Domain 1 — Help Desk & Ticketing
Live ticketing, triage, and first-line diagnostics on real infrastructure.
Infrastructure
- Zammad ticketing system (CT 110) — live instance, instructor review queue active
- Wazuh SIEM 4.14.6 (CT 130)
- Physical Cisco C1111 router (JLM-LAB-R1)
- Physical Cisco 3560CX switch (JLM-LAB-SW1)
- Proxmox PVE host
- Linux containers (CT 102, CT 103)
Labs
ticket-001 — DNS Resolution Failing
Level: Junior · Status: Active
What you'll do: You receive a ticket from a user whose device cannot resolve hostnames. Working on a live Linux endpoint, you trace the failure from the application layer down to the DNS resolver configuration and identify whether the issue is local, upstream, or in the name server itself.
What you'll learn: How to systematically diagnose name resolution failures using Linux network stack tools; how to distinguish between a misconfigured resolver, a dead DNS server, and an upstream outage.
Infrastructure: CT 102 — student-linux-01 (Debian); Zammad
ticket-002 — Device on Wrong VLAN
Level: Junior · Status: Active
What you'll do: A device is receiving the wrong DHCP lease and cannot reach expected network resources. You identify the VLAN assignment error on the switch and trace it back to the switchport configuration.
What you'll learn: How VLAN assignment affects DHCP lease behavior and reachability; how to verify switchport access VLAN configuration using Cisco IOS show commands.
Infrastructure: Physical Cisco 3560CX (JLM-LAB-SW1); Proxmox PVE network bridge; Zammad
ticket-003 — Proxmox Host Cannot Run apt update
Level: Junior · Status: Active
What you'll do: A Proxmox host is returning package manager errors on apt update. You audit the package source configuration, identify the failing repository entry, and restore a clean update path.
What you'll learn: How Debian-based package management works and what causes apt update failures; how to read and correct /etc/apt/sources.list and sources.list.d entries.
Infrastructure: Proxmox PVE host; Debian APT; Zammad
ticket-004 — Cannot SSH Into Switch
Level: Intermediate · Status: Active
What you'll do: An administrator cannot SSH into a Cisco switch. The connection drops at key exchange. You identify the SSH legacy key exchange mismatch between the modern client and the switch, and restore access without rebooting the device.
What you'll learn: Why SSH key exchange algorithm negotiation fails between modern clients and legacy Cisco IOS; how to apply client-side workarounds and what the permanent IOS-side fix looks like.
Infrastructure: Physical Cisco 3560CX (JLM-LAB-SW1); Zammad
ticket-005 — VLAN 1 Return Path Failure
Level: Intermediate · Status: Active
What you'll do: Traffic is leaving a source VLAN successfully but return traffic is not arriving. You trace the Layer 2 and Layer 3 return path across the physical switch and router, identify the missing or misconfigured segment, and verify the fix end-to-end.
What you'll learn: How to analyze a bidirectional traffic path; why return path failures are distinct from forward path failures and which tools expose each.
Infrastructure: Physical Cisco 3560CX (JLM-LAB-SW1); Physical Cisco C1111 (JLM-LAB-R1); Zammad
ticket-006 — Proxmox Repo Hygiene
Level: Intermediate · Status: Active
What you'll do: A Proxmox host is flagging enterprise subscription warnings and a mix of conflicting package sources. You audit the repository configuration, remove invalid sources, and produce a clean, warning-free update baseline.
What you'll learn: The difference between Proxmox enterprise and no-subscription repositories; why mixed or stale repo configurations cause update failures.
Infrastructure: Proxmox PVE host; Debian APT subsystem; Zammad
ticket-007 — Proxmox VLAN 70 Migration
Level: Intermediate · Status: Active
What you'll do: A container needs to be migrated from one VLAN to another without losing management access. You plan the migration, execute it on the Proxmox host, verify network connectivity post-move, and document the change.
What you'll learn: How to safely migrate an LXC container's network attachment in Proxmox; how to anticipate access loss risk during VLAN changes and sequence steps to avoid it.
Infrastructure: Proxmox PVE host; VLAN 70 network path; Zammad
ticket-008 — Comet ATX Hard Reset Validation
Level: Intermediate · Status: Active
What you'll do: A physical host is unresponsive and requires a hard reset. You follow validated hardware reset procedures, document the recovery sequence, and verify the system returns to a healthy operational state.
What you'll learn: Hardware-level recovery procedures for physical lab infrastructure; how to document a hard reset event in a way that distinguishes planned maintenance from an uncontrolled failure.
Infrastructure: Physical Comet ATX host; Zammad
ticket-009 — Zammad Ticket Triage
Level: Senior · Status: Active
What you'll do: You take ownership of a Zammad ticket queue containing multiple open items at different priority levels. You route, reprioritize, escalate, and close tickets correctly — simulating a real help desk intake and triage workflow under load.
What you'll learn: How to manage a ticket queue with competing priorities; the difference between routing, escalation, and closure; how to produce professional resolution notes that meet enterprise documentation standards.
Infrastructure: Zammad (CT 110) — live ticket queue; Instructor review queue
ticket-010 — Wazuh Alert Investigation
Level: Senior · Status: Active
What you'll do: A Zammad ticket arrives flagging a Wazuh security alert on a monitored endpoint. You access the Wazuh dashboard, query the alert index, determine whether the alert represents a genuine incident or a false positive, and write a Zammad investigation note with your disposition.
What you'll learn: How to move between a ticketing system and a SIEM to investigate a security event; how to apply triage discipline to distinguish noise from signal in a live alert stream.
Infrastructure: Wazuh SIEM 4.14.6 (CT 130) — live dashboard; CT 102 — HFG-LX01; CT 103 — HFG-LX02; VM 161 — HFG-WIN01; VM 162 — HFG-WIN02; Zammad (CT 110)
Domain 2 — Identity & Access Management
Active Directory, Group Policy, Entra MFA, and file-server permission architecture.
