CompTIA Security+ SY0-701 — 100 Hands-On Labs (Table View)
Read first (safety & setup): Do everything on isolated VMs (VirtualBox/VMware/UTM). Never touch systems you don’t own or manage. Suggested base stack: pfSense (router/firewall), Security Onion or Wazuh (SIEM), Ubuntu Server, Windows 11/Server, OWASP Juice Shop & DVWA (web vulns), Metasploitable2, Kali/Parrot (toolbox), Pi-hole, Minikube + Docker (cloud/container). Take snapshots before each lab and roll back after “Cleanup.” Notation: Time, Tools/VMs, Deliverable, Domain.
Domain 1 — Attacks, Threats & Vulnerabilities Labs 1–25
| # | Lab | Details (verbatim) |
|---|---|---|
| 1 | Build the Security+ Home Lab | Time: 45–60m | Tools: Hypervisor, ISOs Steps: Create an internal-only vSwitch; import pfSense, Ubuntu, Windows, Security Onion; set IP plan; test ping/DNS. Deliverable: Network diagram + IP table. Domain: D1 |
| 2 | File Integrity & Hashing Basics | Generate SHA-256/512 for sample files; verify integrity after a small edit. Deliverable: Hash table + observation. Domain: D1 |
| 3 | EICAR Safe “Malware” Handling | Download EICAR string, observe AV/EDR reaction, whitelist then rollback. Deliverable: Screenshots of detection & logs. Domain: D1 |
| 4 | Traffic Capture 101 | Use Wireshark to capture ping, HTTP, and DNS; label protocols. Deliverable: pcap with filtered views. Domain: D1 |
| 5 | Recon vs. Scan | Run nslookup, whois, then nmap (top ports) against your lab only; compare passive/active results.Deliverable: Recon notes + Nmap report. Domain: D1 |
| 6 | Vulnerability Scan with OpenVAS/Greenbone | Install Greenbone, scan Metasploitable; classify Critical/High; export report. Deliverable: PDF report + 3 remediation notes. Domain: D1 |
| 7 | Web Scan with OWASP ZAP | Spider & passive scan Juice Shop; list top 5 findings (e.g., missing headers). Deliverable: HTML report. Domain: D1 |
| 8 | Password Policy Reality Check | Create weak vs strong passwords; run John the Ripper on a local hash list; measure time-to-crack difference. Deliverable: Table of crack times. Domain: D1 |
| 9 | Threat Modeling (STRIDE) | Model Juice Shop: identify spoofing/tampering vectors, propose 5 mitigations. Deliverable: 1-page model. Domain: D1 |
| 10 | Phishing Anatomy (Offline) | Use GoPhish with a fake, local SMTP; craft a training template; never send externally. Deliverable: Template + landing page screenshot. Domain: D1 |
| 11 | Social Engineering Red Flags | Create a checklist from 15 real-world indicators; test on your fake email. Deliverable: Checklist PDF. Domain: D1 |
| 12 | Malware TTPs (No live malware) | Catalog malware types; map to MITRE ATT&CK tactics you can detect in your lab. Deliverable: Matrix snippet. Domain: D1 |
| 13 | DoS vs DDoS Concepts (Simulated) | Use hping3 to simulate a small SYN burst inside lab; watch pfSense states & CPU; stop quickly.Deliverable: Graph screenshot + safe-use notes. Domain: D1 |
| 14 | Wireless Threats (Safe AP) | Stand up a spare AP in a Faraday-like location; observe open vs WPA2/WPA3 association attempts. Deliverable: AP logs comparison. Domain: D1 |
| 15 | Vuln Prioritization | From your OpenVAS results, calculate risk = likelihood × impact; rank top 5. Deliverable: Risk ranking table. Domain: D1 |
| 16 | Banner Grabbing & Service Fingerprinting | Use nc/curl -I to read banners; compare to Nmap -sV.Deliverable: Notes + remediation (hide banners). Domain: D1 |
