Performance-based labs
The exam asks you to do things, not only pick answers. Each lab is a short task: read the evidence, act on it and see why.
- Fix a firewall rulesetFind the dangerous rule, rewrite it, order a new deny and pick the secure port.Free
- Read the logsSpot a brute-force break-in and a night-time data transfer, then respond.
- Stop email spoofingRead SPF, DKIM and DMARC records, fix the policy and read a message header.
- Run an incidentOrder a ransomware response, handle a breach notice and keep evidence intact.
- Review accessGive each role least privilege and clean up an admin group.
- Match attacks to defensesPair indicators with attacks and attacks with the controls that stop them.
On exam day
Performance-based questions usually come first and take longest. Flag a long one, answer the multiple choice, then come back. More on these questions