Infrastructure
- Active Directory Domain Services — jlm.lab domain, NetBIOS: JLM
- Group Policy — GPMC on JLM-DC01; Workstations OU and Students OU targets
- VM 160 — JLM-DC01 (Windows Server 2022, Domain Controller, DNS, file server role)
- VM 161 — JLM-WIN01 (Windows 11 Enterprise, domain workstation, Tailscale 100.90.160.62)
- VM 162 — JLM-WIN02 (Windows 11 Enterprise, domain workstation)
- Microsoft Entra tenant — ariamfatraininglabs.onmicrosoft.com (MFA & cloud identity labs)
- Physical Windows endpoints on Tailnet — jmg-server, desktop-opm9863, jm-swe
- Physical macOS endpoints on Tailnet — juliuss-macbook-pro, juliuss-imac, macbook-air
- Physical tablets — Android 7.0 tablet, Chrome tablet (Entra MFA / Authenticator testing)
- Zammad ticketing system (CT 110)
Labs
iam-001 — New User Onboarding
Level: Junior · Status: Active · Active Directory & Group Policy
What you'll do: A new employee needs a domain account. You create the user object in Active Directory, place it in the correct OU, assign group membership, set a compliant initial password, and validate that the account can log into JLM-WIN01.
What you'll learn: The full AD user provisioning workflow using both ADUC and PowerShell; how OU placement, group membership, and initial password policy interact at account creation.
Infrastructure: Active Directory (jlm.lab); VM 160 — JLM-DC01 (ADUC, PowerShell AD module); VM 161 — JLM-WIN01 (login validation); Zammad
iam-002 — Password Reset + Account Unlock
Level: Junior · Status: Active · Active Directory & Group Policy
What you'll do: A user is locked out and needs their password reset. You locate the account in Active Directory, verify the lockout state, reset the password to a compliant temporary value, and confirm the user can log in with the change-at-next-logon flag enforced.
What you'll learn: Help desk password reset procedures in Active Directory; the difference between a locked account, an expired password, and a disabled account; how to validate the reset through a real login attempt.
Infrastructure: Active Directory (jlm.lab); VM 160 — JLM-DC01 (Unlock-ADAccount, Set-ADAccountPassword); VM 161 — JLM-WIN01 (login test); Zammad
iam-003 — Group Membership + Access Request
Level: Junior · Status: Active · Active Directory & Group Policy
What you'll do: A user submits an access request for a network resource. You review their current group membership, add them to the appropriate security group, and verify the change takes effect at the resource level.
What you'll learn: How security groups control resource access in Active Directory; how to add and verify group membership using both ADUC and PowerShell; why group membership is the correct access grant mechanism rather than direct ACE modification.
Infrastructure: Active Directory (jlm.lab); VM 160 — JLM-DC01 (Add-ADGroupMember, Get-ADGroupMember); VM 161 — JLM-WIN01; Zammad
gpo-001 — Login Banner
Level: Junior · Status: Active · Active Directory & Group Policy
What you'll do: Your organization requires a legal notice to appear before every domain workstation login. You create a Group Policy Object, configure the interactive logon message, link it to the Workstations OU, and confirm the banner appears on JLM-WIN01 at the next login.
What you'll learn: How to create, configure, and link a GPO to an OU; the difference between Computer Configuration and User Configuration; how to verify GPO application using gpresult.
Infrastructure: Group Policy (GPMC); Active Directory (jlm.lab); VM 160 — JLM-DC01; VM 161 — JLM-WIN01 (gpupdate, login validation); Zammad
gpo-002 — Idle Screen Lock Policy
Level: Junior · Status: Planned · Active Directory & Group Policy
What you'll do: Your organization needs all student workstations to lock automatically after a period of inactivity. You create a User Configuration GPO scoped to the Students OU, set the idle timeout, and verify the lock triggers on JLM-WIN01.
What you'll learn: The difference between User Configuration and Computer Configuration GPO targeting; how User Configuration policies follow user objects and require the user's OU — not the computer's OU — as the link target.
Infrastructure: Group Policy (GPMC); Active Directory (jlm.lab); VM 160 — JLM-DC01 (Students OU); VM 161 — JLM-WIN01 (idle test, gpresult); Zammad
gpo-003 — Mapped Drives by Security Group
Level: Junior · Status: Planned · Active Directory & Group Policy
What you'll do: Users in the ARIA-Students group should receive the S: drive mapped to \\JLM-DC01\StudentShare at login. You configure a GPO Drive Map preference with item-level targeting so only members of the correct group receive the mapping.
What you'll learn: How GPO Preferences differ from GPO Policies; how item-level targeting uses group membership to scope a setting to a subset of users; how to validate a mapped drive through a real student login.
Infrastructure: Group Policy (GPMC); Active Directory (jlm.lab); VM 160 — JLM-DC01 (Group Policy Preferences); VM 161 — JLM-WIN01; Physical Windows endpoints on Tailnet; Zammad
iam-004 — Computer Cannot Join Domain
Level: Intermediate · Status: Active · Active Directory & Group Policy
What you'll do: A workstation is failing to join the jlm.lab domain. You trace the failure through DNS resolution, Kerberos authentication, and computer object creation, identify the root cause, and complete a validated domain join.
What you'll learn: The dependency chain behind a domain join — DNS must resolve the domain, the DC must be reachable, the join account must have rights to create computer objects; how to read the error codes that identify which step failed.
Infrastructure: Active Directory (jlm.lab); VM 160 — JLM-DC01 (DNS, AD DS); VM 161 / VM 162 (join target); Physical Windows endpoints on Tailnet; Zammad
iam-005 — GPO Not Applying to Workstation
Level: Intermediate · Status: Active · Active Directory & Group Policy
What you'll do: A Group Policy Object is confirmed as linked and enabled but a setting is not appearing on the target workstation. You trace the GPO application path using gpresult and rsop.msc, identify the scoping or targeting failure, and resolve it.
What you'll learn: The most common GPO application failures — wrong OU, wrong scope, WMI filter mismatch, security filtering gap — and how gpresult /r and the HTML report expose each one.
Infrastructure: Group Policy (GPMC); Active Directory (jlm.lab); VM 160 — JLM-DC01 (Get-GPInheritance); VM 161 — JLM-WIN01 (gpresult, rsop.msc); Zammad
gpo-004 — Password Policy + Weak Password Failure
Level: Intermediate · Status: Active · Active Directory & Group Policy
What you'll do: Your domain has no enforced password complexity requirement. You configure a domain-level Default Domain Policy with a 12-character minimum, complexity requirement, and 90-day maximum age, then verify the policy rejects a non-compliant password attempt.
What you'll learn: How domain password policy is configured at the domain root — not an OU; how to use net accounts to confirm the active policy; why weak passwords fail after the policy applies even if the account existed before.
