ghaymah-exam-mahmoud-secops/
├── q1-security-audit/
│   ├── security-checklist.md        # 15-item checklist (Container, Network, OWASP, Data, IAM)
│   └── security-audit.sh            # Bash script: scans ports, SSL, file permissions
├── q2-attack-simulation/
│   ├── incident-response.md         # Full Q2: timeline, IR plan, prevention, alert rules
│   └── alert-rule.yml               # Deployable Prometheus alert rules for brute force detection
├── q3-privacy-assessment/
│   ├── privacy-report.md            # mithal.space assessment: headers, cookies, trackers, comparison
│   └── screenshots/                 # Browser screenshots taken during inspection
│       ├── homepage.png
│       ├── https-certificate.png
│       └── search-results.png
├── q4-siem/
│   ├── siem.py                      # Python log analyzer: auth, nginx, app logs → alerts.json
│   ├── dashboard.html               # Near-real-time alert dashboard (dark theme, no dependencies)
│   ├── deploy-guide.md              # Deployment on Ghaymah Block Storage via systemd
│   └── alerts.json                  # Generated alert output (created at runtime)
├── q5-ransomware-response/
│   ├── emergency-plan.md            # 60-minute ransomware response playbook
│   ├── backup-recovery-strategy.md  # RPO/RTO targets + 3-2-1 rule implementation
│   └── prevention-plan.md           # 5-layer prevention: auth, hardening, network, email, monitoring
├── common-mortakaz/
│   ├── Integration-1.md             # SIEM ↔ Alerting integration
│   └── Integration-2.md             # Backup ↔ Incident Response integration
├── common-qabilah/
│   └── qabilah-profile.txt          # Candidate profile
└── README.md

Questions Summary

Q1 — Security Audit for ghaymah.systems

15-item security checklist across 5 domains (Container, Network, OWASP, Data, IAM)
Bash script that automatically scans: open ports, SSL certificate validity, sensitive file permissions

Run the audit:

chmod +x q1-security-audit/security-audit.sh
./q1-security-audit/security-audit.sh ghaymah.systems 443 .

Q2 — Attack Simulation & Incident Response

Scenario: Brute force on /api/v1/auth/login → successful login → data exfiltration
All deliverables consolidated in incident-response.md:
- Timeline: T+00:00 (recon) → T+01:00 (credential found) → T+01:15 (exfiltration) → T+03:00 (detection)
- 5-phase IR plan: Identification → Containment → Eradication → Recovery → Lessons Learned
- Prevention: rate limiting, WAF, Kubernetes NetworkPolicy, container hardening, MFA
alert-rule.yml: deployable Prometheus rules detecting brute force and anomalous data exports

Q3 — Privacy Assessment of mithal.space

Inspected via browser DevTools (Network, Application, Security tabs)
Findings: HTTPS enforced ✅, no cookies ✅, no tracking scripts ✅, HSTS missing ❌
Privacy score: 8/10 — Strong
Compared to DuckDuckGo and Google Search
3 recommended improvements: add HSTS, self-host Google Fonts, tighten CSP (remove 'unsafe-inline')

Q4 — Lightweight SIEM Log Analyzer

siem.py: reads auth.log, nginx/access.log, app/application.log; detects SSH brute force, HTTP flooding, SQL injection, JWT abuse, and critical application errors
Outputs alerts.json consumed by the dashboard
dashboard.html: near-real-time dark-mode dashboard (30s refresh) with severity stats, IP threat map, activity feed
Deployment: systemd service + Ghaymah Block Storage for log persistence + backup strategy

Run locally (demo mode):

cd q4-siem
python3 siem.py        # Generates alerts.json
# Open dashboard.html in browser

Q5 — Ransomware Response Plan

Scenario: All Block Storage files encrypted with ransom message
Emergency plan: detect → isolate → take forensic snapshot → restore from clean backup → communicate
Backup strategy: RPO=1h, RTO=4h, 3-2-1 rule (live volume + hourly Object Storage backups + offsite weekly)
Prevention: 5 layers — access control, system hardening, network segmentation, email filtering, integrity monitoring

How to Use This Repository

Need	File
Run an automated security scan	`q1-security-audit/security-audit.sh`
Respond to an active API attack	`q2-attack-simulation/incident-response.md`
Set up brute-force alerting	`q2-attack-simulation/alert-rule.yml`
Review site privacy posture	`q3-privacy-assessment/privacy-report.md`
Deploy a SIEM system	`q4-siem/siem.py` + `q4-siem/deploy-guide.md`
Respond to ransomware now	`q5-ransomware-response/emergency-plan.md`
Set up backup strategy	`q5-ransomware-response/backup-recovery-strategy.md`