPT events marked TLP:RED.\"\n\n### Why use MISP?\n*   **Cost**: Free.\n*   **Community**: It is where the community lives.\n*   **Formats**: Exports to STIX, CSV, Snort, Suricata, Bro/Zeek automatically.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:47:47'),
(1001, 788, '## Module 7 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(1002, 789, '## Writing Effective Intelligence Reports\n\nThe best analysis in the world is worthless if the report is confusing.\n\n### 1. The BLUF (Bottom Line Up Front)\nExecutives do not read mystery novels. They want the spoiler on page 1.\n*   **Structure**: State the **Key Judgment** and **Recommendation** in the first paragraph.\n*   *Example*:\n    > **Executive Summary**: We assess with High Confidence that the \"Finance-Payroll\" server is compromised by Ransomware. We recommend immediate network isolation of the entire Finance subnet to prevent spread.\n\n### 2. Words of Estimative Probability (WEP)\nNever use vague words like \"Maybe\", \"Possibly\", or \"Might\". They mean different things to different people.\nStandardize your language (based on Intelligence Community Directives - ICD 203):\n\n| Term | Probability | Meaning |\n|---|---|---|\n| **Almost Certain** | 90-99% | No doubt. Strong evidence. |\n| **Likely / Probable** | 60-90% | Logical, supported by evidence, but gaps exist. |\n| **Roughly Even Chance** | 40-60% | Could go either way. Ambiguous evidence. |\n| **Unlikely** | 10-40% | Evidence suggests this is not the case. |\n| **Remote** | < 10% | Highly improbable. |\n\n*   *Bad*: \"It might be Russia.\"\n*   *Good*: \"We assess with **Moderate Confidence** that the actor is Russian-aligned.\"\n\n### 3. Audience Analysis\nWrite for the reader, not for yourself.\n*   **Strategic Report (CISO/Board)**:\n    *   **Focus**: Impact, Cost, Risk, Trends.\n    *   **Language**: Business English. No \"Hash values\" or \"IPs\".\n    *   **Length**: 1 Page max.\n*   **Operational Report (SOC Manager)**:\n    *   **Focus**: TTPs, Attribution, Campaign timeline.\n    *   **Language**: Technical but explained.\n*   **Tactical Report (Analyst/Engineer)**:\n    *   **Focus**: IOCs, Signatures, Rules.\n    *   **Language**: Raw Data (JSON/CSV). \"Just give me the list.\"\n\n### 4. Analysis vs Facts\nClearly separate **what you know** (Facts) from **what you think** (Assessment).\n*   *Fact*: \"The malware communicates with 1.2.3.4.\"\n*   *Assessment*: \"1.2.3.4 is likely a C2 server.\"\nIf you mix them, you mislead the reader.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:47:47'),
(1003, 790, '## Module 8 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32');

-- --------------------------------------------------------

--
-- Table structure for table `lesson_questions`
--

CREATE TABLE `lesson_questions` (
  `id` int(11) NOT NULL,
  `task_id` int(11) NOT NULL,
  `question_text` text NOT NULL,
  `question_order` int(11) NOT NULL,
  `correct_answer` text NOT NULL,
  `case_sensitive` tinyint(1) DEFAULT 0,
  `hint` text DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `options` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL CHECK (json_valid(`options`))
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `lesson_questions`
--

INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(4164, 1, 'Which component of the CIA Triad ensures that data has not been tampered with?', 1, 'Integrity', 0, 'Think about accuracy and trustworthiness.', '2025-12-26 14:39:59', '[\"Confidentiality\", \"Integrity\", \"Availability\", \"Authorization\"]'),
(4165, 1, 'What is the primary goal of a Phishing attack?', 2, 'To trick users into revealing information', 0, 'It often involves fraudulent emails.', '2025-12-26 14:39:59', '[\"To encrypt hard drives\", \"To slow down the network\", \"To trick users into revealing information\", \"To physically damage hardware\"]'),
(4166, 1, 'Who is considered the \"first line of defense\" in a security team?', 3, 'SOC Analyst', 0, 'They monitor alerts and logs daily.', '2025-12-26 14:39:59', '[\"CISO\", \"SOC Analyst\", \"HR Manager\", \"External Auditors\"]'),
(4167, 2, 'What is the first step in response?', 1, 'Detection', 0, 'Finding it', '2025-12-26 14:39:59', '[\"Panic\", \"Shutdown\", \"Detection\", \"Ignoring\"]'),
(4168, 2, 'Who is the primary adversary?', 2, 'Threat actor', 0, 'Malicious user', '2025-12-26 14:39:59', '[\"Threat actor\", \"Manager\", \"System admin\", \"Regular user\"]'),
(4169, 2, 'What is the priority level?', 3, 'High priority', 0, 'Urgency level', '2025-12-26 14:39:59', '[\"No priority\", \"Optional\", \"Low priority\", \"High priority\"]'),
(4170, 3, 'What is the main output?', 1, 'Log data', 0, 'Event records', '2025-12-26 14:39:59', '[\"Log data\", \"Video streams\", \"Music files\", \"Printer ink\"]'),
(4171, 3, 'When to escalate?', 2, 'Confirmed threat', 0, 'Real danger', '2025-12-26 14:39:59', '[\"Confirmed threat\", \"False alarm\", \"User login\", \"Minor bug\"]'),
(4172, 3, 'What is the priority level?', 3, 'High priority', 0, 'Urgency level', '2025-12-26 14:39:59', '[\"High priority\", \"Low priority\", \"Optional\", \"No priority\"]'),
(4173, 4, 'What is the defensive goal?', 1, 'Protection', 0, 'Safety', '2025-12-26 14:39:59', '[\"Deleting\", \"Protection\", \"Exposure\", \"Sharing\"]'),
(4174, 4, 'What is the first step in response?', 2, 'Detection', 0, 'Finding it', '2025-12-26 14:39:59', '[\"Panic\", \"Ignoring\", \"Shutdown\", \"Detection\"]'),
(4175, 4, 'What tool category is this?', 3, 'Security tool', 0, 'Software type', '2025-12-26 14:39:59', '[\"Game engine\", \"Music player\", \"Security tool\", \"Office tool\"]'),
(4176, 5, 'Who is the primary adversary?', 1, 'Threat actor', 0, 'Malicious user', '2025-12-26 14:39:59', '[\"Threat actor\", \"System admin\", \"Manager\", \"Regular user\"]'),
(4177, 5, 'What is the main output?', 2, 'Log data', 0, 'Event records', '2025-12-26 14:39:59', '[\"Printer ink\", \"Music files\", \"Video streams\", \"Log data\"]'),
(4178, 5, 'What should you analyze first?', 3, 'Context', 0, 'The situation', '2025-12-26 14:39:59', '[\"Weather\", \"Lunch menu\", \"Sports scores\", \"Context\"]'),
(4179, 6, 'What is the primary goal of this concept?', 1, 'Risk reduction', 0, 'Lowers danger', '2025-12-26 14:39:59', '[\"Risk reduction\", \"Data deletion\", \"Cost increase\", \"System slowdown\"]'),
(4180, 6, 'What should you analyze first?', 2, 'Context', 0, 'The situation', '2025-12-26 14:39:59', '[\"Context\", \"Sports scores\", \"Weather\", \"Lunch menu\"]'),
(4181, 6, 'When to escalate?', 3, 'Confirmed threat', 0, 'Real danger', '2025-12-26 14:39:59', '[\"False alarm\", \"Confirmed threat\", \"User login\", \"Minor bug\"]'),
(4182, 7, 'What tool category is this?', 1, 'Security tool', 0, 'Software type', '2025-12-26 14:39:59', '[\"Office tool\", \"Music player\", \"Game engine\", \"Security tool\"]'),
(4183, 7, 'What is the primary goal of this concept?', 2, 'Risk reduction', 0, 'Lowers danger', '2025-12-26 14:39:59', '[\"Risk reduction\", \"Data deletion\", \"Cost increase\", \"System slowdown\"]'),
(4184, 7, 'Which team handles these incidents?', 3, 'SOC team', 0, 'Security Operations', '2025-12-26 14:39:59', '[\"HR Department\", \"SOC team\", \"Marketing\", \"Sales Team\"]'),
(4185, 8, 'What is the main output?', 1, 'Log data', 0, 'Event records', '2025-12-26 14:39:59', '[\"Log data\", \"Music files\", \"Printer ink\", \"Video streams\"]'),
(4186, 8, 'What is the first step in response?', 2, 'Detection', 0, 'Finding it', '2025-12-26 14:39:59', '[\"Ignoring\", \"Panic\", \"Detection\", \"Shutdown\"]'),
(4187, 8, 'What is the primary goal of this concept?', 3, 'Risk reduction', 0, 'Lowers danger', '2025-12-26 14:39:59', '[\"Cost increase\", \"System slowdown\", \"Data deletion\", \"Risk reduction\"]'),
(4188, 9, 'What tool category is this?', 1, 'Security tool', 0, 'Software type', '2025-12-26 14:39:59', '[\"Office tool\", \"Security tool\", \"Music player\", \"Game engine\"]'),
(4189, 9, 'What should you analyze first?', 2, 'Context', 0, 'The situation', '2025-12-26 14:39:59', '[\"Weather\", \"Context\", \"Lunch menu\", \"Sports scores\"]'),
(4190, 9, 'Who is the primary adversary?', 3, 'Threat actor', 0, 'Malicious user', '2025-12-26 14:39:59', '[\"Threat actor\", \"System admin\", \"Manager\", \"Regular user\"]'),
(4191, 10, 'What should you analyze first?', 1, 'Context', 0, 'The situation', '2025-12-26 14:39:59', '[\"Weather\", \"Sports scores\", \"Lunch menu\", \"Context\"]'),
(4192, 10, 'Which team handles these incidents?', 2, 'SOC team', 0, 'Security Operations', '2025-12-26 14:39:59', '[\"Marketing\", \"SOC team\", \"Sales Team\", \"HR Department\"]'),
(4193, 10, 'Who is the primary adversary?', 3, 'Threat actor', 0, 'Malicious user', '2025-12-26 14:39:59', '[\"System admin\", \"Threat actor\", \"Regular user\", \"Manager\"]'),
(4194, 11, 'What is the main output?', 1, 'Log data', 0, 'Event records', '2025-12-26 14:39:59', '[\"Video streams\", \"Log data\", \"Printer ink\", \"Music files\"]'),
(4195, 11, 'What is the first step in response?', 2, 'Detection', 0, 'Finding it', '2025-12-26 14:39:59', '[\"Shutdown\", \"Detection\", \"Panic\", \"Ignoring\"]'),
(4196, 11, 'When to escalate?', 3, 'Confirmed threat', 0, 'Real danger', '2025-12-26 14:39:59', '[\"User login\", \"False alarm\", \"Confirmed threat\", \"Minor bug\"]'),
(4197, 12, 'What is the primary goal of this concept?', 1, 'Risk reduction', 0, 'Lowers danger', '2025-12-26 14:39:59', '[\"Cost increase\", \"System slowdown\", \"Risk reduction\", \"Data deletion\"]'),
(4198, 12, 'When to escalate?', 2, 'Confirmed threat', 0, 'Real danger', '2025-12-26 14:39:59', '[\"Minor bug\", \"Confirmed threat\", \"User login\", \"False alarm\"]'),
(4199, 12, 'What is the defensive goal?', 3, 'Protection', 0, 'Safety', '2025-12-26 14:39:59', '[\"Exposure\", \"Deleting\", \"Protection\", \"Sharing\"]'),
(5264, 32, 'What is the standard system drive letter?', 1, 'C:', 0, 'Primary Windows drive', '2025-12-26 20:49:49', '[\"A:\", \"B:\", \"C:\", \"D:\"]'),
(5265, 32, 'Which file system is modern and supports permissions?', 2, 'NTFS', 0, 'Permissions supported', '2025-12-26 20:49:49', '[\"FAT32\", \"NTFS\", \"exFAT\", \"HFS+\"]'),
(5266, 32, 'What is the max file size for FAT32?', 3, '4 GB', 0, 'Size limit', '2025-12-26 20:49:49', '[\"2 GB\", \"4 GB\", \"8 GB\", \"Unlimited\"]'),
(5267, 33, 'What does UAC stand for?', 1, 'User Account Control', 0, 'Permission system', '2025-12-26 20:49:49', '[\"User Access Control\", \"User Account Control\", \"Unified Access Center\", \"Universal App Control\"]'),
(5268, 33, 'Which color shield indicates a trusted app?', 2, 'Blue', 0, 'Signed application', '2025-12-26 20:49:49', '[\"Red\", \"Yellow\", \"Blue\", \"Green\"]'),
(5269, 33, 'Which UAC level is the most secure?', 3, 'Always Notify', 0, 'Maximum protection', '2025-12-26 20:49:49', '[\"Always Notify\", \"Notify me only when apps try to make changes\", \"Notify me (do not dim my desktop)\", \"Never Notify\"]'),
(5270, 34, 'Which hive stores system-wide settings?', 1, 'HKLM', 0, 'LOCAL_MACHINE', '2025-12-26 20:49:49', '[\"HKCU\", \"HKLM\", \"HKU\", \"HKCR\"]'),
(5271, 34, 'What is the GUI tool for editing the registry?', 2, 'regedit', 0, 'Graphical editor', '2025-12-26 20:49:49', '[\"cmd\", \"regedit\", \"taskmgr\", \"msconfig\"]'),
(5272, 34, 'Which data type is used for text strings?', 3, 'REG_SZ', 0, 'String Value', '2025-12-26 20:49:49', '[\"REG_DWORD\", \"REG_BINARY\", \"REG_SZ\", \"REG_MULTI_SZ\"]'),
(5273, 35, 'What does AD stand for?', 1, 'Active Directory', 0, 'Directory service', '2025-12-26 20:49:49', '[\"Advanced Directory\", \"Active Directory\", \"Access Domain\", \"Admin Domain\"]'),
(5274, 35, 'Which server role authenticates users in AD?', 2, 'Domain Controller', 0, 'Runs AD DS', '2025-12-26 20:49:49', '[\"File Server\", \"Web Server\", \"Domain Controller\", \"DNS Server\"]'),
(5275, 35, 'What is the primary authentication protocol in AD?', 3, 'Kerberos', 0, 'Ticket-based', '2025-12-26 20:49:49', '[\"NTLM\", \"Kerberos\", \"Radius\", \"LDAP\"]'),
(5276, 36, 'What is the naming format for PowerShell cmdlets?', 1, 'Verb-Noun', 0, 'Action-Target', '2025-12-26 20:49:49', '[\"Verb-Noun\", \"Noun-Verb\", \"Action-Object\", \"Subject-Predicate\"]'),
(5277, 36, 'Which cmdlet lists running processes?', 2, 'Get-Process', 0, 'Usage: Get-Process', '2025-12-26 20:49:49', '[\"list-proc\", \"Get-Process\", \"Show-Tasks\", \"ps-list\"]'),
(5278, 36, 'What is the file extension for PowerShell scripts?', 3, '.ps1', 0, 'PowerShell 1', '2025-12-26 20:49:49', '[\".bat\", \".sh\", \".ps1\", \".exe\"]'),
(5279, 37, 'Which event ID indicates a successful logon?', 1, '4624', 0, 'Security Success', '2025-12-26 20:49:49', '[\"4625\", \"4624\", \"4672\", \"1074\"]'),
(5280, 37, 'Which event ID indicates a failed logon?', 2, '4625', 0, 'Security Failure', '2025-12-26 20:49:49', '[\"4624\", \"4625\", \"4768\", \"7045\"]'),
(5281, 37, 'Which log records login attempts?', 3, 'Security', 0, 'Auth events', '2025-12-26 20:49:49', '[\"System\", \"Application\", \"Security\", \"Setup\"]'),
(5282, 38, 'What does GPO stand for?', 1, 'Group Policy Object', 0, 'Config object', '2025-12-26 20:49:49', '[\"General Policy Option\", \"Group Policy Object\", \"Global Permission Order\", \"Group Permission Object\"]'),
(5283, 38, 'Which command forces a GP update?', 2, 'gpupdate /force', 0, 'Refresh command', '2025-12-26 20:49:49', '[\"gpupdate /force\", \"gprefresh\", \"update-policy\", \"gpreload\"]'),
(5284, 38, 'What is the order of GPO application?', 3, 'LSDOU', 0, 'Local, Site, Domain, OU', '2025-12-26 20:49:49', '[\"DSOUL\", \"LSDOU\", \"OUDSC\", \"SLDOU\"]'),
(5285, 39, 'Which built-in tool provides real-time virus protection?', 1, 'Windows Defender', 0, 'Antivirus', '2025-12-26 20:49:49', '[\"Windows Firewall\", \"Windows Defender\", \"BitLocker\", \"SmartScreen\"]'),
(5286, 39, 'Which Sysinternals tool is an advanced Task Manager?', 2, 'Process Explorer', 0, 'Process info', '2025-12-26 20:49:49', '[\"Process Monitor\", \"Autoruns\", \"Process Explorer\", \"PsExec\"]'),
(5287, 39, 'Which tool provides full disk encryption?', 3, 'BitLocker', 0, 'Disk security', '2025-12-26 20:49:49', '[\"SecureBoot\", \"BitLocker\", \"EFS\", \"Vault\"]'),
(5339, 22, 'Which layer is responsible for logical addressing (IPs)?', 1, 'Network', 0, 'Layer 3', '2025-12-26 20:53:36', '[\"Data Link\", \"Network\", \"Transport\", \"Session\"]'),
(5340, 22, 'What is the PDU of Layer 4 (Transport)?', 2, 'Segments', 0, 'TCP Data unit', '2025-12-26 20:53:36', '[\"Bits\", \"Frames\", \"Packets\", \"Segments\"]'),
(5341, 22, 'Which layer handles encryption and compression?', 3, 'Presentation', 0, 'Layer 6', '2025-12-26 20:53:36', '[\"Application\", \"Presentation\", \"Session\", \"Transport\"]'),
(5342, 23, 'Which protocol uses a 3-way handshake?', 1, 'TCP', 0, 'Connection-oriented', '2025-12-26 20:53:36', '[\"UDP\", \"IP\", \"TCP\", \"ICMP\"]'),
(5343, 23, 'Why is UDP used for video streaming?', 2, 'Speed', 0, 'Low overhead', '2025-12-26 20:53:36', '[\"Reliability\", \"Encryption\", \"Speed\", \"Guaranteed Delivery\"]'),
(5344, 23, 'Which TCP/IP layer corresponds to OSI Layer 3 (Network)?', 3, 'Internet', 0, 'IP Layer', '2025-12-26 20:53:36', '[\"Network Access\", \"Internet\", \"Transport\", \"Application\"]'),
(5345, 24, 'Which IP address is a private Class C address?', 1, '192.168.1.10', 0, 'Home router default', '2025-12-26 20:53:36', '[\"8.8.8.8\", \"172.16.0.1\", \"192.168.1.10\", \"10.0.0.5\"]'),
(5346, 24, 'How many bits are in an IPv4 address?', 2, '32', 0, 'Binary count', '2025-12-26 20:53:36', '[\"128\", \"64\", \"32\", \"16\"]'),
(5347, 24, 'What allows private IPs to access the internet?', 3, 'NAT', 0, 'Translation', '2025-12-26 20:53:36', '[\"DHCP\", \"DNS\", \"NAT\", \"ARP\"]'),
(5348, 25, 'What is the CIDR notation for 255.255.255.0?', 1, '/24', 0, 'Count the bits', '2025-12-26 20:53:36', '[\"/8\", \"/16\", \"/24\", \"/32\"]'),
(5349, 25, 'How many usable hosts are in a /24 network?', 2, '254', 0, '256 minus 2', '2025-12-26 20:53:36', '[\"256\", \"255\", \"254\", \"250\"]'),
(5350, 25, 'The first address in a subnet is used for what?', 3, 'Network ID', 0, 'Identification', '2025-12-26 20:53:36', '[\"Broadcast\", \"Gateway\", \"Network ID\", \"DNS\"]'),
(5351, 26, 'Which record maps a name to an IPv4 address?', 1, 'A', 0, 'Address', '2025-12-26 20:53:36', '[\"AAAA\", \"CNAME\", \"A\", \"MX\"]'),
(5352, 26, 'Which record is used for email server delivery?', 2, 'MX', 0, 'Mail Exchange', '2025-12-26 20:53:36', '[\"TXT\", \"PTR\", \"MX\", \"NS\"]'),
(5353, 26, 'What translates domain names to IPs?', 3, 'DNS', 0, 'System name', '2025-12-26 20:53:36', '[\"DHCP\", \"ARP\", \"DNS\", \"NAT\"]'),
(5354, 27, 'What is the first step in the DHCP process?', 1, 'Discover', 0, 'Looking for server', '2025-12-26 20:53:36', '[\"Offer\", \"Request\", \"Discover\", \"Acknowledge\"]'),
(5355, 27, 'What does ARP resolution map?', 2, 'IP to MAC', 0, 'Logical to Physical', '2025-12-26 20:53:36', '[\"MAC to IP\", \"IP to MAC\", \"URL to IP\", \"Port to Protocol\"]'),
(5356, 27, 'What attack relies on faking ARP replies?', 3, 'ARP Spoofing', 0, 'MITM', '2025-12-26 20:53:36', '[\"DNS Poisoning\", \"ARP Spoofing\", \"DDoS\", \"Phishing\"]'),
(5357, 28, 'Which port is used for Secure Shell (SSH)?', 1, '22', 0, 'Encrypted CLI', '2025-12-26 20:53:36', '[\"21\", \"22\", \"23\", \"25\"]'),
(5358, 28, 'Which protocol is UNSAFE for remote administration?', 2, 'Telnet', 0, 'Cleartext', '2025-12-26 20:53:36', '[\"SSH\", \"RDP\", \"HTTPS\", \"Telnet\"]'),
(5359, 28, 'Port 445 is associated with which service?', 3, 'SMB', 0, 'Windows Sharing', '2025-12-26 20:53:36', '[\"FTP\", \"SMB\", \"DNS\", \"HTTP\"]'),
(5363, 30, 'What protocol exposed the password?', 1, 'HTTP', 0, 'Unsecure', '2025-12-26 20:53:36', '[\"HTTPS\", \"SSH\", \"SFTP\", \"HTTP\"]'),
(5364, 30, 'What was the stolen password in the scenario?', 2, 'SuperSecret123', 0, 'Plaintext', '2025-12-26 20:53:36', '[\"admin\", \"password\", \"123456\", \"SuperSecret123\"]'),
(5365, 30, 'How should this login be secured?', 3, 'Use HTTPS', 0, 'Encryption', '2025-12-26 20:53:36', '[\"Use Telnet\", \"Use HTTPS\", \"Change Port\", \"Use UDP\"]'),
(5366, 31, 'Which device connects different networks (Layer 3)?', 1, 'Router', 0, 'Routing decisions', '2025-12-26 20:53:36', '[\"Switch\", \"Hub\", \"Router\", \"Bridge\"]'),
(5367, 31, 'What is the loopback address for localhost?', 2, '127.0.0.1', 0, 'Home', '2025-12-26 20:53:36', '[\"192.168.1.1\", \"0.0.0.0\", \"127.0.0.1\", \"10.0.0.1\"]'),
(5368, 31, 'Which command typically checks connectivity?', 3, 'ping', 0, 'ICMP Echo', '2025-12-26 20:53:36', '[\"ipconfig\", \"ping\", \"netstat\", \"nslookup\"]'),
(5369, 31, 'What is the subnet mask for a /24 network?', 4, '255.255.255.0', 0, 'Class C default', '2025-12-26 20:53:36', '[\"255.0.0.0\", \"255.255.0.0\", \"255.255.255.0\", \"255.255.255.255\"]'),
(5370, 31, 'Which port is used by HTTP?', 5, '80', 0, 'Unencrypted Web', '2025-12-26 20:53:36', '[\"21\", \"80\", \"443\", \"25\"]'),
(5371, 31, 'Which port is used by HTTPS?', 6, '443', 0, 'Encrypted Web', '2025-12-26 20:53:36', '[\"80\", \"8080\", \"443\", \"8443\"]'),
(5372, 31, 'Which port is used by DNS?', 7, '53', 0, 'Name Resolution', '2025-12-26 20:53:36', '[\"23\", \"53\", \"67\", \"110\"]'),
(5373, 31, 'What is Layer 1 of the OSI Model?', 8, 'Physical', 0, 'Cables and bits', '2025-12-26 20:53:36', '[\"Application\", \"Data Link\", \"Physical\", \"Transport\"]'),
(5374, 31, 'How long is a standard MAC address?', 9, '48 bits', 0, 'Hardware address', '2025-12-26 20:53:36', '[\"32 bits\", \"48 bits\", \"64 bits\", \"128 bits\"]'),
(5375, 31, 'How long is an IPv6 address?', 10, '128 bits', 0, 'Modern IP', '2025-12-26 20:53:36', '[\"32 bits\", \"64 bits\", \"128 bits\", \"256 bits\"]'),
(5376, 31, 'Which protocol guarantees delivery of data?', 11, 'TCP', 0, 'Reliable', '2025-12-26 20:53:36', '[\"UDP\", \"IP\", \"TCP\", \"ICMP\"]'),
(5377, 31, 'What is the first step in the TCP Handshake?', 12, 'SYN', 0, 'Hello', '2025-12-26 20:53:36', '[\"ACK\", \"SYN\", \"SYN-ACK\", \"FIN\"]'),
(5378, 31, 'What is the first step in DHCP?', 13, 'Discover', 0, 'Looking for IP', '2025-12-26 20:53:36', '[\"Offer\", \"Request\", \"Acknowledge\", \"Discover\"]'),
(5379, 31, 'Which of the following is a private IP address?', 14, '192.168.1.50', 0, 'RFC 1918', '2025-12-26 20:53:36', '[\"8.8.8.8\", \"1.1.1.1\", \"172.50.1.1\", \"192.168.1.50\"]'),
(5380, 31, 'What does ARP do?', 15, 'Resolves IP to MAC', 0, 'Address Resolution', '2025-12-26 20:53:36', '[\"Resolves MAC to IP\", \"Resolves Name to IP\", \"Resolves IP to MAC\", \"Routes Packets\"]'),
(5381, 31, 'Which protocol is used for ping?', 16, 'ICMP', 0, 'Internet Control Message', '2025-12-26 20:53:36', '[\"TCP\", \"UDP\", \"ICMP\", \"ARP\"]'),
(5382, 31, 'Which Layer 2 device uses MAC addresses to forward frames?', 17, 'Switch', 0, 'Intelligent forwarding', '2025-12-26 20:53:36', '[\"Hub\", \"Router\", \"Switch\", \"Repeater\"]'),
(5383, 31, 'Which DNS record type stores IPv6 addresses?', 18, 'AAAA', 0, 'Quad A', '2025-12-26 20:53:36', '[\"A\", \"MX\", \"AAAA\", \"CNAME\"]'),
(5384, 31, 'What port does standard FTP use?', 19, '21', 0, 'File Transfer', '2025-12-26 20:53:36', '[\"20\", \"21\", \"22\", \"23\"]'),
(5385, 31, 'What is the primary purpose of Wireshark?', 20, 'Packet Capture', 0, 'Analysis', '2025-12-26 20:53:36', '[\"Password Cracking\", \"Packet Capture\", \"Virus Scanning\", \"Routing\"]'),
(5427, 40, 'What does the \"C\" in CIA stand for?', 1, 'Confidentiality', 0, 'Privacy', '2025-12-26 20:58:02', '[\"Control\", \"Confidentiality\", \"Certification\", \"Compliance\"]'),
(5428, 40, 'Which concept ensures data is not altered?', 2, 'Integrity', 0, 'Accuracy', '2025-12-26 20:58:02', '[\"Availability\", \"Integrity\", \"Confidentiality\", \"Authentication\"]'),
(5429, 40, 'A DDoS attack primarily targets which pillar?', 3, 'Availability', 0, 'Uptime', '2025-12-26 20:58:02', '[\"Integrity\", \"Confidentiality\", \"Availability\", \"Authorization\"]'),
(5430, 41, 'Which is \"Something You Are\"?', 1, 'Biometrics', 0, 'Body part', '2025-12-26 20:58:02', '[\"Password\", \"Smart Card\", \"Biometrics\", \"Location\"]'),
(5431, 41, 'Which fits \"Something You Have\"?', 2, 'Smart Card', 0, 'Physical token', '2025-12-26 20:58:02', '[\"PIN\", \"Password\", \"Smart Card\", \"Typing Speed\"]'),
(5432, 41, 'Using a Password and a Fingerprint is an example of what?', 3, 'MFA', 0, 'Multi-Factor', '2025-12-26 20:58:02', '[\"Single Sign On\", \"MFA\", \"Authorization\", \"Encryption\"]'),
(5433, 42, 'Which comes first?', 1, 'Authentication', 0, 'Who are you?', '2025-12-26 20:58:02', '[\"Authorization\", \"Authentication\", \"Accounting\", \"Auditing\"]'),
(5434, 42, 'Which model uses security labels (Top Secret)?', 2, 'MAC', 0, 'Mandatory', '2025-12-26 20:58:02', '[\"DAC\", \"RBAC\", \"MAC\", \"ABAC\"]'),
(5435, 42, 'The principle of giving minimum necessary rights is called?', 3, 'Least Privilege', 0, 'Minimal', '2025-12-26 20:58:02', '[\"Zero Trust\", \"Least Privilege\", \"Defense in Depth\", \"Separation of Duties\"]'),
(5436, 43, 'Which AAA component tracks user actions?', 1, 'Accounting', 0, 'Logs', '2025-12-26 20:58:02', '[\"Authentication\", \"Authorization\", \"Accounting\", \"Access\"]'),
(5437, 43, 'Preventing a user from checking or denying an action is called?', 2, 'Non-Repudiation', 0, 'Undeniable', '2025-12-26 20:58:02', '[\"Integrity\", \"Encryption\", \"Non-Repudiation\", \"Availability\"]'),
(5438, 43, 'What is a primary use of Accounting logs?', 3, 'Forensics', 0, 'Investigation', '2025-12-26 20:58:02', '[\"Speed\", \"Encryption\", \"Forensics\", \"Routing\"]'),
(5439, 44, 'Which encryption uses the SAME key for locking and unlocking?', 1, 'Symmetric', 0, 'Single Key', '2025-12-26 20:58:02', '[\"Asymmetric\", \"Symmetric\", \"Hashing\", \"Public Key\"]'),
(5440, 44, 'Which algorithm is the current gold standard for symmetric encryption?', 2, 'AES', 0, 'Advanced Encryption Standard', '2025-12-26 20:58:02', '[\"DES\", \"AES\", \"MD5\", \"RSA\"]'),
(5441, 44, 'What is Plaintext?', 3, 'Readable data', 0, 'Unencrypted', '2025-12-26 20:58:02', '[\"Ciphertext\", \"Hashed data\", \"Readable data\", \"Key\"]'),
(5442, 45, 'Is hashing reversible?', 1, 'No', 0, 'One-way function', '2025-12-26 20:58:02', '[\"Yes\", \"No\", \"Only with a key\", \"Only for admins\"]'),
(5443, 45, 'What is the primary goal of hashing?', 2, 'Integrity', 0, 'Fingerprinting', '2025-12-26 20:58:02', '[\"Confidentiality\", \"Availability\", \"Integrity\", \"Speed\"]'),
(5444, 45, 'Which hashing algorithm is considered secure today?', 3, 'SHA-256', 0, 'Standard', '2025-12-26 20:58:02', '[\"MD5\", \"SHA-1\", \"SHA-256\", \"ROT13\"]'),
(5445, 46, 'What is another name for Defense in Depth?', 1, 'Layered Security', 0, 'Onion', '2025-12-26 20:58:02', '[\"Single Point of Failure\", \"Layered Security\", \"Zero Trust\", \"Active Defense\"]'),
(5446, 46, 'Which layer involves educating users?', 2, 'Human', 0, 'Training', '2025-12-26 20:58:02', '[\"Physical\", \"Network\", \"Human\", \"Application\"]'),
(5447, 46, 'Why use multiple layers?', 3, 'Redundancy', 0, 'If one fails', '2025-12-26 20:58:02', '[\"Cost savings\", \"Redundancy\", \"Simplicity\", \"Speed\"]'),
(5448, 47, 'What fundamental triad models information security?', 1, 'CIA', 0, 'Confidentiality Integrity Availability', '2025-12-26 20:58:02', '[\"ABC\", \"CIA\", \"RGB\", \"SSH\"]'),
(5449, 47, 'Which element of CIA ensures systems are up and running?', 2, 'Availability', 0, 'Uptime', '2025-12-26 20:58:02', '[\"Confidentiality\", \"Integrity\", \"Availability\", \"Authentication\"]'),
(5450, 47, 'Fingerprints and Retina scans are examples of?', 3, 'Biometrics', 0, 'Something you are', '2025-12-26 20:58:02', '[\"Passwords\", \"Tokens\", \"Biometrics\", \"Smart Cards\"]'),
(5451, 47, 'Identifying a user is called?', 4, 'Authentication', 0, 'AuthN', '2025-12-26 20:58:02', '[\"Authorization\", \"Accounting\", \"Authentication\", \"Access\"]'),
(5452, 47, 'Determining what a user is allowed to do is?', 5, 'Authorization', 0, 'AuthZ', '2025-12-26 20:58:02', '[\"Authentication\", \"Accounting\", \"Authorization\", \"Auditing\"]'),
(5453, 47, 'Which access control model uses \"Top Secret\" labels?', 6, 'MAC', 0, 'Mandatory', '2025-12-26 20:58:02', '[\"DAC\", \"MAC\", \"RBAC\", \"Rule-Based\"]'),
(5454, 47, 'Which access control model relies on the data owner?', 7, 'DAC', 0, 'Discretionary', '2025-12-26 20:58:02', '[\"MAC\", \"DAC\", \"RBAC\", \"ABAC\"]'),
(5455, 47, 'Tracking user activities in logs is known as?', 8, 'Accounting', 0, 'The 3rd A', '2025-12-26 20:58:02', '[\"Authentication\", \"Authorization\", \"Accounting\", \"Analysis\"]'),
(5456, 47, 'Which type of encryption uses a Public and Private key?', 9, 'Asymmetric', 0, 'Two keys', '2025-12-26 20:58:03', '[\"Symmetric\", \"Asymmetric\", \"Hashing\", \"Linear\"]'),
(5457, 47, 'Which type of encryption uses a single shared key?', 10, 'Symmetric', 0, 'Faster', '2025-12-26 20:58:03', '[\"Asymmetric\", \"Symmetric\", \"Hashing\", \"Private\"]'),
(5458, 47, 'Which function is One-Way and non-reversible?', 11, 'Hashing', 0, 'Fingerprint', '2025-12-26 20:58:03', '[\"Encryption\", \"Encoding\", \"Hashing\", \"Compression\"]'),
(5459, 47, 'Which is a secure hashing algorithm?', 12, 'SHA-256', 0, 'Modern', '2025-12-26 20:58:03', '[\"MD5\", \"SHA-1\", \"SHA-256\", \"CRC32\"]'),
