Practical Labs & Tooling Environments
Authentic cybersecurity skill is built by interacting with real operating system telemetry, protocol packet captures, and specialised security utilities in isolated, safe environments.
Why Hands-On Practice is Central to Our Courses
Security concepts come alive when learners observe real process spawning, analyse live PCAPs, configure access policies, and recover deleted artifacts from disk images.
Operational Muscle Memory
Navigating SIEM dashboards, building regex queries, parsing raw Wireshark frames, and writing KQL filters directly builds instinctive operational fluency.
Isolated Training Targets
Vulnerable web applications and target VMs are isolated in local host-only networks, ensuring learners can safely test exploits without endangering external networks.
Repeatable Scientific Methods
Practicing cryptographic hashing with SHA-256 ensures learners verify forensic copies and maintain rigorous evidence documentation standards.
Laboratory Tooling Grouped by Pathway
All tools and platforms listed below are verified against Table 1 of each official course document.
1. SOC Analyst Laboratory Exercises
8 Weeks · 64hDefensive operations center around event monitoring, log aggregation, protocol inspection, and alert enrichment.
- Week 3: Configure Sysmon XML schema and analyse Event ID 1 (Process Creation) and Event ID 3 (Network Connection) traces.
- Week 4: Ingest Apache and SSH authentication logs into Wazuh; create custom rule alerts for brute-force logon patterns.
- Week 5: Dissect packet captures in Wireshark to reconstruct cleartext credential exposure and identify DNS tunneling indicators.
- Week 8 (Capstone): Investigate an end-to-end multi-stage enterprise attack, map indicators to ATT&CK, and draft an executive briefing.
2. Ethical Hacking & Penetration Testing Laboratory
10 Weeks · 80hOffensive verification takes place within strictly isolated virtual networks featuring purposefully vulnerable target machines.
- Week 2: Execute structured host discovery, TCP SYN scanning, and NSE version detection against target lab subnets.
- Week 4: Configure authenticated vulnerability scans in Nessus/OpenVAS and manually triage high-priority findings to eliminate false positives.
- Week 5: Intercept HTTP requests in Burp Suite to test input validation, SQL injection vulnerabilities, and cross-site scripting (XSS).
- Week 10 (Capstone): Conduct a full authorized penetration test of a multi-tier target environment and author a prioritized remediation report.
3. Azure Cloud Security Laboratory
10 Weeks · 80hCloud security exercises focus on identity governance, network perimeter isolation, secrets management, and SIEM detection engineering in Microsoft Azure.
- Week 2: Configure role-based access control (RBAC) scopes and test just-in-time role activation using Privileged Identity Management.
- Week 3: Design isolated VNet subnets and enforce restrictive NSG inbound rules restricting SSH/RDP management ports.
- Week 7: Author Kusto Query Language (KQL) rules in Sentinel to correlate anomalous sign-ins with unexpected storage account key exports.
- Week 10 (Capstone): Perform an end-to-end security audit of a sample cloud application, triage posture findings, and present residual risk.
4. Digital Forensics & Incident Response Laboratory
10 Weeks · 80hForensics training emphasizes scientific evidence handling, cryptographic hashing, file-system carving, memory extraction, and timeline reconstruction.
- Week 2: Calculate cryptographic SHA-256 hashes, verify evidence file integrity, and complete a formal chain-of-custody worksheet.
- Week 4: Ingest prepared Windows disk artifacts into Autopsy and Registry Explorer; analyse Prefetch, UserAssist, and LNK files for execution traces.
- Week 6: Execute Volatility 3 plugins (windows.pslist, windows.netscan) on a volatile memory dump to identify injected code and C2 sockets.
- Week 10 (Capstone): Investigate a simulated enterprise incident using disk images, memory captures, and network PCAPs; deliver a documented, evidence-based report.
Mandatory Rules of Engagement & Safe Execution
All lab exercises must strictly adhere to responsible security protocols:
- Isolated Local Subnets: Offensive lab VMs must be configured with host-only or internal virtual networking to prevent packet leakage to external interfaces.
- No External Probing: Port scanning, fuzzing, or vulnerability testing against external domains, networks, or cloud endpoints is strictly forbidden.
- Safe Malicious Artifact Handling: Malicious samples or suspicious PCAPs provided during training must remain within isolated analysis sandboxes.
Failure to observe these boundary rules results in immediate forfeiture of lab privileges.
Explore Detailed Weekly Modules
Review the full 8-week and 10-week course breakdowns, documented learning outcomes, and suggested assessment components.