Thuta Learning
Search
ExercisesSecurityintermediate

Practice Set 2

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

  • Get comfortable with Practice Set 2, no need to be intimidated by it
  • Be able to run tools yourself inside an authorized lab environment
  • Be able to apply this concept immediately in a real assessment/report

Take a moment to think about this

This round steps things up from round 1 — instead of practicing each skill separately, you'll need to combine them all at once. That includes prioritizing multiple vulnerability findings by severity, designing a defense-in-depth architecture, and writing up an incident response scenario as a document. Budget around 10 minutes per task.

Let's connect it to a real scenario

Task 1: Given 3 vulnerability scan results (Critical: vsftpd backdoor, Medium: outdated Apache version, Low: verbose error message), decide which one should be fixed first based on severity/business impact, and explain why. Task 2: For a web app (frontend + backend + database), design a defense-in-depth architecture (Firewall + Network Segmentation + WAF + IDS + least privilege) layer by layer. Task 3: For the scenario 'customer data is leaking from the company database', write out the Containment/Eradication/Recovery steps following the IR lifecycle (Advanced chapter). Task 4: If a junior security analyst says 'I want to scan the production system — it seems urgent, so I'm not going to wait for authorization', write out how you'd guide/correct them.

Let's walk through it together

text
# Task 1 - prioritization
Critical (vsftpd backdoor): fix FIRST — unauthenticated
  remote code execution, highest possible impact
Medium (outdated Apache): fix SECOND — likely has known
  CVEs but requires more specific conditions to exploit
Low (verbose error message): fix LAST — information
  disclosure only, low direct impact, but easy/cheap to fix
  so don't ignore it forever

# Task 4 - coaching a junior analyst
"I understand the urgency, but scanning production without
authorization is a legal and professional risk regardless of
intent. Let's get emergency authorization from [manager/system
owner] first — even a quick verbal-then-written approval takes
minutes and protects both you and the organization."
You should see
You'll come away with vulnerability prioritization, a defense-in-depth design, an IR scenario, and authorization-boundary coaching practice.

5-minute try-it

Draw the Task 2 defense-in-depth architecture yourself as a text-based diagram (boxes and arrows) — add a caption to each layer explaining what attack it defends against and how.

A quick word of caution

Even under 'urgent' business pressure, you shouldn't skip the authorization process — even an emergency authorization request (a fast-tracked approval) should still go through some process; skipping the process entirely is far more dangerous.

Easy traps

  • Relying on the CVSS score alone for vulnerability prioritization — you should also factor in business context (is this system running a critical business function?)
  • Designing defense-in-depth with a single-point-of-failure mindset — as if 'one layer is enough'

Now try it yourself

Draw the Task 2 defense-in-depth architecture yourself as a text-based diagram (boxes and arrows) — add a caption to each layer explaining what attack it defends against and how.

You'll know it worked when: You'll come away with vulnerability prioritization, a defense-in-depth design, an IR scenario, and authorization-boundary coaching practice.

Practice Set 2 | Thuta Learning