Practice Lab · 12 · Final Challenge
Full Competition Simulation
Run a timed multi-platform defensive simulation combining Windows 11, Windows Server, Linux, Cisco, and forensics into one coordinated exercise.
There is no direct answer key. Prioritize, investigate, remediate, and verify from the evidence provided.
Simulation Snapshot
Final mission
Secure the environment without destroying the mission
This fictional final simulation combines Windows 11, Windows Server, Linux, Cisco, and forensics in one authorized competition-style environment.
Read the mission before changing anything. Required services and approved access must remain available.
Preserve evidence before changing accounts, processes, services, scheduled activity, network policy, or suspicious files.
Do not execute unknown files or intentionally trigger suspicious artifacts.
Prioritize active risk, privilege, persistence, and cross-system impact before lower-risk hardening.
Make one narrow change at a time and immediately verify the exact condition you intended to fix.
Keep a shared evidence notebook with timestamps, commands, findings, changes, and verification results.
The objective is secure, mission-preserving operation, not maximum lockdown.
Environment
Know what must survive the simulation
WIN11-OPS
Windows 11 operations workstation
Required
Defender, Firewall, Windows Update, approved users, normal workstation functionality
Caution
RDP is not required; only approved admins should be elevated.
SRV-FILES
Windows Server file server
Required
SMB file sharing, approved admin access, required roles, healthy services
Caution
Do not break the MediaProjects share or approved administrator access.
UBU-DEV
Ubuntu development workstation
Required
Approved users, development tools, package-management health, host firewall
Caution
SSH is not required; priya may use sudo; alex should remain standard.
SW1 + R1
Cisco switching and inter-VLAN routing
Required
VLAN 10 STAFF, VLAN 20 STUDENTS, VLAN 99 MANAGEMENT, routing, approved management
Caution
Do not erase configurations or interrupt uplinks while troubleshooting.
CASE-FILES
Prepared forensic evidence set
Required
Hashes, timestamps, paths, logs, and notes preserved
Caution
Never execute the unknown sample in the fictional case.
Time plan
Use the clock strategically
0-10 min
Read, assign, inventory
10-30 min
Baseline and preserve
30-70 min
High-impact remediation
70-95 min
Deep review and correlation
95-110 min
Verification sweep
110-120 min
Final review
Team coordination
Give every system an owner
Windows lead
WIN11-OPS baseline, privilege, Defender, Firewall, services, tasks, processes, and authentication evidence.
Server lead
SRV-FILES identities, roles, SMB, services, logs, and required-service verification.
Linux lead
UBU-DEV users, sudo, services, sockets, schedules, logs, firewall, and package review.
Network lead
SW1/R1 interfaces, VLANs, trunks, routing, ACLs, VTY, SSH, port security, and configuration verification.
Forensics / coordinator
Evidence notebook, hashes, cross-system correlation, timeline reconstruction, change log, and final verification tracking.
Windows 11
Baseline the workstation quickly but carefully
Accounts and privilege
Compare every privileged identity with the mission roster.
Get-LocalUser
Get-LocalGroupMember Administrators
Defender and Firewall
Confirm core host protections are enabled and healthy.
Get-MpComputerStatus
Get-NetFirewallProfile
Services and persistence
Look for unneeded remote access, suspicious startup behavior, and recently added services.
Get-Service | Sort-Object Status,Name
Get-ScheduledTask
Processes and networking
Prioritize unknown processes with active listeners or outbound connections.
Get-Process | Sort-Object ProcessName
Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
Windows Server
Protect required server functionality while reviewing privilege and services
Administrators and identity
Verify privileged identities before changing local or domain access.
Get-LocalGroupMember Administrators
Get-ADGroupMember "Domain Admins" -ErrorAction SilentlyContinue
Roles, shares, and sessions
Protect required file sharing while identifying unexpected shares or sessions.
Get-WindowsFeature | Where-Object {$_.InstallState -eq 'Installed'}Get-SmbShare
Get-SmbSession
Services and installs
Correlate newly installed services with executable paths and timing.
Get-Service | Sort-Object Status,Name
Get-WinEvent -FilterHashtable @{LogName="System"; Id=7045} -MaxEvents 60Linux
Check privilege, listeners, persistence, and logs
Users and sudo
Compare effective privilege with the mission.
getent passwd
getent group sudo
sudo -l -U alex
sudo -l -U priya
Services and listeners
Match every listener to a required service or investigated finding.
systemctl --type=service --state=running
ss -tulpn
Schedules and authentication
Distinguish approved maintenance from unexpected recurring execution.
crontab -l
sudo crontab -l
systemctl list-timers --all
sudo grep -Ei "accepted|failed|sudo" /var/log/auth.log 2>/dev/null | tail -n 120
Cisco
Keep connectivity while validating security and segmentation
Interfaces and VLANs
Verify access ports, VLAN existence, and obvious err-disabled or disconnected links.
show interfaces status
show vlan brief
Trunks and routing
Confirm required VLANs cross the uplink and routed networks are present.
show interfaces trunk
show ip interface brief
show ip route
show ip arp
ACLs and management
Review ACL order, hit counts, VTY restrictions, and SSH management.
show ip access-lists
show running-config | section line vty
show ip ssh
Port security and logs
Correlate access-port events with endpoint findings.
show port-security
show interfaces status err-disabled
show logging
Forensics
Preserve and correlate instead of executing unknown content
Hash evidence
Record stable identifiers before analysis or containment.
