OBJECTIVES 2.5, 4.1, 4.4, 4.5
Endpoint hardening, EDR & patching
Endpoint controls reduce attack surface and produce evidence. Troubleshooting means separating a true compromise from a broken agent, stale policy, failed update, or noisy detection.
Establish and verify a secure baseline
Remove unnecessary software, disable unused services, enforce host firewall rules, encrypt storage, and deploy endpoint protection. Compare the affected host against a known-good baseline before changing it.
- Symptom: repeated drift or disabled controls. Check configuration-management history, local overrides, policy precedence, and last successful check-in.
- Example: a firewall rule exists centrally but is absent locally; verify agent health and policy assignment before recreating the rule manually.
Triage EDR, HIPS, antivirus & sandbox alerts
Validate the process tree, signer, hash, command line, parent process, network destination, and user context. A single alert is weaker than correlated endpoint, identity, DNS, and proxy evidence.
- False positive: document the business process and tune the narrowest indicator instead of disabling a protection category.
- True positive: isolate the host when lateral movement or active command-and-control is plausible, preserve evidence, then eradicate and recover.
OBJECTIVES 3.2, 4.5
Network segmentation, zones & NAC
Segmentation limits lateral movement; NAC evaluates identity and device posture before assigning access. Diagnose routing, VLAN, ACL, firewall, 802.1X, RADIUS, and posture decisions as separate layers.
Internet
Public services
User network
Restricted assets
Air-gapped
Troubleshoot denied access
- 1. Confirm physical/link connectivity and the assigned VLAN.
- 2. Check 802.1X/EAP authentication and RADIUS reason codes.
- 3. Verify certificate trust, device posture, and NAC policy.
- 4. Test route, ACL, firewall state, destination port, and return path.
Common misconfigurations
- Native VLAN mismatch or wrong access VLAN
- Overlapping or shadowed firewall rules
- Expired EAP-TLS certificate
- NAC posture rule using stale inventory
- Asymmetric routing that breaks stateful inspection
OBJECTIVES 2.3, 4.1
Mobile security & MDM
MDM/UEM enforces enrollment, encryption, screen lock, application policy, remote wipe, and compliance. Troubleshoot device ownership, enrollment state, policy scope, network reachability, and privacy constraints before forcing reenrollment.
| Model | Ownership / choice | Control | Privacy & cost | Typical troubleshooting issue |
|---|---|---|---|---|
| COBO | Corporate owned, business only | Highest | Low user privacy; high company cost | Overly restrictive policy or failed zero-touch enrollment |
| COPE | Corporate owned, personal use allowed | High | Work/personal boundary required | Container, app-protection, or selective-wipe conflict |
| CYOD | User chooses from approved devices | Medium-high | Balanced support and choice | Model-specific compliance or OS support gap |
| BYOD | User owned and selected | Lowest | Highest privacy sensitivity; lower company cost | Enrollment consent, unsupported OS, root/jailbreak, or data separation |
MDM troubleshooting sequence
Verify supported OS and ownership model, network/DNS/time, enrollment token and certificate, device compliance, policy assignment, application/container status, and last check-in. Use selective wipe for corporate data on personal devices unless policy and authorization require a full wipe.
OBJECTIVES 3.2, 4.5
Secure protocols, VPN & wireless
A secure protocol can still fail because of the wrong port, transport, cipher support, certificate, authentication method, tunnel route, DNS path, or system clock. Diagnose the layer that fails before replacing the protocol.
Protocol checks
- Prefer HTTPS/TLS, SSH, SFTP, SNMPv3, LDAPS, and secure mail transport over cleartext alternatives.
- Confirm destination name, port, network path, server listener, supported TLS version/cipher, and authentication.
- For VPN failures, separate tunnel establishment from post-connect DNS, route, authorization, and split-tunnel policy.
Wireless checks
- Validate SSID, WPA3 mode, EAP method, RADIUS response, certificate trust, and system time.
- Distinguish an evil twin from a legitimate AP using BSSID, channel, certificate, location, and WIDS evidence.
- Management frame protection reduces spoofed deauthentication/disassociation risk but does not replace strong authentication.
OBJECTIVES 4.4, 4.5, 4.8
SIEM, log review, alerting & DLP
Monitoring is useful only when telemetry arrives, timestamps align, rules reflect the environment, and responders can validate and act. DLP adds data context across endpoint, email, web, cloud, and removable media.
Build a log timeline
Start with the detection timestamp, then pivot on user, host, source/destination IP, process, session, message ID, or file hash. Review endpoint, OS security, authentication, DNS, proxy, firewall, VPN, application, email, IDS/IPS, and cloud logs.
Missing logs are evidence: check agent status, permissions, storage, network path, parser changes, retention, time synchronization, and whether the source was deliberately disabled.
Troubleshoot DLP events
Identify the data type and classification, channel, user intent, destination, policy match, and permitted business process. Confirm whether discovery, endpoint, email, web, or cloud DLP generated the event.
- False positives often come from broad patterns without context, such as number formats mistaken for account data.
- Remediate with classification, exact-data matching, scoped exceptions, encryption, tokenization, blocking, quarantine, or user coaching.
OBJECTIVES 1.4, 3.2, 4.1
Certificate & PKI troubleshooting
Certificates support TLS, VPN, Wi-Fi, device enrollment, code signing, and identity. Read the certificate and trust path before assuming the network or application is broken.
Certificate failure checklist
Identity
Hostname/SAN mismatch, wrong EKU, wrong client identity, or certificate bound to the wrong service.
Time
Expired, not yet valid, or client/server clock outside the accepted window.
Trust chain
Missing intermediate, untrusted root, or incorrect chain order.
Status
Revoked certificate or unreachable/misconfigured OCSP and CRL endpoints.
Crypto
Unsupported algorithm, key size, protocol version, cipher, or damaged private key.
Enrollment
Invalid CSR, denied template, missing permission, duplicate identity, or failed renewal.
CROSS-OBJECTIVE REVIEW
Common symptoms & likely checks
Use symptoms to choose evidence, not to jump directly to a cause. Multiple failures can look alike.
| Symptom | Check first | Then validate | Avoid |
|---|---|---|---|
| Endpoint stops reporting | Agent/service, time, disk, network | Collector, parser, permissions, policy | Assuming “no alert” means safe |
| NAC quarantine | Identity and posture reason code | Certificate, EAP, patch, VLAN assignment | Disabling posture checks globally |
| TLS warning | Name, date, issuer, chain | OCSP/CRL, cipher, system time | Clicking through or disabling validation |
| VPN connects but no resources | Assigned IP, routes, DNS | Authorization, split tunnel, firewall return path | Reinstalling before testing the data path |
| DLP blocks valid work | Data match and policy rule | Classification, destination, approved workflow | Broad user or application exemption |
| SIEM alert flood | Source change and rule threshold | Duplicates, parser, enrichment, suppression | Muting the entire detection category |
EXAM PREPARATION
Study strategy for troubleshooting questions
1. READ
Find the exact symptom
Separate authentication, authorization, connectivity, detection, and policy failures.
2. CORRELATE
Use more than one signal
Match timestamps and entities across the smallest useful set of logs.
3. CHOOSE
Prefer the safest next action
Validate before disruption unless the scenario shows immediate active harm.
4. VERIFY
Close the loop
Rescan, retest, monitor, document, and confirm business service recovery.
PBQ practice prompt
Given a failed EAP-TLS Wi-Fi login, inspect the client time, certificate validity/SAN/EKU, issuer chain, RADIUS reason code, NAC posture result, and assigned VLAN. Put the checks in dependency order and identify which evidence proves the root cause.
Practice Security+ questions