(5460, 47, 'What is the best defense against social engineering?', 13, 'User Training', 0, 'Human layer', '2025-12-26 20:58:03', '[\"Firewalls\", \"Encryption\", \"User Training\", \"Biometrics\"]'),
(5461, 47, 'Layering multiple security controls is called?', 14, 'Defense in Depth', 0, 'Onion', '2025-12-26 20:58:03', '[\"Offense in Depth\", \"Defense in Depth\", \"Single Defense\", \"Zero Security\"]'),
(5462, 47, 'What does Non-Repudiation provide?', 15, 'Proof of origin', 0, 'Cannot deny', '2025-12-26 20:58:03', '[\"Privacy\", \"Proof of origin\", \"Speed\", \"Availability\"]'),
(5463, 47, 'Which helps protect Data Integrity?', 16, 'Hashing', 0, 'Check change', '2025-12-26 20:58:03', '[\"Encryption\", \"Hashing\", \"Backups\", \"Firewalls\"]'),
(5464, 47, 'What does MFA stand for?', 17, 'Multi-Factor Authentication', 0, '2+ factors', '2025-12-26 20:58:03', '[\"Multi-Factor Authorization\", \"Multi-Function Access\", \"Multi-Factor Authentication\", \"Main Factor Auth\"]'),
(5465, 47, 'Is a password \"Something you have\"?', 18, 'No', 0, 'Something you know', '2025-12-26 20:58:03', '[\"Yes\", \"No\", \"Depends\", \"Sometimes\"]'),
(5466, 47, 'Which layer of Defense in Depth includes Firewalls?', 19, 'Network', 0, 'Perimeter', '2025-12-26 20:58:03', '[\"Physical\", \"Network\", \"Human\", \"Data\"]'),
(5467, 47, 'Which is NOT a pillar of the CIA triad?', 20, 'Authorization', 0, 'Not C-I-A', '2025-12-26 20:58:03', '[\"Confidentiality\", \"Integrity\", \"Availability\", \"Authorization\"]'),
(5483, 48, 'Which command lists files?', 1, 'dir', 0, 'Directory', '2025-12-26 21:05:12', '[\"ls\", \"list\", \"dir\", \"show\"]'),
(5484, 48, 'How do you enter the \"Documents\" folder?', 2, 'cd Documents', 0, 'Change Directory', '2025-12-26 21:05:12', '[\"dir Documents\", \"cd Documents\", \"enter Documents\", \"go Documents\"]'),
(5485, 48, 'What does \"cd ..\" do?', 3, 'Go back one level', 0, 'Parent directory', '2025-12-26 21:05:12', '[\"Deletes folder\", \"Go back one level\", \"Go to root\", \"Nothing\"]'),
(5486, 49, 'Which command reads a file content?', 1, 'type', 0, 'Type out', '2025-12-26 21:05:12', '[\"read\", \"cat\", \"type\", \"open\"]'),
(5487, 49, 'If you want to read \"note.txt\", what do you type?', 2, 'type note.txt', 0, 'Command + Arg', '2025-12-26 21:05:12', '[\"read note.txt\", \"type note.txt\", \"cat note.txt\", \"open note.txt\"]'),
(5488, 49, 'Is \"cat\" a standard Windows command?', 3, 'No', 0, 'type is used', '2025-12-26 21:05:12', '[\"Yes\", \"No\", \"Maybe\", \"Only in PowerShell\"]'),
(5489, 50, 'Which command shows the computer name?', 1, 'hostname', 0, 'Host', '2025-12-26 21:05:12', '[\"name\", \"hostname\", \"computername\", \"id\"]'),
(5490, 50, 'Which command shows the current user?', 2, 'whoami', 0, 'Identity', '2025-12-26 21:05:12', '[\"user\", \"me\", \"whoami\", \"id\"]'),
(5491, 50, 'Why is \"whoami\" important?', 3, 'To check permissions', 0, 'Privilege level', '2025-12-26 21:05:12', '[\"To check time\", \"To check IP\", \"To check permissions\", \"To list files\"]'),
(5492, 51, 'Which command shows IP details on Windows?', 1, 'ipconfig', 0, 'IP Config', '2025-12-26 21:05:12', '[\"ifconfig\", \"ipconfig\", \"ip a\", \"net config\"]'),
(5493, 51, 'What does Default Gateway usually represent?', 2, 'The Router', 0, 'Exit point', '2025-12-26 21:05:12', '[\"The PC\", \"The Router\", \"The Server\", \"The DNS\"]'),
(5494, 51, 'What is a common local IP starting with?', 3, '192.168', 0, 'Private range', '2025-12-26 21:05:12', '[\"8.8.8\", \"192.168\", \"1.1.1\", \"255.255\"]'),
(5495, 52, 'Which command lists running processes?', 1, 'tasklist', 0, 'List tasks', '2025-12-26 21:05:12', '[\"ps\", \"tasklist\", \"proclist\", \"top\"]'),
(5496, 52, 'What does PID stand for?', 2, 'Process ID', 0, 'Identifier', '2025-12-26 21:05:12', '[\"Program ID\", \"Process ID\", \"Personal ID\", \"Path ID\"]'),
(5497, 52, 'Which switch is used to kill by PID?', 3, '/PID', 0, 'Switch', '2025-12-26 21:05:12', '[\"-p\", \"/PID\", \"-id\", \"--pid\"]'),
(5522, 54, 'What is the severity level of the Challenge Log?', 1, 'ERROR', 0, 'Keyword after timestamp', '2025-12-26 21:12:59', '[\"INFO\", \"DEBUG\", \"ERROR\", \"FATAL\"]'),
(5523, 54, 'Which user was involved in the event?', 2, 'db_admin', 0, 'User field', '2025-12-26 21:12:59', '[\"alice\", \"admin\", \"db_admin\", \"root\"]'),
(5524, 54, 'What database was being accessed?', 3, 'users_db', 0, 'Accessing...', '2025-12-26 21:12:59', '[\"auth_db\", \"users_db\", \"main_db\", \"logs\"]'),
(5525, 55, 'How many failed attempts are shown?', 1, '2', 0, 'Count \"Failed\"', '2025-12-26 21:12:59', '[\"1\", \"2\", \"3\", \"0\"]'),
(5526, 55, 'Which user successfully logged in?', 2, 'root', 0, 'Look for \"Accepted\"', '2025-12-26 21:12:59', '[\"guest\", \"admin\", \"root\", \"user\"]'),
(5527, 55, 'What port is the SSH server running on?', 3, '2222', 0, 'port ...', '2025-12-26 21:12:59', '[\"22\", \"80\", \"2222\", \"443\"]'),
(5528, 56, 'What HTTP method was used in the challenge?', 1, 'POST', 0, 'First word inside quotes', '2025-12-26 21:12:59', '[\"GET\", \"POST\", \"PUT\", \"HEAD\"]'),
(5529, 56, 'What status code was returned?', 2, '401', 0, 'Number after HTTP version', '2025-12-26 21:12:59', '[\"200\", \"404\", \"401\", \"500\"]'),
(5530, 56, 'What page was requested?', 3, '/admin/login.php', 0, 'Path', '2025-12-26 21:12:59', '[\"/index.html\", \"/admin/login.php\", \"/login\", \"/home\"]'),
(5531, 57, 'What is the specific failure reason?', 1, 'Account locked out', 0, 'Read Failure Reason', '2025-12-26 21:12:59', '[\"Bad password\", \"Account locked out\", \"Unknown user\", \"Wrong domain\"]'),
(5532, 57, 'What is the Event ID?', 2, '4625', 0, 'Top line', '2025-12-26 21:12:59', '[\"4624\", \"4625\", \"4672\", \"1000\"]'),
(5533, 57, 'Which IP address initiated the request?', 3, '10.0.0.88', 0, 'Source Network Address', '2025-12-26 21:12:59', '[\"127.0.0.1\", \"10.0.0.88\", \"192.168.1.1\", \"0.0.0.0\"]'),
(5534, 58, 'What SQL command is visible in the URL?', 1, 'UNION SELECT', 0, 'Keyword', '2025-12-26 21:12:59', '[\"DROP TABLE\", \"UNION SELECT\", \"UPDATE\", \"INSERT\"]'),
(5535, 58, 'What does %27 represent in URL encoding?', 2, 'Single Quote (\')', 0, 'Hex for quote', '2025-12-26 21:12:59', '[\"Space\", \"Single Quote (\')\", \"Double Quote (\\\")\", \"Percent Sign\"]'),
(5536, 58, 'Did the server block this request?', 3, 'No (Status 200)', 0, 'Status code', '2025-12-26 21:12:59', '[\"Yes (403)\", \"No (Status 200)\", \"Yes (500)\", \"Maybe\"]'),
(5537, 59, 'What describes the destination port 3389?', 1, 'RDP (Remote Desktop)', 0, 'Common Port', '2025-12-26 21:12:59', '[\"SSH\", \"HTTP\", \"RDP (Remote Desktop)\", \"FTP\"]'),
(5538, 59, 'What flag indicates a connection attempt?', 2, 'SYN', 0, 'TCP Flag', '2025-12-26 21:12:59', '[\"ACK\", \"SYN\", \"FIN\", \"RST\"]'),
(5539, 59, 'Was the connection allowed?', 3, 'No (DROP)', 0, 'Action', '2025-12-26 21:12:59', '[\"Yes (ACCEPT)\", \"No (DROP)\", \"Logged only\", \"Unknown\"]'),
(5540, 60, 'What malicious command is being downloaded?', 1, 'malware.sh', 0, 'File name', '2025-12-26 21:12:59', '[\"virus.exe\", \"malware.sh\", \"test.txt\", \"config.php\"]'),
(5541, 60, 'What tool is used to download the file?', 2, 'wget', 0, 'Command', '2025-12-26 21:12:59', '[\"curl\", \"wget\", \"cat\", \"ping\"]'),
(5542, 60, 'What character is encoded as %7C?', 3, 'Pipe (|)', 0, 'Separator', '2025-12-26 21:12:59', '[\"Semicolon (;)\", \"Pipe (|)\", \"Ampersand (&)\", \"Space\"]'),
(5543, 61, 'What does the decoded command try to do?', 1, 'Download a script', 0, 'DownloadString', '2025-12-26 21:12:59', '[\"Delete files\", \"Download a script\", \"Encrypt drive\", \"Add user\"]'),
(5544, 61, 'What command is executed after downloading?', 2, 'IEX (Invoke-Expression)', 0, 'First word decoded', '2025-12-26 21:12:59', '[\"cmd.exe\", \"IEX (Invoke-Expression)\", \"Start-Process\", \"Write-Host\"]'),
(5545, 61, 'What parameter indicates the command is encoded?', 3, '-Enc', 0, 'Short for -EncodedCommand', '2025-12-26 21:12:59', '[\"-NoP\", \"-NonI\", \"-W\", \"-Enc\"]'),
(5546, 72, 'What describes a Forward Proxy?', 1, 'Acts for the client', 0, 'School/Work proxy', '2025-12-26 21:17:42', '[\"Acts for the server\", \"Acts for the client\", \"Is a VPN\", \"Is a firewall\"]'),
(5547, 72, 'What is the main role of an Intercepting Proxy?', 2, 'View/Modify traffic', 0, 'MitM', '2025-12-26 21:17:42', '[\"Speed up internet\", \"View/Modify traffic\", \"Encrypt data\", \"Host websites\"]'),
(5548, 72, 'What typically uses a Reverse Proxy?', 3, 'High traffic servers', 0, 'Load balancing', '2025-12-26 21:17:42', '[\"Home users\", \"High traffic servers\", \"Laptops\", \"Printers\"]'),
(5549, 73, 'What is Burp Suite primarily used for?', 1, 'Web Security Testing', 0, 'Hacking apps', '2025-12-26 21:17:42', '[\"Network Scanning\", \"Web Security Testing\", \"Password Management\", \"Virus Scanning\"]'),
(5550, 73, 'Which component allows modifying and re-sending individual requests?', 2, 'Repeater', 0, 'Repeat', '2025-12-26 21:17:42', '[\"Proxy\", \"Scanner\", \"Repeater\", \"Intruder\"]'),
(5551, 73, 'Which component is used for automated attacks?', 3, 'Intruder', 0, 'Brute force', '2025-12-26 21:17:42', '[\"Repeater\", \"Intruder\", \"Decoder\", \"Comparer\"]'),
(5552, 74, 'What happens when \"Intercept is On\"?', 1, 'Requests hang/pause', 0, 'Waiting for you', '2025-12-26 21:17:42', '[\"Requests go faster\", \"Requests hang/pause\", \"Browser closes\", \"Server errors\"]'),
(5553, 74, 'Why would you modify the User-Agent header?', 2, 'Pretend to be a specific device', 0, 'Mobile testing', '2025-12-26 21:17:42', '[\"To hack wifi\", \"Pretend to be a specific device\", \"To clear cache\", \"To speed up login\"]'),
(5554, 74, 'What allows you to send the paused request to the server?', 3, 'Forward button', 0, 'Action', '2025-12-26 21:17:42', '[\"Drop button\", \"Forward button\", \"Stop button\", \"Delete button\"]'),
(5555, 75, 'Why use Repeater instead of the browser?', 1, 'Faster iteration', 0, 'Testing variations', '2025-12-26 21:17:42', '[\"Better graphics\", \"Faster iteration\", \"Browser is blocked\", \"It is automatic\"]'),
(5556, 75, 'What does %20 represent in URL encoding?', 2, 'Space', 0, 'Whitespace', '2025-12-26 21:17:42', '[\"Tab\", \"Enter\", \"Space\", \"Slash\"]'),
(5557, 75, 'What tool converts Base64 back to text?', 3, 'Decoder', 0, 'Decode', '2025-12-26 21:17:42', '[\"Encoder\", \"Decoder\", \"Translator\", \"Compiler\"]'),
(5558, 76, 'What happens in a proxy chain?', 1, 'Traffic hops through multiple nodes', 0, 'A->B->C', '2025-12-26 21:17:42', '[\"Traffic is blocked\", \"Traffic hops through multiple nodes\", \"Traffic is deleted\", \"Traffic is faster\"]'),
(5559, 76, 'What is the main difference between Proxy and VPN?', 2, 'VPN encrypts entire device traffic', 0, 'Scope', '2025-12-26 21:17:42', '[\"Proxy is faster\", \"VPN is free\", \"VPN encrypts entire device traffic\", \"Proxy is hardware\"]'),
(5560, 76, 'If you chain A->B->C, who does the Target see?', 3, 'Proxy C', 0, 'The last one', '2025-12-26 21:17:42', '[\"You\", \"Proxy A\", \"Proxy B\", \"Proxy C\"]'),
(5693, 77, 'Which system is typically deployed \"Inline\"?', 1, 'IPS', 0, 'Intrusion Prevention', '2025-12-26 22:11:01', '[\"IDS\", \"IPS\", \"SIEM\", \"TAP\"]'),
(5694, 77, 'What happens if an Out-of-Band IDS crashes?', 2, 'Traffic continues (Fail Open)', 0, 'Loss of visibility only', '2025-12-26 22:11:01', '[\"Network outage\", \"Traffic continues (Fail Open)\", \"Firewall locks down\", \"Servers reboot\"]'),
(5695, 77, 'Why is IPS riskier than IDS?', 3, 'Can block legitimate traffic', 0, 'Business interruption', '2025-12-26 22:11:01', '[\"It is more expensive\", \"It is slower\", \"Can block legitimate traffic\", \"It uses more power\"]'),
(5696, 78, 'Which detection method is best for known threats?', 1, 'Signature-Based', 0, 'Fast and accurate', '2025-12-26 22:11:01', '[\"Anomaly-Based\", \"Signature-Based\", \"Heuristic\", \"AI\"]'),
(5697, 78, 'What is the main advantage of Anomaly detection?', 2, 'Detecting Zero-Days', 0, 'Unknown threats', '2025-12-26 22:11:01', '[\"Speed\", \"Low cost\", \"Detecting Zero-Days\", \"Low false positives\"]'),
(5698, 78, 'What triggers an anomaly alert?', 3, 'Deviation from baseline', 0, 'Unusual behavior', '2025-12-26 22:11:01', '[\"A signature match\", \"A blacklisted IP\", \"Deviation from baseline\", \"A specific file hash\"]'),
(5699, 79, 'What is the major blind spot of NIDS today?', 1, 'Encrypted Traffic (HTTPS)', 0, 'Encryption', '2025-12-26 22:11:01', '[\"Speed\", \"Encrypted Traffic (HTTPS)\", \"UDP Packets\", \"IPv6\"]'),
(5700, 79, 'Where does HIDS sit in the encryption chain?', 2, 'After decryption', 0, 'On the host', '2025-12-26 22:11:01', '[\"Before encryption\", \"After decryption\", \"In the router\", \"On the switch\"]'),
(5701, 79, 'Which capability is unique to HIDS?', 3, 'File Integrity Monitoring', 0, 'FIM', '2025-12-26 22:11:01', '[\"Packet Capture\", \"Flow Analysis\", \"File Integrity Monitoring\", \"DDoS Protection\"]'),
(5702, 81, 'How does Zeek primarily store data?', 1, 'Transaction Logs', 0, 'Metadata', '2025-12-26 22:11:01', '[\"Full Packet Capture\", \"Transaction Logs\", \"SQL Database\", \"Binary Blobs\"]'),
(5703, 81, 'Which log file contains the volume of data transferred?', 2, 'conn.log', 0, 'Connection', '2025-12-26 22:11:01', '[\"files.log\", \"conn.log\", \"http.log\", \"stats.log\"]'),
(5704, 81, 'Can Zeek detect anomalies in encrypted traffic?', 3, 'Yes (via metadata)', 0, 'Byte counts', '2025-12-26 22:11:01', '[\"No\", \"Yes (via metadata)\", \"Only if decrypted\", \"Never\"]'),
(5705, 82, 'What is the best way to tell if an attack succeeded?', 1, 'Check the Server Response', 0, 'Response Code', '2025-12-26 22:11:01', '[\"Check the Source IP\", \"Check the Server Response\", \"Check the Timestamp\", \"Check the Rule ID\"]'),
(5706, 82, 'If a payload appears in an email body triggering an alert, it is likely a?', 2, 'False Positive', 0, 'Context mismatch', '2025-12-26 22:11:01', '[\"True Positive\", \"False Positive\", \"Zero Day\", \"Insider Threat\"]'),
(5707, 82, 'A \"404 Not Found\" response generally indicates?', 3, 'Attempt Failed', 0, 'Target does not exist', '2025-12-26 22:11:01', '[\"Successful Hack\", \"Attempt Failed\", \"Server Offline\", \"IDS Failure\"]'),
(5708, 83, 'What is the standard solution for internal scanners triggering alerts?', 1, 'Whitelisting', 0, 'Ignoring IP', '2025-12-26 22:11:01', '[\"Blocking them\", \"Whitelisting\", \"Counter-attacking\", \"Disabling the IDS\"]'),
(5709, 83, 'What technique limits alerts to \"X times per minute\"?', 2, 'Thresholding', 0, 'Suppression', '2025-12-26 22:11:01', '[\"Whitelisting\", \"Thresholding\", \"Dropping\", \"Sampling\"]'),
(5710, 83, 'Why might P2P updates trigger alerts?', 3, 'Look like Botnet traffic', 0, 'Behavior', '2025-12-26 22:11:01', '[\"They are viruses\", \"Look like Botnet traffic\", \"They are unencrypted\", \"They are slow\"]'),
(5711, 84, 'What is the first step before you can scan?', 1, 'Discovery / Asset Management', 0, 'Knowing what to scan', '2025-12-26 22:11:01', '[\"Remediation\", \"Prioritization\", \"Discovery / Asset Management\", \"Reporting\"]'),
(5712, 84, 'Why is \"Verification\" necessary after patching?', 2, 'To ensure patch was applied correctly', 0, 'Trust but verify', '2025-12-26 22:11:01', '[\"It isn\'t\", \"To ensure patch was applied correctly\", \"To double billing\", \"To slow down IT\"]'),
(5713, 84, 'What is \"Shadow IT\"?', 3, 'Unknown/Unmanaged assets', 0, 'Hidden servers', '2025-12-26 22:11:01', '[\"Hacker tools\", \"Unknown/Unmanaged assets\", \"Dark mode\", \"VPNs\"]'),
(5714, 85, 'Which scan type is less accurate finding missing patches?', 1, 'Unauthenticated', 0, 'External', '2025-12-26 22:11:01', '[\"Authenticated\", \"Unauthenticated\", \"Agent-based\", \"Internal\"]'),
(5715, 85, 'How does an authenticated scan check for patches?', 2, 'Logs in and checks files/registry', 0, 'Commands', '2025-12-26 22:11:01', '[\"Guesses\", \"Checks headers\", \"Logs in and checks files/registry\", \"Port scan\"]'),
(5716, 85, 'What is a common issue with \"Banner Grabbing\"?', 3, 'Banners can act or lie', 0, 'Inaccurate', '2025-12-26 22:11:01', '[\"It causes crashes\", \"Banners can act or lie\", \"It requires passwords\", \"It is too slow\"]'),
(5717, 86, 'What does \"AV:N\" stand for?', 1, 'Attack Vector: Network', 0, 'Remote', '2025-12-26 22:11:01', '[\"Attack Vector: None\", \"Attack Vector: Network\", \"Anti-Virus: None\", \"Admin View: No\"]'),
(5718, 86, 'Which metric indicates user interaction is NOT needed?', 2, 'UI:N', 0, 'Automatic', '2025-12-26 22:11:01', '[\"UI:R\", \"UI:N\", \"PR:N\", \"AV:L\"]'),
(5719, 86, 'A \"Scope Change\" (S:C) usually implies what?', 3, 'Breaking out of sandbox/VM', 0, 'Higher impact', '2025-12-26 22:11:01', '[\"Local only\", \"Breaking out of sandbox/VM\", \"Lower score\", \"Network only\"]'),
(5720, 87, 'Why should you place local scanners in each network segment?', 1, 'To avoid scanning through firewalls', 0, 'Efficiency', '2025-12-26 22:11:01', '[\"To waste money\", \"To avoid scanning through firewalls\", \"Because Nessus requires it\", \"To use more IPs\"]'),
(5721, 87, 'Which scan policy is best for solely finding live hosts?', 2, 'Host Discovery', 0, 'Ping sweep', '2025-12-26 22:11:01', '[\"Basic Network Scan\", \"Web App Scan\", \"Host Discovery\", \"Malware Scan\"]'),
(5722, 87, 'Why avoid scanning SCADA/Printers with aggressive policies?', 3, 'They are fragile and can crash', 0, 'Stability', '2025-12-26 22:11:01', '[\"They have no vulns\", \"They are fragile and can crash\", \"They are strictly read-only\", \"Nessus cannot scan them\"]'),
(5723, 88, 'If \"Exploit Available\" is Yes, what does that mean?', 1, 'Hackable tools exist publicly', 0, 'Urgent', '2025-12-26 22:11:01', '[\"It is theoretical\", \"Hackable tools exist publicly\", \"It is a zero-day\", \"It involves money\"]'),
(5724, 88, 'What does VPR add to the standard CVSS score?', 2, 'Real-world threat context', 0, 'Intel', '2025-12-26 22:11:01', '[\"Nothing\", \"Real-world threat context\", \"User opinion\", \"Randomness\"]'),
(5725, 88, 'What is the first filter you should typically apply?', 3, 'Severity (Crit/High)', 0, 'Triage', '2025-12-26 22:11:01', '[\"Low/Info\", \"Severity (Crit/High)\", \"Port 80\", \"Name\"]'),
(5726, 89, 'What is a \"Pilot\" group in patching?', 1, 'A small test subset of production', 0, 'Canary', '2025-12-26 22:11:01', '[\"The IT team\", \"A small test subset of production\", \"The CEO\", \"The printers\"]'),
(5727, 89, 'Why might you skip testing for an \"Emergency\" patch?', 2, 'Immediate exploitation risk', 0, 'Zero Day', '2025-12-26 22:11:01', '[\"Too lazy\", \"Immediate exploitation risk\", \"Patches never fail\", \"Vendor guarantee\"]'),
(5728, 89, 'What allows you to recover if a patch kills a server?', 3, 'Snapshots / Rollback Plan', 0, 'Backup', '2025-12-26 22:11:01', '[\"Reinstalling OS\", \"Snapshots / Rollback Plan\", \"SLA\", \"Vulnerability Scan\"]'),
(5729, 90, 'Who maintains the CVE list?', 1, 'MITRE', 0, 'Organization', '2025-12-26 22:11:01', '[\"Microsoft\", \"MITRE\", \"Google\", \"NSA\"]'),
(5730, 90, 'What is the difference between CVE and CWE?', 2, 'CVE is specific instance, CWE is category', 0, 'Instance vs Class', '2025-12-26 22:11:01', '[\"They are the same\", \"CVE is for Windows, CWE for Linux\", \"CVE is specific instance, CWE is category\", \"CWE is a score\"]'),
(5731, 90, 'What database adds scoring (CVSS) to the CVEs?', 3, 'NVD', 0, 'National Vuln DB', '2025-12-26 22:11:01', '[\"MITRE\", \"OWASP\", \"NVD\", \"CISA\"]'),
(5732, 91, 'Which strategy involves shutting down a risky system?', 1, 'Avoidance', 0, 'Stop activity', '2025-12-26 22:11:01', '[\"Acceptance\", \"Transference\", \"Avoidance\", \"Mitigation\"]'),
(5733, 91, 'Buying insurance is an example of?', 2, 'Transference', 0, 'Moving risk', '2025-12-26 22:11:01', '[\"Acceptance\", \"Avoidance\", \"Transference\", \"Patching\"]'),
(5734, 91, 'If you Accept a risk, what is usually required?', 3, 'Compensating Controls / Sign-off', 0, 'Paperwork', '2025-12-26 22:11:01', '[\"Nothing\", \"Compensating Controls / Sign-off\", \"Patching\", \"Ignoring it\"]'),
(5735, 92, 'Does DAST require source code access?', 1, 'No (Black Box)', 0, 'Dynamic', '2025-12-26 22:11:01', '[\"Yes\", \"No (Black Box)\", \"Sometimes\", \"Only for Javascript\"]'),
(5736, 92, 'Which testing method happens \"running\" against a live app?', 2, 'DAST', 0, 'Dynamic', '2025-12-26 22:11:01', '[\"SAST\", \"DAST\", \"Unit Testing\", \"Linting\"]'),
(5737, 92, 'Why is DAST considered \"Technology Agnostic\"?', 3, 'HTTP is universal', 0, 'Attacks inputs', '2025-12-26 22:11:01', '[\"It knows all languages\", \"HTTP is universal\", \"It compiles code\", \"It uses AI\"]'),
(5738, 93, 'Which vulnerability category covers IDOR (Insecure Direct Object Reference)?', 1, 'Broken Access Control', 0, 'Permissions', '2025-12-26 22:11:01', '[\"Injection\", \"Broken Access Control\", \"Cryptographic Failures\", \"Logging Failures\"]'),
(5739, 93, 'What is the best defense against Injection?', 2, 'Parameterized Queries', 0, 'Prepared Statements', '2025-12-26 22:11:01', '[\"Firewalls\", \"Parameterized Queries\", \"Encryption\", \"Antivirus\"]'),
(5740, 93, 'Storing passwords in plain text falls under which category?', 3, 'Cryptographic Failures', 0, 'Crypto', '2025-12-26 22:11:01', '[\"Injection\", \"Cryptographic Failures\", \"Access Control\", \"Design Flaws\"]'),
(5741, 94, 'What feature prevents ZAP from attacking the entire internet?', 1, 'Scope / Contexts', 0, 'Limits', '2025-12-26 22:11:01', '[\"Firewall\", \"Scope / Contexts\", \"VPN\", \"Cables\"]'),
(5742, 94, 'What is the ZAP HUD?', 2, 'Browser overlay for testing', 0, 'UI', '2025-12-26 22:11:01', '[\"A report format\", \"Browser overlay for testing\", \"A CI pipeline\", \"A virus\"]'),
(5743, 94, 'Can ZAP be integrated into CI/CD pipelines?', 3, 'Yes (Headless/Docker)', 0, 'Automation', '2025-12-26 22:11:01', '[\"No, GUI only\", \"Yes (Headless/Docker)\", \"Only on Windows\", \"Cost extra\"]'),
(5744, 95, 'Why do traditional spiders fail on React apps?', 1, 'Content loads via JS/DOM', 0, 'SPA', '2025-12-26 22:11:01', '[\"React is secure\", \"Content loads via JS/DOM\", \"URLs are encrypted\", \"Firewalls block them\"]'),
(5745, 95, 'What does an AJAX spider use to crawl?', 2, 'A headless browser', 0, 'Rendering', '2025-12-26 22:11:01', '[\"Curl\", \"Wget\", \"A headless browser\", \"Guessing\"]'),
(5746, 95, 'How might an attacker use robots.txt?', 3, 'To find hidden/disallowed paths', 0, 'Recon', '2025-12-26 22:11:01', '[\"To obey rules\", \"To find hidden/disallowed paths\", \"To crash server\", \"To find emails\"]'),
(5747, 96, 'Why is Active Scanning risky in Production?', 1, 'Can delete data or cause DoS', 0, 'Destructive', '2025-12-26 22:11:01', '[\"It is slow\", \"Can delete data or cause DoS\", \"It costs money\", \"It is illegal in Prod\"]'),
(5748, 96, 'How does a Time-Based SQLi test verify the vuln?', 2, 'Measures server delay', 0, 'Timing', '2025-12-26 22:11:01', '[\"Checks error text\", \"Measures server delay\", \"Crashing server\", \"Downloading DB\"]'),
(5749, 96, 'If a scanner hits a \"Contact Us\" form, what happens?', 3, 'Floods inbox with junk', 0, 'Spam', '2025-12-26 22:11:01', '[\"Nothing\", \"Floods inbox with junk\", \"Hacks email\", \"Server reboots\"]'),
(5750, 97, 'If a payload appears in the response, is it always XSS?', 1, 'No, headers/encoding matter', 0, 'False Positive', '2025-12-26 22:11:01', '[\"Yes\", \"No, headers/encoding matter\", \"Only in Chrome\", \"Never\"]'),
(5751, 97, 'Why do Custom 404 pages confuse scanners?', 2, 'They return 200 OK status', 0, 'Status Code', '2025-12-26 22:11:01', '[\"They are hidden\", \"They return 200 OK status\", \"They are slow\", \"They are encrypted\"]'),
(5752, 97, 'What defines a professional analyst reporting DAST results?', 3, 'Manual Verification', 0, 'Curating', '2025-12-26 22:11:01', '[\"Copy-Pasting\", \"Manual Verification\", \"Ignoring Lows\", \"Running in background\"]'),
(5753, 98, 'What is better than reporting 100 individual bugs?', 1, 'Reporting the systemic root cause', 0, 'Grouping', '2025-12-26 22:11:01', '[\"Reporting 1000 bugs\", \"Reporting the systemic root cause\", \"Ignoring them\", \"Quitting\"]'),
(5754, 98, 'What helps a developer understand \"Why\" they should fix it?', 2, 'Risk Explanation', 0, 'Impact', '2025-12-26 22:11:01', '[\"CVSS Score\", \"Risk Explanation\", \"Manager threats\", \"Compliance laws\"]'),
(5755, 98, 'What is a \"PoC\" in reporting?', 3, 'Proof of Concept (Reproduction steps)', 0, 'Evidence', '2025-12-26 22:11:01', '[\"Point of Contact\", \"Proof of Concept (Reproduction steps)\", \"Piece of Code\", \"Priority of Criticality\"]'),
(5756, 160, 'What is the verified first step in the Vulnerability Management Lifecycle?', 1, 'Asset Discovery', 0, 'Finding the machines', '2025-12-26 22:11:01', '[\"Remediation\", \"Asset Discovery\", \"Scanning\", \"Reporting\"]'),
(5757, 160, 'Why is \"Verification\" critical after patching?', 2, 'To ensure the patch actually fixed the issue', 0, 'Trust but verify', '2025-12-26 22:11:01', '[\"It increases billable hours\", \"To ensure the patch actually fixed the issue\", \"To verify the server is fast\", \"It is not critical\"]'),
(5758, 160, 'What term describes unknown/unmanaged systems on a network?', 3, 'Shadow IT', 0, 'Hidden', '2025-12-26 22:11:01', '[\"Dark Web\", \"Shadow IT\", \"Hidden Services\", \"Honeypots\"]'),
(5759, 160, 'Which scan type allows the scanner to log into the target?', 4, 'Authenticated Scan', 0, 'Credentialed', '2025-12-26 22:11:01', '[\"Unauthenticated Scan\", \"Stealth Scan\", \"Authenticated Scan\", \"Passive Scan\"]'),
(5760, 160, 'Which scan is better for an accurate inventory of installed software?', 5, 'Authenticated Scan', 0, 'Registry access', '2025-12-26 22:11:01', '[\"Unauthenticated Scan\", \"Port Scan\", \"Authenticated Scan\", \"Ping Sweep\"]');
INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(5761, 160, 'What is the main drawback of relying on \"Banner Grabbing\"?', 6, 'Banners can be fake or suppressed', 0, 'Accuracy', '2025-12-26 22:11:01', '[\"It is illegal\", \"Banners can be fake or suppressed\", \"It crashes servers\", \"It takes too long\"]'),
(5762, 160, 'In CVSS, what does \"AV:N\" indicate?', 7, 'Attack Vector: Network', 0, 'Remote', '2025-12-26 22:11:01', '[\"Attack Vector: None\", \"Attack Vector: Network\", \"Anti-Virus: None\", \"Available: No\"]'),
(5763, 160, 'Which CVSS metric measures if the attacker needs someone to click a link?', 8, 'User Interaction (UI)', 0, 'Interaction', '2025-12-26 22:11:01', '[\"Privileges Required (PR)\", \"Attack Complexity (AC)\", \"User Interaction (UI)\", \"Scope (S)\"]'),
(5764, 160, 'A \"Scope Change\" (S:C) in CVSS means expecting what?', 9, 'Impact extending beyond the vulnerable component', 0, 'VM Escape', '2025-12-26 22:11:01', '[\"Impact extending beyond the vulnerable component\", \"Scope is confidential\", \"System crash\", \"No impact\"]'),
(5765, 160, 'Where should you place a scanner to avoid firewall interference?', 10, 'In the same network segment/zone as the target', 0, 'Local', '2025-12-26 22:11:01', '[\"On the internet\", \"In the same network segment/zone as the target\", \"In the DMZ only\", \"On a distinct VLAN\"]'),
(5766, 160, 'Which scan policy determines if a host is simply alive?', 11, 'Host Discovery', 0, 'Ping', '2025-12-26 22:11:01', '[\"Basic Network Scan\", \"Host Discovery\", \"Malware Scan\", \"Web App Scan\"]'),