Infrastructure: Group Policy (GPMC); Active Directory (jlm.lab); VM 160 — JLM-DC01 (Default Domain Policy); VM 161 — JLM-WIN01 (password change test); Zammad
gpo-005 — Account Lockout Policy + Unlock Workflow
Level: Intermediate · Status: Active · Active Directory & Group Policy
What you'll do: Your domain has no account lockout threshold. You configure lockout policy (5 attempts, 15-minute duration), deliberately trigger a lockout to confirm enforcement, then perform the unlock and validate re-access.
What you'll learn: How account lockout policy works at the domain level; the difference between lockoutDuration (auto-unlock timer) and manual unlock; how to use both ADUC and Unlock-ADAccount and document the resolution.
Infrastructure: Group Policy (GPMC); Active Directory (jlm.lab); VM 160 — JLM-DC01 (Search-ADAccount -LockedOut, Event Viewer 4740); VM 161 — JLM-WIN01; Zammad
iam-006 — MFA Enrollment + Registration Verification
Level: Intermediate · Status: Active · MFA & Cloud Identity
What you'll do: A new hire needs to enroll in multi-factor authentication on your organization's Microsoft Entra tenant. You walk through the full enrollment flow, register the Microsoft Authenticator app, confirm the MFA method appears in the user's authentication profile, and verify sign-in succeeds with MFA enforced.
What you'll learn: How MFA registration works in Microsoft Entra; the relationship between Conditional Access policies and MFA enforcement; how to verify enrollment from the admin side versus the user side.
Infrastructure: Microsoft Entra (ariamfatraininglabs.onmicrosoft.com); Microsoft Authenticator app; Physical tablet or phone; Zammad
iam-007 — MFA Lost Device Support Workflow
Level: Intermediate · Status: Active · MFA & Cloud Identity
What you'll do: A user reports they cannot complete MFA because their registered device is no longer available. You locate the account in Entra, review their registered authentication methods, reset MFA state to allow re-registration, and verify the user can re-enroll successfully.
What you'll learn: How to perform a safe MFA reset for a locked-out user; the difference between clearing a single method and full MFA reset; how to validate re-enrollment from both the user and admin perspective.
Infrastructure: Microsoft Entra (ariamfatraininglabs.onmicrosoft.com); Entra admin center; Physical tablet (Android or Chrome); Zammad
fs-001 — File Server Permission Model Deep Dive
Level: Intermediate · Status: Active · File Server Administration
What you'll do: You audit the SMB and NTFS permission layers on \\JLM-DC01\StudentShare, test effective access using the Security tab, demonstrate that an explicit Deny ACE overrides a group Allow, and break and restore NTFS inheritance on a subfolder.
What you'll learn: How SMB and NTFS permissions interact and which layer is the effective ceiling; why explicit Deny ACEs win over Allow ACEs at the same scope; the operational difference between /inheritance:r and /inheritance:d.
Infrastructure: Active Directory (jlm.lab); File server role on VM 160 — JLM-DC01 (icacls, Get-SmbShareAccess); VM 161 — JLM-WIN01 (student01 session); Physical Windows or macOS endpoints on Tailnet; Zammad
fs-002 — Multi-Share Access Segmentation and Security Group Testing
Level: Intermediate · Status: Planned · File Server Administration
What you'll do: You build an access matrix across all six shares in the jlm.lab file server environment, test the write-only behavior of the SecurityLogs share, then perform a live grant and revoke of InstructorShare access by adding and removing student01 from the ARIA-Instructors security group.
What you'll learn: How security groups create access segmentation across a multi-share environment; why Kerberos tokens require a logoff/logon to reflect new group membership; why group-based access is the correct enterprise model over per-user ACEs.
Infrastructure: Active Directory (jlm.lab); File server role on VM 160 — JLM-DC01 (six SMB shares, Add-ADGroupMember); VM 161 — JLM-WIN01; Zammad
gpo-006 — PowerShell Logging
Level: Senior · Status: Active · Active Directory & Group Policy
What you'll do: You create a Computer Configuration GPO that enables PowerShell Module Logging, Script Block Logging, and Transcription on JLM-WIN01, apply it via gpupdate, generate PowerShell activity as student01, and validate the evidence in both the transcript file and Event Viewer (Event IDs 4103 and 4104).
What you'll learn: The three layers of PowerShell logging and what each captures; why PowerShell logging is a computer-side control that follows the workstation; how security teams use transcript files and event logs during incident response.
Infrastructure: Group Policy (GPMC); Active Directory (jlm.lab); VM 160 — JLM-DC01 (Workstations OU); VM 161 — JLM-WIN01 (Event Viewer, C:\ARIA-Logs\PowerShellTranscripts); Zammad
iam-008 — Conditional Access + MFA Troubleshooting
Level: Senior · Status: Active · MFA & Cloud Identity
What you'll do: A user is being blocked from signing in or repeatedly prompted for MFA in unexpected ways. You review the Conditional Access policies in the Entra admin center, trace the sign-in log to the specific policy causing the behavior, and determine whether the enforcement is correct or misconfigured.
What you'll learn: How Conditional Access policies evaluate sign-in context (location, device compliance, risk level) and trigger MFA or block actions; how to use Entra sign-in logs to identify which policy fired and why.
Infrastructure: Microsoft Entra (ariamfatraininglabs.onmicrosoft.com); Entra Conditional Access; Entra sign-in logs; Physical macOS or Windows endpoint on Tailnet; Zammad
iam-009 — Suspicious MFA Prompt + Escalation Review
Level: Senior · Status: Active · MFA & Cloud Identity
What you'll do: A user reports receiving an MFA push notification they did not initiate. You review the account's recent sign-in activity in Entra, assess whether the prompt represents an active credential stuffing attempt or an authorized sign-in from an unexpected location, and write an escalation note with your finding.
What you'll learn: How to use Entra sign-in logs and MFA activity reports to investigate a suspicious authentication event; how to apply escalation language that conveys appropriate urgency without overstating confidence in an incomplete investigation.
Infrastructure: Microsoft Entra (ariamfatraininglabs.onmicrosoft.com); Entra Identity Protection; Physical tablet (Android or Chrome); Zammad
iam-010 — Emergency Access Account + Exception Handling
Level: Senior · Status: Active · MFA & Cloud Identity
What you'll do: Your organization needs a break-glass emergency access account that bypasses MFA and Conditional Access for use when the primary admin is locked out. You configure the account in Entra, verify it is excluded from all CA policies, document the account per security policy, and simulate a controlled use scenario.
What you'll learn: Why emergency access accounts exist and what makes them safe despite bypassing standard controls; how to configure Conditional Access exclusions without creating broad policy gaps.
