Practice assessment: the Demirsu Energy enterprise network
You assess the fictional multi-site Demirsu Energy: you audit the identity infrastructure and group policies, verify the separation of the branch and monitoring segments with passive methods and present a roadmap to the board.
Level 401 · 17 lessons · 15 practice labs
Lessons
Planning
- The brief: a multi-site energy company
- The operational technology boundary: what you only observe
- An organisation-specific threat model and assessment goals
- Short task: draw up a multi-phase assessment plan
Identity and directory
- Domain inventory: users, groups, computers
- Auditing privileged group memberships
- Measuring the domain password policy
- Risky settings in group policy objects
- Short task: prioritise the identity infrastructure findings
Network and segmentation
- Filtering rules on the branch link
- Passively verifying access to the monitoring segment
- Configuration of the remote-access gateway
- Short task: prove the segmentation gap and recommend a fix
Results
- Finding chains: showing a privilege path end to end
- Mapping detection gaps with the defence team
- A one-page summary for the board
- Capstone: report the Demirsu Energy assessment and draw up an improvement roadmap
Practice labs
- Decide what is look-only at the operational technology boundary: Separate the OT systems in Demirsu Enerji's asset list and state for each whether only passive observation or configuration review is allowed.
- Produce a threat model and assessment goals specific to the energy company: Derive three critical scenarios from the company's processes and write the questions the assessment must answer for each.
- Draw up a phased plan for a multi-site assessment: Prepare a plan for HQ, branch and plant with phases, test windows, contact points and stop conditions.
- Inventory the users, groups and computers in the domain: Produce an inventory from the lab domain with user, group and computer counts plus disabled and stale accounts.
- Audit privileged group memberships and remove the excess: List members of Domain Admins and similar groups, document members without a job need, remove them and verify again.
- Find and prioritise risky settings in Group Policy objects: Measure the password policy in the lab GPOs, find risky settings and rank the identity findings by impact.
- Audit the branch link's filtering rules: Measure which ports are reachable from the branch network into HQ and record permissions missing from the rule document as findings.
- Verify access to the monitoring segment using passive methods: Verify which networks can reach the monitoring segment using only rule review and connection checks, sending no commands to devices.
- Audit the remote access gateway and close the segmentation gap: Prove the gateway gives VPN users the whole internal network, propose group-based access, apply it and retest.
- Match assessment steps to the defence team's detections: Match your activity log to the SIEM alerts and write the undetected steps into a gap list.
- Show the privilege path end to end and break its weakest link: Document the lab path from a standard user to admin rights step by step, close the cheapest link and verify the path is broken.
- Write an improvement roadmap and board summary for Demirsu Enerji: Turn the finding chains and detection gaps into a three-phase roadmap and prepare a one-page summary for the board.
- Read the domain password policy and compare it to the company standard: Compare the lab domain's length, complexity, history and lockout settings with the company standard in a table.
- Audit the separate password policy for privileged accounts: Find which groups the fine-grained password policies apply to, show admin accounts are not covered and fix it.
- Measure whether the password hashes in this lab meet the policy: Test the lab domain's hash copy with the approved list, report the non-compliant account rate per department and destroy the hash copy.
About this course
You assess the fictional multi-site Demirsu Energy: you audit the identity infrastructure and group policies, verify the separation of the branch and monitoring segments with passive methods and present a roadmap to the board.
What you will learn
- Planning
- Identity and directory
- Network and segmentation
- Results
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.