Lesson 5: Security Incident Practical

Core path: 42 minutes

Security support is where a careless fix can make the incident worse.

Your job is to protect people, data, and evidence while applying the smallest approved response.

Incident A: suspicious browser and MFA prompt

Evidence:

• browser redirects began after an unknown extension install;
• redirects occur only in one browser profile;
• endpoint protection is current;
• user separately received an unexpected MFA prompt and did not approve it.

Treat these as two observations until evidence links them.

Build:

1. browser/profile containment and evidence;
2. approved scan/remediation path;
3. separate account-security review;
4. verification after correction.

Incident B: EOL BYOD endpoint

Evidence:

• personal device accesses organization email;
• OS is end-of-life;
• security updates unavailable;
• device is outside required management profile.

Identify the vulnerability state and choose a policy/compliance response. Do not pretend the device is acceptable because email still works.

Incident C: SOHO exposure

Evidence:

• router admin uses default password;
• firmware is outdated;
• remote management is publicly reachable;
• guest wireless can reach trusted devices;
• one unnecessary port forward exists.

Prioritize hardening and state how each change will be verified.

Incident D: malware-removal workflow

Evidence:

• supplied endpoint symptoms support possible malware;
• quarantine is authorized;
• approved anti-malware tool is available;
• required data backup exists.

Put these actions into the correct workflow order:

• investigate/verify;
• quarantine;
• System Restore handling where required;
• remediate;
• update anti-malware;
• safe-mode/recovery scan/remove;
• reimage/reinstall if needed;
• schedule scans/updates;
• restore System Restore/create clean restore point where applicable;
• educate/document.

Incident E: browser trust

Evidence:

• user reaches a familiar-looking login page;
• certificate warning appears;
• link came through a QR code in an unexpected message.

Do not bypass the warning or use the page. Verify the legitimate service through a known path and report the suspicious artifact.

Incident F: media retirement

Evidence:

• failed HDD contains sensitive records;
• software wiping is unreliable because the drive fails intermittently;
• approved destruction vendor is available.

Choose the destruction/chain-of-custody process and identify the required certificate/documentation.

Final incident record

Complete four incidents:

asset:
observed indicators:
threat/vulnerability category:
what is NOT proven:
immediate containment/control:
remediation/hardening step:
data/evidence preservation:
verification:
user guidance:
escalation/documentation:

Security-domain checkpoint

Weeks 13–14 now cover:

physical + logical controls
→ Windows permissions/encryption/identity
→ wireless + workstation/mobile hardening
→ threats/social engineering/vulnerabilities
→ malware types/tools/removal
→ SOHO + browser security
→ data destruction
→ verify + document

Next we close the Software Troubleshooting domain with scenario-based Windows, mobile, and security troubleshooting.