Infrastructure: Microsoft Entra (ariamfatraininglabs.onmicrosoft.com); Entra Conditional Access; Entra audit logs; Zammad
fs-003 — Home Folders and Per-User Subfolder Access
Level: Senior · Status: Planned · File Server Administration
What you'll do: You provision per-user home folders under \\JLM-DC01\HomeFiles — creating subfolders for student01 and student02 with explicit NTFS ACEs and broken inheritance, confirming each user can access only their own folder, and mapping a personal H: drive.
What you'll learn: Why admin-provisioned home folders with explicit user ACEs are the correct enterprise pattern over Creator Owner self-creation; the operational significance of breaking inheritance on per-user subfolders; why Access-Based Enumeration matters for home folder shares.
Infrastructure: Active Directory (jlm.lab); File server role on VM 160 — JLM-DC01 (icacls, New-Item, HomeFiles share); VM 161 — JLM-WIN01 (net use H:); Physical Windows endpoints on Tailnet; Zammad
fs-004 — Centralized PowerShell Transcript Share and Write-Only Logging
Level: Senior · Status: Planned · File Server Administration
What you'll do: You update the ARIA - Student Workstation PowerShell Logging GPO to redirect transcript output from the local workstation path to \\JLM-DC01\SecurityLogs\PSTranscripts, confirm student01 can write transcripts but cannot read, list, or delete them, and verify the transcript is readable from the DC admin session.
What you'll learn: Why write-only NTFS permissions create tamper-resistant logging that local transcript storage cannot provide; how centralized collection enables instructor audit without workstation access; how the NTFS explicit Read Deny overrides SMB Change.
Infrastructure: Group Policy (GPMC); Active Directory (jlm.lab); File server role on VM 160 — JLM-DC01 (SecurityLogs SMB share, Get-GPRegistryValue); VM 161 — JLM-WIN01 (student01 session, gpresult); Zammad
Domain 3 — Networking & Cisco
Build, operate, and troubleshoot Cisco topologies in EVE-NG and on physical gear.
Infrastructure
- VM 170 — EVE-NG Pro 7.0.1-21 (licensed, Tailscale 100.71.24.20)
- Cisco vIOS 15.6 — virtual router image in EVE-NG
- Cisco vIOS-L2 15.2 — virtual switch image in EVE-NG
- Cisco ASAv 9.24.1 — virtual security appliance in EVE-NG
- Physical Cisco C1111 (JLM-LAB-R1) — production router; syslog → Wazuh
- Physical Cisco 3560CX (JLM-LAB-SW1) — production switch; syslog → Wazuh
- Zammad ticketing system (CT 110)
Labs
net-build-001 — Cisco IOS CLI Discovery
Level: Junior · Status: Active · Build / Design Track
What you'll do: You build your first EVE-NG topology — a single Cisco router — connect to it via the EVE-NG web console, and produce a full discovery report covering the device identity, interface states, neighbor information, and routing table using only show commands.
What you'll learn: How EVE-NG organizes network topologies and how to launch and connect to devices; the IOS discovery command set that every Cisco troubleshooting workflow starts with.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6 (virtual router); Zammad
net-build-002 — VLAN Basics + Switchport Verification
Level: Junior · Status: Active · Build / Design Track
What you'll do: You build a three-node topology (R1 — SW1 — R2) in EVE-NG, create VLANs on the switch, assign access ports, and verify end-to-end Layer 2 reachability between the routers through the switch.
What you'll learn: How to build and cable a multi-device topology in EVE-NG; how VLAN configuration on a switch determines which devices are in the same broadcast domain.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6 (router); Cisco vIOS-L2 15.2 (switch); Zammad
net-build-003 — IPv4 Addressing + Gateway Testing
Level: Junior · Status: Active · Build / Design Track
What you'll do: You design a subnet plan for your R1-SW1-R2 topology, apply addressing to all router interfaces, and verify that each device can reach its directly connected neighbors with ping. You document the address plan as part of your evidence.
What you'll learn: How to plan subnets for a small multi-router topology; the relationship between interface addressing, connected routes, and Layer 3 reachability.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-001 — Cisco IOS CLI Discovery
Level: Junior · Status: Active · Foundational Track
What you'll do: You access a Cisco router in EVE-NG and navigate the IOS privilege mode structure, running a core set of show commands to discover the device's identity, interface state, and neighbor relationships.
What you'll learn: IOS CLI fundamentals — privilege levels, command modes, show command structure; how show cdp neighbors and show interfaces provide a topology and health picture.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-002 — VLAN Basics + Switchport Verification
Level: Junior · Status: Active · Foundational Track
What you'll do: You create VLANs on a Cisco switch in EVE-NG, assign switchports to the correct VLAN, and verify the configuration using show vlan brief and show interfaces switchport.
What you'll learn: How VLANs segment Layer 2 traffic on a Cisco switch; the difference between access and trunk port modes.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS-L2 15.2 (switch); Zammad
net-003 — IPv4 Addressing + Gateway Testing
Level: Junior · Status: Active · Foundational Track
What you'll do: You address router interfaces in EVE-NG using a provided subnet plan, configure default gateways, and verify connectivity using ping and show ip interface brief.
What you'll learn: How to apply an IPv4 addressing plan to Cisco interfaces; how connected routes are generated automatically; how to validate gateway reachability.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-build-004 — Static Routing + Route Table Verification
Level: Intermediate · Status: Active · Build / Design Track
What you'll do: You extend your topology with loopback interfaces representing remote LAN segments, add static routes on both routers to enable full reachability, and verify that every loopback is reachable from both ends of the topology.
What you'll learn: How static routing scales across a multi-router topology; how loopback interfaces simulate real LAN segments; how to produce route table evidence that proves full reachability.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-build-005 — ACL Basics + Safe Traffic Filtering
Level: Intermediate · Status: Active · Build / Design Track
What you'll do: You design a scoped ACL for your completed topology, document a baseline reachability proof before applying it, apply the ACL to the correct interface and direction, and verify the filter is working using hit counters and targeted pings.
What you'll learn: How to safely introduce an ACL to a working network; why baseline-before and verify-after is the required evidence pattern for any access control change.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-004 — Static Routing + Route Table Verification
Level: Intermediate · Status: Active · Foundational Track
What you'll do: You configure static routes on Cisco routers in EVE-NG to enable routing between non-directly-connected networks and verify the routes appear in the routing table.
