CSA (EC-Council Certifications) case studies
CSA · Put your knowledge to work in context.
The Certified SOC Analyst (CSA) credential is aimed at people who work - or want to work - on a security operations centre's front line: tier-one and tier-two analysts, and the network or systems administrators who increasingly absorb monitoring duties. It tests whether you can recognise an attack in progress and respond to it in a disciplined way, rather than whether you can configure a specific vendor product. The CSA case studies are 5 cases and about 2,550 words.
1Ransomware Precursor on a Segment With No Egress
At 02:14 a SIEM rule fires 47 times in six minutes: WinEvent 4688 on host FIN-WS-22 shows cmd.exe /c vssadmin delete shadows /all /quiet , each spawned by powershell.exe -enc <base64 . The parent process is outlook.exe .
564 words, about 3 min2SIEM Rule Tuning Against a Noisy Detection
A SIEM detection for "impossible travel" fires 300 times a day across 4,000 users. The rule compares consecutive successful logins by geolocation and flags any pair under 60 minutes apart in different countries.
532 words, about 3 min3Log Retention Gap After a Breach Discovery
During an investigation, the team learns a web server was compromised 47 days ago. Its OS audit logs are retained for 30 days locally, then shipped to a SIEM where the index retention is 90 days.
511 words, about 3 min4Blocking a Malicious IP That Is Also a Shared CDN
Threat intel flags IP 203.0.113.44 as command-and-control for a malware family seen in the environment. The SOC proposes a perimeter block.
458 words, about 2 min5Reporting a Confirmed Breach to Regulators and Customers
On a Friday afternoon the team confirms that a database containing 12,000 customer records (names, emails, hashed passwords) was accessed by an external actor. The intrusion began 9 days ago; the team has contained it.
485 words, about 2 min