Where practice is allowed

02Three practice settings

An owned local lab gives you control over a practice environment. Local means on your own device in this context. Keep the activity inside that environment and use invented data. A VM can still have network access, so its name alone does not prove it is isolated; follow the later setup instructions before running tools.

A provider's authorized lab supplies a different kind of permission: its official rules allow the named exercise under stated limits. Its login, scoreboard and other learners can remain excluded. Check the actual challenge identity and rules before using it.

A public service you happen to use is different again. Owning the device you use to reach it, or having an account there, does not give you permission to run security exercises against it. Compare the exact target and proposed action with the grant.

03Choose from the desk cards

Here, desk cards means short written cases you compare in your notes. They are not instructions to create or connect to a system. Use the plan fields below to make your decision explicit.

FICTIONAL PRACTICE SETTINGS

CARD A
Owner: learner
Target: owned, isolated, disposable VM
Allowed action: the listed local training exercise using invented data
Excluded: external connections and real accounts
Stop: activity leaves the VM or unexpected private data appears

CARD B
Owner: school
Target: public school portal
Permission: none for security testing
Proposed action: run the same training exercise against the portal

CARD C
Owner: training provider
Target: provider's named challenge lab
Permission: official rules permit the listed puzzle only
Excluded: provider login, scoreboard and other learners
Stop: unclear target or action; ask through the provider's stated channel

Practice plan
Chosen setting:
Who supplies permission:
Exact target:
Permitted action:
Time window and current rules to confirm:
Excluded systems and data:
Stop condition:
Evidence I will record:
Safe next step:
Question to clarify, if needed:

1. Read all three cards. In the plan, record the owned local setting, who controls it and the action permitted there. Treat the isolation as a stated fact of this fictional card, not something you have established on a real device.
2. Compare Card B with that plan. Explain why moving the same exercise to the school portal changes the permission decision. Then identify the limited permission that could make Card C suitable for its named puzzle.
3. Add the exclusions and one stop condition for your chosen setting. Record something you would need to confirm before a real exercise, such as the exact lab identity, current rules or time window.
4. Review the plan: it should permit one defined local action, keep real services out of scope and give a reason to pause. Finish with the written plan. No installation or network connection is part of this checkpoint.

04Stage check: prepare before practicing

Use Card A for a final invented case. Imagine the permitted exercise displays File unavailable. Write that result as an observation. Add one possible explanation marked uncertain, a safe next check, and a private help draft that contains no puzzle answer or credential.

Then imagine a learner making three incorrect attempts and revealing an answer in an ordinary course question. They stop before submitting a correct answer. Predict the saved-completion state and explain which action is still missing.

Review all parts together. Your practice plan should identify permission and limits. Your evidence note should separate what the case states from what you infer. Your help draft should preserve the error without exposing secrets. Your completion prediction should distinguish displaying an answer from checking and saving it. These are written practice tasks, separate from the required question below.

05What comes next

Computers introduces hardware, files, programs, processes and virtual machines before lab setup. Those lessons are open to read, and following their order helps you build the vocabulary used in their activities.

Keep this stage's method beside later exercises: check permission, name the allowed action, record what happens, and ask a focused question if the evidence is incomplete. You can return to the templates whenever a new tool makes the situation feel unfamiliar.

06Optional challenge

Allow about 5 extra minutes. Name a reason to stop even inside an owned lab, then describe what you would do next. For example, an exercise might reach outside its intended environment. Your explanation should identify the crossed boundary and avoid continuing the action while it is uncertain.

07Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Owner: learner. Target: isolated disposable VM cedar-lab. Action: read the supplied exercise file using invented data. Window: 16:00–17:00 UTC on the stated practice day. Excluded: external services, real accounts and changing files. Stop: activity leaves cedar-lab, private data appears, or permission is uncertain.
Proposal P: read the supplied file in cedar-lab at 16:25 UTC.
Proposal Q: read a school portal from inside cedar-lab at 16:25 UTC.
Note draft: task read exercise; result Permission denied; account password [fictional-value].

08Write a bounded practice plan

Optional written self-check: Record who grants permission, the named target, permitted action, window, exclusions, stop and evidence. Check that network visibility adds no permission. Keep a redacted note with observed results separate from guesses; stop with the written plan here.