Table of Contents

Return to the Cybersecurity Career Playbook

Practice only on systems you own or have written permission to test. Keep vulnerable targets on a host-only network with no route to household, school, employer, or public systems. Take snapshots. Stop if the target leaves the defined range.

Project 1: Account Review

Use a disposable Linux VM.

  1. Record the VM name, operating system, snapshot, and network mode.
  2. Create two test users.
  3. Give one user membership in a test administrative group.
  4. Record the group membership and file access.
  5. Remove the unnecessary privilege.
  6. Confirm the user loses the protected action while the intended administrator keeps access.
  7. Restore the snapshot or delete the test users.

Artifact: Access-review table, before and after evidence, denied test, rollback, and one limitation.

Pass condition: A reviewer identifies the excessive access, sees the denied result, and follows the cleanup record.

Project 2: Synthetic Alert Triage

Use this invented event:

10:02 login success for alex from 192.0.2.44
10:04 five failed logins for backup-admin from 192.0.2.44
10:06 successful login for backup-admin from 192.0.2.44
10:08 archive download of 2.1 GB

Write a report with observed facts, two hypotheses, missing evidence, asset and account questions, severity rationale, safe next check, and escalation threshold.

Do not state compromise as fact. The event might show misuse, an approved maintenance task, or a flawed simulation.

Artifact: One-page triage record.

Pass condition: The report separates observations from inferences, requests useful evidence, and avoids destructive containment without authority.

Project 3: Trust-Boundary Review

Draw a fictional small service with user device, identity provider, web service, database, logging service, and backup. Mark data flow and trust boundaries.

Choose one boundary and record:

  • Asset and data
  • Authorized identity
  • Allowed action
  • Logging evidence
  • Failure or abuse case
  • Owner and escalation
  • Recovery need

Artifact: Diagram and one control decision.

Pass condition: Every flow has a source and destination, the selected control has an owner, and the record states how to verify the result.

Publish Safely

Use invented names and reserved example addresses. Remove tokens, screenshots from live systems, organization details, and challenge answers restricted by platform rules. Label expected and observed results.

Final Review

Score each project for scope, safety, reproducibility, evidence, cleanup, and communication. Each category scores zero to two.

Completion requires ten out of twelve and no zero for scope, safety, or cleanup.

Continue with the Cybersecurity Career Plan .