(5767, 160, 'Why do we avoid aggressive scans on SCADA/ICS systems?', 12, 'They are fragile and may crash', 0, 'Availability', '2025-12-26 22:11:01', '[\"They are secure by default\", \"They are fragile and may crash\", \"They are mostly air-gapped\", \"Nessus cannot see them\"]'),
(5768, 160, 'What is the most important attribute when prioritizing patches?', 13, 'Exploitability (Is there a script?)', 0, 'Risk', '2025-12-26 22:11:01', '[\"CVSS Score only\", \"Alphabetical Order\", \"Exploitability (Is there a script?)\", \"Vendor Name\"]'),
(5769, 160, 'What does Tenable VPR add to the analysis?', 14, 'Real-time threat context', 0, 'Prediction', '2025-12-26 22:11:01', '[\"Nothing\", \"Real-time threat context\", \"Color coding\", \"PDF export\"]'),
(5770, 160, 'What is an \"Emergency\" patch typically reserved for?', 15, 'Zero-Day exploits', 0, 'Log4j scenario', '2025-12-26 22:11:01', '[\"Routine updates\", \"Feature releases\", \"Zero-Day exploits\", \"UI fixes\"]'),
(5771, 160, 'Why must you have a \"Rollback Plan\" before patching?', 16, 'To recover if the patch breaks the server', 0, 'Safety', '2025-12-26 22:11:01', '[\"To uninstall viruses\", \"To recover if the patch breaks the server\", \"Compliance requires it\", \"It is optional\"]'),
(5772, 160, 'Who maintains the official CVE list?', 17, 'MITRE', 0, 'The list owner', '2025-12-26 22:11:01', '[\"NIST\", \"MITRE\", \"Microsoft\", \"Google\"]'),
(5773, 160, 'What is the difference between CVE and CWE?', 18, 'CVE is the specific flaw, CWE is the category', 0, 'Instance vs Type', '2025-12-26 22:11:01', '[\"They are identical\", \"CVE is for software, CWE for hardware\", \"CVE is the specific flaw, CWE is the category\", \"CWE is the score\"]'),
(5774, 160, 'If you cannot patch a system, but isolate it with a firewall, this is called?', 19, 'Remediation (Mitigation)', 0, 'Compensating Control', '2025-12-26 22:11:01', '[\"Acceptance\", \"Remediation (Mitigation)\", \"Transference\", \"Avoidance\"]'),
(5775, 160, 'Buying Cyber Insurance is an example of which risk strategy?', 20, 'Transference', 0, 'Shifting costs', '2025-12-26 22:11:01', '[\"Avoidance\", \"Acceptance\", \"Transference\", \"Mitigation\"]'),
(5776, 181, 'What is the defining characteristic of OSINT?', 1, 'It uses publicly available information', 0, 'Public', '2025-12-26 22:15:15', '[\"It uses hacking tools\", \"It uses spy satellites\", \"It uses publicly available information\", \"It is always illegal\"]'),
(5777, 181, 'Is browsing a company\'s public website considered \"Hacking\"?', 2, 'No, it is Passive OSINT', 0, 'Passive', '2025-12-26 22:15:15', '[\"Yes, immediately\", \"No, it is Passive OSINT\", \"Only if you use Chrome\", \"Only if using VPN\"]'),
(5778, 181, 'Which method gives you information without alerting the target?', 3, 'Passive Reconnaissance', 0, 'Quiet', '2025-12-26 22:15:15', '[\"Active Scanning\", \"Passive Reconnaissance\", \"Phishing\", \"DDoS\"]'),
(5779, 182, 'What is the first step of the Intelligence Cycle?', 1, 'Planning & Direction', 0, 'Goal setting', '2025-12-26 22:15:15', '[\"Collection\", \"Planning & Direction\", \"Analysis\", \"Hacking\"]'),
(5780, 182, 'In which phase do you \"connect the dots\" to form a conclusion?', 2, 'Analysis', 0, 'Thinking', '2025-12-26 22:15:15', '[\"Collection\", \"Analysis\", \"Processing\", \"Scanning\"]'),
(5781, 182, 'What is the output of the \"Collection\" phase?', 3, 'Raw Data', 0, 'Unsorted stuff', '2025-12-26 22:15:15', '[\"Finished Report\", \"Raw Data\", \"Intelligence\", \"Arrests\"]'),
(5782, 183, 'What is a \"Sock Puppet\" in OSINT?', 1, 'A fake online identity', 0, 'Disguise', '2025-12-26 22:15:15', '[\"A hand puppet\", \"A fake online identity\", \"A hacking tool\", \"A VPN protocol\"]'),
(5783, 183, 'Why should you verify your VPN before starting?', 2, 'To hide your Source IP from the target', 0, 'Anonymity', '2025-12-26 22:15:15', '[\"To make internet faster\", \"To hide your Source IP from the target\", \"To access Netflix\", \"To save battery\"]'),
(5784, 183, 'Why use an AI-generated face for a fake profile?', 3, 'Avoids Reverse Image Search detection', 0, 'Uniqueness', '2025-12-26 22:15:15', '[\"It looks better\", \"Avoids Reverse Image Search detection\", \"Real photos are illegal\", \"It is faster\"]'),
(5785, 184, 'Which operator restricts results to a specific website?', 1, 'site:', 0, 'Domain limit', '2025-12-26 22:15:16', '[\"host:\", \"site:\", \"www:\", \"map:\"]'),
(5786, 184, 'How do you find specifically PDF files?', 2, 'filetype:pdf', 0, 'File extension', '2025-12-26 22:15:16', '[\"pdf:\", \"filetype:pdf\", \"ext:adobe\", \"doc:pdf\"]'),
(5787, 184, 'What does `intitle:\"index of\"` typically reveal?', 3, 'Open Directory Listings', 0, 'A list of files', '2025-12-26 22:15:16', '[\"The homepage\", \"Open Directory Listings\", \"Google Maps\", \"DNS records\"]'),
(5788, 185, 'What concept relies on users choosing the same handle everywhere?', 1, 'Username Correlation', 0, 'Reuse', '2025-12-26 22:15:16', '[\"Password Reuse\", \"Username Correlation\", \"Identity Theft\", \"Phishing\"]'),
(5789, 185, 'Which tool checks a username across hundreds of sites?', 2, 'Sherlock', 0, 'Detective', '2025-12-26 22:15:16', '[\"Nmap\", \"Sherlock\", \"Wireshark\", \"Metasploit\"]'),
(5790, 185, 'If a user deletes a post, where might you still find it?', 3, 'Wayback Machine / Archive', 0, 'Time travel', '2025-12-26 22:15:16', '[\"Recycle Bin\", \"Wayback Machine / Archive\", \"Dark Web\", \"Nowhere\"]'),
(5791, 186, 'What does \"HaveIBeenPwned\" tell you?', 1, 'If an email was part of a known breach', 0, 'Leak status', '2025-12-26 22:15:16', '[\"The user\'s password\", \"If an email was part of a known breach\", \"The user\'s location\", \"The user\'s bank\"]'),
(5792, 186, 'What is Hunter.io primarily used for?', 2, 'Finding corporate email formats', 0, 'Business emails', '2025-12-26 22:15:16', '[\"Hacking wifi\", \"Finding corporate email formats\", \"Tracing phones\", \"Buying guns\"]'),
(5793, 186, 'Why is old breach data useful?', 3, 'Password reuse', 0, 'Habits', '2025-12-26 22:15:16', '[\"It isn\'t\", \"Password reuse\", \" blackmail\", \"It proves they are dumb\"]'),
(5794, 187, 'What hidden data in a photo might reveal location?', 1, 'EXIF / GPS Data', 0, 'Metadata', '2025-12-26 22:15:16', '[\"Pixels\", \"EXIF / GPS Data\", \"Color profile\", \"File name\"]'),
(5795, 187, 'Which search engine is famous for its facial recognition capabilities?', 2, 'Yandex', 0, 'Russian one', '2025-12-26 22:15:16', '[\"Bing\", \"DuckDuckGo\", \"Yandex\", \"Yahoo\"]'),
(5796, 187, 'What does Reverse Image Search help you find?', 3, 'Where else the image appears online', 0, 'Sources', '2025-12-26 22:15:16', '[\"The person\'s name\", \"Where else the image appears online\", \"The camera model\", \"The password\"]'),
(5797, 188, 'What record functions as the \"birth certificate\" of a domain?', 1, 'WHOIS', 0, 'Registration', '2025-12-26 22:15:16', '[\"DNS\", \"WHOIS\", \"SSL\", \"HTTP\"]'),
(5798, 188, 'Why do we look for subdomains like \"dev.example.com\"?', 2, 'Often less secure / testing environments', 0, 'Weak targets', '2025-12-26 22:15:16', '[\"They look cool\", \"Often less secure / testing environments\", \"They represent the CEO\", \"They are faster\"]'),
(5799, 188, 'What does \"BuiltWith\" tell you?', 3, 'The technology stack used', 0, 'Tech', '2025-12-26 22:15:16', '[\"Who owns it\", \"The technology stack used\", \"The password\", \"The bugs\"]'),
(5800, 189, 'What tool maps Wifi SSIDs to GPS coordinates?', 1, 'Wigle.net', 0, 'Wifi map', '2025-12-26 22:15:16', '[\"Google Maps\", \"Wigle.net\", \"Shodan\", \"WifiCracker\"]'),
(5801, 189, 'What feature of Google Earth helps verify \"When\" a satellite image was taken?', 2, 'Historical Imagery', 0, 'Timeline', '2025-12-26 22:15:16', '[\"Street View\", \"Historical Imagery\", \"3D Buildings\", \"Atmosphere\"]'),
(5802, 189, 'How can SunCalc help in IMINT?', 3, 'Determine time of day from shadows', 0, 'Shadows', '2025-12-26 22:15:16', '[\"Find the weather\", \"Determine time of day from shadows\", \"Find solar panels\", \"Navigate\"]'),
(5803, 190, 'What does OSINT stand for?', 1, 'Open Source Intelligence', 0, 'Open Source', '2025-12-26 22:15:16', '[\"Open Source Intelligence\", \"Overseas Intelligence\", \"Online Security INTerface\", \"Open System Integration\"]'),
(5804, 190, 'Is Passive OSINT illegal?', 2, 'Generally No (accessing public data)', 0, 'No', '2025-12-26 22:15:16', '[\"Yes, always\", \"Generally No (accessing public data)\", \"Only in Europe\", \"Only for police\"]'),
(5805, 190, 'What is the best way to protect your identity during research?', 3, 'Use a Sock Puppet and VPN', 0, 'OPSEC', '2025-12-26 22:15:16', '[\"Clear cookies\", \"Use a Sock Puppet and VPN\", \"Use Incognito Mode\", \"Ask permission\"]'),
(5806, 190, 'Which Google Dork finds Excel files?', 4, 'filetype:xlsx', 0, 'Spreadsheet', '2025-12-26 22:15:16', '[\"file:excel\", \"filetype:xlsx\", \"type:xls\", \"ext:sheet\"]'),
(5807, 190, 'Which operator searches for text inside the URL?', 5, 'inurl:', 0, 'URL text', '2025-12-26 22:15:16', '[\"site:\", \"inurl:\", \"link:\", \"addr:\"]'),
(5808, 190, 'If you want to view a deleted page, what Google operator helps?', 6, 'cache:', 0, 'Snapshot', '2025-12-26 22:15:16', '[\"history:\", \"cache:\", \"old:\", \"back:\"]'),
(5809, 190, 'Which tool is best for checking username reuse across 300+ sites?', 7, 'Sherlock', 0, 'Python script', '2025-12-26 22:15:16', '[\"Nessus\", \"Sherlock\", \"John the Ripper\", \"Wireshark\"]'),
(5810, 190, 'What service helps you find the email format for a company (e.g., first.last)?', 8, 'Hunter.io', 0, 'Email patterns', '2025-12-26 22:15:16', '[\"HaveIBeenPwned\", \"Hunter.io\", \"Gmail\", \"Outlook\"]'),
(5811, 190, 'What does \"HaveIBeenPwned\" check?', 9, 'If an email is in a known data breach', 0, 'Breaches', '2025-12-26 22:15:16', '[\"The email password\", \"If an email is in a known data breach\", \"If the email is valid\", \"Who owns the email\"]'),
(5812, 190, 'Which search engine is preferred for facial recognition checks?', 10, 'Yandex', 0, 'Russian AI', '2025-12-26 22:15:16', '[\"Bing\", \"Google\", \"Yandex\", \"DuckDuckGo\"]'),
(5813, 190, 'What metadata in a photo provides GPS coordinates?', 11, 'EXIF', 0, 'Tags', '2025-12-26 22:15:16', '[\"Pixel\", \"EXIF\", \"PNG\", \"Stenography\"]'),
(5814, 190, 'What tool lets you search for Wifi hotspots by SSID?', 12, 'Wigle.net', 0, 'War driving DB', '2025-12-26 22:15:16', '[\"WifiMap\", \"Wigle.net\", \"Google Wifi\", \"NetStumbler\"]'),
(5815, 190, 'What record tells you who owns a domain name?', 13, 'WHOIS', 0, 'Registry', '2025-12-26 22:15:16', '[\"DNS\", \"WHOIS\", \"ARP\", \"DHCP\"]'),
(5816, 190, 'What tool visualizes domain infrastructure and subdomains as a graph?', 14, 'DNSDumpster', 0, 'Graph', '2025-12-26 22:15:16', '[\"Nmap\", \"DNSDumpster\", \"Ping\", \"Traceroute\"]'),
(5817, 190, 'Why are subdomains like \"dev\" or \"staging\" valuable targets?', 15, 'Often have weaker security/config', 0, 'Forgotten', '2025-12-26 22:15:16', '[\"They are faster\", \"Often have weaker security/config\", \"They are public\", \"They have more money\"]'),
(5818, 190, 'What is the \"Intelligence Cycle\" step where you interpret data?', 16, 'Analysis', 0, 'Reasoning', '2025-12-26 22:15:16', '[\"Collection\", \"Analysis\", \"Planning\", \"Filing\"]'),
(5819, 190, 'What is a \"Grey Hat\" OSINT source?', 17, 'Semi-legal/paid breach data sites', 0, 'DeHashed', '2025-12-26 22:15:16', '[\"Government sites\", \"Semi-legal/paid breach data sites\", \"News sites\", \"Libraries\"]'),
(5820, 190, 'Why should you verify \"Sock Puppets\" with a burner phone?', 18, 'Platforms require SMS verification', 0, '2FA', '2025-12-26 22:15:16', '[\"To call the target\", \"Platforms require SMS verification\", \"To look cool\", \"It is cheaper\"]'),
(5821, 190, 'What is \"Google Hacking\"?', 19, 'Using advanced operators to find sensitive info', 0, 'Dorking', '2025-12-26 22:15:16', '[\"Hacking Google servers\", \"Using advanced operators to find sensitive info\", \"Phishing Google employees\", \"Using Chrome\"]'),
(5822, 190, 'What is the primary risk of \"Active\" recon (like port scanning)?', 20, 'It generates logs/alerts on the target', 0, 'Detection', '2025-12-26 22:15:16', '[\"It is slow\", \"It generates logs/alerts on the target\", \"It costs money\", \"Nothing\"]'),
(5823, 191, 'Which header field usually matches the actual Envelope Sender?', 1, 'Return-Path', 0, 'Return', '2025-12-26 22:17:47', '[\"Reply-To\", \"Return-Path\", \"From\", \"Subject\"]'),
(5824, 191, 'If \"From\" is \"ceo@company.com\" but \"Return-Path\" is \"hacker@gmail.com\", what is this called?', 2, 'Spoofing', 0, 'Mismatch', '2025-12-26 22:17:47', '[\"Phishing\", \"Spoofing\", \"Spam\", \"Relaying\"]'),
(5825, 191, 'Are \"Message Headers\" authenticated by default?', 3, 'No, they can be easily faked', 0, 'No', '2025-12-26 22:17:47', '[\"Yes, strictly\", \"No, they can be easily faked\", \"Only on Gmail\", \"Only on Outlook\"]'),
(5826, 192, 'Which protocol uses a DNS list of allowed Sender IPs?', 1, 'SPF', 0, 'Sender Policy', '2025-12-26 22:17:47', '[\"SPF\", \"DKIM\", \"DMARC\", \"POP3\"]'),
(5827, 192, 'What does DKIM prevent?', 2, 'Tampering / Modification', 0, 'Integrity', '2025-12-26 22:17:47', '[\"Spoofing IP\", \"Tampering / Modification\", \"Spam\", \"Viruses\"]'),
(5828, 192, 'If DMARC policy is \"p=reject\", what happens to spoofed emails?', 3, 'They are blocked/deleted', 0, 'Reject', '2025-12-26 22:17:47', '[\"Delivered to Inbox\", \"Sent to Spam\", \"They are blocked/deleted\", \"Returned to sender\"]'),
(5829, 193, 'What is \"Typosquatting\"?', 1, 'Registering a domain that looks like the real one', 0, 'Misspelling', '2025-12-26 22:17:47', '[\"Hacking DNS\", \"Registering a domain that looks like the real one\", \"Stealing passwords\", \"Deleting data\"]'),
(5830, 193, 'The \"From\" header says \"tesla-corp.io\". Why is this suspicious?', 2, 'It is not the official trusted domain', 0, 'Fake domain', '2025-12-26 22:17:47', '[\"It is too long\", \"It is not the official trusted domain\", \"It uses hyphens\", \"It is fine\"]'),
(5831, 193, 'What psychological trigger is used in \"URGENT WIRE TRANSFER\"?', 3, 'Urgency / Panic', 0, 'Fear', '2025-12-26 22:17:47', '[\"Greed\", \"Urgency / Panic\", \"Curiosity\", \"Authority\"]'),
(5832, 194, 'Why is \"file.pdf.exe\" dangerous?', 1, 'Windows hides the .exe extension', 0, 'Double extension', '2025-12-26 22:17:47', '[\"It is a PDF\", \"Windows hides the .exe extension\", \"It is corrupt\", \"It is encrypted\"]'),
(5833, 194, 'What is the first safe step when you have a suspicious file?', 2, 'Hash it and check VirusTotal', 0, 'Hashing', '2025-12-26 22:17:47', '[\"Open it\", \"Hash it and check VirusTotal\", \"Email it to IT\", \"Rename it\"]'),
(5834, 194, 'What does \"X-PHP-Originating-Script\" usually indicate?', 3, 'Sent via a web script/bot', 0, 'Automated', '2025-12-26 22:17:47', '[\"Sent by Outlook\", \"Sent via a web script/bot\", \"Sent by Gmail\", \"Legitimate marketing\"]'),
(5835, 195, 'What does \"Defanging\" a URL mean?', 1, 'Making it unclickable', 0, 'Safety', '2025-12-26 22:17:47', '[\"Deleting it\", \"Making it unclickable\", \"Encrypting it\", \"Clicking it\"]'),
(5836, 195, 'If SPF fails for \"microsoft.com\", what does it mean?', 2, 'The sender IP is not Microsoft', 0, 'Spoofing', '2025-12-26 22:17:47', '[\"Microsoft is down\", \"The sender IP is not Microsoft\", \"The email is legitimate\", \"DNS is broken\"]'),
(5837, 195, 'What is suspicious about \"login.microsoft.com.xyz\"?', 3, 'The TLD is .xyz, not .com', 0, 'Fake domain', '2025-12-26 22:17:47', '[\"It is too short\", \"The TLD is .xyz, not .com\", \"It contains login\", \"It is secure\"]'),
(5838, 196, 'What is the TRUE sender address (Return-Path)?', 1, 'support-ticket-882@gmail.com', 0, 'Return Path', '2025-12-26 22:17:47', '[\"admin@company.com\", \"support-ticket-882@gmail.com\", \"victim@company.com\", \"mail.attacker-infrastructure.net\"]'),
(5839, 196, 'Who does the email CLAIM to be from (Display Name)?', 2, 'IT Service Desk', 0, 'Fake Name', '2025-12-26 22:17:47', '[\"Support Ticket\", \"IT Service Desk\", \"Gmail Team\", \"HR\"]'),
(5840, 196, 'Look at the X-Mailer. What software sent this?', 3, 'OstroMail v1.2 (Mass Mailer)', 0, 'Mass Mailer', '2025-12-26 22:17:47', '[\"Outlook\", \"Gmail\", \"OstroMail v1.2 (Mass Mailer)\", \"iPhone Mail\"]'),
(5841, 196, 'Did SPF pass or fail?', 4, 'Pass', 0, 'Pass', '2025-12-26 22:17:47', '[\"Fail\", \"SoftFail\", \"Pass\", \"Neutral\"]'),
(5842, 196, 'Why is this suspicious, despite SPF passing?', 5, 'Sender authenticated as Gmail, but spoofed Company header', 0, 'Mismatch', '2025-12-26 22:17:47', '[\"SPF failed\", \"Sender authenticated as Gmail, but spoofed Company header\", \"It came from Microsoft\", \"The date is wrong\"]'),
(5843, 201, 'Which principle relies on the target\'s fear of disobeying a superior?', 1, 'Authority', 0, 'Boss', '2025-12-26 22:28:54', '[\"Reciprocity\", \"Authority\", \"Liking\", \"Consistency\"]'),
(5844, 201, '\"Act now or lose your account!\" exploits which psychological trigger?', 2, 'Urgency / Scarcity', 0, 'Panic', '2025-12-26 22:28:54', '[\"Trust\", \"Urgency / Scarcity\", \"Social Proof\", \"Kindness\"]'),
(5845, 201, 'What is the best immediate defense when you feel \"rushed\" by a request?', 3, 'Stop and Verify', 0, 'Pause', '2025-12-26 22:28:54', '[\"Do it quickly\", \"Stop and Verify\", \"Argue\", \"Ignore it\"]'),
(5846, 202, 'What is \"Pretexting\"?', 1, 'Creating a fake scenario to trick a victim', 0, 'Story', '2025-12-26 22:28:54', '[\"Guessing passwords\", \"Creating a fake scenario to trick a victim\", \"Scanning ports\", \"Coding malware\"]'),
(5847, 202, 'Who is a common persona for attackers to impersonate?', 2, 'IT Support', 0, 'Help Desk', '2025-12-26 22:28:54', '[\"The Janitor\", \"IT Support\", \"A stranger\", \"A dog\"]'),
(5848, 202, 'How do you defeat an impersonator on the phone?', 3, 'Call them back on a verified number', 0, 'Callback', '2025-12-26 22:28:54', '[\"Ask their name\", \"Call them back on a verified number\", \"Yell at them\", \"Tracing the call\"]'),
(5849, 203, 'What is \"Vishing\"?', 1, 'Phishing conducted over the phone', 0, 'Voice', '2025-12-26 22:28:54', '[\"Video Phishing\", \"Phishing conducted over the phone\", \"Virtual Fishing\", \"Virus Phishing\"]'),
(5850, 203, 'Why is Caller ID not a reliable way to verify a caller?', 2, 'It can be easily spoofed', 0, 'Fake numbers', '2025-12-26 22:28:54', '[\"It is encrypted\", \"It can be easily spoofed\", \"It costs money\", \"It is old tech\"]'),
(5851, 203, 'What payment method is a major red flag for scam calls?', 3, 'Gift Cards', 0, 'iTunes', '2025-12-26 22:28:54', '[\"Credit Card\", \"Gift Cards\", \"Wire Transfer\", \"Check\"]'),
(5852, 204, 'What makes Smishing URLs harder to inspect than email URLs?', 1, 'Mobile interfaces make hovering/previewing difficult', 0, 'No mouse', '2025-12-26 22:28:54', '[\"They are encrypted\", \"Mobile interfaces make hovering/previewing difficult\", \"They are faster\", \"They are secure\"]'),
(5853, 204, 'What is a common \"Lure\" for SMS attacks?', 2, 'Missed package delivery', 0, 'USPS', '2025-12-26 22:28:54', '[\"Free pizza\", \"Missed package delivery\", \"Weather alert\", \"News update\"]'),
(5854, 204, 'If you get a suspicious text from your \"Bank\", what should you do?', 3, 'Log in via the official App or Website', 0, 'Direct access', '2025-12-26 22:28:54', '[\"Click the link\", \"Log in via the official App or Website\", \"Reply STOP\", \"Call the number in the text\"]'),
(5855, 205, 'What constitutes \"Tailgating\"?', 1, 'Following someone into a secure area without badging in', 0, 'Piggyback', '2025-12-26 22:28:54', '[\"Driving too close\", \"Following someone into a secure area without badging in\", \"Breaking a lock\", \"Hacking a badge reader\"]'),
(5856, 205, 'How do attackers exploit \"politeness\" to bypass physical security?', 2, 'Holding the door for someone carrying items', 0, 'Heavy box', '2025-12-26 22:28:54', '[\"Buying lunch\", \"Holding the door for someone carrying items\", \"Saying please\", \"Dressing nice\"]'),
(5857, 205, 'What is the primary defense against Dumpster Diving?', 3, 'Shredding sensitive documents', 0, 'Shred', '2025-12-26 22:28:54', '[\"Burning trash\", \"Shredding sensitive documents\", \"Recycling\", \"Hiding trash\"]'),
(5858, 206, 'What is a \"USB Drop\" attack?', 1, 'Leaving an infected USB drive for a victim to find', 0, 'Bait', '2025-12-26 22:28:54', '[\"Throwing USBs at people\", \"Leaving an infected USB drive for a victim to find\", \"Stealing USBs\", \"Buying USBs\"]'),
(5859, 206, 'What human emotion does Baiting primarily exploit?', 2, 'Curiosity', 0, 'Wonder', '2025-12-26 22:28:54', '[\"Fear\", \"Curiosity\", \"Greed\", \"Sadness\"]'),
(5860, 206, 'How does Quid Pro Quo differ from Baiting?', 3, 'It involves an exchange of service/help', 0, 'Exchange', '2025-12-26 22:28:54', '[\"It is faster\", \"It involves an exchange of service/help\", \"It is digital only\", \"It uses email\"]'),
(5861, 207, 'Which Cialdini principle explains why people comply with requests from \"The CEO\"?', 1, 'Authority', 0, 'Boss', '2025-12-26 22:28:54', '[\"Liking\", \"Authority\", \"Scarcity\", \"Reciprocity\"]'),
(5862, 207, 'If an attacker does you a favor to make you feel obligated, which principle is this?', 2, 'Reciprocity', 0, 'Owe me', '2025-12-26 22:28:54', '[\"Social Proof\", \"Reciprocity\", \"Authority\", \"Commitment\"]'),
(5863, 207, '\"Only 2 spots left!\" is an example of:', 3, 'Scarcity', 0, 'Rare', '2025-12-26 22:28:54', '[\"Authority\", \"Scarcity\", \"Consistency\", \"Liking\"]'),
(5864, 207, 'What is the best way to verify a \"Bank\" calling you?', 4, 'Hang up and call the number on your card', 0, 'Source of truth', '2025-12-26 22:28:54', '[\"Ask for their ID\", \"Hang up and call the number on your card\", \"Trust Caller ID\", \"Ask for a supervisor\"]'),
(5865, 207, 'What is \"Pretexting\"?', 5, 'Creating a fabricated scenario to obtain info', 0, 'Lying scenario', '2025-12-26 22:28:54', '[\"Using text messages\", \"Creating a fabricated scenario to obtain info\", \"Pre-authorized scanning\", \"Testing backups\"]'),
(5866, 207, 'Which technology has made Vishing much more dangerous recently?', 6, 'AI Voice Cloning / Deepfakes', 0, 'AI', '2025-12-26 22:28:54', '[\"5G\", \"AI Voice Cloning / Deepfakes\", \"Fiber Optics\", \"VoIP\"]'),
(5867, 207, 'Why are shortened URLs (bit.ly) dangerous in SMS?', 7, 'They hide the true destination', 0, 'Obfuscation', '2025-12-26 22:28:54', '[\"They are slow\", \"They hide the true destination\", \"They cost money\", \"They assume HTTP\"]'),
(5868, 207, 'What is the term for Phishing via SMS?', 8, 'Smishing', 0, 'SMS', '2025-12-26 22:28:54', '[\"Vishing\", \"Smishing\", \"Phishing\", \"Texting\"]'),
(5869, 207, 'Where should you report spam texts?', 9, '7726 (SPAM)', 0, 'Carrier code', '2025-12-26 22:28:54', '[\"911\", \"7726 (SPAM)\", \"The Police\", \"Your Mom\"]'),
(5870, 207, 'What is \"Tailgating\"?', 10, 'Following an authorized person through a secure door', 0, 'Piggybacking', '2025-12-26 22:28:54', '[\"Driving close\", \"Following an authorized person through a secure door\", \"Hacking the lock\", \"Climbing the fence\"]'),
(5871, 207, 'What is the counter-measure for \"Dumpster Diving\"?', 11, 'Shredding documents', 0, 'Destruction', '2025-12-26 22:28:54', '[\"Recycling\", \"Shredding documents\", \"burning\", \"hiding\"]'),
(5872, 207, 'What is \"Shoulder Surfing\"?', 12, 'Looking at someone\'s screen/keyboard to steal info', 0, 'Peeking', '2025-12-26 22:28:54', '[\"Massaging shoulders\", \"Looking at someone\'s screen/keyboard to steal info\", \"Surfing the web\", \"Hacking wifi\"]'),
(5873, 207, 'If you find a USB drive labeled \"Payroll\" in the lobby, what should you do?', 13, 'Do not plug it in; give to Security', 0, 'Quarantine', '2025-12-26 22:28:54', '[\"Plug it in to check\", \"Do not plug it in; give to Security\", \"Throw it away\", \"Keep it\"]'),
(5874, 207, 'Establishing a fake \"Free WiFi\" spot to steal data is called:', 14, 'Evil Twin', 0, 'WiFi Clone', '2025-12-26 22:28:54', '[\"Bad Twin\", \"Evil Twin\", \"Good Twin\", \"Rogue AP\"]'),
(5875, 207, '\"Quid Pro Quo\" means:', 15, 'Something for Something', 0, 'Exchange', '2025-12-26 22:28:54', '[\"Free for all\", \"Something for Something\", \"Nothing for Nothing\", \"Quick Pro\"]'),
(5876, 207, 'What is the weakest link in most security systems?', 16, 'The Human', 0, 'People', '2025-12-26 22:28:54', '[\"The Firewall\", \"The Human\", \"The Encryption\", \"The Password\"]'),
(5877, 207, 'Does Social Engineering always involve a computer?', 17, 'No (Physical/Phone)', 0, 'No', '2025-12-26 22:28:54', '[\"Yes\", \"No (Physical/Phone)\", \"Maybe\", \"Only on Tuesdays\"]'),
(5878, 207, 'What implies \"Social Proof\"?', 18, '\"9 out of 10 users did this\"', 0, 'Crowd', '2025-12-26 22:28:54', '[\"\\\"I am the boss\\\"\", \"\\\"9 out of 10 users did this\\\"\", \"\\\"This is rare\\\"\", \"\\\"I like you\\\"\"]'),
(5879, 207, 'Why do attackers target new employees?', 19, 'They are eager to please and don\'t know procedures', 0, 'Newbies', '2025-12-26 22:28:54', '[\"They have more access\", \"They are eager to please and don\'t know procedures\", \"They make more money\", \"They are dumb\"]'),
(5880, 207, 'What is the best general defense against Social Engineering?', 20, 'Security Awareness Training & skepticism', 0, 'Training', '2025-12-26 22:28:54', '[\"Better Firewalls\", \"Security Awareness Training & skepticism\", \"More Antivirus\", \"Blocking Email\"]'),
(5881, 221, 'What is the primary function of \"Correlation\" in a SIEM?', 1, 'Connecting related events to detect threats', 0, 'Connecting dots', '2025-12-26 22:35:58', '[\"Saving storage space\", \"Connecting related events to detect threats\", \"Deleting old logs\", \"Speeding up the network\"]'),
(5882, 221, 'Why is \"Retention\" important?', 2, 'Compliance and Forensic Investigation', 0, 'History', '2025-12-26 22:35:58', '[\"To fill up hard drives\", \"Compliance and Forensic Investigation\", \"To slow down the system\", \"It is not important\"]'),
(5883, 221, 'What component typically sits on the Endpoint to send logs?', 3, 'Forwarder / Agent', 0, 'Sender', '2025-12-26 22:35:58', '[\"Firewall\", \"Forwarder / Agent\", \"Router\", \"Switch\"]'),
(5884, 222, 'Which protocol is the standard for network device logging?', 1, 'Syslog', 0, 'Standard', '2025-12-26 22:35:58', '[\"SMB\", \"Syslog\", \"FTP\", \"HTTP\"]'),
(5885, 222, 'What is \"NetFlow\" data?', 2, 'Traffic metadata (Who talked to Whom)', 0, 'Traffic info', '2025-12-26 22:35:58', '[\"Full packet capture\", \"Traffic metadata (Who talked to Whom)\", \"Email contents\", \"File contents\"]'),
(5886, 222, 'Why is \"Time Zone\" alignment critical in SIEM?', 3, 'To accurately correlate events across the world', 0, 'Timeline', '2025-12-26 22:35:58', '[\"It isn\'t\", \"To accurately correlate events across the world\", \"To know when to eat lunch\", \"For daylight savings\"]'),
(5887, 223, 'What is the goal of \"Normalization\"?', 1, 'Converting mixed formats into a standard field structure', 0, 'Standardization', '2025-12-26 22:35:58', '[\"Deleting logs\", \"Converting mixed formats into a standard field structure\", \"Encrypting logs\", \"Compressing logs\"]'),
(5888, 223, 'If Windows calls it \"AccountName\" and Linux calls it \"User\", what does the SIEM do?', 2, 'Maps them to a single field like user.name', 0, 'Mapping', '2025-12-26 22:35:58', '[\"Ignores them\", \"Maps them to a single field like user.name\", \"Deletes one\", \"Errors out\"]'),
