Windows telemetry
Question preview · Intermediate
Choose the most useful event sources for common endpoint investigations.
← All practice formats
Validate / Format preview
Knowledge checks
Check whether you can apply defensive concepts to telemetry, workflows, and investigation decisions—not merely recall definitions.
This public page shows example topics, not an exercise. To work through published activities and save results, use an approved learner account.
Open learner practiceExample topics
What you can practice in this format.
These cards describe sample topics; they are not scored exercises on this public page.
Splunk investigation
Question preview · Advanced
Interpret searches, field behavior, and correlation results.
AWS detection
Question preview · Advanced
Evaluate IAM, CloudTrail, and GuardDuty evidence.
Skills you develop
Practice with a clear purpose.
- Identify knowledge gaps
- Explain why an answer is correct
- Apply concepts to evidence
- Prepare for technical screening
Find the training
Build the knowledge behind the exercise.
Explore the courses that teach the tools and investigation methods used in these practice formats.