This guide provides step-by-step instructions for completing all 12 System & Information Integrity labs. Each lab presents a real-world scenario involving vulnerability management, malware protection, or incident investigation that you must analyze and respond to using artifacts on the domain controller.
In these labs you will analyze security artifacts — vulnerability scan reports, patch logs, antivirus inventories, event logs, policy documents, and incident evidence. Unlike the AC labs (which use Active Directory Users and Computers), the SI labs focus on reading, interpreting, and responding to security data. You will fill out worksheets, write reports, and make compliance determinations based on the evidence provided.
These labs align with CMMC Level 1 System & Information Integrity (SI) requirements:
You will connect to the lab through Apache Guacamole — a web-based remote desktop gateway. There is nothing to install; everything runs in your web browser.
student01student02student05student12After logging in you will see one connection for your pod:
| Connection Name | What It Is |
|---|---|
| PODXX-SRV | Your own pod member server — use this for all SI labs |
This is the only connection you get: every SI lab is done on this desktop.
studentXX@acs-p01.local (or ACS-P01\studentXX) with your domain passwordTip: To return to the Guacamole home screen (for example, to switch connections), press Ctrl+Alt+Shift to open the Guacamole side menu, then click Home.
You should now see the Windows Server desktop in your browser.
You can check your lab verification status in two ways:
Option 1:
Click the "Check Your Progress — Pod XX" banner at the top of the Guacamole interface.
Option 2:
Go directly to: https://training.status.tcecure.com/pod/XX (replace XX with your pod number, e.g., 01)
All SI lab artifacts are stored in a single folder on the domain controller. You will open files in this folder for every lab.
C:\CyberLab\Pod03\SI-Artifacts\)Alternative method using PowerShell:
powershell and press Enterexplorer "C:\CyberLab\Pod03\SI-Artifacts" (replace 03 with your pod number)Your SI-Artifacts folder contains:
ACS-POL-) — reference these for compliance criteriaSI-MX-LY_) — the data you will analyze for each lab_LAB_READY_) — these confirm the lab has been seededImportant: Do NOT delete or modify the original artifact files. When you complete a lab, save your work as a NEW file (instructions are provided in each lab).
Your instructor assigned you a Pod number. Everything you work with is prefixed with your pod number to keep your work separate from other students.
For example, if you are Pod 03:
P03-ACS-SRV-002, P03-WS01, P03-DEV-Laptop-04C:\CyberLab\Pod03\SI-Artifacts\_Completed in the filenameThe SI labs reference several systems in your pod's simulated environment. These are NOT separate machines you connect to — they are represented in the artifact data files.
| System Name | Role | Used In Labs |
|---|---|---|
| PXX-WS01 | End-user workstation (Windows 11) | M2-L1, M3-L1, M3-L2 |
| PXX-ACS-SRV-002 | File server (Windows Server 2022) | M1-L1, M2-L1, M2-L2, M3-L1 |
| PXX-DEV-Laptop-04 | Developer workstation (Windows 11) | M1-L1, M2-L1, M3-L1, M4-L2, M4-L3 |
| PXX-Legacy_Server | Legacy application server (Server 2016) | M1-L1, M3-L1, M3-L3 |
| PXX-ACS-DC01 | Domain controller | M1-L1, M3-L1 |
| PXX-PRINT-01 | Print server (Windows Server 2022) | M3-L1 |
(Replace PXX with your pod prefix, e.g., P03)
Module 1 focuses on identifying, classifying, and understanding information system flaws. You will learn to distinguish between different types of vulnerabilities and evaluate information sources.
Scenario: ACS Corp has conducted a security assessment and identified 5 potential flaws across several systems. Your job is to review each finding and classify it as a Software Flaw, Configuration Flaw, or Patching Gap. You will also assess the risk and determine whether each finding should be formally reported for remediation.
Your Task: Read the flaw examples, classify each one, and complete the identification worksheet.
Step-by-Step Instructions:
How to Classify:
| Type | Definition | Example from This Lab |
|---|---|---|
| Software Flaw | A bug or vulnerability in the software itself | Adobe Acrobat heap overflow (Finding #2) |
| Configuration Flaw | The software works correctly but is configured insecurely | SMBv1 enabled (Finding #1), LDAP signing disabled (Finding #3), TLS 1.0 enabled (Finding #5) |
| Patching Gap | A known patch exists but has not been applied | Failed cumulative update (Finding #4) |
Why This Matters: CMMC SI.L1-3.14.1 requires organizations to identify system flaws. Before you can fix a problem, you must correctly classify what kind of problem it is — the remediation approach differs for each type.
Scenario: Three different information sources have reported potential vulnerabilities. However, not all sources are equally trustworthy. A CISA government advisory, a Microsoft vendor bulletin, and an anonymous blog post each describe a threat. You need to evaluate the reliability of each source and determine which ones should trigger a formal remediation response.
Your Task: Read three source documents, classify each source's reliability, and determine which are actionable.
Step-by-Step Instructions:
Key Concept — Source Reliability:
| Source Type | Reliability | Why |
|---|---|---|
| Government Agency (CISA) | Trusted | Verified by federal cybersecurity experts, CVE assigned |
| Software Vendor (Microsoft) | Trusted | Direct knowledge of their own products, patch available |
| Anonymous Blog | Untrusted | No verification, no CVE, no technical proof |
Why This Matters: Organizations receive vulnerability information from many sources. Acting on every rumor wastes resources; ignoring legitimate warnings creates risk. A cybersecurity analyst must evaluate source credibility before initiating remediation.
Scenario: ACS Corp's vulnerability management program tracks 8 findings across the environment. For each finding, you must calculate the "window of exposure" — the time between when a vulnerability was disclosed and when it was (or should have been) remediated. You will compare each window against the company's remediation policy to determine compliance.
Your Task: Analyze the exposure data, calculate compliance, and identify the most critical gaps.
Step-by-Step Instructions:
| Severity | CVSS Range | Max Window |
|---|---|---|
| Critical | 9.0 – 10.0 | 7 days |
| High | 7.0 – 8.9 | 14 days |
| Medium | 4.0 – 6.9 | 30 days |
| Low | 0.1 – 3.9 | 90 days |
$date = Get-Date -Format "yyyy-MM-dd"
$summary = @"
SI LAB M1-L3 — Window of Exposure Analysis
Pod: PodXX | Date: $date | Analyst: [Your Name]
FINDING ANALYSIS:
SI-2026-001: Exposure=5d, Max=7d, Status=COMPLIANT
SI-2026-002: [Fill in your analysis]
SI-2026-003: [Fill in your analysis]
SI-2026-004: [Fill in your analysis]
SI-2026-005: [Fill in your analysis]
SI-2026-006: [Fill in your analysis]
SI-2026-007: [Fill in your analysis]
SI-2026-008: [Fill in your analysis]
SUMMARY:
Total Findings: 8
Compliant: [count]
Non-Compliant: [count]
Still Open: [count]
MOST CRITICAL GAP: [Which finding has the worst compliance violation and why?]
RECOMMENDATIONS:
1. [Your recommendation for the most critical issue]
2. [Your recommendation for open findings]
"@
Set-Content "C:\CyberLab\PodXX\SI-Artifacts\SI-M1-L3_Completed.txt" $summary
Hints:
Remediation_Date = OPEN are still unresolved — calculate days from Discovery_Date to todayWhy This Matters: The window of exposure is a key compliance metric. CMMC requires timely flaw remediation — tracking how long systems remain vulnerable helps organizations measure their security posture and identify process failures.
Module 2 focuses on reading real vulnerability scan output, analyzing patch management data, and creating formal remediation documentation.
Scenario: A weekly Nessus vulnerability scan has been conducted against the file server PXX-ACS-SRV-002. The scan found 3 vulnerabilities of varying severity. You need to read the scan report, understand each finding, and determine which ones violate the company's remediation policy.
Your Task: Analyze the Nessus scan report and identify compliance violations.
Step-by-Step Instructions:
Navigate to your SI-Artifacts folder
Open the scan report: SI-M2-L1_Nessus_Scan.txt
Read the Target Host Summary section — note the hostname, IP, OS, and scan type
Review each of the 3 findings:
Finding 1 — Critical (CVSS 9.3):
Finding 2 — High (CVSS 7.4):
Finding 3 — Medium (CVSS 5.6):
Also open the remediation policy: ACS-POL-SI-002_Remediation_Timeline.txt — verify the SLA thresholds match your analysis
Open PowerShell and create your analysis:
$date = Get-Date -Format "yyyy-MM-dd"
$analysis = @"
SI LAB M2-L1 — Nessus Scan Analysis
Pod: PodXX | Date: $date | Analyst: [Your Name]
HOST: PXX-ACS-SRV-002 (Windows Server 2022)
SCAN DATE: [from report]
FINDING 1: CVE-2026-21001 — SMBv1 RCE
Severity: Critical (CVSS 9.3)
Age: 365 days | Max Allowed: 7 days
Status: NON-COMPLIANT (exceeded by 358 days)
Recommended Action: [Your recommendation]
FINDING 2: Expired SSL Certificate
Severity: High (CVSS 7.4)
Age: 47 days | Max Allowed: 14 days
Status: NON-COMPLIANT (exceeded by 33 days)
Recommended Action: [Your recommendation]
FINDING 3: Missing Speculative Execution Mitigations
Severity: Medium (CVSS 5.6)
Age: 182 days | Max Allowed: 30 days
Status: NON-COMPLIANT (exceeded by 152 days)
Recommended Action: [Your recommendation]
OVERALL COMPLIANCE: NON-COMPLIANT (3/3 findings overdue)
PRIORITY ACTION: [Which finding should be fixed first and why?]
"@
Set-Content "C:\CyberLab\PodXX\SI-Artifacts\SI-M2-L1_Completed.txt" $analysis
Why This Matters: Vulnerability scanners like Nessus are the primary tool for automated flaw identification. Every cybersecurity professional must be able to read scan output, understand severity scoring, and determine which findings need immediate attention.
Scenario: The IT team claims they have been patching PXX-ACS-SRV-002 regularly. You have been given the Windows Update patch history log and the event log from failed updates. Your job is to determine whether the patching program is actually working — paying close attention to the difference between "attempted" and "successful" patching.
Your Task: Analyze the patch log and event evidence to determine the true patch status.
Step-by-Step Instructions:
Result = Success — antimalware signatures are being updated correctlyResult = Failed with various error codes$date = Get-Date -Format "yyyy-MM-dd"
$report = @"
SI LAB M2-L2 — Patch Verification Analysis
Pod: PodXX | Date: $date | Analyst: [Your Name]
HOST: PXX-ACS-SRV-002
PATCH HISTORY SUMMARY:
- Defender Definition Updates: [count] attempted, [count] successful
- Cumulative Security Updates: [count] attempted, [count] successful
- .NET Updates: [count] attempted, [count] successful
FAILED PATCHES:
1. [Date] — KB5035849 — Error: [code] — [reason]
2. [Date] — KB5035849 — Error: [code] — [reason]
3. [Date] — KB5034441 — Error: [code] — [reason]
4. [Date] — KB5033900 — Error: [code] — [reason]
KEY FINDING: [Explain why the system is NOT compliant despite
showing patch activity]
ROOT CAUSE: [What is causing the patch failures?]
RECOMMENDED ACTIONS:
1. [Your first recommendation]
2. [Your second recommendation]
3. [Your third recommendation]
"@
Set-Content "C:\CyberLab\PodXX\SI-Artifacts\SI-M2-L2_Completed.txt" $report
Key Concept: A failed patch attempt does NOT satisfy the remediation requirement. Per the ACS remediation policy (Section 6): "An attempted patch that FAILS to install does NOT satisfy the remediation requirement. The vulnerability remains OPEN until a successful installation is confirmed via re-scan."
Why This Matters: Many organizations mistakenly believe that having a patching process means they are patched. Verification is critical — you must confirm patches actually installed successfully, not just that an attempt was made.
Scenario: Now that you have identified vulnerabilities (L2.1) and verified that patches are failing (L2.2), you must create formal documentation: a Vulnerability Finding Report and a Remediation Ticket for the most critical open finding.
Your Task: Complete the vulnerability report form and create a remediation ticket.
Step-by-Step Instructions:
SI-2026-001PXX-ACS-SRV-002CVE-2026-210019.3SI-2026-001PXX-ACS-SRV-002Why This Matters: Formal documentation is required by CMMC for all identified vulnerabilities. A vulnerability that is not documented cannot be tracked, assigned, or verified as remediated. The report creates the compliance paper trail.
Module 3 focuses on verifying that antivirus protection is properly deployed, configured, and maintained across all systems. You will audit endpoint coverage, scan schedules, and definition currency.