(5889, 223, 'What process extracts \"192.168.1.1\" from a raw text message?', 3, 'Parsing', 0, 'Extraction', '2025-12-26 22:35:58', '[\"Hashing\", \"Parsing\", \"Encryption\", \"Routing\"]'),
(5890, 224, 'What defines a \"Brute Force\" correlation rule?', 1, 'Multiple failed logins in a short time', 0, 'Many fails', '2025-12-26 22:35:58', '[\"One failed login\", \"Multiple failed logins in a short time\", \"A successful login\", \"A slow login\"]'),
(5891, 224, 'What is \"Impossible Travel\"?', 2, 'Logins from two distant locations in an impossibly short time', 0, 'Teleportation', '2025-12-26 22:35:58', '[\"Traveling without a visa\", \"Logins from two distant locations in an impossibly short time\", \"VPN usage\", \"Remote work\"]'),
(5892, 224, 'Adjusting a rule to reduce False Positives is called:', 3, 'Tuning', 0, 'Adjustment', '2025-12-26 22:35:58', '[\"Breaking\", \"Tuning\", \"Deleting\", \"Ignoring\"]'),
(5893, 225, 'What query language does Splunk use?', 1, 'SPL (Search Processing Language)', 0, 'SPL', '2025-12-26 22:35:58', '[\"SQL\", \"SPL (Search Processing Language)\", \"KQL\", \"Python\"]'),
(5894, 225, 'What query language does Microsoft Sentinel use?', 2, 'KQL (Kusto Query Language)', 0, 'Kusto', '2025-12-26 22:35:58', '[\"SPL\", \"KQL (Kusto Query Language)\", \"Bash\", \"PowerShell\"]'),
(5895, 225, 'What is a major downside of Splunk traditionally?', 3, 'High cost', 0, 'Expensive', '2025-12-26 22:35:58', '[\"It is slow\", \"High cost\", \"It has no features\", \"It only runs on Mac\"]'),
(5896, 226, 'Which component of ELK provides the Visualization / Dashboard?', 1, 'Kibana', 0, 'UI', '2025-12-26 22:35:58', '[\"Elasticsearch\", \"Kibana\", \"Logstash\", \"Beats\"]'),
(5897, 226, 'What is the Database/Search Engine of the stack?', 2, 'Elasticsearch', 0, 'DB', '2025-12-26 22:35:58', '[\"MySQL\", \"Elasticsearch\", \"Redis\", \"Mongo\"]'),
(5898, 226, 'What are \"Beats\"?', 3, 'Lightweight data shippers/agents', 0, 'Agents', '2025-12-26 22:35:58', '[\"Music files\", \"Lightweight data shippers/agents\", \"Databases\", \"Firewalls\"]'),
(5899, 227, 'What makes Wazuh unique compared to basic ELK?', 1, 'It includes XDR features like FIM and Active Response', 0, 'XDR', '2025-12-26 22:35:58', '[\"It costs money\", \"It includes XDR features like FIM and Active Response\", \"It has no UI\", \"It creates viruses\"]'),
(5900, 227, 'What is \"Active Response\" in Wazuh?', 2, 'The ability to automatically block/stop a threat', 0, 'Action', '2025-12-26 22:35:58', '[\"Sending an email\", \"The ability to automatically block/stop a threat\", \"Deleting the server\", \"Calling the police\"]'),
(5901, 227, 'Is Wazuh open source?', 3, 'Yes', 0, 'Free', '2025-12-26 22:35:58', '[\"No\", \"Yes\", \"Only for students\", \"It is a subscription\"]'),
(5902, 228, 'What is the \"Normalization\" phase in SIEM?', 1, 'Mapping different log formats to standard fields', 0, 'Standardize', '2025-12-26 22:35:58', '[\"Compressing logs\", \"Mapping different log formats to standard fields\", \"Deleting logs\", \"Encrypting logs\"]'),
(5903, 228, 'Garbage In, Garbage Out refers to:', 2, 'A SIEM is only as good as the log data fed into it', 0, 'Input quality', '2025-12-26 22:35:58', '[\"Trash management\", \"A SIEM is only as good as the log data fed into it\", \"Deleting logs\", \"Hardware recycling\"]'),
(5904, 228, 'What is \"Impossible Travel\"?', 3, 'Logins from two locations physically impossible to traverse in the time', 0, 'Teleportation', '2025-12-26 22:35:58', '[\"VPN usage\", \"Logins from two locations physically impossible to traverse in the time\", \"Dual citizenship\", \"Space travel\"]'),
(5905, 228, 'SPL (Search Processing Language) belongs to which SIEM?', 4, 'Splunk', 0, 'The big one', '2025-12-26 22:35:58', '[\"Sentinel\", \"Splunk\", \"Wazuh\", \"ELK\"]'),
(5906, 228, 'KQL (Kusto Query Language) belongs to which SIEM?', 5, 'Microsoft Sentinel', 0, 'Azure', '2025-12-26 22:35:58', '[\"Splunk\", \"Microsoft Sentinel\", \"QRadar\", \"ArcSight\"]'),
(5907, 228, 'Which open-source tool allows for \"Active Response\" (blocking IPs)?', 6, 'Wazuh', 0, 'XDR', '2025-12-26 22:35:58', '[\"Logstash\", \"Wazuh\", \"Kibana\", \"Notepad\"]'),
(5908, 228, 'In the ELK stack, which tool is the \"UI\"?', 7, 'Kibana', 0, 'Visualizer', '2025-12-26 22:35:58', '[\"Elasticsearch\", \"Kibana\", \"Logstash\", \"Filebeat\"]'),
(5909, 228, 'What does a \"Forwarder\" do?', 8, 'Sends logs from the endpoint to the SIEM', 0, 'Transportation', '2025-12-26 22:35:58', '[\"Stores logs\", \"Sends logs from the endpoint to the SIEM\", \"Deletes logs\", \"Analyzes logs\"]'),
(5910, 228, 'Why do we need \"Retention\"?', 9, 'Compliance regulations often require keeping logs for 1 year+', 0, 'Compliance', '2025-12-26 22:35:58', '[\"To run out of space\", \"Compliance regulations often require keeping logs for 1 year+\", \"To slow down searches\", \"We don\'t\"]'),
(5911, 231, 'What is the Attacker\'s IP address?', 1, '192.168.1.55', 0, 'IP', '2025-12-26 22:41:26', '[\"127.0.0.1\", \"192.168.1.55\", \"10.0.0.1\", \"8.8.8.8\"]'),
(5912, 231, 'Did the attacker succeed?', 2, 'Yes, the last log says \"Accepted\"', 0, 'Success', '2025-12-26 22:41:26', '[\"No, all failed\", \"Yes, the last log says \\\"Accepted\\\"\", \"Maybe\", \"Unknown\"]'),
(5913, 231, 'Which account was targeted?', 3, 'root', 0, 'Admin', '2025-12-26 22:41:26', '[\"admin\", \"user\", \"root\", \"guest\"]'),
(5914, 232, 'What is the time interval between connections?', 1, '5 Minutes', 0, 'Regularity', '2025-12-26 22:41:26', '[\"1 Minute\", \"5 Minutes\", \"Random\", \"1 Hour\"]'),
(5915, 232, 'Why is \"Regularity\" suspicious?', 2, 'Machines are precise, humans are random', 0, 'Automation', '2025-12-26 22:41:26', '[\"It isn\'t\", \"Machines are precise, humans are random\", \"It means the network is fast\", \"It is normal\"]'),
(5916, 232, 'What destination IP is the victim talking to?', 3, '45.33.2.1', 0, 'C2', '2025-12-26 22:41:26', '[\"10.10.1.100\", \"127.0.0.1\", \"45.33.2.1\", \"192.168.1.1\"]'),
(5917, 233, 'What is the time difference between the two logins?', 1, '1 hour 15 minutes', 0, 'Delta', '2025-12-26 22:41:26', '[\"5 minutes\", \"1 hour 15 minutes\", \"8 hours\", \"1 day\"]'),
(5918, 233, 'Which user account is affected?', 2, 'alice@company.com', 0, 'User', '2025-12-26 22:41:26', '[\"bob\", \"admin\", \"alice@company.com\", \"root\"]'),
(5919, 233, 'What is the most likely malicious explanation?', 3, 'Credential Theft', 0, 'Stolen Creds', '2025-12-26 22:41:26', '[\"VPN\", \"Credential Theft\", \"Fast Plane\", \"Bug\"]'),
(5920, 234, 'Which group was the user added to?', 1, 'Domain Admins', 0, 'Admin', '2025-12-26 22:41:26', '[\"Users\", \"Guests\", \"Domain Admins\", \"Print Operators\"]'),
(5921, 234, 'What Windows Event ID indicates \"Member Added to Group\"?', 2, '4728', 0, 'ID', '2025-12-26 22:41:26', '[\"4624\", \"4728\", \"1102\", \"514\"]'),
(5922, 234, 'Why is the timestamp (03:00 AM) relevant?', 3, 'Off-hours changes are suspicious', 0, 'Night', '2025-12-26 22:41:26', '[\"It is daytime\", \"Off-hours changes are suspicious\", \"Servers restart then\", \"It is normal\"]'),
(5923, 235, 'What is hidden inside the long subdomains?', 1, 'Exfiltrated Data (Encoded)', 0, 'Stolen integrity', '2025-12-26 22:41:26', '[\"Nothing\", \"Exfiltrated Data (Encoded)\", \"IP addresses\", \"Viruses\"]'),
(5924, 235, 'Why do attackers use DNS for exfiltration?', 2, 'Firewalls usually allow Port 53 (DNS) outbound', 0, 'Port 53', '2025-12-26 22:41:26', '[\"It is faster\", \"Firewalls usually allow Port 53 (DNS) outbound\", \"It is encrypted\", \"It compresses data\"]'),
(5925, 235, 'What characteristic of the query string indicates tunneling?', 3, 'Length and High Entropy (Randomness)', 0, 'Long', '2025-12-26 22:41:26', '[\"Short length\", \"Length and High Entropy (Randomness)\", \"It is .com\", \"It is readable\"]'),
(5926, 236, 'In the Firewall log, what is the source IP doing?', 1, 'Port Scanning (trying different ports rapidly)', 0, 'SCAN', '2025-12-26 22:41:26', '[\"Downloading files\", \"Port Scanning (trying different ports rapidly)\", \"Updating\", \"Browsing web\"]'),
(5927, 236, 'What action did the firewall take?', 2, 'BLOCK', 0, 'Action', '2025-12-26 22:41:26', '[\"ALLOW\", \"BLOCK\", \"PASS\", \"LOG\"]'),
(5928, 236, 'What event ID represents a Successful Login?', 3, '4624', 0, 'ID', '2025-12-26 22:41:26', '[\"4625\", \"4624\", \"1000\", \"52\"]'),
(5929, 236, 'What time did the login occur?', 4, '02:00 AM', 0, 'Time', '2025-12-26 22:41:26', '[\"23:55\", \"02:00 AM\", \"Noon\", \"Midnight\"]'),
(5930, 236, 'In the Brute Force scenario, what indicates success?', 5, 'A \"Success\" or \"Accepted\" log after failures', 0, 'Win', '2025-12-26 22:41:26', '[\"More failures\", \"A \\\"Success\\\" or \\\"Accepted\\\" log after failures\", \"Nothing\", \"A lockout\"]'),
(5931, 236, 'How do you detect \"Beaconing\"?', 6, 'Regular time intervals (Heartbeat)', 0, 'Rhythm', '2025-12-26 22:41:26', '[\"High bandwidth\", \"Regular time intervals (Heartbeat)\", \"Random times\", \"Different IPs\"]'),
(5932, 241, 'What does EDR primarily monitor?', 1, 'Endpoint activities (Processes, Files, Network)', 0, 'Endpoint', '2025-12-26 22:47:08', '[\"Network traffic only\", \"Endpoint activities (Processes, Files, Network)\", \"Server hardware\", \"Cloud storage\"]'),
(5933, 241, 'What is a key \"Response\" capability of EDR?', 2, 'Isolating a machine from the network', 0, 'Containment', '2025-12-26 22:47:08', '[\"Sending email alerts\", \"Isolating a machine from the network\", \"Writing reports\", \"Installing updates\"]'),
(5934, 241, 'Where does the EDR Agent run?', 3, 'On each endpoint (laptop/server)', 0, 'Client side', '2025-12-26 22:47:08', '[\"In the cloud\", \"On the firewall\", \"On each endpoint (laptop/server)\", \"In a SIEM\"]'),
(5935, 242, 'What is the primary detection method for traditional Antivirus?', 1, 'Signatures (File Hashes)', 0, 'Hash', '2025-12-26 22:47:08', '[\"Behavior analysis\", \"Signatures (File Hashes)\", \"AI\", \"Network scanning\"]'),
(5936, 242, 'If malware uses a brand-new hash, what is this called?', 2, 'Zero-Day', 0, 'New', '2025-12-26 22:47:08', '[\"First-Day\", \"Zero-Day\", \"New Hash\", \"Fresh Malware\"]'),
(5937, 242, 'What does EDR provide that AV typically does not?', 3, 'Full context and telemetry (Process Tree, etc.)', 0, 'Visibility', '2025-12-26 22:47:08', '[\"A firewall\", \"Full context and telemetry (Process Tree, etc.)\", \"Email scanning\", \"Physical security\"]'),
(5938, 243, 'What does a Process Tree show?', 1, 'Which process started which other process', 0, 'Ancestry', '2025-12-26 22:47:08', '[\"Network connections\", \"Which process started which other process\", \"File locations\", \"User logins\"]'),
(5939, 243, 'In \"explorer.exe -> chrome.exe\", which is the Parent?', 2, 'explorer.exe', 0, 'Desktop', '2025-12-26 22:47:08', '[\"chrome.exe\", \"explorer.exe\", \"System\", \"Neither\"]'),
(5940, 243, 'Why is \"winword.exe -> cmd.exe -> powershell.exe\" suspicious?', 3, 'Office apps should not spawn shells', 0, 'Unexpected child', '2025-12-26 22:47:08', '[\"It is normal\", \"Office apps should not spawn shells\", \"PowerShell is fast\", \"CMD is old\"]'),
(5941, 244, 'Which parent legitimately spawns svchost.exe?', 1, 'services.exe', 0, 'Services Manager', '2025-12-26 22:47:08', '[\"explorer.exe\", \"word.exe\", \"services.exe\", \"chrome.exe\"]'),
(5942, 244, 'If Excel spawns wscript.exe, what is the likely cause?', 2, 'A malicious VBA Macro', 0, 'Macro', '2025-12-26 22:47:08', '[\"A print job\", \"A malicious VBA Macro\", \"An update\", \"Normal behavior\"]'),
(5943, 244, 'What does \"-EncodedCommand\" in PowerShell indicate?', 3, 'Base64-encoded script (often malicious)', 0, 'Obfuscation', '2025-12-26 22:47:08', '[\"Help text\", \"Fast mode\", \"Base64-encoded script (often malicious)\", \"Admin mode\"]'),
(5944, 245, 'In a phishing attack, which application typically spawns cmd.exe?', 1, 'The Office application (Word/Excel)', 0, 'Office', '2025-12-26 22:47:08', '[\"Explorer\", \"The Office application (Word/Excel)\", \"Chrome\", \"Notepad\"]'),
(5945, 245, 'What does \"Living off the Land\" mean?', 2, 'Using built-in tools (PowerShell, WMI) instead of malware', 0, 'No foreign tools', '2025-12-26 22:47:08', '[\"Farming\", \"Using built-in tools (PowerShell, WMI) instead of malware\", \"Using old malware\", \"Running slowly\"]'),
(5946, 245, 'Why is \"certutil\" used by attackers?', 3, 'It can download files (LOLBIN)', 0, 'Built-in downloader', '2025-12-26 22:47:08', '[\"It encrypts data\", \"It can download files (LOLBIN)\", \"It scans networks\", \"It deletes logs\"]'),
(5947, 246, 'Which EDR is famous for APT tracking (e.g., Fancy Bear)?', 1, 'CrowdStrike', 0, 'Falcon', '2025-12-26 22:47:08', '[\"SentinelOne\", \"CrowdStrike\", \"Carbon Black\", \"Elastic\"]'),
(5948, 246, 'Which EDR is native to Windows and uses KQL?', 2, 'Microsoft Defender for Endpoint', 0, 'MDE', '2025-12-26 22:47:08', '[\"CrowdStrike\", \"SentinelOne\", \"Microsoft Defender for Endpoint\", \"Carbon Black\"]'),
(5949, 246, 'Which EDR can autonomously \"rollback\" ransomware damage?', 3, 'SentinelOne', 0, 'Autonomous', '2025-12-26 22:47:08', '[\"CrowdStrike\", \"Carbon Black\", \"SentinelOne\", \"Elastic\"]'),
(5950, 247, 'What is the Grandparent of powershell.exe?', 1, 'WINWORD.EXE', 0, 'Word', '2025-12-26 22:47:08', '[\"explorer.exe\", \"outlook.exe\", \"WINWORD.EXE\", \"cmd.exe\"]'),
(5951, 247, 'What is the likely initial attack vector?', 2, 'A malicious email attachment (phishing)', 0, 'Phishing', '2025-12-26 22:47:08', '[\"USB drive\", \"A malicious email attachment (phishing)\", \"Direct network attack\", \"Insider\"]'),
(5952, 247, 'What do whoami, ipconfig, net user suggest?', 3, 'Reconnaissance / Discovery', 0, 'Recon', '2025-12-26 22:47:08', '[\"Cleanup\", \"Reconnaissance / Discovery\", \"Data destruction\", \"Patching\"]'),
(5953, 247, 'The \"-enc\" flag in PowerShell indicates:', 4, 'Base64-encoded command (obfuscation)', 0, 'Hidden command', '2025-12-26 22:47:08', '[\"Encryption\", \"Base64-encoded command (obfuscation)\", \"Error logging\", \"Network mode\"]'),
(5954, 247, 'What is the key difference between AV and EDR?', 5, 'EDR provides visibility and behavior analysis', 0, 'Telemetry', '2025-12-26 22:47:08', '[\"EDR is cheaper\", \"EDR provides visibility and behavior analysis\", \"AV is newer\", \"AV blocks more\"]'),
(5955, 247, 'Which process is the legitimate parent of svchost.exe?', 6, 'services.exe', 0, 'Service Controller', '2025-12-26 22:47:08', '[\"explorer.exe\", \"winlogon.exe\", \"services.exe\", \"cmd.exe\"]'),
(5956, 251, 'Where is a NIDS typically deployed?', 1, 'At network choke points (e.g., behind firewall)', 0, 'Network edge', '2025-12-26 22:50:58', '[\"On each laptop\", \"At network choke points (e.g., behind firewall)\", \"In the cloud only\", \"On the router console\"]'),
(5957, 251, 'What is a major weakness of NIDS?', 2, 'Blind to encrypted traffic (TLS)', 0, 'Encryption', '2025-12-26 22:50:58', '[\"It is slow\", \"Blind to encrypted traffic (TLS)\", \"It needs batteries\", \"It cannot see packets\"]'),
(5958, 251, 'Which tool is a common HIDS agent?', 3, 'OSSEC / Wazuh', 0, 'Host agent', '2025-12-26 22:50:58', '[\"Snort\", \"OSSEC / Wazuh\", \"Wireshark\", \"Nmap\"]'),
(5959, 252, 'What is the main weakness of Signature-Based detection?', 1, 'Cannot detect Zero-Day (unknown) attacks', 0, 'New threats', '2025-12-26 22:50:58', '[\"Too many alerts\", \"Cannot detect Zero-Day (unknown) attacks\", \"It is expensive\", \"It requires hardware\"]'),
(5960, 252, 'Anomaly-Based detection learns a _____ of normal behavior.', 2, 'Baseline', 0, 'Normal', '2025-12-26 22:50:58', '[\"Signature\", \"Baseline\", \"Firewall\", \"Password\"]'),
(5961, 252, 'Which method typically has more False Positives?', 3, 'Anomaly-Based', 0, 'Noisy', '2025-12-26 22:50:58', '[\"Signature-Based\", \"Anomaly-Based\", \"Neither\", \"Both equally\"]'),
(5962, 253, 'In a Snort rule, what does \"sid\" stand for?', 1, 'Signature ID', 0, 'Unique ID', '2025-12-26 22:50:58', '[\"Session ID\", \"Signature ID\", \"Source ID\", \"Snort ID\"]'),
(5963, 253, 'What action does \"alert\" perform in Snort?', 2, 'Logs and generates an alert', 0, 'Notify', '2025-12-26 22:50:58', '[\"Blocks traffic\", \"Logs and generates an alert\", \"Drops the packet\", \"Ignores it\"]'),
(5964, 253, 'What symbol defines direction in Snort rules?', 3, '-> (Arrow)', 0, 'Arrow', '2025-12-26 22:50:58', '[\"<-\", \"-> (Arrow)\", \"==\", \"=>\"]'),
(5965, 254, 'What is a major performance advantage of Suricata over Snort 2?', 1, 'Multi-threading (uses all CPU cores)', 0, 'Parallel', '2025-12-26 22:50:58', '[\"It is smaller\", \"Multi-threading (uses all CPU cores)\", \"It has a GUI\", \"It is older\"]'),
(5966, 254, 'Can Suricata use Snort rules?', 2, 'Yes', 0, 'Compatible', '2025-12-26 22:50:58', '[\"No\", \"Yes\", \"Only some\", \"Only paid\"]'),
(5967, 254, 'What does Suricata\'s \"File Extraction\" feature do?', 3, 'Saves suspicious files from network traffic', 0, 'Carving', '2025-12-26 22:50:58', '[\"Deletes files\", \"Saves suspicious files from network traffic\", \"Encrypts files\", \"Compresses files\"]'),
(5968, 255, 'What is the first step when triaging an IDS alert?', 1, 'Read the alert message to understand the claim', 0, 'Understand', '2025-12-26 22:50:58', '[\"Delete it\", \"Read the alert message to understand the claim\", \"Block the IP\", \"Reboot the server\"]'),
(5969, 255, 'What often causes False Positives from internal security scanners?', 2, 'Scanners like Nessus trigger \"Port Scan\" rules', 0, 'Your own tools', '2025-12-26 22:50:58', '[\"Hackers\", \"Scanners like Nessus trigger \\\"Port Scan\\\" rules\", \"Viruses\", \"Weather\"]'),
(5970, 255, 'What is \"Tuning\" an IDS rule?', 3, 'Adjusting it to reduce false positives', 0, 'Improve accuracy', '2025-12-26 22:50:58', '[\"Deleting the rule\", \"Adjusting it to reduce false positives\", \"Making it louder\", \"Breaking it\"]'),
(5971, 256, 'Which IDS type monitors network traffic at a choke point?', 1, 'NIDS', 0, 'Network', '2025-12-26 22:50:58', '[\"HIDS\", \"NIDS\", \"SIDS\", \"AIDS\"]'),
(5972, 256, 'Which IDS type can see inside encrypted sessions on the host?', 2, 'HIDS', 0, 'Host', '2025-12-26 22:50:58', '[\"NIDS\", \"HIDS\", \"Firewall\", \"VPN\"]'),
(5973, 256, 'Signature-Based detection relies on:', 3, 'A database of known attack patterns', 0, 'Signatures', '2025-12-26 22:50:58', '[\"Learning normal behavior\", \"A database of known attack patterns\", \"User reports\", \"Random chance\"]'),
(5974, 256, 'Anomaly-Based detection can find:', 4, 'Zero-Day attacks', 0, 'Novel threats', '2025-12-26 22:50:58', '[\"Only known attacks\", \"Zero-Day attacks\", \"Nothing\", \"Old malware\"]'),
(5975, 256, 'Which tool is native multi-threaded?', 5, 'Suricata', 0, 'Performance', '2025-12-26 22:50:58', '[\"Snort 2\", \"Suricata\", \"Wireshark\", \"Nmap\"]'),
(5976, 256, 'In Snort, what does \"msg\" specify?', 6, 'The alert message text', 0, 'Description', '2025-12-26 22:50:58', '[\"Source IP\", \"The alert message text\", \"Destination port\", \"Protocol\"]'),
(5977, 261, 'Which malware type encrypts your files and demands payment?', 1, 'Ransomware', 0, 'Ransom', '2025-12-26 22:55:56', '[\"Spyware\", \"Ransomware\", \"Worm\", \"Virus\"]'),
(5978, 261, 'What makes a Worm different from a Virus?', 2, 'Worms spread without user interaction', 0, 'Self-replicating', '2025-12-26 22:55:56', '[\"Worms are bigger\", \"Worms spread without user interaction\", \"Viruses are newer\", \"No difference\"]'),
(5979, 261, 'What is \"Fileless Malware\"?', 3, 'Malware that lives in RAM, not on disk', 0, 'Memory-only', '2025-12-26 22:55:56', '[\"Malware with no code\", \"Malware that lives in RAM, not on disk\", \"Malware that is deleted\", \"Malware on USB\"]'),
(5980, 262, 'What is Static Analysis?', 1, 'Examining malware without executing it', 0, 'Not running', '2025-12-26 22:55:56', '[\"Running malware in a sandbox\", \"Examining malware without executing it\", \"Asking the malware questions\", \"Deleting the malware\"]'),
(5981, 262, 'What is a major risk of Dynamic Analysis?', 2, 'Sandbox escape', 0, 'Containment failure', '2025-12-26 22:55:56', '[\"It is too slow\", \"Sandbox escape\", \"It is too expensive\", \"Nothing\"]'),
(5982, 262, 'What tool is commonly used for strings extraction?', 3, 'strings command', 0, 'Text', '2025-12-26 22:55:56', '[\"Wireshark\", \"strings command\", \"Nmap\", \"Burp Suite\"]'),
(5983, 263, 'Why should you use \"Host-Only\" networking for a malware lab?', 1, 'To prevent the malware from reaching the internet', 0, 'Isolation', '2025-12-26 22:55:56', '[\"It is faster\", \"To prevent the malware from reaching the internet\", \"It is default\", \"For gaming\"]');
INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(5984, 263, 'What is FlareVM?', 2, 'A pre-configured Windows VM for malware analysis', 0, 'Mandiant tool', '2025-12-26 22:55:56', '[\"A virus\", \"A pre-configured Windows VM for malware analysis\", \"A firewall\", \"An antivirus\"]'),
(5985, 263, 'What should you do BEFORE running malware in a VM?', 3, 'Take a snapshot', 0, 'Snapshot', '2025-12-26 22:55:56', '[\"Delete all files\", \"Take a snapshot\", \"Turn off the firewall\", \"Install games\"]'),
(5986, 264, 'What does high entropy (>7.0) in a file suggest?', 1, 'The file is packed or encrypted', 0, 'Obfuscation', '2025-12-26 22:55:56', '[\"It is small\", \"The file is packed or encrypted\", \"It is safe\", \"It is old\"]'),
(5987, 264, 'If a PE file imports \"VirtualAlloc\", what might it be doing?', 2, 'Memory allocation for code injection', 0, 'Injection', '2025-12-26 22:55:56', '[\"Playing music\", \"Memory allocation for code injection\", \"Deleting files\", \"Printing documents\"]'),
(5988, 264, 'Why hash a malware sample before analysis?', 3, 'To check VirusTotal for known info', 0, 'Lookup', '2025-12-26 22:55:56', '[\"To delete it\", \"To check VirusTotal for known info\", \"To run it\", \"To rename it\"]'),
(5989, 265, 'What is Any.Run used for?', 1, 'Interactive malware sandboxing', 0, 'Sandbox', '2025-12-26 22:55:56', '[\"Static analysis\", \"Interactive malware sandboxing\", \"Coding\", \"Email\"]'),
(5990, 265, 'If malware adds a \"Run\" registry key, what is it likely achieving?', 2, 'Persistence (auto-start)', 0, 'Persistence', '2025-12-26 22:55:56', '[\"Deleting files\", \"Persistence (auto-start)\", \"Playing music\", \"Updating\"]'),
(5991, 265, 'How might malware detect it is in a sandbox?', 3, 'Looking for VM artifacts or lack of user activity', 0, 'Evasion', '2025-12-26 22:55:56', '[\"By asking the user\", \"Looking for VM artifacts or lack of user activity\", \"By checking the calendar\", \"By running fast\"]'),
(5992, 266, 'What does IOC stand for?', 1, 'Indicators of Compromise', 0, 'Evidence', '2025-12-26 22:55:56', '[\"Internet of Computers\", \"Indicators of Compromise\", \"Input Output Control\", \"Internal Office Command\"]'),
(5993, 266, 'What is a \"Mutex\" in malware context?', 2, 'A unique name to prevent multiple instances', 0, 'Single instance', '2025-12-26 22:55:56', '[\"A virus type\", \"A unique name to prevent multiple instances\", \"A password\", \"A file extension\"]'),
(5994, 266, 'Which framework maps malware techniques?', 3, 'MITRE ATT&CK', 0, 'Tactics', '2025-12-26 22:55:56', '[\"NIST\", \"MITRE ATT&CK\", \"ISO 27001\", \"PCI DSS\"]'),
(5995, 267, 'Which malware hides deep in the OS to maintain persistent access?', 1, 'Rootkit', 0, 'Hidden', '2025-12-26 22:55:56', '[\"Worm\", \"Trojan\", \"Rootkit\", \"Virus\"]'),
(5996, 267, 'Which attack gives an attacker full remote control?', 2, 'RAT (Remote Access Trojan)', 0, 'Remote', '2025-12-26 22:55:56', '[\"Rootkit\", \"Spyware\", \"RAT (Remote Access Trojan)\", \"Worm\"]'),
(5997, 267, 'Running malware in a sandbox is called:', 3, 'Dynamic Analysis', 0, 'Execute', '2025-12-26 22:55:56', '[\"Static Analysis\", \"Dynamic Analysis\", \"Passive Analysis\", \"Code Review\"]'),
(5998, 267, 'Examining a file without executing it is:', 4, 'Static Analysis', 0, 'Safe', '2025-12-26 22:55:56', '[\"Dynamic Analysis\", \"Static Analysis\", \"Behavioral Analysis\", \"Reverse Engineering\"]'),
(5999, 267, 'What does PEStudio analyze?', 5, 'Windows PE (Executable) files', 0, 'EXE', '2025-12-26 22:55:56', '[\"Linux binaries\", \"Windows PE (Executable) files\", \"Network packets\", \"JSON files\"]'),
(6000, 267, 'If malware \"sleeps\" for a long time, what might it be doing?', 6, 'Evading sandbox analysis', 0, 'Timeout', '2025-12-26 22:55:56', '[\"Updating\", \"Evading sandbox analysis\", \"Nothing suspicious\", \"Downloading updates\"]'),
(6001, 271, 'What does CSIRT stand for?', 1, 'Computer Security Incident Response Team', 0, 'Team', '2025-12-26 23:03:48', '[\"Cyber Security Internal Review Team\", \"Computer Security Incident Response Team\", \"Critical System IR Team\", \"Cloud Security IR Task\"]'),
(6002, 271, 'Why is a documented IR process important?', 2, 'It ensures consistent and fast response', 0, 'Consistency', '2025-12-26 23:03:48', '[\"It looks good\", \"It ensures consistent and fast response\", \"It is optional\", \"It slows things down\"]'),
(6003, 271, 'Which of these is an example of a security incident?', 3, 'Malware infection', 0, 'Breach', '2025-12-26 23:03:48', '[\"Password reset\", \"Malware infection\", \"Software update\", \"New employee onboarding\"]'),
(6004, 272, 'How many phases are in the NIST IR lifecycle?', 1, '4', 0, 'Four', '2025-12-26 23:03:48', '[\"3\", \"4\", \"5\", \"6\"]'),
(6005, 272, 'Which phase comes after \"Detection & Analysis\"?', 2, 'Containment, Eradication & Recovery', 0, 'Next', '2025-12-26 23:03:48', '[\"Preparation\", \"Containment, Eradication & Recovery\", \"Post-Incident\", \"None\"]'),
(6006, 272, 'What happens after \"Lessons Learned\"?', 3, 'Loop back to Preparation (improvement)', 0, 'Cycle', '2025-12-26 23:03:48', '[\"Nothing\", \"Loop back to Preparation (improvement)\", \"Delete everything\", \"Close the case\"]'),
(6007, 273, 'What is a \"Playbook\" in IR context?', 1, 'A step-by-step guide for handling specific incidents', 0, 'Runbook', '2025-12-26 23:03:48', '[\"A video game\", \"A step-by-step guide for handling specific incidents\", \"A backup plan\", \"A training manual\"]'),
(6008, 273, 'What is a \"Jump Bag\"?', 2, 'Pre-packed forensic tools for on-site response', 0, 'Go Bag', '2025-12-26 23:03:48', '[\"A travel bag\", \"Pre-packed forensic tools for on-site response\", \"A backup drive\", \"A parachute\"]'),
(6009, 273, 'Why is \"Baselining\" systems important?', 3, 'To know what normal looks like', 0, 'Comparison', '2025-12-26 23:03:48', '[\"It is not\", \"To know what normal looks like\", \"To delete old files\", \"To upgrade software\"]'),
(6010, 274, 'What is the first step in analysis?', 1, 'Validate if it is a True Positive', 0, 'Confirm', '2025-12-26 23:03:48', '[\"Delete the alert\", \"Validate if it is a True Positive\", \"Call the police\", \"Ignore it\"]'),
(6011, 274, 'What should you start documenting immediately?', 2, 'A timeline of events', 0, 'Timeline', '2025-12-26 23:03:48', '[\"A blog post\", \"A timeline of events\", \"A resignation letter\", \"A shopping list\"]'),
(6012, 274, 'Who might notify you of an incident externally?', 3, 'FBI, vendor, or partner', 0, 'External', '2025-12-26 23:03:48', '[\"The janitor\", \"FBI, vendor, or partner\", \"The intern\", \"Nobody\"]'),
