CertificationsCompTIA Security+ SY0-701Labs
CompTIA Security+ SY0-701 hands-on labs
The same control seen in several tools: a firewall rule table, a SIEM queue, Linux hardening and Windows policy.
47 labs you run in the browser: 14 guided, 23 assisted, 10 challenge. About 12 hours of authored lab time. 1 opens to any signed-in account without a lab grant, and 1 with no account at all.
47
labs
14
guided
steps in order
10
goal only
challenge and capstone
1
free tasters
signed-in, no grant
What you practise
Exam facts and study plan- Risk register and control sheets· you click13 labs
- Linux bash console· you type10 labs
- SIEM queue· you click10 labs
- Windows desktop· you click8 labs
- Firewall zone and rule table· you click6 labs
- Cloud panel with the matching CLI line· you click2 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Write a change the CAB will approve
ProGuided · Quick · 8 min · Risk register and control sheets
Ticket CHG-908 from Joanna Reyes, IT Operations: "Patch the badge-reader controller firmware on Saturday at 22:00. The CAB meets Thursday…
change managementimpact analysisbackout planmaintenance window
Block a malicious domain at the DNS filter
ProGuided · Quick · 10 min · SIEM queue
Ticket SOC-6120 from Rosa Delgado, SOC lead: "Threat intel flagged cdn-metrics-update.example as a malware command and control domain. Block it at the DNS filter for the whole company…
DNS filteringblock listindicator of compromisescope of a block
Bring a laptop to the security baseline with Group Policy
ProGuided · Quick · 10 min · Windows desktop
Ticket CMP-884 from Gwen Alvarez, Endpoint Team: "Audit found SALES-LT-22 off our build standard on password length, account lockout and disk encryption…
secure baselineconfiguration driftgroup policydisk encryption
Find open service ports and close the unneeded ones
ProGuided · Quick · 10 min · Linux bash console
Ticket INF-418 from Ayesha Khan, Infrastructure Lead: "The audit says app03 answers on ports we never approved. The approved list is SSH on 22 and HTTPS on 443…
attack surfacelistening portunneeded servicehardening
Fix a shared folder everyone can edit
ProGuided · Quick · 10 min · Windows desktop
Ticket AUD-210 from Leah Fischer, Internal Audit: "D:\Shares\Payroll on FS01 lets Everyone modify files. Only the Payroll-Staff group should be able to modify them…
least privilegepermissionsinherited permissionsgroup-based access
Let the vulnerability scanner reach the web servers, nothing else
ProGuided · Quick · 10 min · Firewall zone and rule table
Ticket SEC-2871 from Marcus Hale, Vulnerability Management: "The weekly scan fails against the web servers in the screened subnet. The scanner is 10.20.5.10. Open only what the scan needs…
security zoneaccess control listrule orderfirst match wins
Lock down a payroll folder with Linux permissions
ProGuided · Quick · 10 min · Linux bash console
Ticket AUD-209 from Leah Fischer, Internal Audit: "/srv/payroll on fs01 can be read by every user, interns included. Only the payroll group may read or change it. Nobody else gets in…
least privilegefile permissionsowner and groupaccess control
Prepare the staff portal certificate renewal
Open without an accountGuided · Quick · 10 min · Linux bash console
Harborline's staff portal certificate is nearing expiry. The certificate authority needs a new signing request by Friday. Check the current expiry and site name…
certificate expiryprivate keycertificate signing requestcertificate authority
Preserve laptop evidence with hashes and chain of custody
ProGuided · Quick · 10 min · Linux bash console
Ticket LEG-212 from Ruth Abernathy, General Counsel: "A departing engineer's laptop, ENG-LT-14, may hold stolen design files…
chain of custodyevidence hashingworking copyintegrity
Restrict the admin portal and block an abusive range
ProGuided · Quick · 10 min · Firewall zone and rule table
Ticket SEC-2902 from Marcus Hale: "The admin portal must be reachable only from the office and the contractor VPN range. Separately, one outside range is hammering the public site…
allow listdeny listrule orderfirst match wins
