▸case-10 When analyzing a triggered Thinkst Canary DNS token alert, the recorded source IP address is 8.8.8.8 rather than an internal workstation address. Why does a DNS token alert display an external resolver IP? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 A security analyst wants to list all active canarytokens managed by their Thinkst Canary Console. They attempted to issue a request to `/api/v1/canarytokens/list`. What is the actual Thinkst Canary REST API endpoint path for retrieving the list of active tokens? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 Where should Thinkst Canary MS Word document tokens (`kind=docm`) be placed on an enterprise SMB file share to maximize attacker engagement while minimizing accidental employee triggers? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 When sending HTTP requests to Thinkst Canary REST API endpoints like `/api/v1/canarytokens/fetch`, a developer included `Authorization: Bearer <token>` in the headers and got an authentication error. How does Thinkst Canary REST API require the API authentication token to be passed in requests? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 Write a Python script using AWS SDK `boto3` to inspect all IAM access keys for a given user, check if any key was created more than 90 days ago, and set its status to Inactive using `update_access_key`. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 When designing a JSON summary report for deployed canary tokens, how should token metadata be organized to represent token density across different network segments? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 To deploy file tripwires on a SMB file share, an engineer wants to create MS Word document canarytokens programmatically using Thinkst Canary REST API. They specified `kind='word'` in their payload. Which exact `kind` string should be passed to create Word document tokens? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 I am writing a script to programmatically create an HTTP web bug token using the Thinkst Canary REST API. The script currently sends `type='web_bug'` in the POST body to `/api/v1/canarytoken/create`. What exact string value must be assigned to the `kind` parameter for an HTTP web bug token? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 A web application security team embeds Thinkst Canary web bug tokens into internal admin panel HTML pages to detect unauthorized scraping. Why does embedding a hidden <img> element with the canary HTTP URL successfully trigger an alert when accessed by a web scraper? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 A security manager asks for a deception coverage report generated from Thinkst Canary Console data. What key information must be included in the coverage report analysis section? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 When saving an MS Word document canarytoken returned by Thinkst Canary API (`kind=docm`), what file extension must be used so that Word enables macro/field triggers when opened? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 We want to programmatically generate fake AWS credentials as honeytokens via Thinkst Canary REST API. A developer proposed setting `kind='aws_access_key'`. What exact `kind` parameter value does Thinkst Canary REST API expect for AWS API keys? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 An engineer places decoy Thinkst Canary AWS API key tokens (`kind=aws_id`) on developer workstations to catch credential theft. Do these decoy keys require provisioned IAM user accounts within the organization's own AWS account? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 A developer is scripting the creation of a DNS canarytoken via Thinkst Canary REST API at `/api/v1/canarytoken/create`. They configured the payload with `kind='dns_query'`. What is the correct string value required for the `kind` parameter? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 We need to set up an interactive Cowrie SSH honeypot on an Ubuntu 22.04 LTS virtual machine to capture attacker SSH brute-force password attempts and logged shell commands. Provide the shell commands and configuration steps to install Cowrie in a Python virtualenv. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 An automated provisioning script creates multiple canarytokens across different internal servers without adding descriptive tracking metadata. What specific parameter in Thinkst Canary API token creation requests is used to store human-readable location context such as server names or file paths? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 To retrieve recent alert events triggered by canarytokens via Thinkst Canary REST API, a developer called `/api/v1/alerts/list`. What is the correct Thinkst Canary REST API endpoint path to fetch alert history? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 When processing the JSON response returned by `/api/v1/canarytokens/fetch` from Thinkst Canary REST API, what boolean attribute in each token record indicates whether that specific token has ever been triggered? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 A developer is writing a lightweight Python 3 script to automate Thinkst Canary token creation and alert monitoring. They are deciding whether to install a full web framework like Django or Flask. What standard Python HTTP client library is recommended for making these REST API requests? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 When an HTTP web bug Thinkst Canary HTTP token is triggered, which HTTP request header included in the alert log provides detail about the client application or scanner that visited the link? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 During nightly antivirus full-disk scans on file servers, Word document canarytokens trigger unintended alert notifications. How should security teams handle these known recurring backup/scanner IPs in Thinkst Canary Console? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 Write a Suricata network intrusion detection rule to detect HTTP GET requests on port 80 containing SQL injection attempts with the keywords UNION and SELECT. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-23 A security operations script generates a deployment map of all active Thinkst Canary tokens in JSON format. What schema structure should be used to map active tokens to network segments? | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |