Modern Cybersecurity
A 12-week live cybersecurity course for beginners that builds toward SOC-analyst skills through graded labs and a capstone incident report.
Curriculum
SEN-01How Systems Talk5 lessons · 16 h
- TCP/IP stack
- DNS and HTTP
- TLS 1.3
- Linux command line
- Reading packet captures and SSH logs
SEN-02Identity, Access & Zero Trust6 lessons · 16 h
- Password hashing
- MFA weaknesses and push-approval abuse
- Passkeys
- OAuth and OIDC
- Least-privilege IAM
- Zero trust concepts
SEN-03Web Application Security5 lessons · 16 h
- OWASP Top 10:2025
- Burp Suite Community
- OWASP Juice Shop challenges
- Exploit, prove and fix flaws
- Writing developer-ready findings
SEN-04Security Operations & Detection6 lessons · 16 h
- How a SOC works
- Windows and Linux logging
- SIEM queries
- MITRE ATT&CK mapping
- Sigma rules
- Alert triage
SEN-05Cloud, Containers & AI Security6 lessons · 16 h
- Shared-responsibility model
- AWS IAM and storage misconfigurations
- CloudTrail
- Secrets in code
- Container hygiene
- OWASP Top 10 for LLM applications
SEN-06Incident Response, Compliance & Capstone5 lessons · 16 h
- NIST SP 800-61 Rev. 3 response lifecycle
- Ransomware playbooks
- CERT-In 6-hour reporting rule
- DPDP Act and Rules
- Capstone investigation and report
What's included
Questions
Do I need prior experience?
This course is set at beginner level. The first module starts from the basics, so you only need the time and a laptop or phone with a stable connection.
What if I miss a live class?
Every live class is recorded and posted within 24 hours. You keep access to the recordings for 12 months.
When are the classes?
The next cohort starts 9 November 2026 and runs for 12 weeks, ~8 hrs per week. The full timetable and class link appear in My courses before the first class.
Which language is the course taught in?
English.
How do I pay?
Online through UPI, cards, net banking or wallets, processed by Razorpay. You get a receipt by email and the course appears in My courses right away.
Q01What is the CIA triad?FundamentalsBasic
Confidentiality: only authorised people can read data. Integrity: data is not changed without authorisation. Availability: systems and data are there when needed.
Most security controls protect one or more of these three.
Q02What is the difference between symmetric and asymmetric encryption?CryptographyBasic
Symmetric encryption, such as AES, uses one shared key and is fast. Asymmetric encryption, such as RSA or elliptic-curve, uses a public and private key pair and is used for key exchange and digital signatures.
TLS uses both: asymmetric cryptography to agree a key, then symmetric encryption for the data.
Q03What is the difference between hashing and encryption?CryptographyBasic
Encryption is reversible with the right key. Hashing is one-way.
Store passwords with a slow, salted hash designed for passwords, such as bcrypt or Argon2, never with plain SHA-256 and never encrypted.
Q04What is SQL injection, and how do you prevent it?Web securityIntermediate
User input is concatenated into a query and executed as SQL, letting an attacker read or change data.
Use parameterised queries or prepared statements, give the database account only the permissions it needs, and validate input.
Q05What is the difference between XSS and CSRF?Web securityIntermediate
XSS injects script that runs in the victim's browser on your site. Prevent it with context-aware output encoding and a Content Security Policy.
CSRF tricks a logged-in user's browser into sending a request they did not intend. Prevent it with anti-CSRF tokens and SameSite cookies.
Q06What happens during a TLS 1.3 handshake?NetworkingIntermediate
The client sends supported cipher suites and a key share. The server replies with its key share, its certificate and a signature proving it holds the private key.
Both sides derive session keys with ephemeral Diffie-Hellman, the client verifies the certificate chain, and encrypted data flows after one round trip.
Q07What is the difference between an IDS and an IPS?DetectionIntermediate
An intrusion detection system watches traffic and raises alerts. An intrusion prevention system sits inline and can block traffic.
An IPS needs careful tuning because a false positive blocks legitimate users, not just raises an alert.
Q08How would you triage an alert for a suspicious login?SOCAdvanced
Gather context: user, location, device, time, whether MFA passed, and impossible travel compared with recent logins. Correlate with other logs such as new inbox rules, mass downloads or privilege changes.
If it looks malicious, contain it: revoke sessions and reset credentials. Then confirm with the user, document what happened, and tune the rule if it was a false positive.
Q09What are the most common cloud security misconfigurations?CloudAdvanced
Publicly readable storage buckets, overly broad IAM roles, no MFA on admin or root accounts, access keys committed to code, security groups that open SSH or RDP to 0.0.0.0/0, and audit logging turned off.
Catch them with policy-as-code checks and a cloud security posture tool.
Also on its own page: Modern Cybersecurity interview questions