Cisco 300-220 CBRTHD case studies

Cisco 300-220 CBRTHD · Put your knowledge to work in context.

The Cisco Certified CyberOps Associate credential is aimed at people who want to work in a security operations centre: Tier 1 analysts, SOC triage staff, and network or help-desk engineers moving into defensive security. It tests whether you can recognise an incident, read the evidence in front of you, and follow procedure rather than whether you can configure a specific appliance. The Cisco 300-220 CBRTHD case studies are 5 cases and about 3,085 words.

Ransomware at 02:10: Containment Scope and the Payment Question

At 02:10 on a Saturday, the SOC of a 340-bed hospital receives EDR alerts from 14 nursing-station workstations in the east wing: a process named svc upd.exe running out of C: \ encrypts documents and drops readme.txt in every folder. Six minutes later the file server hosting the imaging archive reports 3,200 modified files.

636 words, about 3 min 2

Sixty Brute-Force Alerts a Day: Tuning SEC-114 Without Creating a Blind Spot

The SIEM ingests roughly 4.2 billion events per month and the detection engineering team owns 380 rules. Rule SEC-114, "Brute Force - Multiple Failed Logons," fires about 60 times per day.

591 words, about 3 min 3

Word Spawns PowerShell: Deciding Whether a Workstation Incident Is Contained

A Tier-1 analyst escalates a Windows 10 engineering workstation, 10.60.22.145, after EDR flags "suspicious process injection." The timeline: at 09:41 the user opened invoice Q3.docm from an external email; WINWORD.EXE spawned powershell.exe with -nop -w hidden -enc followed by a long base64 blob; at 09:42 PowerShell wrote C: .exe and registered a scheduled task named MicrosoftEdgeUpdateTaskMachineUA2 firing every 15 minutes; at 09:43 that binary opened a handle to lsass.exe with access mask 0x1010. EDR blocked the LSASS read but allowed everything else.

596 words, about 3 min 4

High-Entropy TXT Queries from a Build Server Bypassing the Resolver

During a routine PCAP review of the DMZ capture for Tuesday 02:00-03:00, an analyst sees 4,800 DNS queries from 203.0.113.45 to a single authoritative name server, ns1.syncmetrics-cdn[.]net. .syncmetrics-cdn[.]net, with query type TXT.

624 words, about 3 min 5

Contractor Laptop on the Building-Management VLAN: Policy, Privacy, and Evidence

A contractor from an HVAC vendor plugs a personal Windows 11 laptop into a wall port in a mechanical room to run diagnostic software. The port sits on the building-management VLAN and has no NAC and no 802.1X.

638 words, about 3 min