Scenario: Company policy requires that ALL endpoints have antivirus software installed with real-time protection enabled. You have been given an inventory of all systems and their AV status. Some systems may be missing protection entirely or have outdated configurations.
Your Task: Review the AV inventory, identify non-compliant systems, and document the gaps.
Step-by-Step Instructions:
Compliant = FAIL:
$date = Get-Date -Format "yyyy-MM-dd"
$report = @"
SI LAB M3-L1 — AV Coverage Audit
Pod: PodXX | Date: $date | Analyst: [Your Name]
ENDPOINT INVENTORY:
Total Systems: 6
Compliant: [count]
Non-Compliant: [count]
NON-COMPLIANT SYSTEMS:
System 1: PXX-DEV-Laptop-04
Issue: [Describe what is wrong]
Policy Violation: [Which policy section is violated?]
Risk: [What is the security risk?]
Recommended Action: [How to fix]
System 2: PXX-Legacy_Server
Issue: [Describe what is wrong]
Policy Violation: [Which policy section is violated?]
Risk: [What is the security risk?]
Recommended Action: [How to fix]
COMPLIANT SYSTEMS: [List the systems that pass all checks]
OVERALL COMPLIANCE RATE: [X/6 systems compliant = X%]
"@
Set-Content "C:\CyberLab\PodXX\SI-Artifacts\SI-M3-L1_Completed.txt" $report
Hints:
PXX-DEV-Laptop-04 has NO antivirus installed at all — this is a critical gapPXX-Legacy_Server has Defender installed but with extremely old definitions (2019) and has not been scanned since November 2025PXX-WS01, PXX-ACS-SRV-002, PXX-PRINT-01, PXX-ACS-DC01) are compliantWhy This Matters: CMMC SI.L1-3.14.2 requires malware protection at all appropriate locations. A single unprotected endpoint can be the entry point for a network-wide compromise. Regular coverage audits ensure no gaps exist.
Scenario: ACS Corp policy requires weekly full scans on all protected endpoints. You have been given scan history records and Windows Defender event logs. Your job is to verify that scans are running on schedule and producing the expected results.
Your Task: Analyze the scan history and event logs to verify scan compliance.
Step-by-Step Instructions:
N/A — these have no scans at all)PXX-WS01: Scans on Jun 1, May 25, May 18, May 11, May 4 — weekly, COMPLIANTPXX-ACS-SRV-002: Scans on Jun 1, May 25, May 18 — weekly, COMPLIANTPXX-Legacy_Server: Last scan Nov 15, 2025 — no recent scans, NON-COMPLIANTPXX-DEV-Laptop-04: No AV installed — no scans possible, NON-COMPLIANT$date = Get-Date -Format "yyyy-MM-dd"
$report = @"
SI LAB M3-L2 — Scan Log Analysis
Pod: PodXX | Date: $date | Analyst: [Your Name]
SCAN COMPLIANCE BY SYSTEM:
PXX-WS01: [COMPLIANT/NON-COMPLIANT]
Last Scan: [date]
Frequency: [weekly/monthly/none]
Threats Found: [count]
Definition Updates: [regular/irregular/none]
PXX-ACS-SRV-002: [COMPLIANT/NON-COMPLIANT]
Last Scan: [date]
Frequency: [weekly/monthly/none]
PXX-Legacy_Server: [COMPLIANT/NON-COMPLIANT]
Last Scan: [date]
Issue: [Explain the gap]
PXX-DEV-Laptop-04: [COMPLIANT/NON-COMPLIANT]
Issue: [Explain why scans cannot run]
EVENT LOG OBSERVATIONS:
- Scan schedule: [What time do scans run?]
- Definition update frequency: [How often are definitions updated?]
- Any anomalies? [Anything unusual in the logs?]
OVERALL: [X/4 systems scan-compliant]
"@
Set-Content "C:\CyberLab\PodXX\SI-Artifacts\SI-M3-L2_Completed.txt" $report
Why This Matters: CMMC SI.L1-3.14.5 requires periodic scans. Having antivirus installed is not enough — it must actively scan the system on a regular schedule. Inactive or non-functional AV provides a false sense of security.
Scenario: Antivirus software is only as good as its latest definitions. Company policy requires definitions to be updated within 7 days. Systems with definitions older than 30 days must be isolated from the network. You have a definition status report showing the current state across all endpoints.
Your Task: Identify systems with outdated definitions and determine the compliance impact.