| 17 | Common Ports Drill | Capture traffic for ports 20/21/22/23/25/53/80/443/3389; annotate purpose & risks. Deliverable: Labelled pcap. Domain: D1 |
| 18 | False Positives vs True Positives | Pick 5 ZAP findings; validate manually; mark FP/TP. Deliverable: Validation sheet. Domain: D1 |
| 19 | Credential Exposure Hunt | Create dummy API keys in a test repo; run truffleHog; rotate/delete. Deliverable: Findings + rotation steps. Domain: D1 |
| 20 | Open Redirect & Clickjacking (Safe) | Test Juice Shop headers; mitigate with X-Frame-Options & CSP on a test Nginx.Deliverable: Before/after header dumps. Domain: D1 |
| 21 | Misconfigurations Bingo | Intentionally misconfigure a dev web server (dir listing on); document exploitability; fix. Deliverable: Before/after config. Domain: D1 |
| 22 | Vuln Disclosure Process (Mock) | Draft responsible disclosure email & timeline for a lab bug. Deliverable: Templated process. Domain: D1 |
| 23 | Threat Actors & Motives | Create a table (nation-state, cybercriminal, insider, hacktivist) + likely TTPs. Deliverable: 1-page table. Domain: D1 |
| 24 | Supply-Chain Risk Walkthrough | Map your lab’s dependencies (packages, images); propose controls (allow-lists, signed images). Deliverable: Dependency list + controls. Domain: D1 |
| 25 | Physical Security Basics at Home | Document workstation locks, BIOS passwords, boot order, screen lock policy. Deliverable: Checklist + photos (optional). Domain: D1 |
Domain 2 — Architecture & Design Labs 26–45
| # | Lab | Details (verbatim) |
|---|---|---|
| 26 | Subnetting & Segmentation | Create VLAN10 (users), VLAN20 (servers) via pfSense + a vSwitch; verify isolation. Deliverable: Ping matrix. Domain: D2 |
| 27 | DMZ Pattern | Place Juice Shop in a DMZ; only 80/443 from LAN; block admin ports. Deliverable: pfSense rule export + diagram. Domain: D2 |
| 28 | NAT/PAT & Port Forwarding | Expose 443 to DMZ web; test from another VLAN; log connections. Deliverable: NAT rule + test proof. Domain: D2 |
| 29 | Zero Trust Micro-Segmentation (Host-FW) | Use Windows Defender Firewall & `ufw` to allow only required flows. Deliverable: Policy set + verification. Domain: D2 |
| 30 | Secure DNS with Pi-hole + DNSSEC Validation | Route LAN DNS via Pi-hole; enable DNSSEC validation upstream. Deliverable: Query logs + test failures. Domain: D2 |
| 31 | Three-Tier App Diagram | Draw web/app/db tiers and trust boundaries; list controls per boundary. Deliverable: Diagram PNG. Domain: D2 |
| 32 | Resiliency & Redundancy | Configure dual DNS, test host file fallback; simulate DNS outage. Deliverable: Test notes. Domain: D2 |
| 33 | Cloud Design on Minikube | Deploy a service; expose via Ingress; add network policy to restrict pod-to-pod. Deliverable: `kubectl` manifests. Domain: D2 |
| 34 | Hardening Baselines (CIS flavor) | Run Lynis on Ubuntu; address 5 findings; rerun. Deliverable: Before/after Lynis score. Domain: D2 |
| 35 | Container Image Security | Scan images with Trivy; implement non-root user & read-only FS. Deliverable: Dockerfile diff + scan output. Domain: D2 |
| 36 | Secure Design Review (STRIDE + PASTA Lite) | Run a quick threat model on a new feature; log risks & mitigations. Deliverable: 1-pager review. Domain: D2 |
| 37 | Wireless Design | Configure WPA3-Personal; separate guest SSID/VLAN; captive portal optional. Deliverable: AP screenshots. Domain: D2 |
| 38 | IoT Segmentation | Move “lab IoT” VM to isolated VLAN; restrict to DNS/NTP/HTTPS. Deliverable: Rules + test pings blocked. Domain: D2 |
