ETMD EP Practitioners study plan

Map the endpoint threat landscape by writing a one-page taxonomy covering malware families, living-off-the-land binaries, fileless techniques, ransomware behavior chains, and credential theft tooling

Explain the layered architecture of an endpoint protection platform, distinguishing prevention engines (signature, heuristic, behavioral, machine-learning), detection/response sensors, and management plane components

Describe how each major attack stage from initial access to impact would be observed by endpoint telemetry, listing at least two telemetry sources per stage

Sketch a reference deployment topology on paper showing management server, relay or distribution points, agent communication paths, and update channels

Install and configure a management console in a lab, then enroll at least two endpoints and verify policy inheritance and heartbeat status

Configure agent protection settings across prevention modules (on-access scanning, exploit mitigation, web/network protection, device control) and document each setting's operational tradeoff

Build a staged rollout plan that sequences pilot ring, broad ring, and full production with rollback criteria at each gate

Troubleshoot two simulated enrollment failures (certificate trust and network egress) and record the diagnostic steps that resolved each

Design an exclusion policy that separates performance-driven exclusions from false-positive-driven exclusions and justifies each entry

Apply the principle of narrowest viable exclusion by converting at least three broad path or process exclusions into scoped, hash-pinned, or signer-constrained equivalents

Document the approval and change-control workflow for exclusion requests, including who validates, who approves, and how expiry is enforced

Measure the performance impact of scanning on a test host before and after tuning, capturing CPU, disk I/O, and boot time

Define severity and confidence scoring criteria that let an analyst triage an alert consistently without escalation

Walk through five representative alert types (malicious file, suspicious process injection, ransomware behavior, lateral movement attempt, policy violation) and write the triage decision path for each

Draft containment playbooks covering host isolation, account disablement, and memory capture, noting the order of operations and the evidence each step preserves

Practice writing an incident timeline from raw endpoint telemetry for one simulated intrusion

Formulate hunting hypotheses from threat intelligence and ATT&CK techniques, then translate each into a concrete endpoint query

Execute at least four hunts against lab telemetry (persistence via scheduled tasks, anomalous parent-child process relationships, credential dumping indicators, rare binary execution) and record false-positive rates

Convert every validated hunt into a durable detection rule with tuning notes and a documented test case

Review a simulated post-incident artifact set and identify the gaps in logging that would have shortened the investigation

Tune the noisiest detections by analyzing alert volume by rule, host, and user, then adjust thresholds or suppression logic and re-measure

Build a false-positive reduction loop that captures analyst feedback and routes it back into rule and exclusion updates

Assess the security risk introduced by existing exclusions by mapping each to the technique it could enable, and flag the highest-risk entries for remediation

Validate that tuned policies still detect a known-bad test sample set after changes

Define the operational metrics that matter (detection coverage, mean time to detect, mean time to respond, agent health/compliance rate, exclusion count and age) and specify how each is calculated

Build a dashboard or report that presents those metrics to both a technical audience and a management audience

Map the platform's controls to common compliance and audit evidence requirements, identifying which artifacts you can produce on demand

Write an agent health and coverage report that flags unmanaged, stale, or misconfigured endpoints

Consolidate weak areas by reviewing every missed practice question and rewriting the underlying concept in your own words

Re-derive the end-to-end workflow from deployment through tuning, detection, hunting, and reporting without notes

Complete a timed full-length practice assessment and analyze results by domain to target final review

Finalize a one-page reference sheet of key configuration decisions, triage criteria, and metric formulas for last-minute review