What you'll learn: How to add a static route and what information is required; how to read show ip route to confirm the route was accepted and is being used.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-005 — ACL Basics + Safe Traffic Filtering
Level: Intermediate · Status: Active · Foundational Track
What you'll do: You create a named access control list on a Cisco router, apply it to an interface in the correct direction, and verify using show access-lists that the ACL is matching traffic as intended.
What you'll learn: ACL permit/deny logic, implicit deny, and hit counter validation; the importance of testing baseline reachability before and after applying a filter.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-ops-001 — Same-VLAN Peer Cannot Communicate
Level: Intermediate · Status: Active · Operations / Support Track
What you'll do: Two devices on the same VLAN cannot reach each other. You receive a pre-faulted topology in EVE-NG, identify the switchport misconfiguration responsible for the failure, correct it, and verify restoration of communication.
What you'll learn: How to approach Layer 2 isolation failures methodically — checking switchport mode, VLAN assignment, and interface state before assuming routing or addressing is the problem.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS-L2 15.2 (switch); Zammad
net-ops-002 — Wrong IP Address or Subnet Mask
Level: Intermediate · Status: Active · Operations / Support Track
What you'll do: A device cannot reach its gateway. You receive a faulted topology where an addressing error — wrong IP, wrong mask, or both — is preventing Layer 3 reachability. You identify the exact error, correct it, and verify.
What you'll learn: How to differentiate an IP addressing error from a routing error or VLAN error; how show ip interface brief and show interfaces expose misconfigured addresses and masks.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-ops-003 — Missing Static Route
Level: Intermediate · Status: Active · Operations / Support Track
What you'll do: Traffic reaches a destination network but return traffic does not arrive. You identify the missing static route on the return path, add it, and verify bidirectional reachability is restored.
What you'll learn: How to distinguish a one-way reachability failure (missing return route) from a complete routing failure; why every routing design must account for the return path.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-ops-004 — ACL Blocking Approved Traffic
Level: Senior · Status: Active · Operations / Support Track
What you'll do: An ACL is in place but is blocking traffic that should be permitted. You analyze the ACL rule order, identify the overly broad deny catching approved traffic before the permit can match, restructure the rule order, and confirm the fix without breaking intentional blocks.
What you'll learn: How ACL rule order determines match behavior; why a correct policy with wrong ordering produces incorrect outcomes; how to modify an ACL safely using named ACL editing.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Zammad
net-ops-005 — Trunk or VLAN Path Issue
Level: Senior · Status: Active · Operations / Support Track
What you'll do: Inter-VLAN traffic is failing across a trunk link. You diagnose a mismatch between the allowed VLAN list on the trunk and the VLANs required for traffic to flow, correct the trunk configuration, and verify VLAN reachability end-to-end.
What you'll learn: How trunk ports carry multiple VLANs and why allowed VLAN mismatches silently drop traffic; how to read show interfaces trunk to identify which VLANs are active, pruned, and forwarding.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS-L2 15.2 (switch); Cisco vIOS 15.6 (router); Zammad
network-automation-004 — Ansible + Netmiko Network Automation
Level: Senior · Status: Planned · Automation
What you'll do: You use Ansible and Netmiko to automate configuration tasks across multiple Cisco devices in EVE-NG — applying interface configurations, retrieving show command output, and verifying state without logging into each device manually.
What you'll learn: How network automation tools interact with Cisco IOS over SSH; the distinction between Ansible's declarative model and Netmiko's scripted send/expect model; how to structure an automation workflow with idempotency and output validation.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco vIOS 15.6; Cisco vIOS-L2 15.2; Ansible; Netmiko; Zammad
network-automation-005 — RESTCONF API-Based Network Configuration
Level: Senior · Status: Planned · Automation
What you'll do: You configure Cisco IOS XE devices in EVE-NG using RESTCONF — making HTTP API calls to read interface state, push configuration changes, and verify the result without using the CLI.
What you'll learn: How RESTCONF exposes Cisco device configuration as a RESTful API; the YANG data model structure that defines what can be read and written; how API-based configuration is displacing traditional CLI in enterprise automation.
Infrastructure: VM 170 — EVE-NG Pro 7.0.1-21; Cisco IOS XE; RESTCONF/YANG; Zammad
Domain 4 — Linux & Systems Administration
Own a live Debian container: permissions, services, automation, and hardening.
Infrastructure
- CT 102 — student-linux-01 (Debian, HFG-LX01, Tailscale 100.76.81.39) — Wazuh agent active
- CT 103 — student-linux-02 (Debian, HFG-LX02, Tailscale 100.91.190.9) — Wazuh agent active
- Proxmox PVE host — container management
- Wazuh SIEM 4.14.6 (CT 130) — monitoring both containers
- Zammad ticketing system (CT 110)
Labs
linux-001 — Remote Access + Identity Baseline
Level: Junior · Status: Active · Core Linux Labs
What you'll do: You SSH into your assigned Linux container via Tailscale for the first time, establish your user context, confirm the hostname and IP, trace the route to your default gateway, and document the system identity in a structured baseline report.
What you'll learn: SSH remote access workflow over Tailscale; the commands that establish identity and network baseline on any new Linux system; how to produce a structured first-contact system report.
Infrastructure: CT 102 or CT 103 (Debian); Tailscale (direct SSH); Zammad
linux-002 — File Permissions + Ownership
Level: Junior · Status: Active · Core Linux Labs
What you'll do: You create files and directories with specific ownership and permission requirements, apply chmod and chown to meet them, and verify that access behaves exactly as the permission model predicts.
What you'll learn: The Linux permission model — owner, group, other; numeric and symbolic chmod notation; how ownership determines which permission set applies to a given user.
Infrastructure: CT 102 or CT 103 (Debian Linux container); Zammad
linux-003 — Service Status + Logs
Level: Junior · Status: Active · Core Linux Labs
What you'll do: You investigate the state of a running service using systemctl, confirm it is active and enabled, then use journalctl to trace recent service log output and identify any warning or error events.
What you'll learn: How systemctl exposes service state; how journalctl scopes log output by unit, time range, and priority; how to distinguish a healthy service log from one with errors.
Infrastructure: CT 102 or CT 103 (Debian, systemd); Zammad
linux-004 — Network + DNS + Package Health
Level: Junior · Status: Active · Core Linux Labs
What you'll do: You audit the network configuration, DNS resolution, and package manager state on your Linux container — confirming interface addressing, gateway reachability, name resolution, and the availability of pending package updates.
What you'll learn: The command set that covers the three most common root causes of Linux endpoint issues: network misconfiguration, broken DNS, and stale packages.
Infrastructure: CT 102 or CT 103 (Debian, systemd-resolved, APT); Zammad
field-tech-001 — Verify Endpoint Identity + Network Connectivity
Level: Junior · Status: Active · Field Tech Labs
What you'll do: You receive a field-tech assignment to verify an endpoint is reachable, correctly identified, and has network access. You SSH in, confirm hostname, IP, and user context, test gateway and external reachability, and produce a structured verification report.
What you'll learn: The first-contact verification checklist that applies to any endpoint handoff — new deployment, return from maintenance, or tier 1 escalation.
Infrastructure: CT 102 — student-linux-01 (Debian); Tailscale; Zammad (field tech ticket)
field-tech-002 — Basic Linux Endpoint Health Check
Level: Junior · Status: Active · Field Tech Labs
What you'll do: You perform a structured health check on a running Linux container — uptime, disk utilization, memory state, active sessions, OS and kernel version, and interface configuration — and produce a health report documenting each finding.
What you'll learn: The standard endpoint health baseline that IT teams run before assigning a system to a user or before investigating an anomaly.
Infrastructure: CT 102 — student-linux-01 (Debian); Tailscale; Zammad
linux-005 — Disk Usage + Log Cleanup Triage
Level: Intermediate · Status: Active · Core Linux Labs
What you'll do: Your container is approaching disk capacity. You identify the directories consuming the most space using df and du, locate oversized or stale log files, remove them safely, and confirm the disk pressure is resolved.
What you'll learn: How to triage disk capacity issues without blindly deleting files; how log growth patterns differ from application data growth; when manual cleanup is appropriate versus configuring log rotation.
Infrastructure: CT 102 or CT 103 (Debian); Zammad
linux-006 — Bash Scripting + Safe Automation
Level: Intermediate · Status: Active · Core Linux Labs
What you'll do: You write a Bash script that automates a multi-step administrative task on your Linux container, add input validation and error handling, test it against expected and unexpected inputs, and document its behavior.
What you'll learn: Bash scripting fundamentals — variables, conditionals, loops, exit codes; why input validation and error handling are required before any automation touches real systems.
Infrastructure: CT 102 or CT 103 (Debian, Bash shell); Zammad
linux-007 — Package Inventory + Update Readiness
Level: Intermediate · Status: Active · Core Linux Labs
What you'll do: You generate a full package inventory on your Linux container, identify packages with available updates, simulate the upgrade process, and produce an update readiness report distinguishing security updates from feature updates.
What you'll learn: How to audit a Linux system's installed package state and pending update landscape; why organizations separate security patch cycles from general update cycles.
Infrastructure: CT 102 or CT 103 (Debian, APT); Zammad
linux-008 — Filesystem Manipulation + Cleanup Workflow
Level: Intermediate · Status: Active · Core Linux Labs
What you'll do: You receive a container with a cluttered filesystem containing stale directories, orphaned files, and incorrectly named items. You identify what is safe to remove, execute a structured cleanup, and verify the filesystem is in the expected state.
What you'll learn: Safe filesystem manipulation patterns — how to verify before deleting, how to use dry-run flags, and why irreversible operations require explicit confirmation.
Infrastructure: CT 102 or CT 103 (Debian); Zammad
linux-009 — Permissions + Ownership Architecture
Level: Intermediate · Status: Active · Core Linux Labs
What you'll do: You design and implement a multi-user permission structure on your Linux container — creating users and groups, assigning directory ownership, applying permissions that enforce separation between groups, and validating that each principal can and cannot access exactly what is intended.
What you'll learn: How to architect a multi-user permission model; how group ownership and the sticky bit change shared directory behavior; how to validate a permission design by testing access from each user's perspective.
Infrastructure: CT 102 or CT 103 (Debian); Zammad
field-tech-003 — Help Desk Documentation Lab 1
Level: Intermediate · Status: Planned · Field Tech Labs
What you'll do: You document a technical investigation in a format that a tier 2 team could act on without needing to contact you — capturing what you observed, what you checked, what you concluded, and what remains unresolved.
What you'll learn: The difference between notes-for-yourself and documentation-for-someone-else; how to write a ticket update that reduces escalation time rather than creating more questions.
Infrastructure: CT 102 or CT 103 (Debian); Zammad
field-tech-004 — Help Desk Documentation Lab 2
Level: Intermediate · Status: Planned · Field Tech Labs
What you'll do: You review a poorly documented ticket that reached tier 2 without enough context to act on, identify what is missing, and rewrite the ticket update to the standard required for escalation.
What you'll learn: What information is always required in an escalation note; how to reconstruct investigation context from system state when the original documenter left gaps.
Infrastructure: CT 102 or CT 103 (Debian); Zammad
field-tech-005 — Help Desk Documentation Lab 3
Level: Intermediate · Status: Planned · Field Tech Labs
What you'll do: You write a knowledge base article based on a problem you investigated and resolved, structured so another technician could follow it to resolve the same issue without your help.
What you'll learn: How to convert a personal troubleshooting experience into reusable institutional knowledge; the KB article format used by enterprise IT teams.
Infrastructure: CT 102 or CT 103 (Debian); Zammad (KB article)
field-tech-006 — Linux Filesystem Foundations
Level: Intermediate · Status: Planned · Field Tech Labs
What you'll do: You work through a structured filesystem challenge — creating directory trees, applying permissions, testing access as different users, and documenting the outcome.
What you'll learn: Linux filesystem structure and the standard directory hierarchy; how permissions accumulate across parent and child directories; the most common filesystem-related help desk failures.
Infrastructure: CT 102 or CT 103 (Debian); Zammad
field-tech-007 — Linux Authentication Foundations
Level: Intermediate · Status: Planned · Field Tech Labs
What you'll do: You audit user and group accounts on your Linux container, review sudo access, and verify that only authorized principals can escalate privileges.
What you'll learn: How Linux local user authentication works; the role of /etc/passwd, /etc/shadow, and /etc/sudoers; what a privilege audit looks like and what findings require immediate remediation.
Infrastructure: CT 102 or CT 103 (Debian); Zammad
field-tech-008 — Linux Security Foundations
Level: Intermediate · Status: Planned · Field Tech Labs
What you'll do: You perform a basic security audit of your Linux container — reviewing world-writable files, SUID/SGID binaries, listening services, and open ports — and produce a structured findings report.
What you'll learn: The field-level Linux security checks that a technician can perform without specialized tools; which findings are routine versus which require escalation.