| 39 | Data Flow & Trust Boundaries | Create DFD for login and payment (dummy); highlight PII touchpoints. Deliverable: DFD + controls. Domain: D2 |
| 40 | Email Security Architecture (Conceptual) | Document SPF, DKIM, DMARC design (no external send needed). Deliverable: Policy records draft. Domain: D2 |
| 41 | PKI Topology Choices | Build a mini PKI design (root offline, issuing CA online) plan. Deliverable: Topology diagram. Domain: D2 |
| 42 | Architecture Anti-Patterns | List 10 risky patterns (flat networks, shared creds, default passwords) + fixes. Deliverable: Table. Domain: D2 |
| 43 | SaaS Shared Responsibility | Pick a SaaS (hypothetical); map who secures what. Deliverable: RACI-style table. Domain: D2 |
| 44 | BCP/DR Architecture Notes | Define RTO/RPO for 3 lab services; propose backups/failover. Deliverable: DR plan excerpt. Domain: D2 |
| 45 | Secure Baseline Images (Golden) | Create a hardened Windows & Ubuntu template with updates + agents. Deliverable: Checklist + snapshot names. Domain: D2 |
Domain 3 — Implementation Labs 46–75
| # | Lab | Details (verbatim) |
|---|---|---|
| 46 | Least Privilege on Linux | Create users, groups, sudoers with `visudo`; verify denied/allowed actions. Deliverable: Commands + results. Domain: D3 |
| 47 | MFA for SSH (TOTP) | Enable Google Authenticator PAM on Ubuntu + key-based auth; disable password login. Deliverable: Login flow screenshot. Domain: D3 |
| 48 | Windows Password Policy + Account Lockout | Configure via Local Security Policy or GPO; test lockout & unlock. Deliverable: Policy screenshots. Domain: D3 |
| 49 | Build a Private CA & Server TLS | Use OpenSSL or EasyRSA to create CA, issue Nginx cert, enforce TLS 1.2/1.3. Deliverable: Cert chain + `testssl.sh` output. Domain: D3 |
| 50 | HTTPS Security Headers | Add HSTS, CSP, X-Content-Type-Options, Referrer-Policy; verify with `curl -I`. Deliverable: Header dump. Domain: D3 |
| 51 | WireGuard VPN | Set up site-to-site (pfSense ↔ Ubuntu) or client-server; allow only 10.0.0.0/24. Deliverable: Peer config + ping proof. Domain: D3 |
| 52 | Disk Encryption | Linux: LUKS on a secondary disk; Windows: BitLocker; test unlock. Deliverable: Encrypted volume screenshots. Domain: D3 |
| 53 | Wazuh/OSSEC or Security Onion Agents | Install agents on Windows/Linux; forward logs; create one alert rule. Deliverable: Alert screenshot. Domain: D3 |
| 54 | Sysmon for Windows | Install Sysmon with SwiftOnSecurity config; verify process/create/log entries. Deliverable: Event Viewer export. Domain: D3 |
| 55 | FIM with AIDE/Wazuh | Baseline `/etc`; modify a file; detect & report change. Deliverable: FIM report. Domain: D3 |
| 56 | Patch Management Drill | Document patch cadence; run Windows Update & `unattended-upgrades` on Ubuntu. Deliverable: Change log. Domain: D3 |
| 57 | Secure Backups with Restic | Set repo, initialize, encrypt, backup `/var/www`; restore a file. Deliverable: Restore proof. Domain: D3 |
| 58 | SSH Hardening | Disable root, set `AllowUsers`, change ciphers to modern; test. Deliverable: `sshd_config` diff. Domain: D3 |
| 59 | SFTP Chroot Jail | Create restricted upload user; verify no lateral traversal. Deliverable: Session proof. Domain: D3 |
| 60 | Nginx Reverse Proxy to App | TLS at edge, proxy to backend on loopback, limit methods to GET/POST. Deliverable: Config + test. Domain: D3 |
| 61 | TLS Cipher Hygiene | Run `testssl.sh`; remove weak suites; retest. Deliverable: Before/after scan. Domain: D3 |
