Practice tools

Replace the VPN all three companies use to reach Northgate's ERP and PLM system with Private Access to the two applications and nothing else.

Design the path that brings Northgate Engineering's on-premises server logs into Sentinel, and the archive that keeps them for 12 months, so none of it is reachable from the internet.

Redesign the architecture behind Northgate's customer portal so the SSRF path of 15 May fails even with another flaw in the code, and the next attempt is seen.

Review Phil Greaves's design for bringing NE-RODC01 under the domain controller standard: what it may cache, its disk and copies, and what runs on it.

Review Jonas Weber's plan to replace security defaults at Präzision with Conditional Access: rate each control against the export, raise the gaps, and score the design before it goes to Rachel Okafor.

Review Sam Adeyemi's proposed operating model for Defender XDR at Northgate Engineering: the roles each party holds, which actions wait for approval, the hand-off and the access review, before Rachel Okafor replies.

Trace every path from a help desk operator to tier 0 in a BloodHound export with two crossings, and break them without taking away the resets, group requests and license work the business runs on.

Trace every route from a compromised forest to a draft automation that can assign any directory role, then close them without stopping the SOC or the automation.

Map Northgate Engineering's controls to the evidence its own obligations demand (72 hours, the UK prime's 24 hours, named-staff drawings, 12 months of logs) and rate each on what the export proves, telling evidence from a status, a policy sentence or a switch.

Trace the controls running in Northgate Engineering's tenant to eight of the group's requirements and rate each on what the export shows, telling the controls that deliver a requirement from the ones that are only named for it.

Map Northgate Engineering's running controls to eleven NIST CSF 2.0 subcategories and rate each on the evidence, telling the controls that deliver an outcome from the ones that only sound like it.

Configure, assign, add on or step up until five of the group's risks behind SR-02, SR-07 and SR-16 sit inside their limits on a $300K slice of the year-one budget.

Keep, retire and add controls against five of Northgate Engineering's register entries until each sits inside its limit and the spend fits the budget.

Fund, keep and retire Northgate's Microsoft security controls against the four cases the course works, until every risk sits inside appetite and the spend fits the budget.

Classify the group's payroll, HR, contract and payment data, then choose label encryption, Customer Key or Double Key Encryption, the mail route and the protection's administrators for each place it sits or moves, inside the budget.

Classify Northgate's S3 data, then choose the key, transport, rotation and key administrators for each bucket, and find what the strongest key buys that the right one does not.

Stamp Northgate's data with label scheme v1.0, then choose Microsoft-managed keys, Customer Key or Double Key Encryption for each mailbox policy, SharePoint, Teams and the board's papers, inside the budget.

Run Northgate Group's security work from Q4 2026 to Q3 2027 on CON-01's budget with no new headcount: protect the drawings, widen the SOC, ready Copilot and fix sharing, in an order the year can carry.

Run Northgate's two-analyst SOC for a year: the parked backlog, new detections, the ingestion bill, night cover and automation, each with a consequence that arrives later.

A contractor proposes moving Northgate's domain administration into a hardened administrative forest. Review it against NE-AD-STD before it goes to Rachel Okafor.

A single high-level design for three companies, drafted by the architect who made many of the earlier calls. Decide whether the review board takes it forward, and on what conditions.

Northgate Systems' managed service provider proposes delegated administration in place of its two Global Administrator accounts. Decide whether it goes ahead, and on what conditions.

Review the Bicep pull request that builds where Northgate keeps its tenant configuration exports and approved record, and catch the conveniences that undo it.

Review the change that takes Engineering's bank details DLP policy out of simulation, and catch what it gives away on the way.

Review Watchpoint's change that adds automatic session revocation to Engineering's Sentinel, and decide what it may touch, as whom, and when.

Review a Terraform pull request that imports prod's CI deploy role, the cross-account audit role and the prod-data key: find the trust and permission changes that widen who can act in prod.

Test Northgate Engineering's draft delegation for its directors and HR staff, then turn an ordinary administrative unit into a boundary the tenant-wide help desk cannot cross.

Scope a developer's iam:PassRole in Northgate's dev account so they can deploy their own functions and can no longer hand the build role to a new instance.

Put Northgate Engineering's security and identity subscriptions into a management group hierarchy, and place each deny policy where it reaches what it should without breaking the VPN gateway or the sandbox.

Place Northgate's two new accounts and its standing SCPs so the next incident starts from them, without taking from the security account the rights it detects and responds with.

Work the evidence from Northgate Engineering's tenant: consent settings, the grants already in place and the apps behind them, guest invitations and cross-tenant defaults. Prove each misconfiguration from its line and tell it from the defaults that only look loose.

Work the evidence from Northgate Engineering's Teams external access: the tenant settings, the Global user policy and the group's domains. Prove each misconfiguration from its line and tell it from the settings that only look wrong.

Read the configuration exports of Northgate's rebuilt backup bucket and its neighbours, a week after recovery, and prove where the regime falls short of what recovery set.

Route Northgate's nine largest Sentinel tables between the analytics tier and the data lake, with a split where a rule reads part of a table, so every rule keeps firing inside the budget.

Route Northgate Engineering's seven sources into searchable indexes or Amazon S3 so that every search the SOC runs on the month still finds its data, inside a budget about a quarter of what indexing everything costs.

Narrow Northgate Engineering's core firewall and the staging Connect server's network security group so only privileged workstations administer either sync server, while synchronization and staff sign-in keep working.

Narrow the security groups in Northgate's prod VPC so a portal server made to open connections, as on 15 May, reaches nothing it has no business with.

Choose how each layer of Northgate's directory survives, then lose a host, the Manchester site, a tier 0 group and every controller to a wipe, inside a budget.

Choose how each of Engineering's data stores comes back, then lose a mailbox, a site found too late, the Manchester server room and everything to ransomware, against NFR-03 and inside a budget.

Choose how Northgate's portal, orders database and data bucket survive a zone, the Region, an administrator in prod and an SSE-C ransom, and prove orders comes back inside its objectives on finance's budget.

Threat-model the path the May penetration test took to Birmingham's controlled drawings: a license server that must keep NTLM, a guest Wi-Fi, a trusted supplier forest, and the share itself.

Threat-model a proposed Sales agent that reads Salesforce and SharePoint and can create records and send email: who reaches it, what it acts as, and what content from outside can make it do.

Northgate's detections now reach Sentinel only through a repository, tests and a deploy identity. An attacker who can quietly weaken a rule wins: find where.