(6013, 275, 'What is \"Short-Term Containment\"?', 1, 'Immediate actions to stop the attack', 0, 'Quick fix', '2025-12-26 23:03:48', '[\"Long-term planning\", \"Immediate actions to stop the attack\", \"Deleting files\", \"Rebooting\"]'),
(6014, 275, 'Why should you NOT shut down a compromised machine immediately?', 2, 'Volatile memory (RAM) evidence is lost', 0, 'Forensics', '2025-12-26 23:03:48', '[\"It is faster\", \"Volatile memory (RAM) evidence is lost\", \"It makes noise\", \"It uses electricity\"]'),
(6015, 275, 'What is a quarantine VLAN used for?', 3, 'Isolating compromised systems while keeping them accessible', 0, 'Isolation', '2025-12-26 23:03:48', '[\"Gaming\", \"Isolating compromised systems while keeping them accessible\", \"Faster internet\", \"Printer sharing\"]'),
(6016, 276, 'What must be removed during Eradication?', 1, 'Malware and persistence mechanisms', 0, 'Cleanup', '2025-12-26 23:03:48', '[\"User files\", \"Malware and persistence mechanisms\", \"Operating system\", \"All software\"]'),
(6017, 276, 'Before reconnecting a recovered system, what should you do?', 2, 'Validate it is clean', 0, 'Verify', '2025-12-26 23:03:48', '[\"Just plug it in\", \"Validate it is clean\", \"Delete everything\", \"Ignore it\"]'),
(6018, 276, 'Why \"gradual reconnection\"?', 3, 'To detect re-infection before spreading', 0, 'Careful', '2025-12-26 23:03:48', '[\"It is slower\", \"To detect re-infection before spreading\", \"To save power\", \"It looks professional\"]'),
(6019, 277, 'When should the Lessons Learned meeting be held?', 1, 'Within 1-2 weeks of incident closure', 0, 'Soon', '2025-12-26 23:03:48', '[\"Never\", \"Within 1-2 weeks of incident closure\", \"After 1 year\", \"During the incident\"]'),
(6020, 277, 'What is the purpose of a Post-Incident Report?', 2, 'Document what happened and recommendations', 0, 'Documentation', '2025-12-26 23:03:48', '[\"To blame someone\", \"Document what happened and recommendations\", \"To close the ticket\", \"To delete logs\"]'),
(6021, 277, 'How do you prevent similar incidents?', 3, 'Update SIEM rules, playbooks, and train staff', 0, 'Improve', '2025-12-26 23:03:48', '[\"Ignore it\", \"Update SIEM rules, playbooks, and train staff\", \"Fire everyone\", \"Do nothing\"]'),
(6022, 278, 'Which framework defines the 4-phase IR lifecycle?', 1, 'NIST SP 800-61', 0, 'Standard', '2025-12-26 23:03:48', '[\"ISO 27001\", \"NIST SP 800-61\", \"PCI DSS\", \"HIPAA\"]'),
(6023, 278, 'What is the first phase of IR?', 2, 'Preparation', 0, 'First', '2025-12-26 23:03:48', '[\"Detection\", \"Preparation\", \"Containment\", \"Recovery\"]'),
(6024, 278, 'Isolating a host from the network is part of which phase?', 3, 'Containment', 0, 'Isolate', '2025-12-26 23:03:48', '[\"Preparation\", \"Detection\", \"Containment\", \"Eradication\"]'),
(6025, 278, 'Why preserve volatile memory (RAM)?', 4, 'It contains forensic evidence lost on shutdown', 0, 'Evidence', '2025-12-26 23:03:48', '[\"It is faster\", \"It contains forensic evidence lost on shutdown\", \"It is pretty\", \"No reason\"]'),
(6026, 278, 'What document guides response to specific incident types?', 5, 'Playbook', 0, 'Runbook', '2025-12-26 23:03:48', '[\"Resume\", \"Playbook\", \"Novel\", \"Menu\"]'),
(6027, 278, 'What happens in the \"Post-Incident\" phase?', 6, 'Lessons Learned and improvement', 0, 'Review', '2025-12-26 23:03:48', '[\"Panic\", \"Lessons Learned and improvement\", \"Vacation\", \"Nothing\"]'),
(6028, 281, 'What is the \"Golden Rule\" of forensics?', 1, 'Preserve the evidence', 0, 'Do not alter', '2025-12-26 23:05:09', '[\"Delete everything\", \"Preserve the evidence\", \"Work fast\", \"Guess the answer\"]'),
(6029, 281, 'Which forensics type focuses on RAM?', 2, 'Memory Forensics', 0, 'Volatile', '2025-12-26 23:05:09', '[\"Disk\", \"Memory Forensics\", \"Network\", \"Mobile\"]'),
(6030, 281, 'Why is forensics used in lawsuits?', 3, 'eDiscovery and litigation support', 0, 'Legal', '2025-12-26 23:05:09', '[\"For fun\", \"eDiscovery and litigation support\", \"To delete evidence\", \"To hack\"]'),
(6031, 282, 'What is the first phase of the forensic process?', 1, 'Identification', 0, 'Find', '2025-12-26 23:05:09', '[\"Analysis\", \"Identification\", \"Presentation\", \"Deletion\"]'),
(6032, 282, 'Which tool is used for free disk imaging?', 2, 'FTK Imager', 0, 'Free', '2025-12-26 23:05:09', '[\"Wireshark\", \"FTK Imager\", \"Nmap\", \"Burp Suite\"]'),
(6033, 282, 'What document tracks who touched the evidence?', 3, 'Chain of Custody', 0, 'Log', '2025-12-26 23:05:09', '[\"Resume\", \"Chain of Custody\", \"Invoice\", \"Email\"]'),
(6034, 283, 'What happens if Chain of Custody is broken?', 1, 'Evidence may be inadmissible in court', 0, 'Thrown out', '2025-12-26 23:05:09', '[\"Nothing\", \"Evidence may be inadmissible in court\", \"Faster trial\", \"Automatic win\"]'),
(6035, 283, 'What does a write blocker do?', 2, 'Allows reading but prevents writing to evidence', 0, 'Read-only', '2025-12-26 23:05:09', '[\"Speeds up the disk\", \"Allows reading but prevents writing to evidence\", \"Encrypts data\", \"Deletes files\"]'),
(6036, 283, 'What should you do before touching evidence?', 3, 'Photograph the scene', 0, 'Document', '2025-12-26 23:05:09', '[\"Delete logs\", \"Photograph the scene\", \"Guess\", \"Nothing\"]'),
(6037, 284, 'Why should you image a disk before analysis?', 1, 'To preserve the original evidence', 0, 'Protect', '2025-12-26 23:05:09', '[\"It is faster\", \"To preserve the original evidence\", \"To delete files\", \"No reason\"]'),
(6038, 284, 'Which acquisition type captures deleted data?', 2, 'Physical Image', 0, 'Complete', '2025-12-26 23:05:09', '[\"Logical\", \"Physical Image\", \"Live\", \"None\"]'),
(6039, 284, 'How do you verify a disk image is accurate?', 3, 'Compare hashes of source and image', 0, 'Hash match', '2025-12-26 23:05:09', '[\"Guess\", \"Compare hashes of source and image\", \"Look at it\", \"Count files\"]'),
(6040, 285, 'What is the MFT in NTFS?', 1, 'Master File Table - database of all files', 0, 'Index', '2025-12-26 23:05:09', '[\"Main Folder Tree\", \"Master File Table - database of all files\", \"Memory File Track\", \"My First Table\"]'),
(6041, 285, 'What can Alternate Data Streams (ADS) be used for?', 2, 'Hiding data attached to files', 0, 'Steganography', '2025-12-26 23:05:09', '[\"Speeding up reads\", \"Hiding data attached to files\", \"Compressing files\", \"Encrypting\"]'),
(6042, 285, 'What is \"Timestomping\"?', 3, 'Modifying timestamps to hide activity', 0, 'Anti-forensics', '2025-12-26 23:05:09', '[\"Creating timestamps\", \"Modifying timestamps to hide activity\", \"Deleting timestamps\", \"Reading timestamps\"]'),
(6043, 286, 'Which registry hive contains user password hashes?', 1, 'SAM', 0, 'Security', '2025-12-26 23:05:09', '[\"SYSTEM\", \"SAM\", \"SOFTWARE\", \"NTUSER\"]'),
(6044, 286, 'What does Prefetch show?', 2, 'Programs that have been executed', 0, 'Execution', '2025-12-26 23:05:09', '[\"Network connections\", \"Programs that have been executed\", \"Passwords\", \"Emails\"]'),
(6045, 286, 'Where are Windows Event Logs stored?', 3, 'C:\\Windows\\System32\\winevt', 0, 'Logs path', '2025-12-26 23:05:09', '[\"Desktop\", \"C:\\\\Windows\\\\System32\\\\winevt\", \"Recycle Bin\", \"Documents\"]'),
(6046, 287, 'What is the golden rule of forensics?', 1, 'Preserve the evidence', 0, 'Protect', '2025-12-26 23:05:09', '[\"Analyze fast\", \"Preserve the evidence\", \"Delete duplicates\", \"Guess\"]'),
(6047, 287, 'Which tool is commonly used for memory forensics?', 2, 'Volatility', 0, 'RAM', '2025-12-26 23:05:09', '[\"FTK Imager\", \"Volatility\", \"Wireshark\", \"Nmap\"]'),
(6048, 287, 'What does a write blocker prevent?', 3, 'Writing to evidence (preserve integrity)', 0, 'Read-only', '2025-12-26 23:05:09', '[\"Reading\", \"Writing to evidence (preserve integrity)\", \"Deleting\", \"Copying\"]'),
(6049, 287, 'Which Windows artifact tracks program execution?', 4, 'Prefetch', 0, 'Execution', '2025-12-26 23:05:09', '[\"SAM\", \"NTUSER\", \"Prefetch\", \"Cookies\"]'),
(6050, 287, 'What file system feature allows hidden data in NTFS?', 5, 'Alternate Data Streams (ADS)', 0, 'Hidden', '2025-12-26 23:05:09', '[\"MFT\", \"Alternate Data Streams (ADS)\", \"Journal\", \"Inodes\"]'),
(6051, 287, 'What is the purpose of hashing a disk image?', 6, 'Verify image integrity', 0, 'Verification', '2025-12-26 23:05:09', '[\"Compress it\", \"Verify image integrity\", \"Encrypt it\", \"Delete it\"]'),
(6052, 291, 'What does NTA stand for?', 1, 'Network Traffic Analysis', 0, 'NTA', '2025-12-26 23:06:44', '[\"Network Threat Assessment\", \"Network Traffic Analysis\", \"New Technology Application\", \"None\"]'),
(6053, 291, 'What limits your ability to see packet content?', 2, 'Encryption (TLS)', 0, 'Hidden', '2025-12-26 23:06:44', '[\"Speed\", \"Encryption (TLS)\", \"Color\", \"Size\"]'),
(6054, 291, 'What can you determine from packet headers?', 3, 'Source/Destination IPs and ports', 0, 'Metadata', '2025-12-26 23:06:44', '[\"File contents\", \"Source/Destination IPs and ports\", \"Passwords\", \"Nothing\"]'),
(6055, 292, 'What is a SPAN port?', 1, 'A switch port that mirrors traffic for monitoring', 0, 'Mirror', '2025-12-26 23:06:44', '[\"A special cable\", \"A switch port that mirrors traffic for monitoring\", \"A firewall rule\", \"An IP address\"]'),
(6056, 292, 'What file format stores captured packets?', 2, 'PCAP', 0, 'Packet file', '2025-12-26 23:06:44', '[\"PDF\", \"PCAP\", \"DOCX\", \"MP4\"]'),
(6057, 292, 'Which tool is a GUI for packet analysis?', 3, 'Wireshark', 0, 'GUI', '2025-12-26 23:06:44', '[\"tcpdump\", \"Wireshark\", \"grep\", \"nmap\"]'),
(6058, 293, 'What Wireshark feature reconstructs a conversation?', 1, 'Follow TCP Stream', 0, 'Conversation', '2025-12-26 23:06:44', '[\"Export\", \"Follow TCP Stream\", \"Filter\", \"Capture\"]'),
(6059, 293, 'What is a \"Display Filter\" used for?', 2, 'Showing only relevant packets', 0, 'Focus', '2025-12-26 23:06:44', '[\"Capturing packets\", \"Showing only relevant packets\", \"Deleting packets\", \"Encrypting packets\"]'),
(6060, 293, 'Which filter shows only DNS traffic?', 3, 'dns', 0, 'Protocol', '2025-12-26 23:06:44', '[\"tcp\", \"udp\", \"dns\", \"http\"]'),
(6061, 294, 'What is the first step of the TCP handshake?', 1, 'SYN', 0, 'Start', '2025-12-26 23:06:44', '[\"ACK\", \"FIN\", \"SYN\", \"RST\"]'),
(6062, 294, 'How can you extract files from HTTP traffic in Wireshark?', 2, 'Export Objects > HTTP', 0, 'File extraction', '2025-12-26 23:06:44', '[\"Copy paste\", \"Export Objects > HTTP\", \"Print\", \"Screenshot\"]'),
(6063, 294, 'What might a very long User-Agent string indicate?', 3, 'Buffer overflow attempt', 0, 'Attack', '2025-12-26 23:06:44', '[\"Normal traffic\", \"Buffer overflow attempt\", \"Slow browser\", \"Mobile device\"]'),
(6064, 295, 'What is \"Beaconing\"?', 1, 'Regular, timed connections to a C2 server', 0, 'Heartbeat', '2025-12-26 23:06:44', '[\"Random traffic\", \"Regular, timed connections to a C2 server\", \"Fast traffic\", \"Encrypted traffic\"]'),
(6065, 295, 'Why is port 4444 suspicious?', 2, 'Default Metasploit/Meterpreter port', 0, 'Known bad', '2025-12-26 23:06:44', '[\"It is slow\", \"Default Metasploit/Meterpreter port\", \"It is encrypted\", \"It is common\"]'),
(6066, 295, 'What does DGA stand for?', 3, 'Domain Generation Algorithm', 0, 'Random domains', '2025-12-26 23:06:44', '[\"Data Gathering API\", \"Domain Generation Algorithm\", \"Dynamic Gateway Access\", \"Direct Gateway Address\"]'),
(6067, 296, 'What was Zeek formerly known as?', 1, 'Bro', 0, 'Old name', '2025-12-26 23:06:44', '[\"Wireshark\", \"Bro\", \"tcpdump\", \"Snort\"]'),
(6068, 296, 'Which Zeek log tracks all network connections?', 2, 'conn.log', 0, 'Connections', '2025-12-26 23:06:44', '[\"http.log\", \"dns.log\", \"conn.log\", \"ssl.log\"]'),
(6069, 296, 'How is Zeek different from Wireshark?', 3, 'Zeek generates structured logs, better for automation', 0, 'Logs', '2025-12-26 23:06:44', '[\"Zeek has GUI\", \"Zeek generates structured logs, better for automation\", \"Zeek is slower\", \"No difference\"]'),
(6070, 297, 'What tool is used for command-line packet capture on Linux?', 1, 'tcpdump', 0, 'CLI', '2025-12-26 23:06:44', '[\"Wireshark\", \"tcpdump\", \"Nmap\", \"Netcat\"]'),
(6071, 297, 'Which Wireshark filter shows HTTP requests?', 2, 'http.request', 0, 'HTTP', '2025-12-26 23:06:44', '[\"tcp.port\", \"http.request\", \"dns\", \"frame\"]'),
(6072, 297, 'What is the TCP handshake sequence?', 3, 'SYN, SYN-ACK, ACK', 0, 'Three-way', '2025-12-26 23:06:44', '[\"ACK, SYN, FIN\", \"SYN, SYN-ACK, ACK\", \"FIN, ACK, RST\", \"None\"]'),
(6073, 297, 'What does beaconing traffic indicate?', 4, 'Possible C2 communication', 0, 'Malware', '2025-12-26 23:06:44', '[\"Normal browsing\", \"Possible C2 communication\", \"File download\", \"Email\"]'),
(6074, 297, 'Which Zeek log tracks DNS queries?', 5, 'dns.log', 0, 'DNS', '2025-12-26 23:06:44', '[\"conn.log\", \"http.log\", \"dns.log\", \"files.log\"]'),
(6075, 297, 'What file format stores captured packets?', 6, 'PCAP', 0, 'Capture', '2025-12-26 23:06:44', '[\"CSV\", \"PCAP\", \"JSON\", \"XML\"]'),
(6076, 301, 'What is the difference between SOC and Threat Hunting?', 1, 'SOC reacts to alerts; Hunting proactively searches', 0, 'Proactive', '2025-12-26 23:08:10', '[\"No difference\", \"SOC reacts to alerts; Hunting proactively searches\", \"Hunting is automated\", \"SOC is proactive\"]'),
(6077, 301, 'What is \"Dwell Time\"?', 2, 'Time an attacker stays undetected in the network', 0, 'Hidden', '2025-12-26 23:08:10', '[\"Time to read alerts\", \"Time an attacker stays undetected in the network\", \"Shift duration\", \"Lunch break\"]'),
(6078, 301, 'Why are APTs hard to detect?', 3, 'They specifically evade automated detection', 0, 'Stealth', '2025-12-26 23:08:10', '[\"They are slow\", \"They specifically evade automated detection\", \"They use email\", \"They are loud\"]'),
(6079, 302, 'Detection relies on what?', 1, 'Pre-defined rules/signatures', 0, 'Rules', '2025-12-26 23:08:10', '[\"Guessing\", \"Pre-defined rules/signatures\", \"Luck\", \"Magic\"]'),
(6080, 302, 'What should happen after a successful hunt?', 2, 'Create a detection rule for future attacks', 0, 'Automate', '2025-12-26 23:08:10', '[\"Delete logs\", \"Create a detection rule for future attacks\", \"Ignore it\", \"Take vacation\"]'),
(6081, 302, 'At HMM Level 3, hunts are:', 3, 'Proactive and hypothesis-driven', 0, 'Mature', '2025-12-26 23:08:10', '[\"Nonexistent\", \"Random\", \"Proactive and hypothesis-driven\", \"Fully automated\"]'),
(6082, 303, 'What is the first step of the Hunting Loop?', 1, 'Form a Hypothesis', 0, 'Start', '2025-12-26 23:08:10', '[\"Collect data\", \"Form a Hypothesis\", \"Report\", \"Delete logs\"]'),
(6083, 303, 'If a hunt finds nothing malicious, was it wasted?', 2, 'No, you learned what normal looks like', 0, 'Value', '2025-12-26 23:08:10', '[\"Yes\", \"No, you learned what normal looks like\", \"Maybe\", \"Always\"]'),
(6084, 303, 'What should happen after a hunt?', 3, 'Document findings and create detections', 0, 'Improve', '2025-12-26 23:08:10', '[\"Delete evidence\", \"Document findings and create detections\", \"Forget it\", \"Nothing\"]'),
(6085, 304, 'What makes a good hunting hypothesis?', 1, 'Specific, actionable, based on threat intel', 0, 'Focused', '2025-12-26 23:08:10', '[\"Vague and broad\", \"Specific, actionable, based on threat intel\", \"Random\", \"Long\"]'),
(6086, 304, 'Which framework maps attacker techniques?', 2, 'MITRE ATT&CK', 0, 'Framework', '2025-12-26 23:08:10', '[\"NIST\", \"MITRE ATT&CK\", \"ISO 27001\", \"PCI DSS\"]'),
(6087, 304, 'What is a bad hypothesis?', 3, 'Something bad might happen (too vague)', 0, 'Unfocused', '2025-12-26 23:08:10', '[\"Attackers use PowerShell\", \"Something bad might happen (too vague)\", \"DNS tunneling exists\", \"Phishing leads to C2\"]'),
(6088, 305, 'Which data source shows process command lines?', 1, 'EDR', 0, 'Endpoint', '2025-12-26 23:08:10', '[\"Firewall\", \"EDR\", \"DNS\", \"Proxy\"]'),
(6089, 305, 'What is important about log retention?', 2, 'Determines how far back you can hunt', 0, 'History', '2025-12-26 23:08:10', '[\"It is not important\", \"Determines how far back you can hunt\", \"Makes logs colorful\", \"Speeds up queries\"]'),
(6090, 305, 'What tool enhances Windows logging for hunting?', 3, 'Sysmon', 0, 'Windows', '2025-12-26 23:08:10', '[\"Wireshark\", \"Sysmon\", \"Nmap\", \"Burp Suite\"]'),
(6091, 306, 'What does \"Long Tail Analysis\" focus on?', 1, 'Rare occurrences (outliers)', 0, 'Unusual', '2025-12-26 23:08:10', '[\"Common events\", \"Rare occurrences (outliers)\", \"Fast events\", \"Old events\"]'),
(6092, 306, 'In \"Stack Counting\", what is suspicious?', 2, 'Values that appear very rarely', 0, 'Rare', '2025-12-26 23:08:10', '[\"Values that appear often\", \"Values that appear very rarely\", \"All values\", \"No values\"]'),
(6093, 306, 'What is \"Pivoting\" in hunting?', 3, 'Moving from one indicator to related data', 0, 'Connect', '2025-12-26 23:08:10', '[\"Rotating chairs\", \"Moving from one indicator to related data\", \"Deleting logs\", \"Blocking IPs\"]'),
(6094, 307, 'Threat Hunting is:', 1, 'Proactive search for undetected threats', 0, 'Hunt', '2025-12-26 23:08:10', '[\"Waiting for alerts\", \"Proactive search for undetected threats\", \"Deleting logs\", \"Writing reports\"]'),
(6095, 307, 'What is \"Dwell Time\"?', 2, 'Time attacker remains undetected', 0, 'Hidden', '2025-12-26 23:08:10', '[\"Time to lunch\", \"Time attacker remains undetected\", \"Shift length\", \"Meeting time\"]'),
(6096, 307, 'A good hypothesis is:', 3, 'Specific and actionable', 0, 'Focused', '2025-12-26 23:08:10', '[\"Vague\", \"Specific and actionable\", \"Random\", \"Long\"]'),
(6097, 307, 'What framework maps adversary techniques?', 4, 'MITRE ATT&CK', 0, 'Matrix', '2025-12-26 23:08:10', '[\"NIST\", \"MITRE ATT&CK\", \"ISO\", \"PCI\"]'),
(6098, 307, 'Long Tail Analysis focuses on:', 5, 'Rare occurrences', 0, 'Outliers', '2025-12-26 23:08:10', '[\"Common events\", \"Rare occurrences\", \"Fast events\", \"All events\"]'),
(6099, 307, 'After finding a threat, you should:', 6, 'Create a detection rule', 0, 'Automate', '2025-12-26 23:08:10', '[\"Delete it\", \"Create a detection rule\", \"Ignore it\", \"Hide it\"]'),
(6100, 311, 'What does MITRE ATT&CK provide?', 1, 'Knowledge base of adversary tactics and techniques', 0, 'Framework', '2025-12-26 23:09:24', '[\"A firewall\", \"Knowledge base of adversary tactics and techniques\", \"An antivirus\", \"A SIEM\"]'),
(6101, 311, 'What does a \"Tactic\" represent?', 2, 'The adversary\'s goal', 0, 'Why', '2025-12-26 23:09:24', '[\"A specific tool\", \"The adversary\'s goal\", \"A CVE\", \"A patch\"]'),
(6102, 311, 'Which matrix covers Windows, Linux, macOS?', 3, 'Enterprise', 0, 'Main', '2025-12-26 23:09:24', '[\"Mobile\", \"Enterprise\", \"ICS\", \"Cloud\"]'),
(6103, 312, 'How many Enterprise tactics are there?', 1, '14', 0, 'Fourteen', '2025-12-26 23:09:24', '[\"10\", \"12\", \"14\", \"20\"]'),
(6104, 312, 'Which tactic involves stealing passwords?', 2, 'Credential Access', 0, 'Passwords', '2025-12-26 23:09:24', '[\"Execution\", \"Credential Access\", \"Discovery\", \"Impact\"]'),
(6105, 312, 'Which tactic is about maintaining access after initial compromise?', 3, 'Persistence', 0, 'Stay', '2025-12-26 23:09:24', '[\"Initial Access\", \"Persistence\", \"Exfiltration\", \"Collection\"]'),
(6106, 313, 'What is a \"Sub-Technique\"?', 1, 'A more specific method under a main technique', 0, 'Specific', '2025-12-26 23:09:24', '[\"A different framework\", \"A more specific method under a main technique\", \"A tool\", \"A tactic\"]'),
(6107, 313, 'T1059.001 refers to:', 2, 'PowerShell execution', 0, 'Script', '2025-12-26 23:09:24', '[\"Registry\", \"PowerShell execution\", \"DNS\", \"HTTP\"]'),
(6108, 313, 'What is a \"Procedure\" in ATT&CK?', 3, 'Real-world example of technique usage', 0, 'Example', '2025-12-26 23:09:24', '[\"A tactic\", \"Real-world example of technique usage\", \"A sub-technique\", \"A detection rule\"]'),
(6109, 314, 'What tool visualizes ATT&CK coverage?', 1, 'ATT&CK Navigator', 0, 'Tool', '2025-12-26 23:09:24', '[\"Wireshark\", \"ATT&CK Navigator\", \"Nmap\", \"Burp Suite\"]'),
(6110, 314, 'In the matrix, columns represent:', 2, 'Tactics', 0, 'Goals', '2025-12-26 23:09:24', '[\"Techniques\", \"Tactics\", \"Procedures\", \"Tools\"]'),
(6111, 314, 'What format provides machine-readable ATT&CK data?', 3, 'STIX', 0, 'Standard', '2025-12-26 23:09:24', '[\"PDF\", \"STIX\", \"CSV\", \"DOCX\"]'),
(6112, 315, 'How can ATT&CK help evaluate a security product?', 1, 'Check if it detects specific techniques', 0, 'Evaluation', '2025-12-26 23:09:24', '[\"By price\", \"Check if it detects specific techniques\", \"By color\", \"By name\"]'),
(6113, 315, 'What is \"Gap Analysis\" in ATT&CK context?', 2, 'Identifying techniques you cannot detect', 0, 'Missing', '2025-12-26 23:09:24', '[\"Finding bugs\", \"Identifying techniques you cannot detect\", \"Deleting logs\", \"Writing reports\"]'),
(6114, 315, 'Threat-Informed Defense means:', 3, 'Building defenses based on likely threat actors', 0, 'Focused', '2025-12-26 23:09:24', '[\"Random defenses\", \"Building defenses based on likely threat actors\", \"No defenses\", \"Old defenses\"]'),
(6115, 316, 'ATT&CK stands for:', 1, 'Adversarial Tactics, Techniques, and Common Knowledge', 0, 'Meaning', '2025-12-26 23:09:24', '[\"Attack Technical Team\", \"Adversarial Tactics, Techniques, and Common Knowledge\", \"Automated Threat Testing\", \"None\"]'),
(6116, 316, 'How many Enterprise tactics are there?', 2, '14', 0, 'Count', '2025-12-26 23:09:24', '[\"10\", \"12\", \"14\", \"16\"]'),
(6117, 316, 'Techniques describe:', 3, 'How adversaries achieve goals', 0, 'Method', '2025-12-26 23:09:24', '[\"Why they attack\", \"How adversaries achieve goals\", \"Who attacks\", \"When attacks happen\"]'),
(6118, 316, 'T1059 refers to:', 4, 'Command and Scripting Interpreter', 0, 'Execution', '2025-12-26 23:09:24', '[\"Persistence\", \"Command and Scripting Interpreter\", \"Discovery\", \"Exfiltration\"]'),
(6119, 316, 'Which tool visualizes ATT&CK coverage?', 5, 'Navigator', 0, 'Visualization', '2025-12-26 23:09:24', '[\"Wireshark\", \"Navigator\", \"Nmap\", \"Burp\"]'),
(6120, 316, 'Gap Analysis identifies:', 6, 'Techniques you cannot detect', 0, 'Blind spots', '2025-12-26 23:09:24', '[\"Best techniques\", \"Techniques you cannot detect\", \"Fast techniques\", \"Old techniques\"]'),
(6121, 321, 'In IaaS, who is responsible for patching the OS?', 1, 'The customer', 0, 'You', '2025-12-26 23:10:39', '[\"The provider\", \"The customer\", \"Nobody\", \"Microsoft\"]'),
(6122, 321, 'Which model gives you just the application?', 2, 'SaaS', 0, 'Software', '2025-12-26 23:10:39', '[\"IaaS\", \"PaaS\", \"SaaS\", \"None\"]'),
(6123, 321, 'AWS EC2 is an example of:', 3, 'IaaS', 0, 'Infrastructure', '2025-12-26 23:10:39', '[\"PaaS\", \"SaaS\", \"IaaS\", \"FaaS\"]'),
(6124, 322, 'Who secures the physical data center?', 1, 'The cloud provider', 0, 'Provider', '2025-12-26 23:10:39', '[\"Customer\", \"The cloud provider\", \"Government\", \"Nobody\"]'),
(6125, 322, 'IAM is whose responsibility?', 2, 'The customer (always)', 0, 'You', '2025-12-26 23:10:39', '[\"Provider\", \"The customer (always)\", \"Maybe both\", \"Neither\"]'),
(6126, 322, 'In SaaS, what does the customer manage?', 3, 'Data and user access', 0, 'Limited', '2025-12-26 23:10:39', '[\"Everything\", \"Data and user access\", \"Hardware\", \"Nothing\"]'),
(6127, 323, 'Which AWS service logs API calls?', 1, 'CloudTrail', 0, 'Audit', '2025-12-26 23:10:39', '[\"GuardDuty\", \"CloudTrail\", \"Config\", \"WAF\"]'),
(6128, 323, 'What should be blocked by default on S3 buckets?', 2, 'Public Access', 0, 'Privacy', '2025-12-26 23:10:39', '[\"Private Access\", \"Public Access\", \"All Access\", \"Admin Access\"]'),
(6129, 323, 'What does IAM stand for?', 3, 'Identity and Access Management', 0, 'Identity', '2025-12-26 23:10:39', '[\"Internet Access Manager\", \"Identity and Access Management\", \"Internal Admin Module\", \"Instance Access Mode\"]'),
(6130, 324, 'What is Azure Sentinel?', 1, 'Cloud-native SIEM', 0, 'SIEM', '2025-12-26 23:10:39', '[\"Firewall\", \"Cloud-native SIEM\", \"Antivirus\", \"VPN\"]'),
(6131, 324, 'PIM provides:', 2, 'Just-in-time admin access', 0, 'Temporary', '2025-12-26 23:10:39', '[\"Permanent access\", \"Just-in-time admin access\", \"Public access\", \"No access\"]'),
(6132, 324, 'Which service manages secrets in Azure?', 3, 'Key Vault', 0, 'Secrets', '2025-12-26 23:10:39', '[\"Blob Storage\", \"Key Vault\", \"Azure AD\", \"Sentinel\"]'),
(6133, 325, 'What is the #1 cause of cloud breaches?', 1, 'Misconfigurations', 0, 'Config', '2025-12-26 23:10:39', '[\"Hackers\", \"Misconfigurations\", \"Malware\", \"Phishing\"]'),
(6134, 325, 'What does CSPM stand for?', 2, 'Cloud Security Posture Management', 0, 'Posture', '2025-12-26 23:10:39', '[\"Cloud Security Policy Manager\", \"Cloud Security Posture Management\", \"Cyber Security PM\", \"Cloud System Protection Mode\"]'),
(6135, 325, 'Open Security Groups allowing 0.0.0.0/0 SSH is:', 3, 'A critical misconfiguration', 0, 'Bad', '2025-12-26 23:10:39', '[\"Normal\", \"A critical misconfiguration\", \"Recommended\", \"Fast\"]'),
(6136, 326, 'In IaaS, who patches the operating system?', 1, 'The customer', 0, 'You', '2025-12-26 23:10:39', '[\"Provider\", \"The customer\", \"AWS\", \"Nobody\"]'),
(6137, 326, 'The Shared Responsibility Model divides:', 2, 'Security responsibilities between customer and provider', 0, 'Division', '2025-12-26 23:10:39', '[\"Costs\", \"Security responsibilities between customer and provider\", \"Users\", \"Regions\"]'),
(6138, 326, 'Which AWS service detects threats using ML?', 3, 'GuardDuty', 0, 'ML', '2025-12-26 23:10:39', '[\"CloudTrail\", \"GuardDuty\", \"Config\", \"WAF\"]'),
(6139, 326, 'What is Azure Sentinel?', 4, 'Cloud-native SIEM', 0, 'SIEM', '2025-12-26 23:10:39', '[\"VPN\", \"Firewall\", \"Cloud-native SIEM\", \"Storage\"]'),
(6140, 326, 'Public S3 buckets are:', 5, 'A major security risk', 0, 'Bad', '2025-12-26 23:10:39', '[\"Recommended\", \"A major security risk\", \"Fast\", \"Cheap\"]'),
(6141, 326, 'CSPM helps find:', 6, 'Cloud misconfigurations', 0, 'Errors', '2025-12-26 23:10:39', '[\"Malware\", \"Cloud misconfigurations\", \"Users\", \"Costs\"]'),
(6142, 331, 'What is \"Alert Fatigue\"?', 1, 'Being overwhelmed by too many alerts', 0, 'Tired', '2025-12-26 23:11:57', '[\"Being lazy\", \"Being overwhelmed by too many alerts\", \"Not seeing alerts\", \"Fast response\"]'),
(6143, 331, 'Automation provides what key benefit?', 2, 'Speed and consistency', 0, 'Fast', '2025-12-26 23:11:57', '[\"More alerts\", \"Speed and consistency\", \"More cost\", \"Complexity\"]'),
(6144, 331, 'Which task is ideal for automation?', 3, 'Repetitive enrichment lookups', 0, 'Repetitive', '2025-12-26 23:11:57', '[\"Complex investigations\", \"Repetitive enrichment lookups\", \"Board meetings\", \"Hiring\"]'),
(6145, 332, 'What does SOAR stand for?', 1, 'Security Orchestration, Automation, and Response', 0, 'SOAR', '2025-12-26 23:11:57', '[\"Security Operations and Response\", \"Security Orchestration, Automation, and Response\", \"System Organized Auto Response\", \"None\"]'),
(6146, 332, 'Which is an open-source SOAR platform?', 2, 'TheHive / Shuffle', 0, 'Free', '2025-12-26 23:11:57', '[\"Splunk SOAR\", \"TheHive / Shuffle\", \"Cortex XSOAR\", \"IBM Resilient\"]'),
