Practice Set 1

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Get comfortable with Practice Set 1, no need to be intimidated by it
Be able to run tools yourself inside an authorized lab environment
Be able to apply this concept immediately in a real assessment/report

Take a moment to think about this

This round is about putting the Basic/Intermediate concepts you've already learned into practice again — telling apart the CIA Triad and Passive vs Active Recon, being able to read Nmap output, and correctly applying legal/ethical boundaries are the skills you'll practice hands-on here. No task should take you more than 5 minutes.

Let's connect it to a real scenario

Task 1: Explain the difference between 'Confidentiality', 'Integrity', and 'Availability' in one sentence each. Task 2: Distinguish Passive Recon from Active Recon with 2 examples of each. Task 3: In an Nmap scan output, read and explain what it means when port 22 shows 'open' and port 3306 shows 'filtered' — what's the difference? Task 4: For the scenario 'a friend asked me to help check their WiFi router password, so I want to scan it', write out how you should approach it according to the legal/ethical framework (Basic lesson 2).

Can explain the differences within the CIA Triad
Can distinguish Passive vs Active Recon with examples
Can correctly decide a legal/ethical scenario

Let's walk through it together

text

# Task 4 - the friend/WiFi scenario
Even with a friend's verbal request, best practice is:
1. Get it in writing (even a simple text message confirming
   "yes, please test my home WiFi security")
2. Confirm scope: JUST the WiFi, not their laptop/phone/other
   devices, unless explicitly agreed
3. Stop immediately if anything unexpected happens
4. Report findings back to them directly, not publicly

Verbal permission is weaker than written, but for a home
WiFi favor with a friend it may be reasonable — for anything
involving a business, ALWAYS get written authorization first.

You should see

You'll come away able to explain the CIA Triad and Recon types, read Nmap output, and make a legal-scenario decision.

5-minute try-it

Write out your own personal policy for how you'd actually respond if you ran into the Task 4 scenario yourself (a request from a friend or family member).

A quick word of caution

Don't scan or test any real-world target for this round — the focus here is purely on practicing the concepts and decision-making logic.

Easy traps

Getting the CIA Triad muddled up as if 'they're all basically the same thing'
Assuming that a casual/verbal 'my friend's device' request is enough authorization on its own — it's important to clearly confirm the scope

Now try it yourself

Write out your own personal policy for how you'd actually respond if you ran into the Task 4 scenario yourself (a request from a friend or family member).

You'll know it worked when: You'll come away able to explain the CIA Triad and Recon types, read Nmap output, and make a legal-scenario decision.