Switch an admin from SSH passwords to keys
ProGuided · Quick · 10 min · Linux bash console
Ticket SEC-3310 from Ayesha Khan, Infrastructure Lead: "Admin access to app01 should be by SSH key only: no passwords, no root login. You work from jump01…
public key authenticationsecure remote administrationhardeningroot login
Triage a reported fake invoice and purge it
ProGuided · Quick · 10 min · SIEM queue
Ticket HD-5120 from Priya Raman, Accounts Payable, 08:40: "An invoice from Northline Freight, a supplier I know, has new bank details. I have not paid…
phishingbusiness email compromiselookalike domainemail authentication
Triage the overnight SIEM alert queue
ProGuided · Quick · 10 min · SIEM queue
Message from Rosa Delgado, SOC lead, 07:15: "Four alerts came in overnight. Close the ones that are expected, with a reason each, and tell me which one is real and why. If one is real…
SIEMalert triagefalse positivelog aggregation
Verify a download with its published hash
ProGuided · Quick · 10 min · Linux bash console
Ticket END-77 from Gwen Alvarez, Endpoint Team: "Before I push monitor-agent-4.2.tar.gz to 400 laptops, confirm the copy on our share is the one the vendor published…
hashintegritychecksumsalt
Find the certificate that expires before the freeze
ProAssisted · Quick · 5 min · Risk register and control sheets
A change freeze starts on 1 November and lasts until 30 November. During a freeze only emergency changes are allowed. Five certificates sit in the inventory…
digital certificatecertificate expiryself-signed certificateSHA-1
Match the records room gaps to the right controls
ProAssisted · Quick · 5 min · Risk register and control sheets
An internal audit left two gaps open at Rivergate Family Clinics. After-hours entry to the records room goes unseen, and the loading bay door is left ajar after deliveries…
control categorycontrol typepreventive controldetective control
Clear the returned laptop before it is resold
ProAssisted · Quick · 6 min · Risk register and control sheets
Contractor Jide Okafor returned laptop AST-2214 on 20 October. A disposal partner wiped it and sent a certificate. Before the laptop can be resold…
asset inventorysanitizationcrypto erasecertificate of destruction
Label the export before it leaves the building
ProAssisted · Quick · 6 min · Risk register and control sheets
An analytics vendor asked for the October claims export, claims-2026-10.csv, 48,210 rows. It holds member ids, names, email addresses, card last four digits and diagnosis codes…
data classificationtokenizationmaskingdata at rest
Record the vendor checks before database access
ProAssisted · Quick · 6 min · Risk register and control sheets
Northwind Supplies wants read access to the customer database for its invoice portal. Their questionnaire is back with five answers. An answer is a claim until something backs it up…
due diligenceSOC 2 reportright to auditservice level agreement
Remove the rights the contractor kept
ProAssisted · Quick · 6 min · Risk register and control sheets
It is the quarterly access review for the deploy and finance systems. Eight accounts are on the list. Remove access that outlived its reason…
least privilegeaccess reviewservice accountorphan account
Contain the worm in the right order
ProAssisted · Quick · 7 min · SIEM queue
A worm is spreading on the records subnet, which has 40 hosts. Three are confirmed: WS-REC-08, WS-REC-11 and WS-REC-15 all show the same file hash. The 01:00 backup is clean and tested…
incident responsecontainmentevidence preservationchain of custody
Cut off the remote session a phone call opened
ProAssisted · Quick · 7 min · Windows desktop
Marcus Lee in finance got a call from someone who said they were from Delta IT Services. The caller asked him to install SupportLink and read out a one-time code…
vishingpretextingremote accessleast privilege
Score the refund fraud risk for the board
ProAssisted · Quick · 7 min · Risk register and control sheets
A support agent can push a refund to any card, and the payout leaves before anyone checks. The refund policy names two controls: manual review over $500 and a velocity limit of three…
