Network Security Analyst case studies
Network Security Analyst · Put your knowledge to work in context.
The Network Security Analyst credential is a vendor-neutral, independent-study exam profile for practitioners who monitor, detect, and respond to security events across enterprise networks. This page is an independent study resource; it is not affiliated with, endorsed by, or sponsored by any certification body or vendor. The Network Security Analyst case studies are 5 cases and about 4,447 words.
1Store Segmentation Cutover Kills the POS Estate
NorthLine Retail operates 42 stores. Each store has one Layer 2 access switch, a branch router that performs inter-VLAN routing and carries the WAN uplink, POS terminals, a store controller, and staff Wi-Fi handhelds.
966 words, about 5 min2NXDOMAIN Burst and a 61-Second Heartbeat on a Finance Workstation
At 02:10 on a Tuesday the IDS raises 3,412 DNS NXDOMAIN events in 11 minutes, all from 10.20.4.77, a Windows 10 workstation in the finance department. The queries are for 8–14 character random-looking labels under four second-level domains registered within the last six days, all hosted in the same /24 of a hosting provider.
865 words, about 4 min3Twelve VPN Successes After a Low-and-Slow Spray
At 09:05 on Monday the SIEM fires on VPN authentication: 1,847 failures from 58 source IPs across nine ASNs, against 912 distinct usernames, over 40 minutes. Twelve authentications then succeed.
906 words, about 5 min4A Quarterly Report That Would Overstate Detection
You are drafting the quarterly security operations report for a 3,000-employee insurer. The raw numbers: 412,000 alerts, of which 380,000 came from a single signature; automation closed 96% within two minutes; 41 incident tickets were opened; reported mean time to detect is 47 minutes; the SOC's stated ATT&CK coverage is 98%, computed from techniques that have a rule mapped to them, most of which have never fired.
839 words, about 4 min5Beacon on a Developer Laptop During a Red Team Window
EDR on DEV-WS-014, a developer laptop in the platform engineering subnet 10.30.8.0/24, records rundll32.exe spawned by outlook.exe at 02:14 on a Saturday, followed by a TLS session every 60 seconds with roughly 15% jitter to a domain resolving to 185.199.x.x, a hosting range with a poor reputation. The JA3 fingerprint matches a known Cobalt Strike malleable profile published last year.
871 words, about 4 min