Every domain you can practise.
32 security domains, each with its own question bank. Pick one to see what it covers, then start a quiz straight from there.
Investigate and respond
Incident response
Decide what to isolate, preserve, investigate and restore when an attack is under way.
100 questionsDigital forensics
Work through evidence collection, memory capture, chain of custody and incident timelines.
250 questionsSOC
Triage alerts, scope incidents and make the first useful move under pressure.
100 questionsThreat hunting and detection
Use process, network and registry evidence to find suspicious activity before an alert tells the whole story.
100 questionsMalware analysis
Choose safe analysis steps and use memory, startup and rule tools to understand a suspicious file.
100 questionsThreat intelligence
Check indicators in context, respect sharing rules and separate observed behaviour from attribution.
Build and test
Web security
Spot the weakness in a real web flow, then choose the control that actually fixes it.
176 questionsApplication security
Read short code and API situations covering injection, access checks, secure design and release decisions.
87 questionsRust security
Review Rust code, crates and builds for the flaws the compiler does not catch, from unsafe blocks and panics to malicious crates and AI-written code.
90 questionsAPI security
Catch missing access checks, unsafe data handling and business flow abuse in everyday API work.
129 questionsPenetration testing
Pick the right tool and stay within the scope of an authorised assessment.
110 questionsVulnerability management
Find exposed flaws, plan safe fixes and decide who owns the remaining risk when a fix must wait.
115 questionsDevSecOps and supply chain
Secure build jobs, dependencies, software updates and the path from source to release.
100 questionsContainers and Kubernetes
Secure workloads, service accounts, network policies and images in a Kubernetes cluster.
100 questionsMobile security
Find risky Android app settings, token storage, WebView exposure and weak API checks.
Systems and identity
Identity and access
Test decisions around access control, OAuth, MFA, privileged accounts and offboarding.
125 questionsNetwork security
Read traffic and firewall situations without confusing a WAF with a network control.
100 questionsWireless security
Find rogue access points, weak authentication and bad guest network boundaries.
125 questionsCloud security
Review AWS, Azure and Google Cloud access, storage, networking and incident cases.
100 questionsWindows security
Use Windows events, account activity and privileged access to investigate threats.
100 questionsLinux security
Review SSH, iptables, sudo and process exposure on Linux hosts.
100 questionsEmail security
Investigate spoofed mail, forged domains, authentication failures and mailbox takeover.
100 questionsSecurity protocols
Read packet and handshake clues across TCP, TLS, SSH and MCP.
100 questionsMicrosoft 365 and SaaS security
Investigate mailbox takeovers, sharing links, OAuth apps and stale guest access.
99 questionsData security
Protect sensitive records through access controls, discovery, encryption, retention and tested recovery.
Governance and specialist
Cryptography
Choose how to protect keys, passwords, messages and certificates in practical situations.
150 questionsAudit and compliance
Test whether controls work, who owns the risk and whether changes and suppliers are properly reviewed.
132 questionsPCI DSS
Work through card data scope, payment-page scripts, supplier evidence and the controls that protect checkout.
100 questionsISO 27001
Work through ISMS scope, risk treatment, audit evidence and continual improvement.
100 questionsGDPR
Assess personal data incidents, rights requests, lawful basis and data minimisation.
125 questionsOT and industrial security
Make safe security decisions for plant networks, controllers, engineering access and incident response.
131 questionsAI security
Defend agents and models against prompt injection, unsafe tools and data exposure.