Free Sample Scenarios

Realistic situations, no account needed. Choose the best response, then read why the other options fail. Nothing is saved.

General Cybersecurity · Intermediate
You Entered Your MFA Code on a Fake Sign-In Page
An employee entered their Microsoft 365 password and MFA code on a fake sign-in page 20 minutes ago. The attacker may now hold a valid session.
AWS Security · Intermediate
Why Are the HTTPS Replies Being Rejected?
Clients cannot load an HTTPS site on an EC2 instance. VPC Flow Logs for its network interface show two records: 198.51.100.7 to 10.0.1.25, source port 51234, destination port 443, TCP, ACCEPT; then 10.0.1.25 to 198.51.100.7, source port 443, destination port 51234, TCP, REJECT. The security group allows inbound 443 from anywhere.
DevOps Skills · Intermediate
A Pull Request That Runs with Your Secrets
A repository workflow uses the pull_request_target trigger, checks out the pull request's head commit, and runs its build script with a token that has write access and access to repository secrets. External contributors can open pull requests.
General Cybersecurity · Advanced
The Single-Use Discount Code That Works Twice
A discount code is meant to be single-use. The server reads used = false, applies the discount, then sets used = true. A tester sends 30 parallel requests and receives the discount 14 times.
Azure Security · Advanced
A Forgotten DNS Record and a Stranger's Website
promo.contoso.com is a CNAME to contoso-promo.azurewebsites.net, but the App Service was deleted months ago. Attackers could create a new app with that name and serve content under your domain, including capturing cookies scoped to the parent domain.
General Cybersecurity · Intermediate
One Password, Thousands of Accounts: Pick the Two Fixes
Logs show an attacker trying the same few common passwords against thousands of accounts, one attempt per account every few hours.
AI Security · Advanced
The Assistant That Still Shows Last Team's Plans
A RAG assistant copies each document's access list into its vector metadata when the document is indexed, and re-indexes weekly. An employee moved teams on Monday. On Thursday the assistant still quotes the old team's confidential plans to them.

Want full tests and your own progress?