CyberSim · CAE-CAI 2026

Knowledge Unit practicum

Complete the actual work, attach its outputs, explain what the evidence shows, and transfer the method to an unfamiliar case. Faculty review every official outcome.

CSF · threat lab · 70 minutes

Attack-to-control range

Investigate a compromised AI support service, classify the attack path, rank vulnerabilities, and deploy proportionate controls.

Do the work

Build an attack path from mixed host, identity, and model records.
Rank three vulnerabilities by impact and exploitability.
Configure access, integrity, and recovery controls, then rerun the incident.

Submit these artifacts

Attack-path graph with cited records.
Before-and-after control test report.

Server-executed native workbench

Run the primary and transfer fixtures

The server executes each fixture and returns a signed, content-addressed artifact that is sealed with the submission.

StrategySensitivity 65Scope 55

Primary fixturecae-practicum-csf

Unfamiliar transfercae-practicum-csf-transfer

Outcome evidence

Artifact references can be approved repository URLs, LMS files, or institution-controlled evidence identifiers.

Primary workbench artifactReport or transfer artifact

CSF.1Faculty-ratedIdentify confidentiality, integrity, availability, authenticity, and nonrepudiation in an incident record.CSF.2Faculty-ratedPrioritize competing cybersecurity goals for a service with explicit operational constraints.CSF.3Faculty-ratedInfer an attacker's objective, capability, access, and motivation from cited telemetry.CSF.4Faculty-ratedClassify attack techniques from host, identity, network, and application evidence.CSF.5Faculty-ratedRank vulnerabilities by exploitability, impact, exposure, and affected assets.CSF.6Faculty-ratedDistinguish malware behavior families from process, persistence, and network indicators.CSF.7Faculty-ratedMatch preventive, detective, corrective, and recovery mechanisms to observed attack paths.CSF.8Faculty-ratedDesign and test layered protection for an unfamiliar system while preserving required service behavior.CSF.9Faculty-ratedConfigure identification, authentication, authorization, and audit controls and verify enforcement.CSF.10Faculty-ratedAnalyze a dated cybersecurity event from authoritative sources and separate confirmed facts from inference.

Transfer performanceUnfamiliar fixtureApply the same method to the sealed transfer variant. Explain what changed, what remained valid, and cite the second artifact.