Infrastructure: CT 102 or CT 103 (Debian); Wazuh SIEM 4.14.6 (CT 130); Zammad
linux-010 — Cron Scheduled Task Triage
Level: Senior · Status: Active · Core Linux Labs
What you'll do: A scheduled task is not running as expected. You audit the crontab, identify the misconfiguration — wrong syntax, environment variable issue, or permission problem — and verify the corrected job runs successfully on schedule.
What you'll learn: How cron interprets schedules, environment, and output; the most common cron failure modes; when to use systemd timers over cron for service-level scheduled tasks.
Infrastructure: CT 102 or CT 103 (Debian, cron, systemd); Zammad
linux-011 — Service Configuration + Environment Files
Level: Senior · Status: Active · Core Linux Labs
What you'll do: A service is failing to start because of a misconfigured environment file or unit configuration. You read the systemd journal to identify the startup error, locate the relevant configuration, correct it, and confirm the service starts cleanly.
What you'll learn: How systemd unit files and environment files interact; how to trace a service startup failure from the journal error back to the root configuration cause.
Infrastructure: CT 102 or CT 103 (Debian, systemd); Zammad
linux-012 — Log Rotation + Disk Growth Prevention
Level: Senior · Status: Active · Core Linux Labs
What you'll do: You configure logrotate for a service generating unbounded log output, set size and retention thresholds, test the rotation manually, and verify the configuration will prevent the disk growth pattern from recurring.
What you'll learn: How logrotate rules work and how to write them; the difference between size-based and time-based rotation; how to verify rotation behavior without waiting for the scheduled run.
Infrastructure: CT 102 or CT 103 (Debian, logrotate); Zammad
linux-013 — SSH Access Key Hygiene
Level: Senior · Status: Active · Core Linux Labs
What you'll do: You audit the SSH configuration on your Linux container — reviewing authorized_keys entries, confirming password authentication is disabled, identifying any keys without comments or ownership attribution, and producing a key hygiene report.
What you'll learn: How authorized_keys controls SSH key-based access; why key management hygiene matters at scale; what an SSH key audit looks like and which findings represent security risk versus operational debt.
Infrastructure: CT 102 or CT 103 (Debian, SSH server); Tailscale; Zammad
field-tech-009 — Network Troubleshooting Foundations
Level: Senior · Status: Planned · Field Tech Labs
What you'll do: You diagnose a network connectivity issue from the Linux container — working from socket state through interface configuration to routing and DNS — and produce a systematic investigation note that traces the failure to its root cause.
What you'll learn: How to apply a structured network troubleshooting methodology on a Linux endpoint; how to use ss, ip route, dig, and traceroute as a diagnostic sequence rather than isolated tools.
Infrastructure: CT 102 or CT 103 (Debian); Zammad
field-tech-010 — Cybersecurity Readiness Lab
Level: Senior · Status: Planned · Field Tech Labs
What you'll do: You complete a structured self-assessment of your Linux container's security posture — authentication controls, service exposure, file permissions, update currency, and audit logging — and write a professional readiness report with findings and recommended actions.
What you'll learn: How to conduct a structured endpoint security readiness review; how to frame findings in terms of risk rather than just technical observations; the documentation format that security and compliance teams expect.
Infrastructure: CT 102 or CT 103 (Debian); Wazuh SIEM 4.14.6 (CT 130); Zammad
automation-iac-foundation — Infrastructure as Code Foundation
Level: Senior · Status: Planned · Automation
What you'll do: You define infrastructure declaratively using IaC tooling — describing a container configuration as code, applying it, verifying the result matches the declared state, and modifying the declaration to demonstrate idempotent re-application.
What you'll learn: The declarative versus imperative infrastructure model; why IaC reproducibility and idempotency matter operationally; how code-defined infrastructure connects to version control, change management, and audit trails.
Infrastructure: Proxmox PVE host; CT 102 or CT 103 (target container); Terraform or Ansible; Zammad
automation-script-review — Script Code Review
Level: Senior · Status: Planned · Automation
What you'll do: You review a peer-submitted automation script for correctness, safety, and operational risk — identifying assumptions the script makes, inputs it does not validate, and failure modes it does not handle.
What you'll learn: How to read automation code as a reviewer rather than an author; the questions a code review must answer before a script is approved for use on production systems.
Infrastructure: CT 102 or CT 103 (Debian); Zammad (review ticket)
Domain 5 — Security Operations Center
Investigate real alerts in a live Wazuh SIEM as a client-engagement SOC analyst.
Infrastructure
- CT 130 — Wazuh SIEM 4.14.6 (all-in-one: manager, indexer, dashboard)
- Wazuh agent — CT 102 HFG-LX01 (Debian, agent 002)
- Wazuh agent — CT 103 HFG-LX02 (Debian, agent 006)
- Wazuh agent — VM 161 HFG-WIN01 (Windows 11, agent 007)
- Wazuh agent — VM 162 HFG-WIN02 (Windows 11, agent 008)
- Physical Cisco C1111 (JLM-LAB-R1) — syslog → Wazuh
- Physical Cisco 3560CX (JLM-LAB-SW1) — syslog → Wazuh
- Synthetic alert injection via create_soc_lab.py run from CT 130
- Zammad ticketing system (CT 110)
Labs
proj-sec-001 — SOC Analyst Onboarding — Hargrove Dental Group
Level: Junior · Status: Active · Track A: Defensive SOC
What you'll do: On your first day as a SOC analyst for the Hargrove Dental Group engagement, you access the Wazuh dashboard, orient yourself to the monitored environment, review the current alert queue, and produce a shift-start assessment table and triage disposition report — no synthetic events injected, real baseline data only.
What you'll learn: How to navigate a live Wazuh SIEM dashboard and read the alert index without guidance; how to build an alert queue assessment before acting; the documentation standard for a SOC shift handoff note aligned to NIST SP 800-61 Detection/Analysis phase.
Infrastructure: CT 130 — Wazuh SIEM 4.14.6 (live dashboard, no injection); CT 102 — HFG-LX01; CT 103 — HFG-LX02; VM 161 — HFG-WIN01; VM 162 — HFG-WIN02; Zammad (CT 110, shift report ticket)
proj-sec-002 — SSH Brute Force Investigation — Meridian Logistics Group
Level: Intermediate · Status: Active · Track A: Defensive SOC
What you'll do: A Zammad ticket escalates suspicious authentication activity on a monitored Linux endpoint at Meridian Logistics Group. Working in the Wazuh SIEM, you query the alert index for 45 SSH authentication failures followed by a successful login from the same source IP within a compressed window and determine whether this constitutes a confirmed breach.