Step-by-Step Instructions:
PXX-Legacy_Server: Definitions from 2019-03-22 — over 2,600 days old! This system's AV is essentially uselessPXX-DEV-Laptop-04: No AV installed — cannot have definitions$date = Get-Date -Format "yyyy-MM-dd"
$report = @"
SI LAB M3-L3 — Definition Currency Audit
Pod: PodXX | Date: $date | Analyst: [Your Name]
DEFINITION STATUS:
[For each of the 6 systems, list:]
PXX-[hostname]:
Definition Version: [version]
Last Updated: [date]
Days Since Update: [number]
Policy Max: 7 days
Status: [COMPLIANT / NON-COMPLIANT]
Action Required: [None / Update / Isolate / Install AV]
CRITICAL FINDINGS:
1. PXX-Legacy_Server: Definitions are [X] days old
- Per policy Section 3.3: Systems > 30 days old must be ISOLATED
- This system should be immediately disconnected from the network
- Recommended: Update definitions, run full scan, then reconnect
2. PXX-DEV-Laptop-04: No antivirus installed
- Cannot have definitions without AV
- Recommended: Install Microsoft Defender immediately
COMPLIANCE SUMMARY: [X/6 systems compliant]
"@
Set-Content "C:\CyberLab\PodXX\SI-Artifacts\SI-M3-L3_Completed.txt" $report
Why This Matters: CMMC SI.L1-3.14.4 requires updating malicious code protection mechanisms when new releases are available. Outdated definitions mean the AV cannot detect recent threats — a system running 2019 definitions cannot protect against 2026 malware.
Module 4 focuses on how security policies are enforced through Group Policy, and what happens when a user circumvents those policies. You will investigate a real incident scenario involving a developer who disabled endpoint protection.
Scenario: ACS Corp uses Group Policy to enforce Windows Defender settings across all endpoints. A Group Policy Object (GPO) named PXX-SI-Defender-Policy has been created and linked to your pod's OU. Your job is to review the GPO settings and verify they enforce the requirements from the Malware Protection Policy.
Your Task: Review the GPO report and verify all required settings are configured.
Step-by-Step Instructions:
Navigate to your SI-Artifacts folder
Open the GPO report: SI-M4-L1_GPO_Report.txt
Compare each GPO setting against the policy requirements in ACS-POL-SI-003_Malware_Protection.txt:
Check 1 — Defender Cannot Be Disabled:
Check 2 — Real-Time Protection Enforced:
Check 3 — Definition Update Schedule:
Check 4 — Scan Schedule:
Check 5 — Tamper Protection (THE GAP):
NOT CONFIGURED IN GPOComplete the checklist at the bottom of the GPO report
Create your review using PowerShell:
$date = Get-Date -Format "yyyy-MM-dd"
$review = @"
SI LAB M4-L1 — GPO Compliance Review
Pod: PodXX | Date: $date | Analyst: [Your Name]
GPO NAME: PXX-SI-Defender-Policy
LINKED TO: OU=PodXX,OU=Students,DC=acs-p01,DC=local
SETTING REVIEW:
1. Turn off Defender = Disabled
Policy Requirement: Section 3.1 - AV must be installed
Status: COMPLIANT
2. Real-Time Protection = Active
Policy Requirement: Section 3.2 - RTP must be enabled
Status: COMPLIANT
3. Definition Updates = 7-day max, hourly checks
Policy Requirement: Section 3.3 - Update within 7 days
Status: COMPLIANT
4. Full Scan Schedule = Daily at 02:00
Policy Requirement: Section 3.4 - Weekly minimum
Status: COMPLIANT (exceeds requirement)
5. Tamper Protection = NOT CONFIGURED IN GPO
Policy Requirement: Section 3.5 - Must be enabled
Status: GAP IDENTIFIED
Finding: Tamper Protection cannot be enforced via GPO.
Must be verified manually using:
Get-MpPreference | Select IsTamperProtected
Recommendation: [Your recommendation]
OVERALL: 4/5 settings compliant, 1 gap identified
"@
Set-Content "C:\CyberLab\PodXX\SI-Artifacts\SI-M4-L1_Completed.txt" $review
Why This Matters: Group Policy is the primary mechanism for enforcing security settings at scale. If a setting is not in the GPO, individual users can change it. Understanding what GPO can and cannot enforce is critical for security architecture.
