Start small
One useful decision at a time.
Open a lab below to see its purpose, starting knowledge and the evidence you will produce. Begin with its README, then use the same prepare, show, analyse, check and verify commands across all twenty.
Save a prediction before opening the reference answer. Repeat with less help, solve a changed case and explain the result aloud. The practice guide includes later recall checks and a private progress record.
These are original guided learning materials at an introductory level. Reference checks validate their behaviour and supplied answers. Personal completion and explanations have not yet been assessed. This is a practice curriculum, not evidence of production experience or every skill needed in a security role.
All inputs are fictional and all tools run offline. Some labs read formats such as saved scan exports or configuration text; others use deliberately small teaching models. Each README states its limits. No live scanning, cloud account or changes to your computer's security settings are required.
Practice track
Network investigation and testing
Read what a service exposes, test a narrow hypothesis and describe what the evidence supports.
Lab 07 / FoundationAsset discovery and inventory
Compare a saved scan with the authorised asset inventory.
- Start with
- DNS investigation; ports and services.
- Evidence
- Saved synthetic scan export and inventory.
- Your deliverable
- An inventory of expected, newly observed and unobserved services.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 08 / FoundationTCP handshake investigation
Distinguish a completed handshake, a reset and incomplete evidence.
- Start with
- DNS investigation; client and server roles.
- Evidence
- Packet summaries with flags, endpoints and frame order.
- Your deliverable
- A flow table with packet references and capture limitations.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 09 / FoundationTLS certificate review
Check certificate evidence against the intended hostname and observation time.
- Start with
- Names, UTC time and HTTPS basics.
- Evidence
- Decoded fictional certificate fields and connection context.
- Your deliverable
- A certificate review that separates validity checks from trust assumptions.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 10 / FoundationHTTP headers and cookies
Review web response settings against the needs of a fictional application.
- Start with
- HTTP log triage; requests and responses.
- Evidence
- Saved response headers and stated application requirements.
- Your deliverable
- A short configuration review with specific fixes and limits.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 11 / FoundationVulnerability prioritisation
Explain which fictional findings need attention first using an explicit local rubric.
- Start with
- Asset discovery; access review.
- Evidence
- Findings, exposure, service importance, exploitation and confidence.
- Your deliverable
- A prioritised queue with reasons, dependencies and uncertainties.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 12 / FoundationRemediation and retesting
Decide whether a claimed fix is demonstrated, incomplete or cannot yet be tested.
- Start with
- Asset discovery; careful evidence statements.
- Evidence
- Before-and-after evidence for fictional findings.
- Your deliverable
- A retest record with scope, result and the next evidence needed.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 13 / FoundationEmail identity and message triage
Compare message identities and destinations with trusted receiving evidence.
- Start with
- DNS and domain-name basics.
- Evidence
- Fictional From and Reply-To headers, extracted link domains and a receiver provenance register.
- Your deliverable
- A measured triage note that avoids treating one header as proof of safety.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Practice track
Defensive operations and recovery
Review endpoint activity, put events in context and check that recovery and configuration controls meet their purpose.
Lab 14 / FoundationEndpoint process investigation
Use process relationships and approved activity to decide what deserves review.
- Start with
- Login triage; basic process concepts.
- Evidence
- Synthetic process records and maintenance context.
- Your deliverable
- A process-tree review with benign alternatives and next checks.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 15 / FoundationScheduled task review
Compare recurring task settings and changes with authorised maintenance.
- Start with
- Endpoint process investigation.
- Evidence
- Task inventory, execution identities and approval notes.
- Your deliverable
- A change-review table for paths, timing and account use.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 16 / FoundationEvidence timeline reconstruction
Normalise event times and show where clock uncertainty limits ordering.
- Start with
- Login triage; UTC and time zones.
- Evidence
- Fictional logs with offsets and clock-quality context.
- Your deliverable
- A UTC timeline that distinguishes reliable order from overlapping time ranges.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 17 / FoundationAlert correlation and duplicate handling
Group related records without confusing duplicate alerts with separate incidents.
- Start with
- Login triage; timeline reconstruction.
- Evidence
- Synthetic alert identifiers, event times and correlation criteria.
- Your deliverable
- A grouping record showing retained evidence and ambiguous relationships.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Open the complete alert correlation and duplicate handling lab ↗
Lab 18 / FoundationBackup and recovery verification
Check backup scope, freshness and restore evidence against stated recovery needs.
- Start with
- File integrity; timeline reconstruction.
- Evidence
- Backup inventories, timestamps and synthetic restore-check evidence.
- Your deliverable
- A recovery-readiness note with gaps and the next validation step.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 19 / FoundationLinux file permission review
Work out access from owner, group and other permission bits.
- Start with
- Access review; files and directories.
- Evidence
- Fictional file modes, directory permissions and identity memberships.
- Your deliverable
- An access table explaining the relevant permission class and missing rights.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 20 / FoundationSSH configuration review
Evaluate a small supported configuration against stated administration requirements.
- Start with
- Linux permissions; authentication and authorisation.
- Evidence
- Saved synthetic configuration and an explicit supported-directive model.
- Your deliverable
- A configuration review that identifies unsupported cases and needed verification.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Practice track
Cloud, identity and configuration
Practise access lifecycle, exposure review and audit reasoning before working with a real cloud platform.
Lab 21 / FoundationCloud storage exposure review
Reason about public exposure in a deliberately small fictional storage model.
- Start with
- Access review; public versus private access.
- Evidence
- Storage settings, access rules and stated sharing requirements.
- Your deliverable
- An exposure review that preserves necessary sharing and describes model limits.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 22 / FoundationJoiner, mover and leaver access
Update access decisions when a person starts, changes duties or leaves.
- Start with
- Access review; timeline reconstruction.
- Evidence
- Fictional identity changes, effective dates and approved exceptions.
- Your deliverable
- A lifecycle action list tied to current duties and timing.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 23 / FoundationMFA and account recovery review
Check enrolment and recovery evidence against explicit account requirements.
- Start with
- Identity lifecycle; authentication basics.
- Evidence
- Account types, authentication settings and exception context.
- Your deliverable
- A control review that distinguishes enrolment from complete protection.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 24 / FoundationCloud audit-event investigation
Reconstruct identity and configuration activity from saved audit events.
- Start with
- Login triage; access review; timeline reconstruction.
- Evidence
- Fictional cloud audit records with outcomes and logging coverage.
- Your deliverable
- An event handover that separates successful actions, failures and missing evidence.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 25 / FoundationSecret handling and exposure review
Find fictional sensitive values in the wrong places and plan an appropriate response.
- Start with
- File integrity; public and private data boundaries.
- Evidence
- Dummy configuration, changes and logs containing obvious nonfunctional examples.
- Your deliverable
- An exposure map and ordered remediation checklist.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Lab 26 / FoundationDependency inventory and advisory review
Match a small inventory to fictional version-range advisories without assuming exploitability.
- Start with
- Vulnerability prioritisation; basic software version numbers.
- Evidence
- Software inventory, synthetic advisories and deployment context.
- Your deliverable
- An affected-version table with recommended verification and update priorities.
- First session
- 30–45 minutes for a first guided pass; split it into shorter sessions as needed.
Three scenarios, a worked example, a worksheet and repeatable reference checks. Independent practice not yet assessed.
Open the complete dependency inventory and advisory review lab ↗