Practice Labs
Supplementary — not from your PDFHands-on exercises linked to subtopics in your guide. You've done 0 of 38.
Classify incidents with the CIA triad
A tabletop exercise. Decide which CIA property (or non-repudiation) each incident hurts, and which control would have helped.
L1
Inventory the security controls around you
Find real controls at home or work and label each one by category (managerial, operational, technical, physical) and functional type.
L1
Inspect a suspicious email safely
Read the headers of a spam or phishing message already sitting in your own mailbox and spot the warning signs, without clicking anything.
L2
Verify a download with a hash
Check that a file you downloaded is exactly what the publisher released by comparing SHA-256 digests.
L3
Encrypt, decrypt and sign with OpenSSL
Use symmetric encryption on a file, then create an RSA key pair to sign and verify it, which ties together three sections of Lesson 3.
L3
Inspect a website's certificate chain
Read a real TLS certificate and find the subject, SAN, issuer, validity dates, chain of trust and revocation details.
L3
See why passwords are salted and stretched
A short Python experiment showing how salting stops identical passwords producing identical hashes, and how key stretching makes each hash slower to compute.
L3 · L4
Set up and review MFA on your own account
Turn on app-based multifactor authentication for an account you own, store the recovery codes safely, and review its sign-in activity.
L4
Audit your passwords with a password manager
Use a reputable password manager's built-in health report to find weak or reused passwords on your own accounts and replace them.
L4
Apply least privilege on Linux
Create users and groups in a practice VM, lock down a shared folder, and give one user a single narrowly scoped sudo permission.
L4
Build an isolated practice network
Set up two virtual machines on a host-only network so you have a safe, segmented place for every other lab. Then prove it is isolated from your home network.
L5
Configure a host firewall (default deny)
Lock down a practice VM with ufw: block all inbound traffic except SSH from your lab network, then check what's allowed.
L5 · L9
Harden SSH with key-based login
Replace password logins with an SSH key pair on your practice VM, then turn off password and root login.
L3 · L5
Map the shared responsibility model
For three cloud services you actually use, work out which security tasks the provider handles and which are yours.
L6
Run a container with least privilege
Start the same web container twice, once with defaults and once hardened, and compare what each one is allowed to do.
L10 · L6
Back up, restore and verify
Back up a folder, restore it somewhere else, and prove the restore is complete with hashes. Then write a 3-2-1 plan for your own data.
L3 · L7
Build an asset inventory
Record every device and important account you own, with owner, classification and support status. Then find the ones that are end-of-life.
L6 · L7
Look up CVEs for your own software
List software versions on your own computer, check them against the National Vulnerability Database, read the CVSS scores, and plan fixes.
L8
Audit and harden a Linux VM
Run the open-source auditing tool Lynis on your practice VM, fix a few of its findings, and re-run it to see the hardening index improve.
L10 · L9
Secure your home Wi-Fi router
Review your own router's settings against the wireless security topics in Lesson 9 and fix the weak ones.
L5 · L9
Record a Windows security baseline
Check the built-in protections on your own Windows PC with PowerShell and Windows Security, and write down a baseline you can compare against later.
L10 · L3
Harden your own phone
Go through your phone's settings against Lesson 10B: screen lock, encryption, app sources, location, Bluetooth and NFC.
L10 · L8
Add security headers to a local web server
Serve a page from a local nginx container, add standard HTTP security headers, and check them with curl and your browser's developer tools.
L11 · L5
Read email security DNS records
Look up the MX, SPF and DMARC records for domains you use, and explain what each one tells receiving mail servers.
L11 · L2
Investigate Windows sign-in events
Find your own successful and failed sign-ins and privileged sessions in the Windows Security log, then filter them the way a SOC analyst would.
L12
Review SSH authentication logs on Linux
Generate your own successful and failed SSH logins between two practice VMs, then find and summarise them with journalctl and grep.
L12 · L13
Capture and read your own traffic in Wireshark
Capture your own computer's traffic while you browse, then use display filters to find DNS lookups and TLS handshakes, and see what encryption hides and what it doesn't.
L11 · L12
Tabletop: respond to a ransomware incident
Walk a realistic ransomware scenario through every incident response phase, and produce a timeline, decisions and a lessons-learned report.
L12 · L13
Preserve evidence with hashes and chain of custody
Practise collecting a copy of some files as evidence: hash them, log every handover on a chain-of-custody form, and later prove nothing has changed.
L12
Read a web server's access log
Run a local web server, browse it yourself (including a few pages that don't exist), then read the access log to pick out status codes, clients and unusual requests.
L12 · L13
Check a file's reputation by its hash
Hash a legitimate installer and look the hash up in a public reputation service. This is how analysts check an indicator of compromise without handling a suspicious file.
L13 · L3 · L8
Write a change request
Plan a real change, such as a router firmware update, through a proper change management process: impact analysis, test plan, backout plan and maintenance window.
L14
Automate a daily security status report
Write a PowerShell script that collects key security settings on your own PC into a CSV, then schedule it. It's a small example of security automation and continuous monitoring.
L12 · L14
Calculate SLE, ARO and ALE
Work through quantitative risk for three scenarios in a spreadsheet, then choose a risk response by comparing a control's cost with the loss it prevents.
L15
Assess a vendor you already use
Use a cloud service's public trust or security page to fill in a short vendor questionnaire, and decide which agreements you'd need with them.
L15 · L2
Classify your own data
Sort a sample of your own files into classification levels and write the handling rules for each: where it may be stored, who may see it, and how it's shared and destroyed.
L14 · L16
Detect sensitive data with pattern matching
Build the core of a data loss prevention rule: regular expressions that find card-number-like and email patterns in a folder of test files.
L11 · L16 · L8
Mask and tokenize data in a database
With Python's built-in SQLite, store fake customer data, give support staff a masked view, and replace card numbers with tokens held in a separate vault table.
L16 · L3