incident-response-trainer
Incident response training · Rule-based scoring
DemoCatalogHistoryDashboard
← Back to catalog
Cloud Infrastructureextremely-hardDR Failover Split-Brain ManipulationCritical asset
Scenario

Manipulated health checks forced a DR failover — both regions now accept writes (split-brain)

A extremely-hard Cloud Infrastructure scenario on DR Failover Split-Brain Manipulation.

Practice this scenario

Start a graded attempt against this scenario. Your response is scored by the same deterministic rubric used across the catalog. Email and evidence content stay hidden until you start.

Launches this exact scenario. One of 4 templates in this Track + Difficulty pool.

catalog id · cloud-dr-failover-split-brain-manipulation

Training alignment

What this scenario practices, mapped to recognized frameworks.

Educational mapping only. Not a compliance attestation.

What this trains
  • Stop divergence and reconcile a manipulated cross-region failover
  • Harden the DR path so tampered health checks cannot force a flip
MITRE ATT&CKmitre-attack
  • Modify Cloud Compute Infrastructure · Defense EvasionT1578 · TA0005
    MappedMedium confidence

    Trains detecting a tampered health-check/failover configuration set by an unexpected identity.

  • Data Manipulation · ImpactT1565 · TA0040
    PartialMedium confidence

    Trains reconciling diverging writes after a forced failover produced a split-brain.

MITRE D3FENDmitre-d3fend
  • Resource Access Policy AuditingD3-RAPA
    MappedHigh confidence

    Trains auditing who obtained DR-config rights and changed the health-check target.

  • User Account ContainmentD3-UAC
    MappedHigh confidence

    Trains revoking the unexpected automation identity that triggered the failover.

NIST CSF 2.0nist-csf-2
  • Continuous Monitoring · DetectDE.CM · DE
    MappedHigh confidence

    Trains detecting a failover with the 'failed' region still healthy.

  • Incident Recovery Plan Execution · RecoverRC.RP · RC
    MappedMedium confidence

    Trains a controlled recovery that reconciles divergence rather than discarding writes.

NIST SP 800-61r3nist-sp-800-61r3
  • IR lifecycle phaseContainment, Eradication & Recovery
    MappedHigh confidence

    Trains stopping dual-write and reconciling both regions without deleting a side.

  • IR lifecycle phaseDetection & Analysis
    MappedHigh confidence

    Trains reconstructing how the tampered health check forced the failover.

CISA Cybersecurity Performance Goalscisa-cpg
  • System Backups2.R
    MappedHigh confidence

    Trains relying on intact backups to reconcile divergent regional writes.

  • Detecting Relevant Threats and TTPs3.A
    MappedMedium confidence

    Trains detecting manipulation of the DR/health-check control path.

CIS Controls v8cis-controls
  • Data RecoveryControl 11
    MappedHigh confidence

    Trains the data-recovery control behind reconciling a split-brain safely.

  • Audit Log ManagementControl 8
    MappedHigh confidence

    Trains preserving DR controller, health-check, and per-region write logs.