(6147, 332, 'SOAR connects tools through:', 3, 'API integrations', 0, 'APIs', '2025-12-26 23:11:57', '[\"Email\", \"API integrations\", \"Phone calls\", \"Fax\"]'),
(6148, 333, 'What is the first step in a playbook?', 1, 'Trigger (what starts the workflow)', 0, 'Start', '2025-12-26 23:11:57', '[\"Action\", \"Trigger (what starts the workflow)\", \"Closure\", \"Enrichment\"]'),
(6149, 333, 'Why include \"Human in the Loop\"?', 2, 'For critical actions requiring approval', 0, 'Safety', '2025-12-26 23:11:57', '[\"Slower\", \"For critical actions requiring approval\", \"More errors\", \"Fun\"]'),
(6150, 333, 'What should playbooks always include?', 3, 'Logging and error handling', 0, 'Audit', '2025-12-26 23:11:57', '[\"Music\", \"Logging and error handling\", \"Colors\", \"Animations\"]'),
(6151, 334, 'What action is common for malware alerts?', 1, 'Isolate the host', 0, 'Containment', '2025-12-26 23:11:57', '[\"Delete the host\", \"Isolate the host\", \"Ignore\", \"Promote user\"]'),
(6152, 334, 'Threat Intel automation pushes IOCs to:', 2, 'SIEM and Firewall blocklists', 0, 'Block', '2025-12-26 23:11:57', '[\"Email\", \"SIEM and Firewall blocklists\", \"Phone\", \"Printer\"]'),
(6153, 334, 'For suspected account compromise, what should be automated?', 3, 'Force password reset and revoke sessions', 0, 'Reset', '2025-12-26 23:11:57', '[\"Promote user\", \"Force password reset and revoke sessions\", \"Delete account\", \"Ignore\"]'),
(6154, 335, 'Which Python library is used for HTTP calls?', 1, 'requests', 0, 'HTTP', '2025-12-26 23:11:57', '[\"json\", \"requests\", \"socket\", \"hashlib\"]'),
(6155, 335, 'Why is Python popular for security?', 2, 'Simple syntax and great libraries', 0, 'Easy', '2025-12-26 23:11:57', '[\"It is fast\", \"Simple syntax and great libraries\", \"It is new\", \"It is hard\"]'),
(6156, 335, 'What does hashlib calculate?', 3, 'File hashes (MD5, SHA256)', 0, 'Hash', '2025-12-26 23:11:57', '[\"Passwords\", \"File hashes (MD5, SHA256)\", \"Colors\", \"Sound\"]'),
(6157, 336, 'SOAR stands for:', 1, 'Security Orchestration, Automation, and Response', 0, 'SOAR', '2025-12-26 23:11:57', '[\"Security Operations\", \"Security Orchestration, Automation, and Response\", \"System Order\", \"None\"]'),
(6158, 336, 'What is the main benefit of automation?', 2, 'Speed and consistency', 0, 'Faster', '2025-12-26 23:11:57', '[\"More alerts\", \"Speed and consistency\", \"More cost\", \"Complexity\"]'),
(6159, 336, 'What starts a playbook?', 3, 'A trigger (e.g., SIEM alert)', 0, 'Trigger', '2025-12-26 23:11:57', '[\"A human\", \"A trigger (e.g., SIEM alert)\", \"Random chance\", \"Nothing\"]'),
(6160, 336, 'Which Python library makes HTTP API calls?', 4, 'requests', 0, 'Library', '2025-12-26 23:11:57', '[\"json\", \"requests\", \"socket\", \"os\"]'),
(6161, 336, 'For malware alerts, a common automated action is:', 5, 'Isolate the host', 0, 'Contain', '2025-12-26 23:11:57', '[\"Delete files\", \"Isolate the host\", \"Reboot\", \"Ignore\"]'),
(6162, 336, 'TheHive is an example of:', 6, 'Open-source SOAR', 0, 'Free', '2025-12-26 23:11:57', '[\"Commercial SIEM\", \"Open-source SOAR\", \"Antivirus\", \"Firewall\"]'),
(6163, 341, 'Why is real-time documentation important?', 1, 'You will forget details later', 0, 'Accurate', '2025-12-26 23:13:12', '[\"It is not\", \"You will forget details later\", \"It is slower\", \"For fun\"]'),
(6164, 341, 'Documentation is required for:', 2, 'Legal evidence and audits', 0, 'Compliance', '2025-12-26 23:13:12', '[\"Fun\", \"Legal evidence and audits\", \"Nothing\", \"Vacation\"]'),
(6165, 341, 'What should you avoid in documentation?', 3, 'Vague language like \"some malware\"', 0, 'Be specific', '2025-12-26 23:13:12', '[\"Details\", \"Vague language like \\\"some malware\\\"\", \"Timestamps\", \"Evidence\"]'),
(6166, 342, 'What timezone should timelines use?', 1, 'UTC', 0, 'Standard', '2025-12-26 23:13:12', '[\"Local\", \"UTC\", \"EST\", \"Random\"]'),
(6167, 342, 'What should every timeline entry include?', 2, 'Timestamp, Source, Event, Actor', 0, 'Complete', '2025-12-26 23:13:12', '[\"Just time\", \"Timestamp, Source, Event, Actor\", \"Just event\", \"Nothing\"]'),
(6168, 342, 'Why link to evidence in the timeline?', 3, 'To support claims with proof', 0, 'Verification', '2025-12-26 23:13:12', '[\"Decoration\", \"To support claims with proof\", \"Fun\", \"Color\"]'),
(6169, 343, 'What comes first in an incident report?', 1, 'Executive Summary', 0, 'Top', '2025-12-26 23:13:12', '[\"Appendix\", \"Executive Summary\", \"Technical Findings\", \"Timeline\"]'),
(6170, 343, 'Who is the Executive Summary written for?', 2, 'Leadership (non-technical)', 0, 'C-Suite', '2025-12-26 23:13:12', '[\"Hackers\", \"Leadership (non-technical)\", \"Developers\", \"Interns\"]'),
(6171, 343, 'What should you include in an Appendix?', 3, 'Raw logs, hashes, supporting evidence', 0, 'Details', '2025-12-26 23:13:12', '[\"Summary\", \"Raw logs, hashes, supporting evidence\", \"Executive summary\", \"Nothing\"]'),
(6172, 344, 'What should an Executive Summary avoid?', 1, 'Technical jargon', 0, 'Simple', '2025-12-26 23:13:12', '[\"Details\", \"Technical jargon\", \"Impact\", \"Recommendations\"]'),
(6173, 344, 'How should impact be described?', 2, 'In business terms (money, data, reputation)', 0, 'Quantify', '2025-12-26 23:13:12', '[\"Technically\", \"In business terms (money, data, reputation)\", \"Vaguely\", \"Not at all\"]'),
(6174, 344, 'What question should the summary answer?', 3, 'What happened and are we safe?', 0, 'Status', '2025-12-26 23:13:12', '[\"Who is to blame?\", \"What happened and are we safe?\", \"What is for lunch?\", \"Nothing\"]'),
(6175, 345, 'What does MTTD stand for?', 1, 'Mean Time to Detect', 0, 'Detection', '2025-12-26 23:13:12', '[\"Mean Time to Delete\", \"Mean Time to Detect\", \"Maximum Threat Time\", \"None\"]'),
(6176, 345, 'A high False Positive rate indicates:', 2, 'Poor detection rules', 0, 'Bad rules', '2025-12-26 23:13:12', '[\"Good security\", \"Poor detection rules\", \"Fast response\", \"Nothing\"]'),
(6177, 345, 'Why track metrics over time?', 3, 'To identify trends and improvements', 0, 'Progress', '2025-12-26 23:13:12', '[\"For fun\", \"To identify trends and improvements\", \"To delete data\", \"No reason\"]'),
(6178, 346, 'What timezone should incident timelines use?', 1, 'UTC', 0, 'Standard', '2025-12-26 23:13:12', '[\"Local\", \"UTC\", \"EST\", \"Random\"]'),
(6179, 346, 'Who is the Executive Summary written for?', 2, 'Leadership', 0, 'Audience', '2025-12-26 23:13:12', '[\"Hackers\", \"Leadership\", \"Developers\", \"Public\"]'),
(6180, 346, 'What does MTTR stand for?', 3, 'Mean Time to Respond', 0, 'Response', '2025-12-26 23:13:12', '[\"Mean Time to Read\", \"Mean Time to Respond\", \"Max Threat Time\", \"None\"]'),
(6181, 346, 'What should documentation avoid?', 4, 'Vague language', 0, 'Specific', '2025-12-26 23:13:12', '[\"Details\", \"Vague language\", \"Timestamps\", \"Evidence\"]'),
(6182, 346, 'What makes metrics valuable?', 5, 'Tracking trends over time', 0, 'Progress', '2025-12-26 23:13:12', '[\"One-time snapshots\", \"Tracking trends over time\", \"Colors\", \"Nothing\"]'),
(6183, 346, 'An Appendix should contain:', 6, 'Raw evidence and supporting data', 0, 'Details', '2025-12-26 23:13:12', '[\"Summary\", \"Raw evidence and supporting data\", \"Executive summary\", \"Nothing\"]'),
(6184, 361, 'What is the purpose of a message queue (Kafka) in SIEM?', 1, 'Buffer ingestion spikes and decouple collection from indexing', 0, 'Buffer', '2025-12-27 02:16:31', '[\"Speed up queries\", \"Buffer ingestion spikes and decouple collection from indexing\", \"Store logs long-term\", \"Replace the SIEM\"]'),
(6185, 361, 'In tiered storage, where should the last 7 days of logs reside?', 2, 'Hot tier (SSD)', 0, 'Fast', '2025-12-27 02:16:31', '[\"Cold archive\", \"Hot tier (SSD)\", \"Data lake\", \"Backup tapes\"]'),
(6186, 361, 'What does Search Head Cluster provide in Splunk?', 3, 'High availability and load balancing for searches', 0, 'HA', '2025-12-27 02:16:31', '[\"Faster indexing\", \"High availability and load balancing for searches\", \"Better parsing\", \"Cheaper storage\"]'),
(6187, 362, 'What does ECS stand for?', 1, 'Elastic Common Schema', 0, 'Schema', '2025-12-27 02:16:31', '[\"Event Collection System\", \"Elastic Common Schema\", \"Enterprise Control System\", \"Endpoint Correlation Service\"]'),
(6188, 362, 'Why normalize logs to a common schema?', 2, 'Enable consistent queries across different log sources', 0, 'Consistency', '2025-12-27 02:16:31', '[\"Make logs smaller\", \"Enable consistent queries across different log sources\", \"Hide sensitive data\", \"Comply with regulations\"]'),
(6189, 362, 'What enrichment might you add during parsing?', 3, 'GeoIP, asset info, threat intelligence', 0, 'Context', '2025-12-27 02:16:31', '[\"Compression\", \"GeoIP, asset info, threat intelligence\", \"Encryption\", \"Deletion markers\"]'),
(6190, 363, 'What is \"Multi-Stage Correlation\"?', 1, 'Detecting attack chains across multiple events/logs', 0, 'Chain', '2025-12-27 02:16:31', '[\"Faster queries\", \"Detecting attack chains across multiple events/logs\", \"Storing more data\", \"Compressing logs\"]'),
(6191, 363, 'Why add whitelists to correlation rules?', 2, 'Reduce false positives from known-good sources', 0, 'Tune', '2025-12-27 02:16:31', '[\"Make rules slower\", \"Reduce false positives from known-good sources\", \"Delete logs\", \"Add encryption\"]'),
(6192, 363, 'What is \"Absence Detection\"?', 3, 'Alerting when an expected event does NOT occur', 0, 'Missing', '2025-12-27 02:16:31', '[\"Detecting attackers\", \"Alerting when an expected event does NOT occur\", \"Finding duplicates\", \"Searching faster\"]'),
(6193, 364, 'Why filter early in a query?', 1, 'Reduce data volume before expensive operations', 0, 'Performance', '2025-12-27 02:16:31', '[\"Make results pretty\", \"Reduce data volume before expensive operations\", \"Add more logs\", \"Comply with laws\"]'),
(6194, 364, 'Which wildcard placement is more efficient?', 2, 'Suffix: admin* (not *admin)', 0, 'Suffix', '2025-12-27 02:16:31', '[\"Both equal\", \"Suffix: admin* (not *admin)\", \"Prefix: *admin\", \"Neither\"]'),
(6195, 364, 'What does \"indexed field\" mean?', 3, 'A field the SIEM can search quickly without scanning all data', 0, 'Fast lookup', '2025-12-27 02:16:31', '[\"A calculated field\", \"A field the SIEM can search quickly without scanning all data\", \"A deleted field\", \"A hidden field\"]'),
(6196, 365, 'What is Sigma?', 1, 'Vendor-agnostic detection rule format', 0, 'Universal', '2025-12-27 02:16:31', '[\"A SIEM product\", \"Vendor-agnostic detection rule format\", \"A programming language\", \"A log format\"]'),
(6197, 365, 'Why use version control for detections?', 2, 'Track changes and enable rollback', 0, 'Git', '2025-12-27 02:16:31', '[\"Make detections slower\", \"Track changes and enable rollback\", \"Hide detections\", \"Compress rules\"]'),
(6198, 365, 'What tool executes real attack techniques for testing?', 3, 'Atomic Red Team', 0, 'Test', '2025-12-27 02:16:31', '[\"Sigma\", \"Atomic Red Team\", \"Splunk\", \"Wireshark\"]'),
(6199, 366, 'In a tiered storage model, where are recent logs stored?', 1, 'Hot tier (SSD)', 0, 'Tier', '2025-12-27 02:16:31', '[\"Cold archive\", \"Hot tier (SSD)\", \"Tape\", \"Cloud only\"]'),
(6200, 366, 'What does OCSF stand for?', 2, 'Open Cybersecurity Schema Framework', 0, 'Schema', '2025-12-27 02:16:31', '[\"Open Cyber Security Framework\", \"Open Cybersecurity Schema Framework\", \"Online Cloud Security Format\", \"None\"]'),
(6201, 366, 'Multi-Stage Correlation detects:', 3, 'Attack chains across multiple events', 0, 'Chain', '2025-12-27 02:16:31', '[\"Single events\", \"Attack chains across multiple events\", \"Faster searches\", \"Log compression\"]'),
(6202, 366, 'What is the benefit of filtering early in queries?', 4, 'Reduce data volume for faster execution', 0, 'Speed', '2025-12-27 02:16:31', '[\"More results\", \"Reduce data volume for faster execution\", \"Better colors\", \"More logs\"]'),
(6203, 366, 'Sigma rules compile to:', 5, 'SIEM-specific queries (SPL, KQL, etc.)', 0, 'Output', '2025-12-27 02:16:31', '[\"PDFs\", \"SIEM-specific queries (SPL, KQL, etc.)\", \"Executables\", \"Emails\"]'),
(6204, 366, 'Detection-as-Code enables:', 6, 'Version control and CI/CD for detections', 0, 'DevOps', '2025-12-27 02:16:31', '[\"Faster attacks\", \"Version control and CI/CD for detections\", \"More alerts\", \"Less security\"]'),
(6205, 371, 'Why is memory forensics critical for fileless malware?', 1, 'Fileless malware never touches disk; only exists in RAM', 0, 'Volatile', '2025-12-27 02:18:03', '[\"It is faster\", \"Fileless malware never touches disk; only exists in RAM\", \"Disk is encrypted\", \"Memory is smaller\"]'),
(6206, 371, 'When should you capture memory during an incident?', 2, 'Before shutdown or containment actions', 0, 'Early', '2025-12-27 02:18:03', '[\"After formatting\", \"Before shutdown or containment actions\", \"Next week\", \"Never\"]'),
(6207, 371, 'What happens to RAM when power is removed?', 3, 'Data is lost (volatile memory)', 0, 'Gone', '2025-12-27 02:18:03', '[\"Data is saved\", \"Data is lost (volatile memory)\", \"Data is compressed\", \"Data is encrypted\"]'),
(6208, 372, 'Which tool captures Linux memory?', 1, 'LiME (Linux Memory Extractor)', 0, 'Linux', '2025-12-27 02:18:03', '[\"WinPMEM\", \"LiME (Linux Memory Extractor)\", \"DumpIt\", \"FTK Imager\"]'),
(6209, 372, 'What is hiberfil.sys?', 2, 'Windows hibernation file containing RAM contents', 0, 'Sleep', '2025-12-27 02:18:03', '[\"A log file\", \"Windows hibernation file containing RAM contents\", \"A virus\", \"A backup file\"]'),
(6210, 372, 'Why run acquisition tool from external USB?', 3, 'Avoid writing to evidence disk and altering it', 0, 'Integrity', '2025-12-27 02:18:03', '[\"Faster speed\", \"Avoid writing to evidence disk and altering it\", \"USB is encrypted\", \"No reason\"]'),
(6211, 373, 'Which plugin finds hidden/unlinked processes?', 1, 'psscan', 0, 'Hidden', '2025-12-27 02:18:03', '[\"pslist\", \"psscan\", \"cmdline\", \"dlllist\"]'),
(6212, 373, 'What does malfind detect?', 2, 'Injected code in process memory', 0, 'Injection', '2025-12-27 02:18:03', '[\"Network connections\", \"Injected code in process memory\", \"File hashes\", \"Passwords\"]'),
(6213, 373, 'What is the difference between pslist and psscan?', 3, 'pslist walks linked list; psscan scans all memory for process structs', 0, 'Scan vs Walk', '2025-12-27 02:18:03', '[\"No difference\", \"pslist walks linked list; psscan scans all memory for process structs\", \"psscan is faster\", \"pslist finds hidden processes\"]'),
(6214, 374, 'What is Process Hollowing?', 1, 'Starting a process suspended and replacing its code', 0, 'Replace', '2025-12-27 02:18:03', '[\"Loading a DLL\", \"Starting a process suspended and replacing its code\", \"Killing a process\", \"Debugging\"]'),
(6215, 374, 'What memory protection is suspicious when combined with code?', 2, 'PAGE_EXECUTE_READWRITE', 0, 'RWX', '2025-12-27 02:18:03', '[\"PAGE_READONLY\", \"PAGE_EXECUTE_READWRITE\", \"PAGE_NOACCESS\", \"PAGE_WRITECOPY\"]'),
(6216, 374, 'How do you detect unlinked/hidden processes?', 3, 'Compare pslist (linked) vs psscan (scanned)', 0, 'Compare', '2025-12-27 02:18:03', '[\"Run antivirus\", \"Compare pslist (linked) vs psscan (scanned)\", \"Reboot\", \"Check Task Manager\"]'),
(6217, 375, 'What does DKOM stand for?', 1, 'Direct Kernel Object Manipulation', 0, 'Kernel', '2025-12-27 02:18:03', '[\"Dynamic Kernel Object Mode\", \"Direct Kernel Object Manipulation\", \"Driver Kernel Object Manager\", \"None\"]'),
(6218, 375, 'How does a rootkit hide a process using DKOM?', 2, 'Unlinks the process from the EPROCESS linked list', 0, 'Unlink', '2025-12-27 02:18:03', '[\"Deletes the executable\", \"Unlinks the process from the EPROCESS linked list\", \"Renames the process\", \"Encrypts the process\"]');
INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(6219, 375, 'Which Volatility plugin detects SSDT hooks?', 3, 'ssdt', 0, 'Hooks', '2025-12-27 02:18:03', '[\"pslist\", \"netscan\", \"ssdt\", \"malfind\"]'),
(6220, 376, 'What type of malware only exists in RAM?', 1, 'Fileless malware', 0, 'Memory-only', '2025-12-27 02:18:03', '[\"Ransomware\", \"Fileless malware\", \"Worm\", \"Trojan\"]'),
(6221, 376, 'Which tool is used for Linux memory acquisition?', 2, 'LiME', 0, 'Linux', '2025-12-27 02:18:03', '[\"WinPMEM\", \"DumpIt\", \"LiME\", \"FTK Imager\"]'),
(6222, 376, 'What does malfind detect?', 3, 'Injected code in process memory', 0, 'Injection', '2025-12-27 02:18:03', '[\"Files\", \"Injected code in process memory\", \"Passwords\", \"Network\"]'),
(6223, 376, 'What is DKOM?', 4, 'Direct Kernel Object Manipulation', 0, 'Rootkit', '2025-12-27 02:18:03', '[\"Dynamic Kernel Mode\", \"Direct Kernel Object Manipulation\", \"Driver Object Manager\", \"None\"]'),
(6224, 376, 'pslist walks the linked list; psscan...', 5, 'Scans all memory for process structures', 0, 'Scan', '2025-12-27 02:18:03', '[\"Is the same\", \"Scans all memory for process structures\", \"Is faster\", \"Only works on Linux\"]'),
(6225, 376, 'What memory protection suggests injected code?', 6, 'PAGE_EXECUTE_READWRITE', 0, 'RWX', '2025-12-27 02:18:03', '[\"PAGE_READONLY\", \"PAGE_EXECUTE_READWRITE\", \"PAGE_GUARD\", \"PAGE_NOACCESS\"]'),
(6226, 381, 'What tool did the NSA release for free?', 1, 'Ghidra', 0, 'Free', '2025-12-27 02:19:34', '[\"IDA Pro\", \"Ghidra\", \"x64dbg\", \"OllyDbg\"]'),
(6227, 381, 'Why extract IOCs from malware?', 2, 'Create signatures and blocklists', 0, 'Detection', '2025-12-27 02:19:34', '[\"For fun\", \"Create signatures and blocklists\", \"Delete the malware\", \"Sell them\"]'),
(6228, 381, 'What is the purpose of a disassembler?', 3, 'Convert machine code to assembly', 0, 'Translate', '2025-12-27 02:19:34', '[\"Run malware\", \"Convert machine code to assembly\", \"Compile code\", \"Debug\"]'),
(6229, 382, 'Which register typically holds return values in x86?', 1, 'EAX', 0, 'Return', '2025-12-27 02:19:34', '[\"EBX\", \"EAX\", \"ECX\", \"ESP\"]'),
(6230, 382, 'What does the CALL instruction do?', 2, 'Calls a function (pushes return address, jumps)', 0, 'Function', '2025-12-27 02:19:34', '[\"Returns\", \"Calls a function (pushes return address, jumps)\", \"Compares\", \"Loops\"]'),
(6231, 382, 'In x64 calling convention, where are the first 4 arguments?', 3, 'Registers (RCX, RDX, R8, R9)', 0, 'Registers', '2025-12-27 02:19:34', '[\"Stack only\", \"Registers (RCX, RDX, R8, R9)\", \"Memory\", \"Nowhere\"]'),
(6232, 383, 'What does \"Xrefs\" show in IDA?', 1, 'Where a function or variable is referenced', 0, 'Cross-reference', '2025-12-27 02:19:34', '[\"Errors\", \"Where a function or variable is referenced\", \"Registry keys\", \"Network calls\"]'),
(6233, 383, 'What does Ghidra\'s decompiler produce?', 2, 'Pseudo-C code from assembly', 0, 'Readable', '2025-12-27 02:19:34', '[\"Executable\", \"Pseudo-C code from assembly\", \"Encrypted code\", \"Packed code\"]'),
(6234, 383, 'Which API is commonly used to inject code into another process?', 3, 'WriteProcessMemory + CreateRemoteThread', 0, 'Injection', '2025-12-27 02:19:34', '[\"CreateFile\", \"WriteProcessMemory + CreateRemoteThread\", \"RegSetValueEx\", \"CryptEncrypt\"]'),
(6235, 384, 'What does F7 do in x64dbg?', 1, 'Step Into (enter function calls)', 0, 'Step', '2025-12-27 02:19:34', '[\"Run\", \"Step Into (enter function calls)\", \"Exit\", \"Breakpoint\"]'),
(6236, 384, 'Why set a breakpoint on VirtualAlloc?', 2, 'Catch memory allocation (often for unpacking)', 0, 'Unpack', '2025-12-27 02:19:34', '[\"It is random\", \"Catch memory allocation (often for unpacking)\", \"Speed up\", \"Delete files\"]'),
(6237, 384, 'What is a common anti-debug API to bypass?', 3, 'IsDebuggerPresent', 0, 'Anti-debug', '2025-12-27 02:19:34', '[\"CreateFile\", \"IsDebuggerPresent\", \"InternetOpen\", \"RegSetValue\"]'),
(6238, 385, 'What is the purpose of a packer?', 1, 'Compress/obfuscate code to evade detection', 0, 'Hide', '2025-12-27 02:19:34', '[\"Speed up malware\", \"Compress/obfuscate code to evade detection\", \"Add features\", \"Make it smaller for email\"]'),
(6239, 385, 'What does API Hashing hide?', 2, 'The names of Windows APIs being called', 0, 'Names', '2025-12-27 02:19:34', '[\"Return values\", \"The names of Windows APIs being called\", \"File paths\", \"Network traffic\"]'),
(6240, 385, 'How do you find the Original Entry Point (OEP)?', 3, 'Set breakpoints on VirtualAlloc, step until unpacked code runs', 0, 'Breakpoint', '2025-12-27 02:19:34', '[\"Run strings\", \"Set breakpoints on VirtualAlloc, step until unpacked code runs\", \"Read documentation\", \"Ask the malware\"]'),
(6241, 386, 'Which tool is NSA\'s free disassembler?', 1, 'Ghidra', 0, 'Free', '2025-12-27 02:19:34', '[\"IDA Pro\", \"Ghidra\", \"x64dbg\", \"OllyDbg\"]'),
(6242, 386, 'Which register holds the return value in x86?', 2, 'EAX', 0, 'Return', '2025-12-27 02:19:34', '[\"EBX\", \"EAX\", \"ECX\", \"EDX\"]'),
(6243, 386, 'What does F7 do in x64dbg?', 3, 'Step Into', 0, 'Debug', '2025-12-27 02:19:34', '[\"Run\", \"Step Into\", \"Step Over\", \"Exit\"]'),
(6244, 386, 'What is the purpose of a packer?', 4, 'Obfuscate and evade detection', 0, 'Hide', '2025-12-27 02:19:34', '[\"Speed up\", \"Obfuscate and evade detection\", \"Add features\", \"Compress for email\"]'),
(6245, 386, 'Which API is used for code injection?', 5, 'WriteProcessMemory', 0, 'Inject', '2025-12-27 02:19:34', '[\"CreateFile\", \"WriteProcessMemory\", \"RegSetValue\", \"CryptEncrypt\"]'),
(6246, 386, 'What does IsDebuggerPresent detect?', 6, 'If the process is being debugged', 0, 'Anti-debug', '2025-12-27 02:19:34', '[\"Malware\", \"If the process is being debugged\", \"Network\", \"Files\"]'),
(6247, 391, 'Who consumes Strategic threat intel?', 1, 'Executives (high-level trends, risk)', 0, 'Leadership', '2025-12-27 02:21:01', '[\"SOC Analysts\", \"Executives (high-level trends, risk)\", \"Developers\", \"Interns\"]'),
(6248, 391, 'What does \"Actionability\" mean for intel?', 2, 'Can we do something with this information?', 0, 'Useful', '2025-12-27 02:21:01', '[\"Is it expensive\", \"Can we do something with this information?\", \"Is it pretty\", \"Is it long\"]'),
(6249, 391, 'Technical intel contains:', 3, 'Hashes, IPs, domains, YARA rules', 0, 'IOCs', '2025-12-27 02:21:01', '[\"Strategy documents\", \"Hashes, IPs, domains, YARA rules\", \"Financial reports\", \"HR data\"]'),
(6250, 392, 'What is MISP?', 1, 'Open-source threat intel sharing platform', 0, 'Platform', '2025-12-27 02:21:01', '[\"A SIEM\", \"Open-source threat intel sharing platform\", \"A firewall\", \"A sandbox\"]'),
(6251, 392, 'What does GreyNoise help distinguish?', 2, 'Background internet noise vs targeted attacks', 0, 'Filter', '2025-12-27 02:21:01', '[\"Good vs bad files\", \"Background internet noise vs targeted attacks\", \"Encrypted vs clear\", \"Fast vs slow\"]'),
(6252, 392, 'What is \"Pivoting\" in threat intel?', 3, 'Using one IOC to discover related infrastructure', 0, 'Connect', '2025-12-27 02:21:01', '[\"Turning around\", \"Using one IOC to discover related infrastructure\", \"Deleting IOCs\", \"Renaming IOCs\"]'),
(6253, 393, 'What is the Diamond Model used for?', 1, 'Relating Adversary, Infrastructure, Capability, and Victim', 0, 'Framework', '2025-12-27 02:21:01', '[\"File analysis\", \"Relating Adversary, Infrastructure, Capability, and Victim\", \"Network monitoring\", \"Encryption\"]'),
(6254, 393, 'Why is attribution difficult?', 2, 'False flags, shared tools, proxy infrastructure', 0, 'Challenges', '2025-12-27 02:21:01', '[\"It is easy\", \"False flags, shared tools, proxy infrastructure\", \"Everyone signs their work\", \"Logs are perfect\"]'),
(6255, 393, 'What does \"High Confidence\" attribution mean?', 3, 'Multiple corroborating sources support it', 0, 'Verified', '2025-12-27 02:21:01', '[\"Guessing\", \"Multiple corroborating sources support it\", \"One source\", \"No evidence\"]'),
(6256, 394, 'What is STIX?', 1, 'JSON format for describing threat intelligence', 0, 'Format', '2025-12-27 02:21:01', '[\"A transport protocol\", \"JSON format for describing threat intelligence\", \"A firewall\", \"A SIEM\"]'),
(6257, 394, 'What does TAXII do?', 2, 'Transport STIX-formatted threat intel', 0, 'Transport', '2025-12-27 02:21:01', '[\"Store files\", \"Transport STIX-formatted threat intel\", \"Encrypt data\", \"Delete IOCs\"]'),
(6258, 394, 'What does TLP:RED mean?', 3, 'Not for disclosure outside the recipient', 0, 'Restricted', '2025-12-27 02:21:01', '[\"Public\", \"Not for disclosure outside the recipient\", \"Community share\", \"Partner share\"]'),
(6259, 395, 'Where can you push IOCs for blocking?', 1, 'Firewall, Proxy, EDR, Email Gateway', 0, 'Enforcement', '2025-12-27 02:21:01', '[\"Nowhere\", \"Firewall, Proxy, EDR, Email Gateway\", \"Only SIEM\", \"Only Email\"]'),
(6260, 395, 'What is a TIP?', 2, 'Threat Intelligence Platform', 0, 'Platform', '2025-12-27 02:21:01', '[\"Threat Inspection Protocol\", \"Threat Intelligence Platform\", \"Technical Investigation Process\", \"None\"]'),
(6261, 395, 'Why is a feedback loop important?', 3, 'Intel team learns if IOCs were useful or false positives', 0, 'Improve', '2025-12-27 02:21:01', '[\"It is not\", \"Intel team learns if IOCs were useful or false positives\", \"To delete intel\", \"To create more alerts\"]'),
(6262, 396, 'Who consumes Strategic intel?', 1, 'Executives', 0, 'Leadership', '2025-12-27 02:21:01', '[\"SOC Analysts\", \"Executives\", \"Developers\", \"All\"]'),
(6263, 396, 'What is MISP?', 2, 'Open-source threat intel platform', 0, 'Platform', '2025-12-27 02:21:01', '[\"SIEM\", \"Open-source threat intel platform\", \"Firewall\", \"EDR\"]'),
(6264, 396, 'STIX is a:', 3, 'JSON format for threat intel', 0, 'Format', '2025-12-27 02:21:01', '[\"Transport protocol\", \"JSON format for threat intel\", \"Firewall rule\", \"Log format\"]'),
(6265, 396, 'TAXII is a:', 4, 'Transport protocol for STIX', 0, 'Transport', '2025-12-27 02:21:01', '[\"Data format\", \"Transport protocol for STIX\", \"SIEM\", \"EDR\"]'),
(6266, 396, 'What does TLP:RED mean?', 5, 'Not for disclosure outside recipient', 0, 'Restricted', '2025-12-27 02:21:01', '[\"Public\", \"Not for disclosure outside recipient\", \"Share widely\", \"Community only\"]'),
(6267, 396, 'Where do you push IOCs for enforcement?', 6, 'Firewall, Proxy, EDR', 0, 'Block', '2025-12-27 02:21:01', '[\"Only SIEM\", \"Firewall, Proxy, EDR\", \"Nowhere\", \"Email only\"]'),
(6268, 401, 'What is the Red Team\'s primary role?', 1, 'Offensive - simulate attacks to test defenses', 0, 'Offense', '2025-12-27 02:22:24', '[\"Defensive\", \"Offensive - simulate attacks to test defenses\", \"Compliance\", \"Training\"]'),
(6269, 401, 'What is Purple Teaming?', 2, 'Collaboration between Red and Blue teams', 0, 'Collab', '2025-12-27 02:22:24', '[\"Only offense\", \"Collaboration between Red and Blue teams\", \"Only defense\", \"Management\"]'),
(6270, 401, 'Why does Purple Teaming improve security?', 3, 'Red shares attack methods, Blue improves detection', 0, 'Learn together', '2025-12-27 02:22:24', '[\"It is cheaper\", \"Red shares attack methods, Blue improves detection\", \"More alerts\", \"Less work\"]'),
(6271, 402, 'What is an ROE in Red Team context?', 1, 'Rules of Engagement - defines scope and limits', 0, 'Rules', '2025-12-27 02:22:24', '[\"A tool\", \"Rules of Engagement - defines scope and limits\", \"A C2 framework\", \"A report\"]'),
