CNCDP case studies
CNCDP · Put your knowledge to work in context.
The Certified Network and Cyber Defense Professional (CNCDP) is an independent, vendor-neutral credential aimed at practitioners who defend networks rather than build them: SOC analysts moving beyond tier-one triage, network security engineers, incident responders, and threat hunters. It tests whether you can reason across the whole defensive lifecycle, from architecture decisions and threat intelligence through vulnerability management, detection engineering, incident handling, forensics, hunting, and the governance context that constrains all of it. The CNCDP case studies are 5 cases and about 4,096 words.
1Segmentation After Acquisition: The 90-Day CDE Enclave
RetailCo operates 240 stores and a headquarters data center. The cardholder data environment (CDE) is 14 servers and 2 payment gateways in VLAN 40, but VLAN 40 shares a pair of core switches with all corporate traffic, and the only enforcement point is a perimeter firewall; internal routing between the 10.0.0.0/8 campus, the store VPN concentrator, and the CDE is unrestricted.
819 words, about 4 min241,200 Findings, Three Engineers, and a Change Freeze
Northwind Health scans 8,400 assets weekly. The latest authenticated scan produced 41,200 findings: 610 rated Critical by CVSS and 3,900 High.
774 words, about 4 min3Ransomware Across Three Plants: Containment Under a Downtime Clock
At 02:14 on a Saturday, EDR raises a high-severity alert on a workstation in Plant 2 of a nine-plant food manufacturer. By 03:40 the Plant 2 file server shows 4,100 files renamed with a .locked extension, and the print spooler has failed at two other plants.
809 words, about 4 min4A Reimaged Laptop and a 30-Day Retention Clock
An analyst at the EU subsidiary of a US company resigns on a Friday and hands back a Windows 11 laptop. On Monday the security team learns from a peer that the analyst forwarded more than 40 client pricing spreadsheets to a personal Gmail address over the previous three weekends.
861 words, about 4 min5Signing a SaaS Vendor Whose SOC 2 Excludes the Only System That Matters
A payments-adjacent fintech with 700 staff processes card data for 60 merchant clients. Procurement wants to sign a three-year contract in 12 days with a new cloud call-recording SaaS vendor that will receive the first 90 seconds of every customer service call, including card numbers customers read aloud.
833 words, about 4 min