Case studies
Six synthetic investigations that connect observed evidence to its underlying mechanism.
Cases
- Case 01 · A user accesses a file share
- Case 02 · User was removed from the group, but access continues
- Case 03 · GPO is not applying on the expected device
- Case 04 · Application uses NTLM instead of Kerberos
- Case 05 · Certificate appears valid, but authentication fails
- Case 06 · Assess identity security for a small example organization
Connect knowledge from separate lessons in one case.
- Choose a case and read its evidence.
- Answer the question in your own words, then select an option.
- Check the explanation and revisit the linked lesson for any missing mechanism.
Connect a symptom to a possible cause and its evidence without overclaiming from one record.