(6272, 402, 'Which tool is used for AD attack path mapping?', 2, 'BloodHound', 0, 'Graph', '2025-12-27 02:22:24', '[\"Metasploit\", \"BloodHound\", \"Cobalt Strike\", \"Nmap\"]'),
(6273, 402, 'What is post-exploitation?', 3, 'Actions after initial access (persistence, lateral movement)', 0, 'After', '2025-12-27 02:22:24', '[\"Before hacking\", \"Actions after initial access (persistence, lateral movement)\", \"Cleanup\", \"Reporting\"]'),
(6274, 403, 'What does NDR focus on?', 1, 'Network Detection and Response', 0, 'Network', '2025-12-27 02:22:24', '[\"Endpoints\", \"Network Detection and Response\", \"Email\", \"Cloud\"]'),
(6275, 403, 'What is a honeytoken?', 2, 'Fake credential or data designed to alert on access', 0, 'Trap', '2025-12-27 02:22:24', '[\"Real password\", \"Fake credential or data designed to alert on access\", \"A log file\", \"A backup\"]'),
(6276, 403, 'How does Blue Team use MITRE ATT&CK?', 3, 'Map detection coverage and identify gaps', 0, 'Coverage', '2025-12-27 02:22:24', '[\"Attack systems\", \"Map detection coverage and identify gaps\", \"Delete logs\", \"Train users\"]'),
(6277, 404, 'What is an Atomic Test?', 1, 'Single technique execution with immediate validation', 0, 'Small test', '2025-12-27 02:22:24', '[\"Full attack simulation\", \"Single technique execution with immediate validation\", \"Discussion only\", \"Report writing\"]'),
(6278, 404, 'During Purple Team, what happens if Blue fails to detect?', 2, 'Create new detection rule or tune existing', 0, 'Improve', '2025-12-27 02:22:24', '[\"Blame Red\", \"Create new detection rule or tune existing\", \"Ignore it\", \"Delete logs\"]'),
(6279, 404, 'Why is real-time communication important in Purple Team?', 3, 'Blue can correlate activity in real-time', 0, 'Immediate', '2025-12-27 02:22:24', '[\"It is not\", \"Blue can correlate activity in real-time\", \"For fun\", \"To delay\"]'),
(6280, 405, 'What is the difference between pen testing and adversary emulation?', 1, 'Adversary emulation replicates specific threat actor TTPs', 0, 'Realistic', '2025-12-27 02:22:24', '[\"No difference\", \"Adversary emulation replicates specific threat actor TTPs\", \"Pen testing is better\", \"Emulation is cheaper\"]'),
(6281, 405, 'Which framework automates adversary emulation?', 2, 'MITRE Caldera', 0, 'Automated', '2025-12-27 02:22:24', '[\"Metasploit\", \"MITRE Caldera\", \"Wireshark\", \"Splunk\"]'),
(6282, 405, 'Why emulate a specific APT group?', 3, 'Test defenses against adversaries likely to target you', 0, 'Relevance', '2025-12-27 02:22:24', '[\"For fun\", \"Test defenses against adversaries likely to target you\", \"It is required\", \"To impress management\"]'),
(6283, 406, 'What is the Red Team\'s goal?', 1, 'Test defenses by simulating attacks', 0, 'Offense', '2025-12-27 02:22:24', '[\"Build tools\", \"Test defenses by simulating attacks\", \"Write reports\", \"Train users\"]'),
(6284, 406, 'What is Purple Teaming?', 2, 'Collaboration between Red and Blue', 0, 'Together', '2025-12-27 02:22:24', '[\"Only offense\", \"Collaboration between Red and Blue\", \"Only defense\", \"Compliance\"]'),
(6285, 406, 'Which tool extracts Windows credentials?', 3, 'Mimikatz', 0, 'Creds', '2025-12-27 02:22:24', '[\"BloodHound\", \"Mimikatz\", \"Cobalt Strike\", \"Nmap\"]'),
(6286, 406, 'What is a honeytoken?', 4, 'Fake data that alerts when accessed', 0, 'Trap', '2025-12-27 02:22:24', '[\"Password\", \"Fake data that alerts when accessed\", \"Log file\", \"Backup\"]'),
(6287, 406, 'What framework automates adversary emulation?', 5, 'MITRE Caldera', 0, 'Automation', '2025-12-27 02:22:24', '[\"Metasploit\", \"MITRE Caldera\", \"Wireshark\", \"Burp\"]'),
(6288, 406, 'What happens after Blue fails to detect in Purple Team?', 6, 'Create or improve detection rules', 0, 'Improve', '2025-12-27 02:22:24', '[\"Blame Red\", \"Create or improve detection rules\", \"Ignore it\", \"Fire someone\"]'),
(6289, 411, 'Why establish a baseline before exercises?', 1, 'To distinguish attack activity from normal behavior', 0, 'Compare', '2025-12-27 02:26:00', '[\"It is required by law\", \"To distinguish attack activity from normal behavior\", \"To slow things down\", \"No reason\"]'),
(6290, 411, 'What should be documented for each exercise?', 2, 'Technique, execution steps, expected detection, results', 0, 'Everything', '2025-12-27 02:26:00', '[\"Nothing\", \"Technique, execution steps, expected detection, results\", \"Only failures\", \"Only successes\"]'),
(6291, 411, 'Which tool provides a library of technique tests?', 3, 'Atomic Red Team', 0, 'Library', '2025-12-27 02:26:00', '[\"Splunk\", \"Atomic Red Team\", \"Wireshark\", \"Nmap\"]'),
(6292, 412, 'Which Sysmon Event ID indicates process access to LSASS?', 1, 'Event ID 10', 0, 'Access', '2025-12-27 02:26:00', '[\"Event ID 1\", \"Event ID 10\", \"Event ID 11\", \"Event ID 22\"]'),
(6293, 412, 'What is DCSync?', 2, 'Replicating AD credentials by impersonating a domain controller', 0, 'Replication', '2025-12-27 02:26:00', '[\"Syncing files\", \"Replicating AD credentials by impersonating a domain controller\", \"Backing up\", \"Logging\"]'),
(6294, 412, 'Which Windows event logs DCSync activity?', 3, 'Security Event 4662 (replication rights)', 0, 'AD', '2025-12-27 02:26:00', '[\"Sysmon 1\", \"Security Event 4662 (replication rights)\", \"Application log\", \"System log\"]'),
(6295, 413, 'What does PsExec create on the remote host?', 1, 'A service (PSEXESVC)', 0, 'Service', '2025-12-27 02:26:00', '[\"A file only\", \"A service (PSEXESVC)\", \"Nothing\", \"A registry key\"]'),
(6296, 413, 'Which parent-child relationship is suspicious for WMI?', 2, 'WmiPrvSE.exe spawning cmd.exe or powershell.exe', 0, 'Process tree', '2025-12-27 02:26:00', '[\"svchost → notepad\", \"WmiPrvSE.exe spawning cmd.exe or powershell.exe\", \"explorer → chrome\", \"lsass → svchost\"]'),
(6297, 413, 'Windows Event 7045 indicates:', 3, 'A new service was installed', 0, 'Service', '2025-12-27 02:26:00', '[\"Login\", \"A new service was installed\", \"File access\", \"Network connection\"]'),
(6298, 414, 'What indicates DNS tunneling?', 1, 'High query volume, unusually long subdomains', 0, 'DNS', '2025-12-27 02:26:00', '[\"Slow DNS\", \"High query volume, unusually long subdomains\", \"No DNS\", \"Fast DNS\"]'),
(6299, 414, 'Why monitor uploads to cloud storage domains?', 2, 'Attackers exfiltrate to Dropbox, Google Drive, etc.', 0, 'Cloud exfil', '2025-12-27 02:26:00', '[\"It is slow\", \"Attackers exfiltrate to Dropbox, Google Drive, etc.\", \"Cloud is unsafe\", \"For compliance\"]'),
(6300, 414, 'Which HTTP method is commonly used for exfiltration?', 3, 'POST', 0, 'Upload', '2025-12-27 02:26:00', '[\"GET\", \"POST\", \"DELETE\", \"HEAD\"]'),
(6301, 415, 'What does Detection Rate measure?', 1, 'Percentage of executed techniques that were detected', 0, 'Success', '2025-12-27 02:26:00', '[\"Speed\", \"Percentage of executed techniques that were detected\", \"Cost\", \"Size\"]'),
(6302, 415, 'Why use ATT&CK Navigator heatmaps?', 2, 'Visualize detection coverage across techniques', 0, 'Visualization', '2025-12-27 02:26:00', '[\"It is pretty\", \"Visualize detection coverage across techniques\", \"Required by law\", \"For fun\"]'),
(6303, 415, 'How often should Purple Team exercises occur?', 3, 'Regularly (monthly or quarterly)', 0, 'Recurring', '2025-12-27 02:26:00', '[\"Once ever\", \"Regularly (monthly or quarterly)\", \"Never\", \"Only after breaches\"]'),
(6304, 416, 'Which Sysmon event indicates process access to LSASS?', 1, 'Event ID 10', 0, 'Credential', '2025-12-27 02:26:00', '[\"1\", \"Event ID 10\", \"Event ID 11 \", \"Event ID 22\"]'),
(6305, 416, 'PsExec creates what on remote hosts?', 2, 'A service (PSEXESVC)', 0, 'Remote', '2025-12-27 02:26:00', '[\"A file\", \"A service (PSEXESVC)\", \"Nothing\", \"A user\"]'),
(6306, 416, 'DNS tunneling is characterized by:', 3, 'Long subdomains, high query volume', 0, 'DNS', '2025-12-27 02:26:00', '[\"Fast lookups\", \"Long subdomains, high query volume\", \"No queries\", \"Short names\"]'),
(6307, 416, 'Detection Rate formula:', 4, '(Detected / Executed) x 100', 0, 'Metric', '2025-12-27 02:26:00', '[\"Executed / Detected\", \"(Detected / Executed) x 100\", \"Random\", \"None\"]'),
(6308, 416, 'What should happen after deploying new detection?', 5, 'Re-test the technique', 0, 'Validate', '2025-12-27 02:26:00', '[\"Nothing\", \"Re-test the technique\", \"Delete old alerts\", \"Wait\"]'),
(6309, 416, 'What is Time to Detect (TTD)?', 6, 'Time between execution and alert', 0, 'Speed', '2025-12-27 02:26:00', '[\"Time to delete\", \"Time between execution and alert\", \"Time to report\", \"Time to lunch\"]'),
(6310, 421, 'How does container isolation differ from VMs?', 1, 'Containers share the host kernel; VMs have full kernel isolation', 0, 'Kernel', '2025-12-27 02:27:22', '[\"No difference\", \"Containers share the host kernel; VMs have full kernel isolation\", \"VMs are less secure\", \"Containers are slower\"]'),
(6311, 421, 'What is the risk of container escape?', 2, 'Attacker gains access to the host and other containers', 0, 'Host', '2025-12-27 02:27:22', '[\"Nothing\", \"Attacker gains access to the host and other containers\", \"Container restarts\", \"Performance drop\"]'),
(6312, 421, 'What standard provides Kubernetes hardening guidance?', 3, 'CIS Kubernetes Benchmark', 0, 'CIS', '2025-12-27 02:27:22', '[\"ISO 27001\", \"CIS Kubernetes Benchmark\", \"PCI DSS\", \"HIPAA\"]'),
(6313, 422, 'Why avoid --privileged flag?', 1, 'It gives the container full host capabilities', 0, 'Root', '2025-12-27 02:27:22', '[\"It is slow\", \"It gives the container full host capabilities\", \"It uses more memory\", \"No reason\"]'),
(6314, 422, 'What does --cap-drop=ALL do?', 2, 'Removes all Linux capabilities from the container', 0, 'Least privilege', '2025-12-27 02:27:22', '[\"Adds capabilities\", \"Removes all Linux capabilities from the container\", \"Drops the container\", \"Deletes files\"]'),
(6315, 422, 'Which tool audits Docker against CIS Benchmark?', 3, 'Docker Bench Security', 0, 'Audit', '2025-12-27 02:27:22', '[\"Nmap\", \"Docker Bench Security\", \"Wireshark\", \"Burp Suite\"]'),
(6316, 423, 'What does RBAC control in Kubernetes?', 1, 'Who can do what to which resources', 0, 'Access', '2025-12-27 02:27:22', '[\"Network traffic\", \"Who can do what to which resources\", \"Storage\", \"Logging\"]'),
(6317, 423, 'What is the most restrictive Pod Security Standard?', 2, 'Restricted', 0, 'Strict', '2025-12-27 02:27:22', '[\"Privileged\", \"Baseline\", \"Restricted\", \"None\"]'),
(6318, 423, 'Why use NetworkPolicy?', 3, 'Restrict pod-to-pod communication', 0, 'Segmentation', '2025-12-27 02:27:22', '[\"Faster network\", \"Restrict pod-to-pod communication\", \"More pods\", \"Easier config\"]'),
(6319, 424, 'Which tool scans container images for CVEs?', 1, 'Trivy', 0, 'Scanner', '2025-12-27 02:27:22', '[\"Nmap\", \"Trivy\", \"Wireshark\", \"Metasploit\"]'),
(6320, 424, 'What is Distroless?', 2, 'Container images with no shell or package manager', 0, 'Minimal', '2025-12-27 02:27:22', '[\"A Linux distro\", \"Container images with no shell or package manager\", \"A Docker command\", \"A network tool\"]'),
(6321, 424, 'Why sign container images?', 3, 'Verify provenance and prevent tampering', 0, 'Trust', '2025-12-27 02:27:22', '[\"Faster pulls\", \"Verify provenance and prevent tampering\", \"Smaller size\", \"No reason\"]'),
(6322, 425, 'What does Falco monitor?', 1, 'System calls (syscalls) at runtime', 0, 'Syscall', '2025-12-27 02:27:22', '[\"Network only\", \"System calls (syscalls) at runtime\", \"Files only\", \"Nothing\"]'),
(6323, 425, 'What is a behavioral baseline?', 2, 'Profile of normal container behavior to detect anomalies', 0, 'Normal', '2025-12-27 02:27:22', '[\"A security tool\", \"Profile of normal container behavior to detect anomalies\", \"A network policy\", \"A log file\"]'),
(6324, 425, 'What action can runtime security take on a threat?', 3, 'Kill, pause, or alert on the container', 0, 'Response', '2025-12-27 02:27:22', '[\"Nothing\", \"Kill, pause, or alert on the container\", \"Only log\", \"Restart host\"]'),
(6325, 426, 'Containers share what with the host?', 1, 'The kernel', 0, 'Shared', '2025-12-27 02:27:22', '[\"Nothing\", \"The kernel\", \"The filesystem only\", \"Memory only\"]'),
(6326, 426, 'What does --cap-drop=ALL do?', 2, 'Removes all Linux capabilities', 0, 'Restrict', '2025-12-27 02:27:22', '[\"Adds capabilities\", \"Removes all Linux capabilities\", \"Drops container\", \"Nothing\"]'),
(6327, 426, 'Which tool scans images for CVEs?', 3, 'Trivy', 0, 'Scanner', '2025-12-27 02:27:22', '[\"Nmap\", \"Trivy\", \"Docker\", \"Kubernetes\"]'),
(6328, 426, 'What does RBAC control?', 4, 'Who can access which resources', 0, 'Access', '2025-12-27 02:27:22', '[\"Network\", \"Who can access which resources\", \"Storage\", \"CPU\"]'),
(6329, 426, 'What does Falco monitor?', 5, 'System calls at runtime', 0, 'Runtime', '2025-12-27 02:27:22', '[\"Images\", \"System calls at runtime\", \"Network only\", \"Logs\"]'),
(6330, 426, 'Why use minimal base images?', 6, 'Fewer vulnerabilities, smaller attack surface', 0, 'Less CVEs', '2025-12-27 02:27:22', '[\"Faster\", \"Fewer vulnerabilities, smaller attack surface\", \"Prettier\", \"Cheaper\"]'),
(6331, 431, 'What is the Zero Trust motto?', 1, 'Never trust, always verify', 0, 'Motto', '2025-12-27 02:28:42', '[\"Trust everyone\", \"Never trust, always verify\", \"Trust but verify\", \"Always trust\"]'),
(6332, 431, 'What does \"Assume Breach\" mean?', 2, 'Design security as if attackers are already inside', 0, 'Mindset', '2025-12-27 02:28:42', '[\"Panic\", \"Design security as if attackers are already inside\", \"Give up\", \"Trust more\"]'),
(6333, 431, 'Which NIST document defines Zero Trust Architecture?', 3, 'SP 800-207', 0, 'Standard', '2025-12-27 02:28:42', '[\"SP 800-53\", \"SP 800-207\", \"SP 800-171\", \"SP 800-61\"]'),
(6334, 432, 'In Zero Trust, what replaces network location as the trust boundary?', 1, 'Identity', 0, 'Who', '2025-12-27 02:28:42', '[\"Firewall\", \"Identity\", \"IP address\", \"VPN\"]'),
(6335, 432, 'What is phishing-resistant MFA?', 2, 'FIDO2/WebAuthn hardware keys', 0, 'Strong', '2025-12-27 02:28:42', '[\"SMS codes\", \"FIDO2/WebAuthn hardware keys\", \"Email codes\", \"Security questions\"]'),
(6336, 432, 'Conditional Access decisions are based on:', 3, 'User, device, location, and application risk signals', 0, 'Signals', '2025-12-27 02:28:42', '[\"Random\", \"User, device, location, and application risk signals\", \"Time only\", \"IP only\"]'),
(6337, 433, 'What does microsegmentation prevent?', 1, 'Lateral movement after initial compromise', 0, 'Contain', '2025-12-27 02:28:42', '[\"Authentication\", \"Lateral movement after initial compromise\", \"Logging\", \"Faster network\"]'),
(6338, 433, 'What does ZTNA replace?', 2, 'Traditional VPN', 0, 'VPN', '2025-12-27 02:28:42', '[\"Firewall\", \"Traditional VPN\", \"SIEM\", \"EDR\"]'),
(6339, 433, 'Microsegmentation uses what type of traffic rules?', 3, 'Identity/context-based, not just IP', 0, 'Context', '2025-12-27 02:28:42', '[\"IP only\", \"Identity/context-based, not just IP\", \"Random\", \"None\"]'),
(6340, 434, 'What is continuous verification?', 1, 'Evaluating trust throughout the session, not just at login', 0, 'Ongoing', '2025-12-27 02:28:42', '[\"One-time check\", \"Evaluating trust throughout the session, not just at login\", \"Weekly audit\", \"Never check\"]'),
(6341, 434, 'What is a step-up authentication?', 2, 'Requiring additional verification when risk increases', 0, 'More MFA', '2025-12-27 02:28:42', '[\"Login\", \"Requiring additional verification when risk increases\", \"Password reset\", \"Logout\"]'),
(6342, 434, 'UEBA provides:', 3, 'User and entity behavior analytics', 0, 'Behavior', '2025-12-27 02:28:42', '[\"Firewall rules\", \"User and entity behavior analytics\", \"Encryption\", \"Backups\"]'),
(6343, 435, 'What is the first step in Zero Trust implementation?', 1, 'Identify users, devices, applications, and data', 0, 'Discovery', '2025-12-27 02:28:42', '[\"Deploy firewall\", \"Identify users, devices, applications, and data\", \"Buy tools\", \"Hire staff\"]'),
(6344, 435, 'What are \"Quick Wins\" for Zero Trust?', 2, 'MFA everywhere, conditional access, EDR', 0, 'Easy', '2025-12-27 02:28:42', '[\"Nothing\", \"MFA everywhere, conditional access, EDR\", \"Complete overhaul\", \"Do nothing\"]'),
(6345, 435, 'What should you protect first?', 3, 'Crown jewels (most critical assets)', 0, 'Priority', '2025-12-27 02:28:42', '[\"Everything equally\", \"Crown jewels (most critical assets)\", \"Nothing\", \"Random\"]'),
(6346, 436, 'Zero Trust motto is:', 1, 'Never trust, always verify', 0, 'Motto', '2025-12-27 02:28:42', '[\"Always trust\", \"Never trust, always verify\", \"Trust everyone\", \"Trust but verify\"]'),
(6347, 436, 'In Zero Trust, what is the new perimeter?', 2, 'Identity', 0, 'Boundary', '2025-12-27 02:28:42', '[\"Firewall\", \"Identity\", \"VPN\", \"Router\"]'),
(6348, 436, 'ZTNA replaces:', 3, 'Traditional VPN', 0, 'Access', '2025-12-27 02:28:42', '[\"SIEM\", \"Traditional VPN\", \"EDR\", \"Antivirus\"]'),
(6349, 436, 'Microsegmentation prevents:', 4, 'Lateral movement', 0, 'Contain', '2025-12-27 02:28:42', '[\"Authentication\", \"Lateral movement\", \"Logging\", \"Backup\"]'),
(6350, 436, 'Continuous verification means:', 5, 'Trust is evaluated throughout the session', 0, 'Ongoing', '2025-12-27 02:28:42', '[\"One check\", \"Trust is evaluated throughout the session\", \"Never check\", \"Weekly\"]'),
(6351, 436, 'First step in ZT implementation:', 6, 'Identify users, devices, apps, data', 0, 'Discovery', '2025-12-27 02:28:42', '[\"Buy tools\", \"Identify users, devices, apps, data\", \"Hire\", \"Nothing\"]'),
(6352, 441, 'What is the difference between a framework and compliance?', 1, 'Framework is guidance; compliance is mandatory requirements', 0, 'Difference', '2025-12-27 02:30:07', '[\"Same thing\", \"Framework is guidance; compliance is mandatory requirements\", \"Compliance is optional\", \"Framework is mandatory\"]'),
(6353, 441, 'Why do organizations adopt security frameworks?', 2, 'Common language, best practices, risk management', 0, 'Benefits', '2025-12-27 02:30:07', '[\"For fun\", \"Common language, best practices, risk management\", \"To slow things down\", \"No reason\"]'),
(6354, 441, 'What is an audit?', 3, 'Verification that requirements are met', 0, 'Check', '2025-12-27 02:30:07', '[\"Sales pitch\", \"Verification that requirements are met\", \"Training\", \"Party\"]'),
(6355, 442, 'How many core functions are in NIST CSF?', 1, '5 (Identify, Protect, Detect, Respond, Recover)', 0, 'Five', '2025-12-27 02:30:07', '[\"3\", \"5 (Identify, Protect, Detect, Respond, Recover)\", \"7\", \"10\"]'),
(6356, 442, 'What is a \"Profile\" in NIST CSF?', 2, 'Current or target state of cybersecurity posture', 0, 'State', '2025-12-27 02:30:07', '[\"A social media page\", \"Current or target state of cybersecurity posture\", \"A firewall rule\", \"A user account\"]'),
(6357, 442, 'Which tier represents continuous improvement?', 3, 'Tier 4 - Adaptive', 0, 'Best', '2025-12-27 02:30:07', '[\"Tier 1\", \"Tier 2\", \"Tier 3\", \"Tier 4 - Adaptive\"]'),
(6358, 443, 'What does ISMS stand for?', 1, 'Information Security Management System', 0, 'ISMS', '2025-12-27 02:30:07', '[\"Internal Security Monitoring System\", \"Information Security Management System\", \"Internet Security Module Standard\", \"None\"]'),
(6359, 443, 'How long is ISO 27001 certification valid?', 2, '3 years with annual surveillance audits', 0, 'Three', '2025-12-27 02:30:07', '[\"Forever\", \"3 years with annual surveillance audits\", \"1 year\", \"Monthly\"]'),
(6360, 443, 'What is the purpose of ISO 27002?', 3, 'Guidance on implementing ISO 27001 controls', 0, 'How-to', '2025-12-27 02:30:07', '[\"Certification\", \"Guidance on implementing ISO 27001 controls\", \"Auditing\", \"Pricing\"]'),
(6361, 444, 'Which SOC 2 criterion is always required?', 1, 'Security', 0, 'Core', '2025-12-27 02:30:07', '[\"Availability\", \"Privacy\", \"Security\", \"Integrity\"]'),
(6362, 444, 'What is the difference between SOC 2 Type I and Type II?', 2, 'Type I is point-in-time; Type II tests over a period', 0, 'Duration', '2025-12-27 02:30:07', '[\"Same thing\", \"Type I is point-in-time; Type II tests over a period\", \"Type II is faster\", \"Type I is better\"]'),
(6363, 444, 'Who performs SOC 2 audits?', 3, 'CPA firm (independent auditors)', 0, 'Auditor', '2025-12-27 02:30:07', '[\"Internal team\", \"CPA firm (independent auditors)\", \"Customers\", \"Anyone\"]'),
(6364, 445, 'How many requirements does PCI-DSS have?', 1, '12', 0, 'Twelve', '2025-12-27 02:30:07', '[\"5\", \"10\", \"12\", \"20\"]'),
(6365, 445, 'What does HIPAA protect?', 2, 'PHI (Protected Health Information)', 0, 'Health', '2025-12-27 02:30:07', '[\"Credit cards\", \"PHI (Protected Health Information)\", \"IP addresses\", \"Passwords\"]'),
(6366, 445, 'What is the HIPAA Breach Notification Rule?', 3, 'Report breaches within 60 days', 0, 'Notify', '2025-12-27 02:30:07', '[\"Delete data\", \"Report breaches within 60 days\", \"Hide breach\", \"Nothing\"]'),
(6367, 446, 'NIST CSF has how many core functions?', 1, '5', 0, 'Functions', '2025-12-27 02:30:07', '[\"3\", \"5\", \"7\", \"10\"]'),
(6368, 446, 'ISO 27001 certification lasts:', 2, '3 years', 0, 'Duration', '2025-12-27 02:30:07', '[\"Forever\", \"1 year\", \"3 years\", \"5 years\"]'),
(6369, 446, 'Which SOC 2 criterion is mandatory?', 3, 'Security', 0, 'Required', '2025-12-27 02:30:07', '[\"Privacy\", \"Availability\", \"Security\", \"Integrity\"]'),
(6370, 446, 'PCI-DSS has how many requirements?', 4, '12', 0, 'Count', '2025-12-27 02:30:07', '[\"5\", \"10\", \"12\", \"15\"]'),
(6371, 446, 'HIPAA protects:', 5, 'Protected Health Information (PHI)', 0, 'Health', '2025-12-27 02:30:07', '[\"Credit cards\", \"Protected Health Information (PHI)\", \"Passwords\", \"IP addresses\"]'),
(6372, 446, 'SOC 2 Type II tests controls over:', 6, 'A period of time (6-12 months)', 0, 'Duration', '2025-12-27 02:30:07', '[\"One day\", \"A period of time (6-12 months)\", \"One hour\", \"Never\"]'),
(6976, 765, 'What transforms \"Data\" into \"Intelligence\"?', 1, 'Analysis and Context', 0, 'Data needs processing and analysis to become useful.', '2025-12-29 13:30:44', '[\"Storage\", \"Encryption\", \"Analysis and Context\", \"Transmission\"]'),
(6977, 765, 'Which is an example of \"Intelligence\"?', 2, 'A report advising to block an IP due to active ransomware targeting your industry', 0, 'Intelligence is actionable and relevant.', '2025-12-29 13:30:44', '[\"A log file\", \"A list of IP addresses\", \"A report advising to block an IP due to active ransomware targeting your industry\", \"A spreadsheet of users\"]'),
(6978, 765, 'What is the primary goal of CTI?', 3, 'To support decision making', 0, 'CTI gives stakeholders the info they need to decide.', '2025-12-29 13:30:44', '[\"To hack back\", \"To support decision making\", \"To replace firewalls\", \"To find software bugs\"]'),
(6979, 766, 'Which phase involves setting the goals and requirements?', 1, 'Direction', 0, 'Also called Planning & Direction.', '2025-12-29 13:30:45', '[\"Collection\", \"Direction\", \"Analysis\", \"Feedback\"]'),
(6980, 766, 'Translating a document from Russian to English happens in which phase?', 2, 'Processing', 0, 'Processing converts raw data into a usable format.', '2025-12-29 13:30:45', '[\"Processing\", \"Analysis\", \"Collection\", \"Dissemination\"]'),
(6981, 766, 'Why is Feedback important?', 3, 'It improves future intelligence cycles', 0, 'Feedback ensures the intel met the needs of the consumer.', '2025-12-29 13:30:45', '[\"It saves money\", \"It improves future intelligence cycles\", \"It is required by law\", \"It deletes old data\"]'),
(6982, 767, 'Who is the primary audience for Strategic Intelligence?', 1, 'Executives / CISO', 0, 'High-level decision makers.', '2025-12-29 13:30:45', '[\"SOC Analyst\", \"Penetration Tester\", \"Executives / CISO\", \"Firewall Administrator\"]'),
(6983, 767, 'A list of malicious IP addresses is what type of intelligence?', 2, 'Tactical', 0, 'Tactical intel is used for immediate blocking/detection (IOCs).', '2025-12-29 13:30:45', '[\"Strategic\", \"Operational\", \"Tactical\", \"Technical\"]'),
(6984, 767, 'Information about an adversary\'s habits (TTPs) is...', 3, 'Operational', 0, 'Operational intel explains \"How\" the adversary operates.', '2025-12-29 13:30:45', '[\"Operational\", \"Strategic\", \"Tactical\", \"None\"]'),
(6985, 768, 'What is the \"Pyramid of Value\" order from bottom to top?', 1, 'Data > Information > Intelligence', 0, 'Raw Data -> Processed Info -> Actionable Intel.', '2025-12-29 13:30:45', '[\"Intelligence > Information > Data\", \"Data > Information > Intelligence\", \"Data > Intelligence > Information\", \"None\"]'),
(6986, 768, 'Which phase comes AFTER Collection?', 2, 'Processing', 0, 'After collecting raw data, you must process it.', '2025-12-29 13:30:45', '[\"Direction\", \"Analysis\", \"Processing\", \"Dissemination\"]'),
(6987, 768, 'Tactical Intelligence is best consumed by...', 3, 'Automated Systems / SOC Analysts', 0, 'Machines (SIEM) need lists of IPs/Hashes.', '2025-12-29 13:30:45', '[\"Board of Directors\", \"Automated Systems / SOC Analysts\", \"HR Department\", \"Legal Team\"]'),
(6988, 768, 'Strategic Intelligence focuses on...', 4, 'Long-term risk and trends', 0, 'Big picture for executives.', '2025-12-29 13:30:45', '[\"Long-term risk and trends\", \"Daily alerts\", \"Malware reverse engineering\", \"Network packets\"]'),
(6989, 768, 'What does \"TTP\" stand for?', 5, 'Tactics, Techniques, and Procedures', 0, 'TTPs describe adversary behavior.', '2025-12-29 13:30:45', '[\"Tactics, Techniques, and Procedures\", \"Time To Patch\", \"Threat Tech Protocol\", \"Total Threat Protection\"]'),
(6990, 768, 'In the Intelligence Cycle, what happens during \"Dissemination\"?', 6, 'Intelligence is delivered to consumers', 0, 'Sharing the finished product.', '2025-12-29 13:30:45', '[\"Data is encrypted\", \"Intelligence is delivered to consumers\", \"Data is collected\", \"Requirements are set\"]'),
(6991, 768, 'Why is \"Direction\" the first phase?', 7, 'To define requirements so we know what to look for', 0, 'You need a goal before you start collecting.', '2025-12-29 13:30:45', '[\"To save time\", \"To define requirements so we know what to look for\", \"It is the easiest\", \"Collection is actually first\"]'),
(6992, 768, 'Which is an example of \"Operational\" Intelligence?', 8, 'Report on APT28\'s phishing methods', 0, 'Focuses on Actor behaviors and campaigns.', '2025-12-29 13:30:45', '[\"Hash: abc12345\", \"Global cybercrime cost report\", \"Report on APT28\'s phishing methods\", \"A firewall log\"]'),
(6993, 768, 'What is \"Data\"?', 9, 'Raw, unprocessed facts', 0, 'The base of the pyramid.', '2025-12-29 13:30:45', '[\"Analyzed insight\", \"Raw, unprocessed facts\", \"Contextualized info\", \"A report\"]'),
(6994, 768, 'Feedback helps to...', 10, 'Close the loop and improve the next cycle', 0, 'Continuous improvement.', '2025-12-29 13:30:45', '[\"Close the loop and improve the next cycle\", \"Delete data\", \"Stop the cycle\", \"Archive logs\"]'),
(6995, 769, 'What defines OSINT?', 1, 'Data from publicly available sources', 0, 'Open Source = Public.', '2025-12-29 13:30:45', '[\"Hacking servers\", \"Data from publicly available sources\", \"Spying on private emails\", \"Inside knowledge\"]'),