What you'll learn: How to identify and scope a credential-based intrusion attempt using a real SIEM; how to distinguish brute-force noise from a confirmed breach event; how to produce a SOC investigation report and escalation note aligned to NIST SP 800-61.
Infrastructure: CT 130 — Wazuh SIEM 4.14.6; CT 102 — HFG-LX01 (injected: 45 SSH auth failures + successful login); Physical Cisco C1111 + 3560CX syslog; Zammad (CT 110)
proj-sec-003 — Compromised Endpoint Investigation — Castellan Property Management
Level: Intermediate · Status: Active · Track A: Defensive SOC
What you'll do: Wazuh alerts indicate a combination of SSH brute-force activity and unusual process execution on a monitored endpoint at Castellan Property Management. You correlate two alert types across the same endpoint and timeline to determine whether they represent a single attack chain or independent events.
What you'll learn: How to correlate multiple alert types across the same endpoint in a SIEM; the difference between isolated events and correlated attack chain indicators; how to scope an investigation conclusion when evidence is suggestive but not conclusive.
Infrastructure: CT 130 — Wazuh SIEM 4.14.6; CT 103 — HFG-LX02 (injected: SSH brute-force + process execution events); Zammad (CT 110)
proj-sec-004 — Web Reconnaissance Investigation — Thornfield Industrial Supply
Level: Intermediate · Status: Active · Track A: Defensive SOC
What you'll do: Wazuh is receiving a flood of web log events from a single external source against an endpoint at Thornfield Industrial Supply. You analyze the request pattern, determine whether this is automated reconnaissance, a vulnerability scan, or normal traffic at high volume, and write a finding.
What you'll learn: How web request log patterns differ between legitimate high-volume traffic and automated scanning; how to use Wazuh to aggregate and filter web log events at volume; how to frame an investigation conclusion when the data shows pattern but not proof of malicious intent.
Infrastructure: CT 130 — Wazuh SIEM 4.14.6; CT 102 — HFG-LX01 (injected: 200 Apache-format web log entries); Zammad (CT 110)
proj-sec-005 — Full Attack Chain Investigation — Bridgecroft Financial Services
Level: Senior · Status: Active · Track A: Defensive SOC
What you'll do: A three-phase attack scenario plays out across the Bridgecroft Financial Services monitored environment: initial SSH brute-force, successful authentication and process execution, and lateral movement indicators. You reconstruct the full timeline, confirm the scope of compromise, and produce an incident report to enterprise standard.
What you'll learn: How to work a full attack chain from initial access through lateral movement in a SIEM; how timeline reconstruction differs from alert-by-alert triage; how to write an incident report that distinguishes confirmed findings from indicators requiring further investigation.
Infrastructure: CT 130 — Wazuh SIEM 4.14.6; CT 102 — HFG-LX01 + CT 103 — HFG-LX02 (injected: three-phase attack); Physical Cisco C1111 + 3560CX syslog; Zammad (CT 110, full incident ticket)
proj-sec-006 — Escalation Drill — Crestline Community Bank
Level: Senior · Status: Active · Track A: Defensive SOC
What you'll do: Working the Crestline Community Bank SOC engagement, you encounter a situation that requires escalation. You determine who receives the escalation, what information must be included, what must NOT be included, and write the escalation note in correct professional language.
What you'll learn: The professional and procedural discipline of escalation: what triggers it, who owns the decision, how to communicate urgency without alarming stakeholders inappropriately, and how to document the escalation as part of the incident record.
Infrastructure: CT 130 — Wazuh SIEM 4.14.6 (organic baseline data, no injection); Zammad (CT 110, escalation ticket)
sec-b-001 — Authorized Vulnerability Scanning
Level: Senior · Status: Planned · Track B: Offensive & Pen Testing
What you'll do: Under a written lab authorization scope, you run a structured vulnerability scan against designated training targets using nmap and an open-source vulnerability scanner, parse the output, triage findings by severity, and produce a scan report.
What you'll learn: How to scope and execute an authorized vulnerability scan without creating noise on production infrastructure; how to read and triage scan output; what a professional vulnerability scan report must contain.
Infrastructure: CHLOE — dedicated Proxmox node (isolated); nmap; OpenVAS / Greenbone Community Edition; Wazuh SIEM 4.14.6; Zammad
sec-b-002 — Controlled Exploit Validation
Level: Senior · Status: Planned · Track B: Offensive & Pen Testing
What you'll do: Against instructor-staged isolated targets within the CHLOE range, you validate a known vulnerability using Metasploit under a controlled, scoped authorization, document the exploitation path, confirm the scope did not extend beyond the authorized target, and write a findings note.
What you'll learn: How to execute a controlled, authorized exploit validation; why scope control and evidence of scope compliance are non-negotiable in any authorized penetration test; the difference between exploit validation and an attack.
Infrastructure: CHLOE — dedicated Proxmox node (isolated range); Metasploit Framework; Instructor-staged targets; Zammad
sec-b-003 — Disposable CTF Lab
Level: Senior · Status: Planned · Track B: Offensive & Pen Testing
What you'll do: You work through a capture-the-flag scenario against a purpose-built disposable target (Metasploitable2, DVWA, or equivalent) deployed in the CHLOE isolated range. After completing the challenge, you participate in a full teardown verification to confirm no artifacts remain.
What you'll learn: Offensive security methodology in a fully safe, disposable environment; how CTF-style labs translate to real vulnerability patterns; why teardown verification is as important as the exercise itself.
Infrastructure: CHLOE — dedicated Proxmox node; Metasploitable2 / DVWA; Wazuh SIEM 4.14.6 (blue-team observation); Zammad
sec-b-004 — Purple Team Simulation
Level: Senior · Status: Planned · Track B: Offensive & Pen Testing
What you'll do: Working in a paired exercise, one student plays the attacker (executing instructor-staged offensive actions) while another plays the SOC analyst (triaging the resulting Wazuh alerts in real time). Roles then reverse. Both students produce a joint incident timeline.
What you'll learn: How offensive actions appear in a defensive SIEM; how attacker timing, tooling choice, and lateral movement pattern affect detection difficulty; how to build a joint timeline that captures both the attack and the detection story.
Infrastructure: CHLOE — dedicated Proxmox node (attack range); CT 130 — Wazuh SIEM 4.14.6 (live detection); Zammad (CT 110, joint incident report)
