NSA Assessment case studies
NSA Assessment · Put your knowledge to work in context.
The NSA Assessment is a multiple-choice examination covering network security fundamentals, security architecture and design, cryptography, network protocols and analysis, threat detection and incident response, security operations and monitoring, and access control and identity management. The domain weightings suggest where the emphasis falls: network security fundamentals carry the largest share, followed by architecture, cryptography, protocols, and threat detection at roughly equal weight, with operations and access control rounding out the exam. The NSA Assessment case studies are 5 cases and about 3,418 words.
1Dual-ISP Cutover and Stateful Firewall Drops
A regional logistics firm runs a flat 10.40.0.0/16 internal network with 1,800 endpoints. In March it added a second ISP circuit-400 Mbps fiber, with a 150 Mbps LTE backup-to an existing 1 Gbps primary link.
676 words, about 3 min2Data-at-Rest Encryption, KMS Envelope Keys, and Legacy TLS Instruments
A healthcare analytics company stores 38 TB of patient encounter data in an S3-compatible object store and ships weekly backups to tape for seven-year retention. A new contract requires FIPS 140-2 validated cryptography, AES-256 for data at rest, and TLS 1.2 or higher in transit.
715 words, about 4 min3IPsec MTU Black Hole on a 2 GB File Transfer
A user at branch 10.8.4.0/24 reports that a 2 GB file copy to a server at 10.8.9.20 stalls at about 40 MB and then resumes after a minute. A packet capture from a SPAN port on the branch uplink shows the client negotiating a TCP maximum segment size of 1,460 bytes, then sending 1,460-byte TCP segments in 1,500-byte IP packets with the DF bit set.
692 words, about 3 min4LSASS Access and SMB Lateral Movement at 02:14
At 02:14 on a Saturday, the SOC receives an EDR alert: powershell.exe on workstation WKS-4471 (10.20.14.71) accessed lsass.exe memory, and an unsigned binary named svc update.exe then made SMB connections to 14 hosts in the same /24 within 90 seconds. The logged-on user is a help-desk technician, but EDR shows a domain administrator account was used eight minutes earlier to create a scheduled task.
669 words, about 3 min5Cloud IdP Migration with Stale Accounts and Service Credentials
A 4,200-employee manufacturer is migrating from on-premises Active Directory to a cloud identity provider using SAML 2.0 and SCIM. The estate includes 310 SaaS applications, 1,150 AD security groups, and 240 service accounts.
666 words, about 3 min