Get-FileHash <evidence-file> -Algorithm SHA256
sha256sum <evidence-file>
Metadata
Record paths, ownership, size, and timestamps without altering content.
Get-Item <evidence-file> | Format-List Name,Length,CreationTime,LastWriteTime,FullName
stat <evidence-file>
Timeline correlation
Build conclusions from multiple independent artifacts.
Review authentication events
Review process-creation events
Review scheduled tasks or timers
Review network-to-process mappings
Fictional evidence set
Decide what matters, what is related, and what must remain available
support-temp is in Administrators but is not on the mission roster.
Competition prompt
What evidence should be preserved before changing the account?
updater-helper.exe runs from Downloads and owns an outbound connection to a fictional external endpoint.
Competition prompt
Which process, file, and network details should be recorded before containment?
FileIndexHelper was installed from C:\Temp\fileindex.exe shortly after a privileged logon sourced from WIN11-OPS.
Competition prompt
What would strengthen or weaken the hypothesis that these events are related?
The MediaProjects SMB share is active with approved users connected.
Competition prompt
Why should this remain untouched unless another finding directly affects it?
SSH is enabled and listening on TCP 22 although the mission says SSH is not required.
Competition prompt
What should be checked before disabling it?
alex has unrestricted sudo and a NOPASSWD rule despite being designated a standard user.
Competition prompt
Which privilege settings conflict with the mission, and how would you verify the correction?
Gi0/1 is trunking, but VLAN 20 is missing from the allowed VLAN list. VLANs 10 and 99 are present.
Competition prompt
Which users are most likely affected, and what is the narrowest safe correction?
Subinterfaces for VLANs 10, 20, and 99 are all up/up with expected gateway addresses.
Competition prompt
Why does this argue against rebuilding the router configuration?
VTY access permits both Telnet and SSH, while the mission requires secure management and SSH is operational.
Competition prompt
What narrow change would reduce exposure while preserving administration?
Browser history, file metadata, process creation, and a scheduled task all reference the same fictional update-tool artifact.
Competition prompt
How would you organize these into a defensible timeline?
A process ID tied to the suspicious executable also owns an outbound connection.
Competition prompt
Why is process-to-network correlation stronger than an IP address alone?
A privileged SRV-FILES logon occurred within minutes of support-temp activity on WIN11-OPS, but no direct proof identifies the exact action taken.
Competition prompt
What is confirmed, and what must remain a hypothesis?
Change control
Use the same discipline for every fix
State the problem before changing anything.
Record the evidence supporting the change.
Choose the smallest change that satisfies the mission.
Make one meaningful change at a time.
Immediately re-run the exact check that revealed the issue.
Confirm required services still work.
Record the result before moving on.
If verification fails, investigate before stacking more changes.
Final verification matrix
Do not stop at 'the command worked'
A completed competition fix must satisfy the security goal and preserve the mission.
WIN11-OPS
SRV-FILES
UBU-DEV
SW1 + R1
CASE-FILES
Debrief
Explain your competition decisions
Which finding did you prioritize first, and what evidence justified that choice?
Which finding looked serious at first but was mission-required or lower priority?
Which change had the greatest risk of breaking required functionality?
What cross-system evidence suggested the Windows workstation and server might be related?
What evidence prevented you from overreacting to the Linux SSH finding?
Why was the missing VLAN 20 trunk allowance more important than rebuilding router subinterfaces?
Which forensic artifact most strongly proved execution rather than file presence?
Where did you separate a confirmed fact from a hypothesis?
Which verification check could have caught accidental breakage?
If you had ten more minutes, what would you investigate next and why?
Simulation complete
Finish only after the entire environment is re-verified
I read the mission before making changes.
I documented required services and approved users for every platform.
I preserved evidence before remediation.
I prioritized active risk, privilege, and propagation over cosmetic hardening.
I made narrow changes supported by evidence.
I kept required Windows, Server, Linux, and network services available.
I correlated related findings across systems.
I documented facts separately from hypotheses.
I re-ran the exact checks that revealed each major issue.
I completed a final cross-platform verification sweep.
I saved network configuration only after verification.
I can explain every major change and why it was necessary.