Five interactive labs aligned to SY0-701 Domain 4 — Security Operations. Work through each station to earn points and master mitigation strategies.
🩹
Patching
Apply CVE patches in priority order. Understand CVSS scoring and patch windows to reduce exploit windows.
Lab 1 · 25 pts
🔧
Hardening
Configure a server to eliminate unnecessary services, enforce secure defaults, and reduce attack surface.
Lab 2 · 25 pts
🗂️
Network Segmentation
Place assets into correct network zones (DMZ, internal, restricted). Limit lateral movement paths.
Lab 3 · 25 pts
🚨
Isolation
Respond to an active incident. Decide which systems to isolate to contain a spreading threat.
Lab 4 · 25 pts
🔑
Access Control
Build an ACL matrix. Apply least privilege and role-based access to protect sensitive resources.
Lab 5 · 25 pts
🎯 Learning Objectives: After completing all labs you will be able to explain how patching, hardening, segmentation, isolation, and access control function; describe how each is implemented; and match each strategy to the vulnerability types it best addresses. Click any lab card or use the tabs above to begin.
🩹 Lab 1 — Patch Management Station
Your organization's vulnerability scanner returned 8 CVEs. Prioritize and apply patches in the correct order. Systems must be patched from Critical → High → Medium → Low. Earn 25 points for completing all patches correctly.
Patches Applied:
0 / 8
⚠️ Scenario Question
A CVE with a CVSS score of 9.8 exists on your web server. A patch is available. An intern suggests waiting until the next monthly maintenance window (21 days). What should you do?
Patch Queue — Click to apply each patch in priority order:
CVE ID
System
Vulnerability
CVSS
Severity
Exploit Available
Action
🔧 Lab 2 — Server Hardening Checklist
You are configuring a new Linux web server before production deployment. Check every control that should be enabled, disabled, or configured to reduce attack surface. Missing critical items will reduce your score.
Controls Applied:
0 / 0
❓ Hardening Concept Check
Which definition best describes "attack surface reduction" as it relates to hardening?
🗂️ Lab 3 — Network Segmentation Builder
Drag each network asset into the correct zone. Proper placement limits lateral movement and contains breaches. DMZ = public-facing; Corporate LAN = internal users; Restricted/OT = critical/sensitive systems.
🔗 Unplaced Assets — drag into a zone:
🌐 DMZ (Demilitarized Zone)
Drop public-facing assets here
🏢 Corporate LAN (Internal)
Drop internal user systems here
🔒 Restricted / OT Network
Drop critical/sensitive systems here
🚨 Lab 4 — Incident Isolation Decision Simulator
A ransomware infection has been detected. Click systems to isolate (network-disconnect) or mark safe. Isolate compromised and at-risk systems; do not isolate clean systems needed for business continuity.
⚠️ ACTIVE INCIDENT — T+00:00
Security alerts show WORKSTATION-7 beaconing to a known C2 IP on port 4444. Network traffic analysis shows lateral movement attempts from WORKSTATION-7 toward the file server and HR database. The accounting workstation is clean but on the same VLAN. The domain controller is critical for authentication — isolating it will lock out all users.
Click each system to toggle isolation status:
❓ Isolation vs. Shutdown
Why is network isolation generally preferred over powering off a compromised system during an active incident?
🔑 Lab 5 — Access Control Matrix Builder
Apply the principle of least privilege. Set the correct permission for each user role / resource pair. Use Allow, Read-Only, or Deny. Earn points for each correct assignment.
🏢 Organization Context
MidWest Financial Services stores customer PII, financial records, and payroll data. Roles: IT Admin, HR Manager, Accountant, Help Desk, External Auditor. Build the ACL that satisfies least privilege and regulatory compliance.