# Pre-assessment and post-test: Form A and Form B **About 20 minutes, alone, in writing, no reading beforehand.** Answer each item in one to three sentences. There is no penalty for "I don't know"; write it rather than guess, because the result decides which pages you read. Print Form A and Form B on separate sheets. Run one as the pre-assessment and the other as the post-test, and alternate which comes first between cohorts. The key and the routing rules are on the teaching page: https://assured-methodology.vercel.app/docs/teaching Participant code: ________ ## Form A **1. Alert.** A detection for remote-administration tools fires on the IT team's sanctioned, change-ticketed deployment tool doing exactly what the rule describes. Write the verdict. Answer: **2. Alert (depth).** A Level 0 pattern entry matches every discriminator, but the subject is a domain administrator. What level does the case run at, and why? Answer: **3. Subject.** The alert names service account svc-backup in an interactive logon from an HR workstation. Who is the subject? Answer: **4. Subject.** A manager emails the SOC that the employee in your open case is going through a divorce and seems stressed. What goes into the case record? Answer: **5. Scope.** A phishing message reached four mailboxes; one recipient opened it. Draw the entity boundary and name one deliberate exclusion. Answer: **6. Scope.** An attacker session read a store holding personal data of people in the EU. What do you record, and who decides whether a notification clock started? Answer: **7. Uncover.** Your leading hypothesis is an attacker; the one benign alternative (an admin's weekend maintenance) is untested. What does your ledger say? Answer: **8. Uncover.** A user submitted the password on a phishing kit's page; the attacker's sign-in then failed at MFA. What is the user's status? Answer: **9. Risk.** The evidence on a domain controller alert has been examined and leans benign. Which axis does that lower, and what cell results? Answer: **10. Risk.** A crown-jewel database alert arrives and the relevant logs are not available yet. Score likelihood and confidence. Answer: **11. Escalation decision.** During Subject you confirm, at High confidence, that an attacker's session on a mailbox is still live. What happens now? Answer: **12. Documentation.** A close note reads "FP, known noise." Name three of the rubric checks it fails. Answer: --- ## Form B **1. Alert.** A rule for LSASS memory access fires on the backup agent the vendor documents as reading LSASS, on a host where that agent is approved. Write the verdict. Answer: **2. Alert (depth).** A CI runner that holds release-signing keys matches a pattern entry exactly. What level does the case run at, and why? Answer: **3. Subject.** An app named "Contoso Files Sync" performs bulk reads after an admin consented to it. Who or what is the subject, and which identifier do you record? Answer: **4. Subject.** A colleague tells you the subject of your case has money troubles. What goes into the case record? Answer: **5. Scope.** One host shows a beacon to a new domain. Draw the entity boundary and name one deliberate exclusion. Answer: **6. Scope.** An attacker session read a store holding California residents' personal data. What do you record, and who decides whether a notification clock started? Answer: **7. Uncover.** A change ticket matches the activity's time window. What does your ledger do with it? Answer: **8. Uncover.** A user entered the password on a kit's page and closed the tab before any MFA prompt. What is the user's status? Answer: **9. Risk.** The evidence on a payroll-server alert has been examined and leans benign. Which axis does that lower, and what cell results? Answer: **10. Risk.** An identity-provider admin alert arrives and the sign-in logs have not been examined. Score likelihood and confidence. Answer: **11. Escalation decision.** EDR quarantined a malicious download before it ran: no process, no callback, no persistence. Does this page IR? Answer: **12. Documentation.** A close note reads "Looked normal, closing." Name three of the rubric checks it fails. Answer: