网络安全调查案件
模拟公司中的 16 个安全事件案件。按难度筛选，然后在浏览器中解决一个。
| 1Your First Case NotePractice saving an observation and using it to support a finding. | 简单 |
| 2The Unwanted ConnectionSeparate a legitimate payment connection from an unwanted order export. | 中等 |
| 3Two Copies of One ProgramFind matching files on two workstations and prove neither copy returns. | 中等 |
| 4The Stolen Support LoginTrace a server intrusion to a stolen login and stop the next step. | 中等 |
| 5The Forgotten ContractorFollow a login after a contract ended and close the forgotten account. | 简单 |
| 6A Permission Too FarRemove unapproved administration access while the manager keeps working. | 简单 |
| 7One Unprotected AdminFind the missing MFA protection among two administration accounts. | 简单 |
| 8The Rule That Did NothingExplain why a deny rule is ignored and fix it without cutting off support. | 中等 |
| 9The Backup Caught in the BlockRestore an approved backup without reopening a leak on the same port. | 中等 |
| 10After the RestartCatch an unwanted startup before a stopped program returns. | 中等 |
| 11The Program Behind ItFollow a parent process to the launcher that keeps bringing an exporter back. | 中等 |
| 12Before You ReconnectPreserve live evidence and safely recover an isolated workstation. | 中等 |
| 13The Wrong File Was IsolatedUse file fingerprints to reverse a mistaken quarantine and remove the real threat. | 中等 |
| 14A Second Way OutFind an alternate export route that a single-port fix would miss. | 中等 |
| 15Stop the Second HopStop a compromised workstation from launching a program on the shop server. | 困难 |
| 16The Incident HandoffCombine account, process and file evidence to finish a two-machine incident. | 困难 |