cyberquizzer
Hands-on·Scenario mode

You are on call.
Work the incident.

A real case from the app, starting now. No account, no card.

Briefing· A deployment key is found in a public repository · Medium

You are on the platform security rota. A partner's security team emails to say an access key for your deployment user ci-deploy is visible in a repository you made public on 1 September for their integration. The developers say the key was removed last week. Establish when it was exposed, whether it was used, and what to do.

Evidence
codegit log -p, deploy/settings.py (repository public since 2026-09-01)
1commit 9f3c2a1   2026-09-08 17:42   Priya Nair <priya@northbay.example>2    Remove hardcoded credentials from settings3 4--- a/deploy/settings.py5+++ b/deploy/settings.py6-AWS_ACCESS_KEY_ID = "AKIA4XQ7EXAMPLE9K2LM"7-AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"8+AWS_ACCESS_KEY_ID = os.environ["AWS_ACCESS_KEY_ID"]9+AWS_SECRET_ACCESS_KEY = os.environ["AWS_SECRET_ACCESS_KEY"]10 11commit c82e11f   2026-08-19 09:31   Priya Nair <priya@northbay.example>12    Add deploy script for staging13 14--- /dev/null15+++ b/deploy/settings.py16+AWS_ACCESS_KEY_ID = "AKIA4XQ7EXAMPLE9K2LM"17+AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"18+DEPLOY_BUCKET = "staging-deploy"
Decision 1 of 5

When did the key first become readable by outsiders?

Read the evidence, then commit.
Make the first call

19 cases, easy to hard.

Each unlocked by finishing the one before, so the format teaches itself before the hard ones arrive. Replay any you have cleared. New cases land in batches as they pass review.

  • Social Engineering and Human Factors
  • Network and Infrastructure Security
  • Access and Identity Management
  • Cryptography and Secure Communications
  • Cloud Security
  • Operational Security
  • Application and Data Security
  • Threat Detection and Response
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
  17. 17
  18. 18
  19. 19

Easy

5 casesOne artifact. The answer is in front of you.
  • 1
    Urgent supplier bank changeFree

    Social Engineering and Human Factors · 4 decisions · email

  • 2
    Fake employee benefits notice

    Social Engineering and Human Factors · 4 decisions · email

  • 3
    A user forwards a suspicious email

    Social Engineering and Human Factors · 4 decisions · email

  • 4
    Wireless profiles before office opening

    Network and Infrastructure Security · 4 decisions · table

  • 5
    Failed sign-ins from a single address

    Access and Identity Management · 4 decisions · table

Medium

7 casesTwo artifacts, and one inference to make.
  • 6
    Renewed portal serves an incomplete certificate chain

    Cryptography and Secure Communications · 4 decisions · code, log

  • 7
    Customer exports exposed from cloud storage

    Cloud Security · 4 decisions · log, table

  • 8
    Firewall review finds an open management path

    Network and Infrastructure Security · 4 decisions · table, log

  • 9
    Invoice worker has excessive cloud permissions

    Access and Identity Management · 4 decisions · code, log

  • 10
    Contractors bypass the cloud MFA policy

    Access and Identity Management · 4 decisions · code, table

  • 11
    SaaS tenant isolation design

    Cloud Security · 4 decisions · table, code

  • 12
    A deployment key is found in a public repository

    Operational Security · 5 decisions · code, table

Hard

7 casesThree artifacts. Nothing is true until you correlate it.
  • 13
    Reporting database is published to the internet

    Application and Data Security · 5 decisions · code, table, log

  • 14
    Kerberos ticket harvesting and egress

    Threat Detection and Response · 5 decisions · log, code

  • 15
    Build runner can take control of the cluster

    Network and Infrastructure Security · 5 decisions · code, log

  • 16
    Suspicious lateral movement

    Threat Detection and Response · 5 decisions · code, log, table

  • 17
    Public web PKI design

    Cryptography and Secure Communications · 5 decisions · table

  • 18
    Remote PowerShell and design archive

    Threat Detection and Response · 5 decisions · log, table

  • 19
    Customer data pulled through the orders API

    Application and Data Security · 5 decisions · log, code

Every decision feeds your accuracy and coverage on the Progress page. Three badges track the ladder.

Before you start

No. There is no terminal, no drag and drop, and no simulated command line. A case is four or five linked select questions over real artifacts, closer to a CCNA testlet than a CompTIA performance-based question. The skill it trains is the same one a PBQ tests: reading evidence and making the call.

Finish what you started.

Case 1 is free and complete: the incident, the debrief, and your score. No card.

Work case 1 free

Not today? Take a cheat sheet instead, free and no signup.