Scenario: Security monitoring has detected a series of concerning events on the developer workstation PXX-DEV-Laptop-04. Windows Defender was disabled, real-time protection was turned off, and scanning was stopped — all by the same user account. You need to analyze the security event log to reconstruct what happened.
Your Task: Read the security events and create a timeline of the incident.
Step-by-Step Instructions:
Navigate to your SI-Artifacts folder
Open the event log: SI-M4-L2_Security_Events.txt
Read each event in chronological order and note:
Event Timeline:
| Time | Event ID | What Happened |
|---|---|---|
| 09:14:22 | 5007 | PXX-d.chen changed DisableAntiSpyware from 0 to 1 (Defender OFF) |
| 09:14:23 | 5001 | Real-time protection disabled — service stopped |
| 09:15:01 | 5007 | PXX-d.chen changed DisableRealtimeMonitoring from 0 to 1 (RTP OFF) |
| 09:15:02 | 5010 | Malware scanning disabled entirely |
| 09:22:45 | 5007 | PXX-d.chen added exclusion path C:\DevBuilds |
| (~23 hour gap — NO protection) | ||
| 08:00:01 (next day) | 5007 | GPO refresh restored DisableAntiSpyware to 0 (Defender back ON) |
| 08:00:05 | 1000 | Quick scan triggered by protection re-enable |
Review the policy: ACS-POL-SI-003_Malware_Protection.txt — specifically Sections 4.1 (Prohibited Actions) and 6 (Non-Compliance Consequences)
Answer these questions in your report:
PXX-d.chen)Create your incident analysis:
$date = Get-Date -Format "yyyy-MM-dd"
$analysis = @"
SI LAB M4-L2 — Security Event Analysis
Pod: PodXX | Date: $date | Analyst: [Your Name]
INCIDENT TIMELINE:
[List each event with timestamp, Event ID, and description]
KEY FINDINGS:
1. User PXX-d.chen intentionally disabled endpoint protection
2. Protection was off for approximately [X] hours
3. During unprotected period, user had internet access
4. Unauthorized exclusion added for C:\DevBuilds
5. Protection was only restored by automated GPO refresh
POLICY VIOLATIONS:
- Section 4.1: Users SHALL NOT disable antivirus
- Section 4.2: Developers SHALL NOT disable Defender
- Section 5: Exclusions require IT Security approval
CRITICAL EVENT IDs TO MONITOR:
- 5001: Real-time protection disabled
- 5007: Defender configuration changed
- 5010: Scanning disabled
RISK ASSESSMENT:
[What could have happened during the 23-hour unprotected window?]
"@
Set-Content "C:\CyberLab\PodXX\SI-Artifacts\SI-M4-L2_Completed.txt" $analysis
Why This Matters: Security event monitoring is essential for detecting policy violations in real time. The Event IDs 5001, 5007, and 5010 are the key indicators that endpoint protection has been tampered with. A SIEM should alert on these events immediately — waiting for GPO refresh (as happened here) leaves a dangerous window of exposure.
Scenario: This is the full incident investigation combining everything from Labs L4.1 and L4.2. Developer David Chen (PXX-d.chen) disabled Windows Defender on his workstation to speed up his software builds. You have event logs, an interview transcript, and the exclusion request form. You must conduct a complete investigation: review the evidence, assess the damage, determine the correct response, and fill out the exclusion form showing what David SHOULD have done.
Your Task: Complete a full incident investigation with evidence review, interview analysis, and corrective action.
Step-by-Step Instructions:
Navigate to your SI-Artifacts folder
You will work with 5 files for this lab:
Step A — Review the Event Evidence:
C:\DevBuilds was also addedStep B — Read the Interview Transcript:
Step C — Fill Out the Exclusion Form (What David SHOULD Have Done):
PXX-d.chen)PXX-DEV-Laptop-04C:\DevBuildsStep D — Write the Investigation Report:
$date = Get-Date -Format "yyyy-MM-dd"
$report = @"
SI LAB M4-L3 — Incident Investigation Report
Pod: PodXX | Date: $date | Analyst: [Your Name]
INCIDENT SUMMARY:
On 2026-05-15, developer PXX-d.chen intentionally disabled Windows
Defender on PXX-DEV-Laptop-04 to improve build performance. Protection
remained off for approximately 23 hours until GPO refresh restored it.
