eCDFP case studies
eCDFP · Put your knowledge to work in context.
The eCDFP (Certified Defense Fundamentals Professional) is a defensive-security certification listed by INE among its cybersecurity certifications. It sits alongside INE's offensive and specialist credentials, and the certification family it belongs to emphasizes hands-on, scenario-based practice rather than pure multiple-choice recall: INE describes its model as "learn by doing" with immersive labs built to resemble real working conditions. The eCDFP case studies are 5 cases and about 3,394 words.
1Funding the First Control in a Flat Logistics Network
You are the security lead for a 400-employee third-party logistics company that has never had a dedicated security team. The network is a flat /16: 180 servers, 1,100 endpoints, and three domain controllers share one VLAN with user laptops.
768 words, about 4 min2Nightly 45 MB Upload from a Finance Workstation
At 09:00 a NetFlow review shows workstation 10.20.14.37, used by a finance analyst on Windows 10, sent 42–48 MB outbound to 198.51.100.23:443 every night between 02:10 and 02:25 for the past six days. The destination is a hosting provider in another country, and the TLS certificate is self-signed with CN=sync-update-cdn.
693 words, about 3 min3LSASS Access from a Masqueraded Scheduled Task
A Windows Server 2019 file server, FS-03, hosts 12 TB of engineering drawings. EDR is in audit-only mode because a line-of-business application crashed under blocking.
648 words, about 3 min4A Password Spray That the SIEM Never Saw
Your SIEM contains Okta, VPN, and Windows Security logs for 4,000 employees. A detection rule fires when a single user has more than 10 failed logons in 5 minutes, generating roughly 300 alerts per day, 85% from three service accounts.
644 words, about 3 min5Ransomware at 08:40 with Domain-Joined Backups
At 08:40 on a Monday, 60 of 900 Windows endpoints begin showing .locked files and a ransom note. By 09:20 all 60 are encrypted; the helpdesk has 140 calls.
641 words, about 3 min