TS-C (NCCT) case studies
TS-C · Put your knowledge to work in context.
TS-C is a professional certification exam for practitioners who need to demonstrate working command of a technical discipline end to end - from its core vocabulary and design principles through hands-on configuration, day-to-day operations, and the security and governance controls that wrap around a production environment. It is aimed at people who already have some hands-on exposure and now want an independent, third-party validation of that experience, typically engineers, administrators, and technical leads who own or influence the systems in scope rather than pure observers. The TS-C case studies are 5 cases and about 3,963 words.
1Two Collection Paths, Two Truths: Reconciling Agent and Scanner Findings
A vulnerability management team runs a single platform with two collection methods. About 4,200 of 12,000 assets carry an agent; the remaining 7,800 are scanned nightly from three scanner appliances.
620 words, about 3 min2Two Appliances, Forty Sites, and a Segmented Cardholder Environment
A retailer must build vulnerability scanning for 15,000 endpoints across 40 branch sites, three data centres, and a PCI cardholder data environment on an isolated VLAN with no inbound traffic from the corporate network. Each branch sits on a 50 Mbps MPLS circuit that also carries point-of-sale traffic; the network team permits no more than 30% sustained utilisation from scanning.
818 words, about 4 min3Agent Rollout Stalls at 8% and the OT Network Has No Internet
A company is deploying agent-based assessment across 25,000 Windows and macOS endpoints, 3,000 servers, and a 900-host operational technology segment that has no internet access and no route to the corporate data centre. Rollout is by GPO for Windows and an MDM package for macOS.
820 words, about 4 min4Authentication Failures, a Stale Feed, and a Full Database
On Monday morning four problems land at once. Credentialed scans now fail authentication on roughly 3,100 of 9,000 hosts, though network checks still return results.
850 words, about 4 min5Audit Evidence, a Shared Admin Login, and 210 Undocumented Exceptions
An internal audit of a cardholder-scope estate of 5,000 assets is due in six weeks. Current state: 210 findings older than 90 days are marked accepted risk with no named owner and no expiry date; the scanning service account holds domain administrator rights; three analysts share one administrator login on the platform; retention is set to 45 days while the written policy requires 13 months; and the audit team wants proof of continuous monitoring across the full 13-month period.
855 words, about 4 min