C|CT case studies
C|CT · Put your knowledge to work in context.
The Certified Cybersecurity Technician (C CT) is an entry-level EC-Council certification positioned on the vendor's roadmap as a "Technician" credential at the entry level, alongside a note that "You can also pursue the CCT course without prior IT experience." EC-Council describes it as helping learners "develop practical skills across multiple cybersecurity domains and kick-start your professional journey," and places it above the no-experience Essentials Series (N DE, E HE, D FE and others) and below core certifications such as C ND and C EH. It suits career changers, students, help-desk and junior IT staff, and anyone building a blue-team foundation before specialising. The C|CT case studies are 5 cases and about 3,449 words.
1Infusion Pump Segmentation Under a Two-Hour Window
Northbridge Regional Hospital runs a 3,200-endpoint network on a single 10.0.0.0/16 VLAN. Its 180 infusion pumps share that VLAN with nursing workstations, VoIP handsets, and badge readers.
689 words, about 3 min2Red Team Token Reaches Beyond the Scope Boundary
During a 12-week authorized red team for a SaaS provider, your team finds Jenkins at staging.example.com without authentication. Job configurations contain a HashiCorp Vault token labeled prod-db-read.
732 words, about 4 min3Ransomware on a Live File Server With Legal Hold
At 07:40, a 40 TB Windows file server at a 2,000-employee logistics firm begins renaming files to .locked and dropping README RESTORE.txt. The server is still powered on; EDR shows a signed but malicious process injected into lsass and an outbound SMB connection to 10.10.8.22.
693 words, about 3 min4MFA Push Bombing Leads to a Successful Lagos Sign-In
At 03:12, the SOC receives 47 Microsoft Entra ID MFA push notifications for 12 users in four minutes. Eleven users deny; one user in Chicago approves a push and then calls the helpdesk saying they did not initiate it.
671 words, about 3 min5Black Friday DDoS With a Ransom Demand
An online retailer's primary site is hit at 13:05 on Black Friday. Inbound traffic jumps from 6 Gbps to 48 Gbps; 70% is SYN flood from 18,000 source IPs, and 8 Gbps is HTTP POST flood hitting /cart/checkout with valid-looking cookies.
664 words, about 3 min