ATSA case studies
ATSA · Put your knowledge to work in context.
The ATSA is a multiple-choice certification exam aimed at security practitioners who need to demonstrate breadth across defensive and offensive-adjacent operations rather than depth in a single tool. It suits SOC analysts, junior-to-mid security engineers, network administrators moving into security, and GRC staff who want a common technical vocabulary. The ATSA case studies are 5 cases and about 2,787 words.
1Segmentation Before a Change Freeze in a PCI Environment
Northline Retail runs a payment API that accepts card data across 60 workloads split between VMware and AWS. The cardholder data environment (CDE) currently sits in a flat 10.20.0.0/16 network shared with corporate IT, marketing, and a legacy reporting database.
620 words, about 3 min2Prioritising Vulnerability Remediation Under a 14-Day SLA
Meridian Health has 1,800 servers and 6,200 endpoints. Its vulnerability scanner reports 41,000 open findings, including 12 rated CVSS 9.8.
566 words, about 3 min3OAuth Consent and Mailbox Forwarding in Microsoft 365
At 02:10, a SOC analyst sees a Microsoft 365 alert: a global administrator account signed in from an unusual location and consented to an OAuth application named “MailSync Pro.” The app requests Mail.Read, Mail.Send, and offline access. The same account created an inbox rule that forwards finance mail to an external address.
553 words, about 3 min4Identity Integration After a 30-Day Acquisition Cutover
Helio Systems acquires a 300-person analytics firm. The parent has 2,400 employees and 180 contractors using Okta and Microsoft 365; the acquired firm uses on-premises Active Directory and a line-of-business application that only supports LDAP simple bind to a single directory.
521 words, about 3 min5Conditional Approval of a SaaS Vendor With SOC 2 Exceptions
BrightPath Clinics wants to deploy a SaaS patient-scheduling platform that will store names, dates of birth, insurance IDs, and appointment notes for 400,000 patients. The vendor provided a SOC 2 Type II report with three exceptions: access reviews were not performed for two quarters, encryption at rest was not enabled for a logging bucket, and incident notification relies on the customer noticing.
527 words, about 3 min