Turn understanding into practice.
Guided tasks using dummy information and your own authorized systems. These are exercises, not automated scans of a real site.
1. Cybersecurity: start with the big picture
List five assets in a fictional web agency. For each, write who owns it and what would happen if it disappeared.
2. The CIA triad: three protection goals
Classify these events: a public customer list, an altered invoice, an offline shop. Explain which CIA goals are affected.
3. Assets, threats, vulnerabilities, and risk
Create a risk register with asset, threat, weakness, likelihood, impact, and one practical control for three fictional risks.
4. Controls: how protection is built
Design three independent controls for a website administrator. Explain which prevents, detects, or helps recover.
5. Networks: how devices communicate
Draw Browser → DNS → Server → Response. Add IP address, HTTPS, and the application at the correct point.
6. Identity: who are you, and what may you do?
Write permissions for editor, developer, and administrator roles. Identify one permission each role should not receive.
7. Phishing and social engineering
Write a checklist for verifying a sudden bank-detail change. Use an established contact route, not the new message.
8. Malware and ransomware
Create an incident note for a suspicious attachment: what happened, device affected, time, and who should be contacted.
9. Encryption, hashing, and HTTPS
Inspect the certificate details of a site you normally use. Record the hostname and validity dates; do not enter sensitive data.
10. Device security, updates, and backups
Back up a harmless test folder. Delete only a disposable copy, restore it, and record the actual recovery time.
11. Firewalls, VPNs, and zero trust
Write firewall requirements for a fictional staging server: who needs access and which unnecessary access should be blocked?
12. Website and application security
Design authorization rules for viewing invoices. Explain why changing an invoice ID must never bypass the owner check.
13. APIs, integrations, and secrets
Draw a shipping API integration. Mark where the server stores the secret and where webhook authenticity is checked.
14. Cloud security and shared responsibility
Make a responsibility table for a cloud virtual server: hardware, OS, app, identities, data, backups, monitoring.
15. AI security: protecting AI-enabled systems
Threat-model a support assistant with dummy data. List allowed tools, forbidden data, and actions requiring approval.
16. Logs, monitoring, and detection
Investigate this sample: 09:00 five failed logins; 09:03 success; 09:05 new forwarding rule. List questions, not assumptions.
17. Incident response and recovery
Write an email-account incident playbook covering sessions, forwarding, integrations, recovery settings, and evidence.
18. Security assessment and professional ethics
Draft a one-page authorization and scope agreement for a local lab assessment. Include stop conditions and exclusions.
19. Safe practice: a 14-day foundation plan
Choose three tasks from the 14-day plan. Schedule them and write what evidence will demonstrate completion.
20. Final concept check and reference map
Create a short security review for a fictional agency, connecting assets, permissions, updates, monitoring, and recovery.
Keep observations in your personal notebook. The WordPress course tracks lesson and quiz completion; it does not automatically grade or store these written lab notes.
CyberPath · Learn. Practice. Protect.
Student help · My account · Practice only on systems you own or are authorized to assess.