45. Practice Exercises with Hints
45.9 Advanced Defensive Drills – AD to Mobile
Chapters 38–44 themes: AD hygiene, malware handling mindset, DoS awareness, session security, evasion awareness, IoT default passwords, mobile sideload – defence drills, OWN lab only.
| Exercise | Task | Hint |
|---|---|---|
| E1 | AD: why Kerberoast matters to Blue – fix name two | SPN + weak service password; gMSA / long password + monitor 4769 |
| E2 | Malware: first Blue steps on a suspected Windows lab VM | Isolate network; snapshot/image policy; do not "clean in place" first if IR matters |
| E3 | DoS: rate-limit idea for public login – one control | WAF / reverse-proxy limits / CAPTCHA class; ISP/cloud shields for volumetric |
| E4 | Session: steal cookie idea on OWN HTTP lab → fix flags | Secure + HttpOnly + HTTPS; short TTL |
| E5 | IoT: Raja-Rani camera default admin/admin – Blue checklist |
Change password; segment VLAN; update firmware; never expose to WAN |
| E6 | Mobile: three staff rules for Sahyadri phones | Store installs only; screen lock; no unknown APK |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Roasts weak SPN in OWN AD lab | gMSA; AES; Tier model; audit |
| Speaks "cryptolocker" scare without isolate | IR playbook: contain → evidence → eradicate → recover |
| Evil-twin demo on OWN lab AP only | Staff VPN/HTTPS habits; no public evil-twin practice |
Ravindra Bagale's Tip
Advanced chapters scary vatatat. Defence line ek: least privilege + patch + segment + monitor. Tools nantar. Aata pudhe capstone!
Lab
Pick one track: (A) AD lab pre-auth fix re-verify, or (B) mobile emulator permission revoke, or (C) IoT VM password change. Write 8-line Blue report for owner Rani.