EVIDENCE REVIEWED:
1. Windows Defender event log (Event IDs: 5001, 5007, 5010)
2. Interview transcript with PXX-d.chen
3. ACS-POL-SI-003 Malware Protection Policy
4. GPO configuration for PXX-SI-Defender-Policy
TIMELINE:
[List the complete timeline from event log]
INTERVIEW FINDINGS:
- Action was intentional, not accidental
- Motivation: Build performance (legitimate concern, wrong approach)
- User bypassed established exclusion request process
- User had internet access during unprotected period
POLICY VIOLATIONS:
1. Section 4.1: Disabled antivirus protection
2. Section 4.2: Developer disabled Defender for build performance
3. Section 5: Added exclusion without IT Security approval
4. Section 3.5: Tamper protection was circumvented
RISK EXPOSURE:
- 23 hours without malware protection
- Active internet browsing and package downloads during exposure
- Unknown files downloaded without scanning
- Potential malware could have been introduced to corporate network
CORRECTIVE ACTIONS:
1. [What should happen to the user per policy Section 6?]
2. [What technical controls should be added?]
3. [What process improvements are needed?]
4. [Should the exclusion for C:\DevBuilds be approved properly?]
LESSONS LEARNED:
[What should the organization change to prevent this from happening again?]
"@
Set-Content "C:\CyberLab\PodXX\SI-Artifacts\SI-M4-L3_Completed.txt" $report
Why This Matters: This lab brings together everything from Module 4: GPO enforcement, event detection, incident investigation, and policy compliance. In the real world, insider threats from well-meaning employees (like David disabling AV for convenience) are one of the most common security incidents. The proper response combines technical controls (GPO enforcement, tamper protection) with process controls (exclusion request forms, user education).
| What You Need | Where to Find It |
|---|---|
| Your lab artifacts folder | C:\CyberLab\PodXX\SI-Artifacts\ |
| Remediation timeline policy | ACS-POL-SI-002_Remediation_Timeline.txt |
| Malware protection policy | ACS-POL-SI-003_Malware_Protection.txt |
| Flaw examples for classification | SI-M1-L1_Flaw_Examples.txt |
| Source documents for evaluation | SI-M1-L2_CISA_Advisory.txt, SI-M1-L2_Vendor_Alert.txt, SI-M1-L2_Blog_Post.txt |
| Exposure calculation data | SI-M1-L3_Exposure_Data.csv |
| Nessus vulnerability scan | SI-M2-L1_Nessus_Scan.txt |
| Patch history log | SI-M2-L2_Patch_History.csv |
| AV coverage inventory | SI-M3-L1_AV_Inventory.csv |
| Scan history | SI-M3-L2_Scan_History.csv |
| Definition status report | SI-M3-L3_Definition_Status.csv |
| GPO report | SI-M4-L1_GPO_Report.txt |
| Rogue developer events | SI-M4-L2_Security_Events.txt |
| Interview transcript | SI-M4-L3_Interview_Transcript.txt |
| Exclusion request form | SI-M4-L3_Exclusion_Form.txt |
| Open PowerShell | Start menu → type "PowerShell" → click Windows PowerShell |
_Completed in the filename so you can distinguish it from the original artifactsC:\CyberLab\PodXX\SI-Artifacts\ (replace XX with your pod number)PodXX and PXX with your actual pod number_Completed file and try againUse this checklist to track your progress:
| Lab | Task | Done? |
|---|---|---|
| L1.1 | Classify 5 system flaws and complete the identification worksheet | ☐ |
| L1.2 | Evaluate 3 vulnerability sources and complete the classification worksheet | ☐ |
| L1.3 | Calculate exposure windows for 8 findings and write analysis report | ☐ |
| L2.1 | Analyze Nessus scan report and identify compliance violations | ☐ |
| L2.2 | Review patch history and determine true patch status | ☐ |
| L2.3 | Complete vulnerability report form and remediation ticket | ☐ |
| L3.1 | Audit AV coverage across 6 endpoints and identify gaps | ☐ |
| L3.2 | Verify scan schedules and log analysis across all systems | ☐ |
| L3.3 | Check definition currency and identify systems requiring isolation | ☐ |
| L4.1 | Review GPO settings and identify the Tamper Protection gap | ☐ |
| L4.2 | Reconstruct incident timeline from Defender event log | ☐ |
| L4.3 | Complete full rogue developer investigation with exclusion form | ☐ |