(6996, 769, 'Which is an example of Passive Reconnaissance?', 2, 'Searching Google for the company name', 0, 'Passive means no direct contact with the target systems.', '2025-12-29 13:30:45', '[\"Port scanning the target\", \"Trying to login\", \"Searching Google for the company name\", \"Sending a phishing email\"]'),
(6997, 769, 'What is a \"Sock Puppet\"?', 3, 'A fake online identity used for research', 0, 'Used to protect your real identity during investigations.', '2025-12-29 13:30:45', '[\"A type of malware\", \"A fake online identity used for research\", \"A VPN provider\", \"A hacking tool\"]'),
(6998, 770, 'Which DNS record shows the IP address of a domain?', 1, 'A', 0, 'A record maps Name to IPv4.', '2025-12-29 13:30:45', '[\"MX\", \"A\", \"TXT\", \"NS\"]'),
(6999, 770, 'What is the best source for finding subdomains via SSL certificates?', 2, 'Certificate Transparency Logs (crt.sh)', 0, 'CT logs serve as a permanent record of all issued certificates.', '2025-12-29 13:30:45', '[\"WHOIS\", \"Certificate Transparency Logs (crt.sh)\", \"Ping\", \"Traceroute\"]'),
(7000, 770, 'Why check MX records?', 3, 'To see who handles their email (e.g., Google vs Microsoft)', 0, 'Mail Exchanger records point to the mail server.', '2025-12-29 13:30:45', '[\"To find the website IP\", \"To see who handles their email (e.g., Google vs Microsoft)\", \"To find employee passwords\", \"To see browsing history\"]'),
(7001, 771, 'What is the danger of interacting with threat actors on Telegram?', 1, 'It ruins OPSEC and can be illegal', 0, 'Passive observation is the rule.', '2025-12-29 13:30:45', '[\"You might make friends\", \"It ruins OPSEC and can be illegal\", \"They will ban you\", \"It costs money\"]'),
(7002, 771, 'What is \"Sherlock\" used for?', 2, 'Username enumeration across platforms', 0, 'Finds where else a username exists.', '2025-12-29 13:30:45', '[\"Password cracking\", \"Username enumeration across platforms\", \"WiFi hacking\", \"Decryption\"]'),
(7003, 771, 'Which platform is best for finding corporate hierarchy and tech stacks?', 3, 'LinkedIn', 0, 'The professional network.', '2025-12-29 13:30:45', '[\"TikTok\", \"LinkedIn\", \"Snapchat\", \"Pinterest\"]'),
(7004, 772, 'Which Google Dork finds PDF files?', 1, 'filetype:pdf', 0, 'Standard Google operator.', '2025-12-29 13:30:45', '[\"filetype:pdf\", \"ext:pdf\", \"search:pdf\", \"pdf:yes\"]'),
(7005, 772, 'What does Shodan crawl?', 2, 'Devices and Ports', 0, 'The search engine for the Internet of Things.', '2025-12-29 13:30:45', '[\"Web pages\", \"Devices and Ports\", \"Social Media\", \"Emails\"]'),
(7006, 772, 'Maltego is primarily used for...', 3, 'Visual Link Analysis', 0, 'Graph-based visualization.', '2025-12-29 13:30:45', '[\"Brute forcing\", \"Visual Link Analysis\", \"Coding\", \"Firewalling\"]'),
(7007, 773, 'What does OPSEC stand for?', 1, 'Operational Security', 0, 'Protecting your operations.', '2025-12-29 13:30:45', '[\"Open Security\", \"Operational Security\", \"Optional Security\", \"Operation Secrecy\"]'),
(7008, 773, 'Passive Reconnaissance involves...', 2, 'No direct contact with the target', 0, 'staying invisible.', '2025-12-29 13:30:45', '[\"Touching the target\", \"No direct contact with the target\", \"Hacking the target\", \"Asking the target questions\"]'),
(7009, 773, 'A \"Sock Puppet\" should...', 3, 'Have a realistic backstory and no link to you', 0, 'To blend in.', '2025-12-29 13:30:45', '[\"Be linked to your real identity\", \"Have a realistic backstory and no link to you\", \"Be an empty profile\", \"Use your work email\"]'),
(7010, 773, 'Which DNS record helps map Email infrastructure?', 4, 'MX', 0, 'Mail Exchanger.', '2025-12-29 13:30:45', '[\"A\", \"MX\", \"CNAME\", \"PTR\"]'),
(7011, 773, 'Which tool archives historical versions of websites?', 5, 'Wayback Machine', 0, 'Archive.org.', '2025-12-29 13:30:45', '[\"Shodan\", \"Wayback Machine\", \"Nmap\", \"Wireshark\"]'),
(7012, 773, 'What is \"Google Dorking\"?', 6, 'Using advanced search operators to find sensitive info', 0, 'Advanced search queries.', '2025-12-29 13:30:45', '[\"Hacking Google servers\", \"Using advanced search operators to find sensitive info\", \"Creating fake Google accounts\", \"Deleting Google results\"]'),
(7013, 773, 'Shodan is best for finding...', 7, 'Webcams, Servers, and IoT devices', 0, 'Internet connected hardware.', '2025-12-29 13:30:45', '[\"People\", \"Webcams, Servers, and IoT devices\", \"News articles\", \"Credit cards\"]'),
(7014, 773, 'Why search \"Certificate Transparency\" logs?', 8, 'To discover subdomains', 0, 'Certs reveal hostnames.', '2025-12-29 13:30:45', '[\"To find passwords\", \"To discover subdomains\", \"To update SSL\", \"To hide traffic\"]'),
(7015, 773, 'What information does WHOIS provide?', 9, 'Domain ownership and registration data', 0, 'Registrar info.', '2025-12-29 13:30:45', '[\"Domain ownership and registration data\", \"Website source code\", \"Database passwords\", \"User traffic\"]'),
(7016, 773, 'Which platform is most useful for corporate reconnaissance (employees, jobs)?', 10, 'LinkedIn', 0, 'Professional context.', '2025-12-29 13:30:45', '[\"Instagram\", \"LinkedIn\", \"Twitch\", \"Snapchat\"]'),
(7017, 774, 'What is Static Analysis?', 1, 'Analyzing the file without execution', 0, 'Looking at the code/properties at rest.', '2025-12-29 13:38:32', '[\"Running the malware\", \"Analyzing the file without execution\", \"Deleting the file\", \"Updating antivirus\"]'),
(7018, 774, 'Which tool captures network traffic during Dynamic Analysis?', 2, 'Wireshark', 0, 'Packet analyzer.', '2025-12-29 13:38:32', '[\"Wireshark\", \"Notepad\", \"Calculator\", \"Zip\"]'),
(7019, 774, 'Why use a Sandbox?', 3, 'To isolate the malware so it doesn\'t infect the host', 0, 'Safety first.', '2025-12-29 13:38:32', '[\"To play with sand\", \"To isolate the malware so it doesn\'t infect the host\", \"To make the computer faster\", \"To encrypt the virus\"]'),
(7020, 775, 'Does changing one byte in a file change its Hash?', 1, 'Yes, completely', 0, 'Avalanche effect.', '2025-12-29 13:38:32', '[\"Yes, completely\", \"No\", \"Only if it is a large file\", \"Maybe\"]'),
(7021, 775, 'What is a \"PDB Path\"?', 2, 'A debug path left by the compiler showing the attacker\'s folder structure', 0, 'Program Database path.', '2025-12-29 13:38:32', '[\"A database path\", \"A debug path left by the compiler showing the attacker\'s folder structure\", \"A public domain\", \"A protocol\"]'),
(7022, 775, 'If you see very few strings in a binary, it is likely...', 3, 'Packed or Obfuscated', 0, 'Packing hides text.', '2025-12-29 13:38:32', '[\"Clean\", \"Packed or Obfuscated\", \"Empty\", \"A text file\"]'),
(7023, 776, 'What is the safest way to analyze a suspicious file initially?', 1, 'Static Analysis', 0, 'No execution = Minimum risk.', '2025-12-29 13:38:32', '[\"Double click it\", \"Static Analysis\", \"Dynamic Analysis on your host\", \"Email it to a friend\"]'),
(7024, 776, 'Which hash algorithm is currently the industry standard for IOCs?', 2, 'SHA256', 0, 'Secure Hash Algorithm 256-bit.', '2025-12-29 13:38:32', '[\"MD5\", \"SHA256\", \"CRC32\", \"ROT13\"]'),
(7025, 776, 'What is a \"Sandbox\"?', 3, 'An isolated environment for safely running malware', 0, 'Isolation is key.', '2025-12-29 13:38:32', '[\"A playground\", \"An isolated environment for safely running malware\", \"A hacking tool\", \"A firewall\"]'),
(7026, 776, 'Dynamic Analysis observes...', 4, 'File behavior at runtime (Registry, Network, File system)', 0, 'Behavioral analysis.', '2025-12-29 13:38:32', '[\"Code structure\", \"File behavior at runtime (Registry, Network, File system)\", \"File size only\", \"Author name\"]'),
(7027, 776, 'If a file is \"Packed\", what must happen before it runs?', 5, 'It must unpack itself in memory', 0, 'Decompression/Decryption.', '2025-12-29 13:38:32', '[\"It must be deleted\", \"It must unpack itself in memory\", \"It must be compiled\", \"It must hold still\"]'),
(7028, 776, 'Which tool extracts readable text from a binary?', 6, 'strings', 0, 'The strings command.', '2025-12-29 13:38:32', '[\"strings\", \"grep\", \"cat\", \"ls\"]'),
(7029, 776, 'What does C2 stand for?', 7, 'Command & Control', 0, 'The server managing the botnet.', '2025-12-29 13:38:32', '[\"Command & Control\", \"Cool & Calm\", \"Computer 2\", \"Cyber Command\"]'),
(7030, 776, 'Why check a file hash on VirusTotal?', 8, 'To see if other vendors have already detected it', 0, 'Community intelligence.', '2025-12-29 13:38:32', '[\"To download the virus\", \"To see if other vendors have already detected it\", \"To delete the internet\", \"To hack Google\"]'),
(7031, 776, 'Pestudio is primarily used for...', 9, 'Static Analysis', 0, 'Analyzing PE headers/strings.', '2025-12-29 13:38:32', '[\"Dynamic Analysis\", \"Static Analysis\", \"Writing Reports\", \"Chatting\"]'),
(7032, 776, 'Ransomware typically does what?', 10, 'Encrypts files and demands payment', 0, 'Encryption for extortion.', '2025-12-29 13:38:32', '[\"Encrypts files and demands payment\", \"Steals passwords\", \"Mines crypto\", \"Shows ads\"]'),
(7033, 777, 'Which is an example of an IOC?', 1, 'A known malicious file hash', 0, 'Static evidence.', '2025-12-29 13:38:32', '[\"High CPU usage\", \"A known malicious file hash\", \"Slow network\", \"A user logging in\"]'),
(7034, 777, 'Which indicator focuses on \"Behavior\" and \"Intent\"?', 2, 'IOA', 0, 'Indicator of Attack.', '2025-12-29 13:38:32', '[\"IOC\", \"IOA\", \"URL\", \"IP\"]'),
(7035, 777, 'Which is harder for an attacker to change?', 3, 'Their Behavior/Tactics (IOA)', 0, 'Changing TTPs requires retraining.', '2025-12-29 13:38:32', '[\"Their IP address\", \"Their File Hash\", \"Their Behavior/Tactics (IOA)\", \"Their Domain\"]'),
(7036, 778, 'Can you verify TLP:RED intel with a third party?', 1, 'No - never', 0, 'Verified only with source.', '2025-12-29 13:38:32', '[\"Yes\", \"No - never\", \"Only if you trust them\", \"Maybe\"]'),
(7037, 778, 'Which TLP level allows sharing with the general public?', 2, 'CLEAR', 0, 'White/Clear = Public.', '2025-12-29 13:38:32', '[\"CLEAR\", \"GREEN\", \"AMBER\", \"RED\"]'),
(7038, 778, 'TLP:AMBER allows sharing with...', 3, 'Your organization and clients on need-to-know basis', 0, 'Restricted distribution.', '2025-12-29 13:38:32', '[\"The internet\", \"Your organization and clients on need-to-know basis\", \"Only 1 person\", \"Anyone\"]'),
(7039, 779, 'What does STIX stand for?', 1, 'Structured Threat Information Expression', 0, 'Standard language for CTI.', '2025-12-29 13:38:32', '[\"Structured Threat Information Expression\", \"Standard Text Info X\", \"Secure Threat Intel Xchange\", \"Simple Text Index\"]'),
(7040, 779, 'What is TAXII?', 2, 'The transport mechanism for STIX', 0, 'Trusted Automated Exchange of Intelligence Information.', '2025-12-29 13:38:32', '[\"The transport mechanism for STIX\", \"A cab service\", \"A file format\", \"A virus\"]');
INSERT INTO `lesson_questions` (`id`, `task_id`, `question_text`, `question_order`, `correct_answer`, `case_sensitive`, `hint`, `created_at`, `options`) VALUES
(7041, 779, 'Which is an IOC?', 3, '192.168.1.1 (C2 IP)', 0, 'Artifact.', '2025-12-29 13:38:32', '[\"192.168.1.1 (C2 IP)\", \"Port Scanning Activity\", \"Pass the Hash Attack\", \"Phishing Methodology\"]'),
(7042, 779, 'Which is an IOA?', 4, 'Cred Dumping from LSASS', 0, 'Behavior.', '2025-12-29 13:38:32', '[\"File Hash\", \"Cred Dumping from LSASS\", \"Domain Name\", \"Email Subject\"]'),
(7043, 779, 'TLP:RED means...', 5, 'Not for disclosure, restricted to specific recipients', 0, 'Most restrictive.', '2025-12-29 13:38:32', '[\"Share with everyone\", \"Share with community\", \"Not for disclosure, restricted to specific recipients\", \"Share with Org\"]'),
(7044, 779, 'If you receive TLP:GREEN info, can you post it on Twitter?', 6, 'No', 0, 'Twitter = Public (CLEAR). Green is Community.', '2025-12-29 13:38:32', '[\"Yes\", \"No\", \"Only if anonymous\", \"If its cool\"]'),
(7045, 779, 'Why use Standards like STIX?', 7, 'To allow automated machine-to-machine sharing', 0, 'Interoperability.', '2025-12-29 13:38:32', '[\"To make things complicated\", \"To allow automated machine-to-machine sharing\", \"To encrypt data\", \"To hide info\"]'),
(7046, 779, 'David Bianco\'s Pyramid of Pain places what at the top (Hardest for attacker)?', 8, 'TTPs (Tactics, Techniques, Procedures)', 0, 'Behavior is hardest to change.', '2025-12-29 13:38:32', '[\"Hash Values\", \"IP Addresses\", \"TTPs (Tactics, Techniques, Procedures)\", \"Domain Names\"]'),
(7047, 779, 'Who manages the TLP standard?', 9, 'FIRST.org', 0, 'Forum of Incident Response and Security Teams.', '2025-12-29 13:38:32', '[\"FIRST.org\", \"Google\", \"Microsoft\", \"Nobody\"]'),
(7048, 779, 'An IP Address in the Pyramid of Pain is...', 10, 'Easy to change (Low Pain)', 0, 'Attacker just rents a new VPS.', '2025-12-29 13:38:32', '[\"Easy to change (Low Pain)\", \"Impossible to change\", \"Tough\", \"Annoying\"]'),
(7049, 780, 'In MITRE ATT&CK, \"Initial Access\" is a...', 1, 'Tactic (Goal)', 0, 'The \'Why\'.', '2025-12-29 13:38:32', '[\"Tactic (Goal)\", \"Technique (Method)\", \"Procedure\", \"Tool\"]'),
(7050, 780, 'In MITRE ATT&CK, \"Spearphishing Attachment\" is a...', 2, 'Technique', 0, 'The \'How\'.', '2025-12-29 13:38:32', '[\"Tactic\", \"Technique\", \"Procedure\", \"Matrix\"]'),
(7051, 780, 'What does the matrix help defenders do?', 3, 'Map defenses against real-world threats', 0, 'Gap analysis.', '2025-12-29 13:38:32', '[\"Map defenses against real-world threats\", \"Install virus\", \"Hack back\", \"Guess passwords\"]'),
(7052, 781, 'What is the Navigator used for?', 1, 'Visualizing/Heatmapping the matrix', 0, 'Annotating layers.', '2025-12-29 13:38:32', '[\"Visualizing/Heatmapping the matrix\", \"Browsing the web\", \"GPS\", \"Chatting\"]'),
(7053, 781, 'If you color techniques used by Ransomware red, you are doing...', 2, 'Threat Modeling / Emulation Planning', 0, 'Visualizing the adversary.', '2025-12-29 13:38:32', '[\"Threat Modeling / Emulation Planning\", \"Defensive Coverage\", \"Coding\", \"Patching\"]'),
(7054, 781, 'Where can you access Navigator?', 3, 'Github / MITRE Website', 0, 'It is an open web app.', '2025-12-29 13:38:32', '[\"Github / MITRE Website\", \"Dark Web\", \"Only offline\", \"App Store\"]'),
(7055, 782, 'What is a \"Tactic\" in ATT&CK?', 1, 'The adversary\'s technical goal (The Why)', 0, 'High level objective.', '2025-12-29 13:38:32', '[\"The adversary\'s technical goal (The Why)\", \"The specific command\", \"The tool used\", \"The IP address\"]'),
(7056, 782, 'What is a \"Technique\"?', 2, 'How the goal is achieved', 0, 'The method.', '2025-12-29 13:38:32', '[\"How the goal is achieved\", \"The goal itself\", \"The date of attack\", \"The victim\"]'),
(7057, 782, '\"Persistence\" is an example of...', 3, 'Tactic', 0, 'Staying in the system.', '2025-12-29 13:38:32', '[\"Tactic\", \"Technique\", \"Software\", \"Actor\"]'),
(7058, 782, '\"Registry Run Keys\" is an example of...', 4, 'Technique', 0, 'A way to achieve Persistence.', '2025-12-29 13:38:32', '[\"Technique\", \"Tactic\", \"Procedure\", \"MITRE\"]'),
(7059, 782, 'What is \"Sub-Technique\"?', 5, 'A more specific implementation of a technique', 0, 'e.g., T1059.001 (PowerShell) under Command Scripting.', '2025-12-29 13:38:32', '[\"A more specific implementation of a technique\", \"A smaller tactic\", \"A tool\", \"A user\"]'),
(7060, 782, 'Why is Mapping to MITRE important?', 6, 'It provides a common language for defenders and red teams', 0, 'Standardization.', '2025-12-29 13:38:32', '[\"It provides a common language for defenders and red teams\", \"It is fun\", \"It is required for windows updates\", \"It prevents all hacks\"]'),
(7061, 782, 'Who maintains ATT&CK?', 7, 'MITRE Corp', 0, 'Federally Funded R&D Center.', '2025-12-29 13:38:32', '[\"MITRE Corp\", \"Microsoft\", \"Google\", \"FBI\"]'),
(7062, 782, 'What does the \"Enterprise\" matrix cover?', 8, 'Windows, Linux, macOS, Cloud networks', 0, 'Standard IT networks.', '2025-12-29 13:38:32', '[\"Windows, Linux, macOS, Cloud networks\", \"Mobile phones only\", \"Satellites\", \"Cars\"]'),
(7063, 782, 'Can Navigator export layers?', 9, 'Yes, as JSON or SVG', 0, 'For sharing.', '2025-12-29 13:38:32', '[\"Yes, as JSON or SVG\", \"No\", \"Only PDF\", \"Only PNG\"]'),
(7064, 782, 'ATT&CK is based on...', 10, 'Real-world observations', 0, 'Evidence based.', '2025-12-29 13:38:32', '[\"Real-world observations\", \"Theoretical hacks\", \"Sci-fi movies\", \"Random guesses\"]'),
(7065, 783, 'What is the primary difference between SOC and Threat Hunting?', 1, 'SOC is Reactive, Hunting is Proactive', 0, 'Alerts vs Search.', '2025-12-29 13:38:32', '[\"SOC is Reactive, Hunting is Proactive\", \"SOC works at night\", \"Hunting uses guns\", \"No difference\"]'),
(7066, 783, 'What does \"Assume Breach\" mean?', 2, 'Assume the network is compromised and look for evidence', 0, 'Proactive stance.', '2025-12-29 13:38:32', '[\"Assume the network is compromised and look for evidence\", \"Breach the network yourself\", \"Assume security is perfect\", \"Give up\"]'),
(7067, 783, 'What metric does Hunting aim to reduce?', 3, 'Dwell Time', 0, 'Time undetected.', '2025-12-29 13:38:32', '[\"Dwell Time\", \"Cost\", \"False Positives\", \"Ping\"]'),
(7068, 784, 'In \"Stacking\", where is the malicious activity usually found?', 1, 'The Long Tail (Least Frequent)', 0, 'Malware is the anomaly.', '2025-12-29 13:38:32', '[\"The Long Tail (Least Frequent)\", \"The Short Stack (Most Frequent)\", \"The Middle\", \"Everywhere\"]'),
(7069, 784, 'What is \"Stacking\" also known as?', 2, 'Frequency Analysis', 0, 'Counting stats.', '2025-12-29 13:38:32', '[\"Frequency Analysis\", \"Stack Overflow\", \"Heap Spray\", \"Sorting\"]'),
(7070, 784, 'Clustering helps to...', 3, 'Identify outliers by grouping similar items', 0, 'Finding the odd one out.', '2025-12-29 13:38:32', '[\"Identify outliers by grouping similar items\", \"Encrypt data\", \"Delete logs\", \"Generate alerts\"]'),
(7071, 785, 'Defining a Hypothesis is the first step of...', 1, 'A Structured Hunt', 0, 'Hypothesis-Driven Hunting.', '2025-12-29 13:38:32', '[\"A Structured Hunt\", \"Incident Response\", \"Malware Analysis\", \"Patching\"]'),
(7072, 785, 'Which is a valid Hypothesis?', 2, 'APT29 uses PowerShell for lateral movement', 0, 'Specific and testable proposition.', '2025-12-29 13:38:32', '[\"APT29 uses PowerShell for lateral movement\", \"I will find bad stuff\", \"PowerShell is bad\", \"Updates are essential\"]'),
(7073, 785, 'If you stack \"User Agents\", which one is fast investigation?', 3, 'Python-urllib/2.7 (Count: 1)', 0, 'Low count + suspicious string = Priority.', '2025-12-29 13:38:32', '[\"Mozilla/5.0 (Windows NT 10.0)... (Count: 5000)\", \"Python-urllib/2.7 (Count: 1)\", \"Chrome/90 (Count: 4000)\", \"Edge/89 (Count: 2000)\"]'),
(7074, 785, 'What separates Hunting from Incident Response?', 4, 'Hunting looks for unknown threats; IR handles known incidents', 0, 'Discovery vs Reaction.', '2025-12-29 13:38:32', '[\"Hunting looks for unknown threats; IR handles known incidents\", \"Hunting is faster\", \"IR is cheaper\", \"Hunting is automated\"]'),
(7075, 785, 'The \"Baseline\" is...', 5, 'Known Good behavior', 0, 'You need to know what is Normal to find what is Abnormal.', '2025-12-29 13:38:32', '[\"Known Good behavior\", \"Known Bad behavior\", \"A firewall rule\", \"A password\"]'),
(7076, 785, 'What is a \"Pivot\"?', 6, 'Moving from one data point to another related one', 0, 'e.g., Domain -> IP -> Other Domains.', '2025-12-29 13:38:32', '[\"Moving from one data point to another related one\", \"Turning around\", \"Deleting a row\", \"Closing a ticket\"]'),
(7077, 785, 'Checking for \"Beaconing\" traffic is analyzing...', 7, 'Regular interval communications (Heartbeats)', 0, 'C2 callbacks.', '2025-12-29 13:38:32', '[\"Regular interval communications (Heartbeats)\", \"Large file downloads\", \"SQL Injection\", \"Password failures\"]'),
(7078, 785, 'Least Frequency Analysis is effective for finding...', 8, 'Rare events', 0, 'Outliers.', '2025-12-29 13:38:32', '[\"Rare events\", \"Common events\", \"System files\", \"Updates\"]'),
(7079, 785, 'A \"Hunt\" should always result in...', 9, 'Ideally a detection rule or improved visibility', 0, 'Improving the security posture regardless of finding a breach.', '2025-12-29 13:38:32', '[\"Ideally a detection rule or improved visibility\", \"A verified breach\", \"Firing someone\", \"Installing an antivirus\"]'),
(7080, 785, 'Assume Breach implies...', 10, 'Defenses can fail', 0, 'Accepting risk.', '2025-12-29 13:38:32', '[\"Defenses can fail\", \"Defenses act perfectly\", \"Hackers are lazy\", \"Firewalls stop everything\"]'),
(7081, 786, 'What involves confirming multiple feeds reporting the same indicator?', 1, 'Deduplication/Correlation', 0, 'Merging duplicates.', '2025-12-29 13:38:32', '[\"Deduplication/Correlation\", \"Encryption\", \"Deletion\", \"Scanning\"]'),
(7082, 786, 'Why \"Enrich\" an indicator?', 2, 'To add context (e.g., GeoIP, ASM Info, Rep Score)', 0, 'Context aids decision making.', '2025-12-29 13:38:32', '[\"To add context (e.g., GeoIP, ASM Info, Rep Score)\", \"To make it expensive\", \"To encrypt it\", \"To hide it\"]'),
(7083, 786, 'Pushing IOCs to a SIEM is part of...', 3, 'Integration / Dissemination', 0, 'Actioning the intel.', '2025-12-29 13:38:32', '[\"Integration / Dissemination\", \"Collection\", \"Planning\", \"Analysis\"]'),
(7084, 787, 'In MISP, what represents a \"Threat Actor\" or \"Mitre Technique\"?', 1, 'Galaxy / Tag', 0, 'Contextual metadata.', '2025-12-29 13:38:32', '[\"Galaxy / Tag\", \"Attribute\", \"Event\", \"User\"]'),
(7085, 787, 'The top-level container in MISP is an...', 2, 'Event', 0, 'Events contain attributes.', '2025-12-29 13:38:32', '[\"Event\", \"Attribute\", \"Object\", \"Server\"]'),
(7086, 787, 'MISP allows you to...', 3, 'Share and Sync intelligence with other organizations', 0, 'Community sharing.', '2025-12-29 13:38:32', '[\"Share and Sync intelligence with other organizations\", \"Scan viruses\", \"Hack websites\", \"Manage passwords\"]'),
(7087, 788, 'Which is a popular Graph-based TIP?', 1, 'OpenCTI', 0, 'Knowledge Graph platform.', '2025-12-29 13:38:32', '[\"OpenCTI\", \"Notepad++\", \"Calculator\", \"Outlook\"]'),
(7088, 788, 'What is the benefit of a Knowledge Graph (OpenCTI)?', 2, 'Visualizing complex relationships between entities', 0, 'Graph theory.', '2025-12-29 13:38:32', '[\"Visualizing complex relationships between entities\", \"Saving disk space\", \"Faster typing\", \"Cheaper hosting\"]'),
(7089, 788, 'Why \"Normalize\" data in a TIP?', 3, 'To store diverse feeds in a consistent format', 0, 'Standardization.', '2025-12-29 13:38:32', '[\"To store diverse feeds in a consistent format\", \"To delete it\", \"To encrypt it\", \"To hide source\"]'),
(7090, 788, 'If you have zero budget, which TIP is best?', 4, 'MISP (Open Source)', 0, 'Free and open source.', '2025-12-29 13:38:32', '[\"MISP (Open Source)\", \"Splunk Enterprise\", \"Recorded Future\", \"CrowdStrike\"]'),
(7091, 788, 'What is an \"IoC Decay\" or \"Expiration\"?', 5, 'Retiring an indicator when it is no longer malicious', 0, 'Lifecycle management.', '2025-12-29 13:38:32', '[\"Retiring an indicator when it is no longer malicious\", \"Deleting files\", \"Password expiry\", \"Server crash\"]'),
(7092, 788, 'Enrichment Connectors typically query...', 6, 'External APIs (VirusTotal, AlienVault)', 0, 'Third party data.', '2025-12-29 13:38:32', '[\"External APIs (VirusTotal, AlienVault)\", \"Local files\", \"Printers\", \"Keyboards\"]'),
(7093, 788, 'Sharing an Event in MISP creates a...', 7, 'Distributed warning to the community', 0, 'Collective defense.', '2025-12-29 13:38:32', '[\"Distributed warning to the community\", \"Security breach\", \"Firewall rule\", \"False positive\"]'),
(7094, 788, 'Can a TIP automate firewall blocking?', 8, 'Yes, via integration/orchestration', 0, 'SOAR capabilities.', '2025-12-29 13:38:32', '[\"Yes, via integration/orchestration\", \"No, never\", \"Only if manual\", \"Only on Tuesdays\"]'),
(7095, 788, 'Attributes in MISP can be marked as...', 9, 'to_ids (Actionable for IDS)', 0, 'Flag indicating if it should be exported to security controls.', '2025-12-29 13:38:32', '[\"to_ids (Actionable for IDS)\", \"Private\", \"Deleted\", \"Fun\"]'),
(7096, 788, 'STIX 2.0 uses what format?', 10, 'JSON', 0, 'Modern standard.', '2025-12-29 13:38:32', '[\"JSON\", \"XML\", \"CSV\", \"Binary\"]'),
(7097, 789, 'What is BLUF?', 1, 'Bottom Line Up Front', 0, 'Conclusion first.', '2025-12-29 13:38:32', '[\"Bottom Line Up Front\", \"Blue Light\", \"Bottom Left\", \"Big Line\"]'),
(7098, 789, 'Who is the audience for a \"Strategic\" report?', 2, 'Executives', 0, 'Decision makers.', '2025-12-29 13:38:32', '[\"Executives\", \"SOC Analysts\", \"Engineers\", \"Hackers\"]'),
(7099, 789, 'Why use \"Estimative Language\"?', 3, 'To standardize uncertainty and confidence', 0, 'Clarity of probability.', '2025-12-29 13:38:32', '[\"To standardize uncertainty and confidence\", \"To sound smart\", \"To confuse people\", \"To avoid liability\"]'),
(7100, 790, 'Which statement uses proper Estimative Language?', 1, 'It is LIKELY that APT29 is responsible', 0, 'Standard term.', '2025-12-29 13:38:32', '[\"It is LIKELY that APT29 is responsible\", \"Maybe it is APT29\", \"I believe it is APT29\", \"It is 100% APT29\"]'),
(7101, 790, 'Strategic Reports should focus on...', 2, 'Business Risk and Impact', 0, 'Executive view.', '2025-12-29 13:38:32', '[\"Business Risk and Impact\", \"IP Addresses\", \"Malware code\", \"Logs\"]'),
(7102, 790, 'Tactical Reports should focus on...', 3, 'Actionable IOCs and Rules', 0, 'Defender view.', '2025-12-29 13:38:32', '[\"Actionable IOCs and Rules\", \"Financial loss\", \"Geopolitics\", \"Trends\"]'),
(7103, 790, 'What is \"Words of Estimative Probability\" (WEP)?', 4, 'Standard terms to convey likelihood', 0, 'Intelligence standard.', '2025-12-29 13:38:32', '[\"Standard terms to convey likelihood\", \"A spell check tool\", \"A thesaurus\", \"A translation\"]'),
(7104, 790, 'A report with 50 pages of technical details should usually include...', 5, 'An Executive Summary (BLUF)', 0, 'For the busy reader.', '2025-12-29 13:38:32', '[\"An Executive Summary (BLUF)\", \"A poem\", \"No summary\", \"Pictures of cats\"]'),
(7105, 790, 'Dissemination via API is best for...', 6, 'Speed and Automation', 0, 'Machine consumption.', '2025-12-29 13:38:32', '[\"Speed and Automation\", \"Executives\", \"Legal Reviews\", \"Press Releases\"]'),
(7106, 790, 'Feedback in the intel cycle ensures...', 7, 'Relevance and Improvement', 0, 'Quality control.', '2025-12-29 13:38:32', '[\"Relevance and Improvement\", \"Payment\", \"Deletion\", \"Encryption\"]'),
(7107, 790, 'If you have Low Confidence, you should...', 8, 'State it clearly', 0, 'Honesty in analysis.', '2025-12-29 13:38:32', '[\"State it clearly\", \"Lie\", \"Say High Confidence\", \"Say nothing\"]'),
(7108, 790, 'Intelligence Requirements (IRs) drive the...', 9, 'Entire Intelligence Cycle', 0, 'The starting point.', '2025-12-29 13:38:32', '[\"Entire Intelligence Cycle\", \"Lunch menu\", \"Server updates\", \"HR policy\"]'),
(7109, 790, 'Which is NOT a goal of reporting?', 10, 'To confuse the reader', 0, 'Clarity is King.', '2025-12-29 13:38:32', '[\"To confuse the reader\", \"To inform decisions\", \"To warn of threats\", \"To document findings\"]');

-- --------------------------------------------------------

--