| 62 | GPG Email/File Encryption | Create keypair; encrypt/decrypt file; sign & verify. Deliverable: Commands + outputs. Domain: D3 |
| 63 | Secrets Management (Vault Dev Mode) | Store an API key; pull via CLI; revoke/rotate. Deliverable: Policy + transcript. Domain: D3 |
| 64 | API Rate Limiting | Put simple Flask app behind Nginx rate-limit; demonstrate blocked bursts. Deliverable: Logs showing 429s. Domain: D3 |
| 65 | Docker Least Privilege | Run container as non-root, drop capabilities, read-only FS, seccomp. Deliverable: `docker run` flags + `id` inside. Domain: D3 |
| 66 | Image Signing (cosign) — optional | Sign local image; verify policy in deploy script. Deliverable: Signature verify output. Domain: D3 |
| 67 | Kubernetes RBAC & NetworkPolicy | Create a role limiting `get,list` on pods; apply NetworkPolicy to deny all except web. Deliverable: YAML + tests. Domain: D3 |
| 68 | Wireless Implementation (WPA3) | Configure WPA3-SAE; test client connect; disable WPS. Deliverable: AP/client screenshots. Domain: D3 |
| 69 | Mobile Device Hardening (Emulator) | Android emulator: set PIN, full-disk encryption, disable unknown sources, work profile. Deliverable: Settings screenshots. Domain: D3 |
| 70 | SPF/DKIM/DMARC (Concept + Local Lab) | Draft TXT records; validate with a DNS tester (local). Deliverable: Record strings + results. Domain: D3 |
| 71 | RADIUS/EAP-TLS (Conceptual/Sim) | Stand up FreeRADIUS in lab; issue client certs; test auth (if possible). Deliverable: Config snippets. Domain: D3 |
| 72 | Windows Defender Policies | Enable ASR rules, SmartScreen, controlled folder access. Deliverable: Policy screenshots + block event. Domain: D3 |
| 73 | Application Allow-listing (Windows) | Create a basic WDAC/SRP rule to block unsigned app; test block. Deliverable: Event ID proof. Domain: D3 |
| 74 | Data Loss Prevention (Concept in Lab) | Simulate PII strings; write a simple `logstash`/Wazuh rule to flag them in logs. Deliverable: Alert sample. Domain: D3 |
| 75 | Remote Access Hardening | Disable RDP by default; if needed, restrict to VPN, enable NLA; log attempts. Deliverable: Policy + log. Domain: D3 |
Domain 4 — Operations & Incident Response Labs 76–90
| # | Lab | Details (verbatim) |
|---|---|---|
| 76 | SIEM Pipeline | Forward Windows/Linux logs to Wazuh/SO; create dashboard for auth events. Deliverable: Dashboard screenshot. Domain: D4 |
| 77 | Incident Response Plan (IRP) | Draft IR lifecycle (prep, ID, contain, eradicate, recover, lessons); define roles & comms. Deliverable: 2-page IRP. Domain: D4 |
| 78 | Alert Triage Playbook | Pick 3 alerts (failed logins, suspicious PowerShell, web 500s); write triage steps & severity. Deliverable: Playbook cards. Domain: D4 |
| 79 | Disk Forensics (Safe) | Use `dd` to image a small disk file; compute hashes; mount read-only; carve a deleted txt. Deliverable: Hashes + recovered file. Domain: D4 |
| 80 | Memory Capture (Lab) | Use WinPmem (VM) to capture RAM; run Volatility to list processes. Deliverable: Volatility output. Domain: D4 |
| 81 | YARA Rules 101 | Write a YARA rule for EICAR; test local scan. Deliverable: Rule + match output. Domain: D4 |
| 82 | PCAP Forensics | Analyze suspicious HTTP download in Wireshark; extract object; verify hash. Deliverable: PCAP + notes. Domain: D4 |
| 83 | Baseline vs Anomaly | Record “normal” CPU, network, logons for 24h; compare when running a heavy job. Deliverable: Graphs + variance notes. Domain: D4 |