risk scoreresidual riskrisk treatmentrisk appetite
Split the plant network off the office
ProAssisted · Quick · 7 min · Firewall zone and rule table
The plant historian sits on the office network and answers anything in the office range. The engineering team has finished moving its tooling to one jump host, 10.20.9.5…
segmentationsecurity zonedefault denyfail closed
Apply one control of each type to a front-desk PC
ProAssisted · Quick · 12 min · Windows desktop
Ticket SEC-6034 from Elena Ruiz, Facilities IT: the shared reception PC has no sign-in notice, does not lock when left unattended, and records no sign-in audit events…
deterrent controlspreventive controlsdetective controlscorrective controls
Find SQL injection traces and block them
ProAssisted · Quick · 14 min · SIEM queue; Firewall zone and rule table
Ticket SEC-7042 from Hana Ito, Web team: "The catalog and product pages threw odd database errors this morning. The request log from WEB-01 is in the SIEM…
SQL injectionweb server logweb application firewallanomaly score
Forward failed logons to the SIEM
ProAssisted · Quick · 14 min · SIEM queue; Windows desktop
Ticket SEC-7046 from Rosa Delgado, SOC lead: "APP-02 has recorded failed sign-ins all week and the SIEM shows nothing from that server…
audit policylog forwardingfailed logon eventSIEM ingestion
Bring the branch VPN up
ProAssisted · In-depth · 20 min · Firewall zone and rule table
Branch-2 lost power over the weekend, and its firewall came back on the proposal in the signed handover sheet. Our side of the HQ to Branch-2 tunnel still offers the old one…
site-to-site VPNIPsecIKE phase 1IPsec phase 2
Check a threat feed against the SIEM
ProAssisted · In-depth · 20 min · SIEM queue
The intel team loaded this week's threat feed into the SIEM as a low-severity batch alert. Work the feed: search our events for every entry in it…
threat intelligence feedindicator of compromisereputationblock list
Fix and run the leaver script
ProAssisted · In-depth · 20 min · Windows desktop
The monthly offboarding job runs C:\Scripts\Disable-Leavers.ps1 to disable the accounts of people who have left Harborline. This month it disabled nobody. Read the script…
PowerShell scriptdisable accountoffboardingActive Directory Users and Computers
Set password and lockout policy in Group Policy
ProAssisted · In-depth · 20 min · Windows desktop
Ticket SEC-6018 from Mira Singh, Endpoint Security: an audit found that the Finance workstation policy still allows short passwords and has no lockout threshold…
password historyminimum password lengthaccount lockoutGroup Policy
Close the clinic audit findings
ProAssisted · In-depth · 22 min · Risk register and control sheets
Internal auditor Hana Varga left five findings at Rivergate Family Clinics in report AUD-2026-14. You have six controls that the clinic uses or plans to use…
control categorycontrol typechange managementbackout plan
Find every copy of the claims export and close the exposure
ProAssisted · In-depth · 24 min · Cloud panel with the matching CLI line
The October claims export, claims-2026-10.csv, holds member ids, names, card digits and diagnosis codes for 48,210 rows. It was shared with an analytics vendor…
data exposurepublic cloud storageencryption at restversioning
Allow the approved scanner through the web server firewall
ProAssisted · In-depth · 25 min · Linux bash console
Ticket SEC-6092 from Linh Tran, Vulnerability Management: web-01 is due for the quarterly scan, but the host firewall rejects the scanner…
host firewallfirewalld rich rulepermanent configuration
Contain a Defender detection and remove its scheduled task
ProAssisted · In-depth · 25 min · Windows desktop
Ticket SEC-6044 from Mina Patel, Endpoint Response: Jordan Lee reported repeated security pop-ups on HR-LT-22 after opening a fake payroll attachment…
Defender threat quarantinescheduled task persistencefull scan
Take the door fix through change control
ProAssisted · In-depth · 25 min · Risk register and control sheets