| 84 | Host Firewall Block & Verify | Block an IP with Windows FW/`ufw`; validate drops in logs. Deliverable: Rule + log evidence. Domain: D4 |
| 85 | Ransomware Tabletop (No real malware) | Simulate encryption via a script renaming files; test backup restore; document decisions. Deliverable: Tabletop report. Domain: D4 |
| 86 | Patch a Critical CVE | Pick one CVE from your scanner; patch; rescan to verify closure. Deliverable: Before/after reports. Domain: D4 |
| 87 | Threat Intel Feeds | Ingest a free CTI feed (STIX/TAXII or simple list) into SIEM; alert on hits. Deliverable: Rule + sample hit. Domain: D4 |
| 88 | Web Compromise Drill (Juice Shop) | Generate an error burst; detect via logs; contain by WAF rule or rate-limit; recover. Deliverable: Timeline. Domain: D4 |
| 89 | Phishing Response Playbook | Quarantine message, reset creds, block domain, user coaching; measure MTTR. Deliverable: Playbook + metric. Domain: D4 |
| 90 | BCP/DR Test | Fail your web VM; bring up from backup/snapshot; verify RTO/RPO targets. Deliverable: Test results. Domain: D4 |
Domain 5 — Governance, Risk & Compliance Labs 91–100
| # | Lab | Details (verbatim) |
|---|---|---|
| 91 | Risk Register | Build a register (asset, threat, vulnerability, risk, owner, treatment). Deliverable: Spreadsheet. Domain: D5 |
| 92 | Qual vs Quant Risk (ALE) | Calculate SLE, ARO, ALE for 3 scenarios; compare to control cost. Deliverable: Calculations. Domain: D5 |
| 93 | Acceptable Use Policy (AUP) | Draft a concise AUP for your lab; include monitoring notice. Deliverable: 1-page AUP. Domain: D5 |
| 94 | Data Classification Scheme | Public/Internal/Confidential/Restricted; map safeguards per class. Deliverable: Matrix. Domain: D5 |
| 95 | Privacy Mapping | List PII/PHI/PCI data and handling rules (masking, retention). Deliverable: Data map. Domain: D5 |
| 96 | Vendor Risk Checklist | Create questionnaire (SOC 2, ISO 27001, DPAs, sub-processors, breach notice). Deliverable: Checklist. Domain: D5 |
| 97 | Control Framework Mapping | Map 10 of your controls to NIST CSF functions. Deliverable: Mapping table. Domain: D5 |
| 98 | Security Awareness Plan | Design a 12-month micro-learning calendar + phishing simulations cadence. Deliverable: Plan doc. Domain: D5 |
| 99 | Log Retention & Chain of Custody | Define retention by data type; write a simple evidence handling form. Deliverable: Policy + form. Domain: D5 |
| 100 | Metrics & Reporting (KPI/KRI) | Build a dashboard (patch %, MFA coverage, MTTR, phishing click-rate). Deliverable: One-page report. Domain: D5 |
Publishing Tips (for organic traffic)
– Use clear H2/H3 headings: “Lab 01 — Build the Security+ Home Lab”.
– Add short intros and a Table of Contents with jump links.
– Include screenshots (with redactions). Add alt text like Wireshark capture of DNS query.
– Add an FAQ at the end targeting “People also ask” (e.g., “Is Security+ hands-on?”).
– Internal link to your related guides on SY0-701 study plans and PBQ strategy.
– Add schema.org/HowTo for 3–5 representative labs to earn rich results.
CertGet 100% Pass Guarantee — Security+ SY0-701
To obtain your CompTIA Security+ (SY0-701) certification quickly and securely, you can use
CertGet’s special service — 100% pass guarantee with
pay after you pass. For more details, visit:
CertGet — Security+ SY0-701 Service
.
Copying or quoting from this article is permitted with proper attribution to CertGet and a visible link to
www.Certget.com.