Internal audit report AUD-2026-14 found the clinic east door propped open and no review of after-hours entry to the records room. Facilities has a change ready: a badge reader…
technical controlphysical controloperational controlpreventive control
Answer the audit with evidence that proves the control ran
ProAssisted · In-depth · 30 min · Risk register and control sheets
Internal auditor Hana Varga has closed fieldwork on report AUD-2026-14. Five findings are open at Rivergate Family Clinics: after-hours entry to the records room, a shared reception login…
auditfindingevidenceaudit opinion
Find out why a supplier's mail is rejected
ProChallenge · Quick · 10 min · SIEM queue
Message from Tomas Weber, Procurement, 10:05: "Mail from Calder Packaging keeps bouncing. They say it is our fault. I need a plain answer by noon: whose problem is it…
SPFDKIMDMARCemail gateway
Find why the web service will not start after patching
ProChallenge · Quick · 10 min · Linux bash console
Ticket INC-5521 from Ayesha Khan, Infrastructure Lead: "web02 has been down since last night's patching and the site is dark. Get it back…
log reviewroot causeservice availabilitylistening port
Fix the partner SFTP rule that does nothing
ProChallenge · In-depth · 20 min · Firewall zone and rule table
Ticket NET-2214 from Naomi Oyelaran, Network Operations: "I added a rule so Tideway Logistics (203.0.113.40) can reach sftp.rivergate at 10.30.4.15 on port 22…
firewall rule orderfirst match winsleast exposurepacket test
Back up the finance share and prove a restore
ProChallenge · In-depth · 25 min · Linux bash console
Ticket INF-533 from Priscilla Bank, Finance Director: "Backups ran for months and nobody ever restored one. Back up /srv/finance tonight and prove it restores…
backuprestore testintegrity checkrecovery
Find the beaconing host and a clear-text login in a capture
ProChallenge · In-depth · 25 min · SIEM queue
Ticket SOC-318 from Rosa Delgado, Network Operations: "The IDS flagged VLAN 40 for five minutes. Here is the capture…
packet capturebeaconingclear-text protocolindicators of compromise
Harden a new jump server before go-live
ProChallenge · In-depth · 25 min · Linux bash console
Ticket CHG-1140 from Ayesha Khan, Infrastructure Lead: "jump01 goes live Friday. Checklist: no root login over SSH, keys only, no unused services, the payroll export folder group-only…
hardeningattack surfaceleast privilegesecure remote administration
Prioritize Monday's scan findings and raise remediation tickets
ProChallenge · In-depth · 25 min · Risk register and control sheets
Ticket VM-77 from Marcus Hale, Vulnerability Management: "Eight new findings from Sunday's scan. Tell the owners which three to fix this week, close what is false, and ticket the rest…
CVSSEPSSknown exploited vulnerabilitiesfalse positive
Close a public bucket and trim an over-permissive role
ProChallenge · In-depth · 28 min · Cloud panel with the matching CLI line
Ticket SEC-2210 from Ivo Petrov, Head of Engineering: "A researcher says acme-finance-exports is world readable. Close it, but the reporting app has to keep reading it. Also…
cloud misconfigurationshared responsibilityleast privilegepublic storage
Take the quarterly risk register to the board
ProChallenge · In-depth · 40 min · Risk register and control sheets
Ticket RISK-77 from Dana Whitfield, VP Finance and Operations: "The risk committee meets Monday. Update the register from the evidence, price the two risks the board asked about…
risk registerrisk appetitesingle loss expectancyannualized loss expectancy
Trace one phishing intrusion across three hosts and contain it
ProChallenge · In-depth · 45 min · SIEM queue
Ticket SEC-4102 from Marcus Webb, CISO, 09:30: "A message called Quarterly benefits update reached six staff this morning and three people clicked…
phishingbeaconSIEMcontainment
Where to go next
Every certification with labsSY0-701 lab questions
There are 47 labs: 14 guided, 23 assisted, 10 challenge. Together they carry about 12 hours of authored lab time, and 1 free taster lab.
Practise SY0-701 the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.