CyberPatriot Practice Labs
Practice the decisions, not just the commands
Twelve fictional competition-style labs covering Windows 11, Windows Server, Ubuntu/Mint, Cisco networking, forensics, and mixed-system scenarios.
Each lab is built around inspection, evidence, narrow defensive action, and verification.
Lab Snapshot
What makes these different
The answer is not shown first
Each lab gives you a fictional environment, requirements, clues, and verification goals. You work through the evidence before any debrief.
Competition mindset
Required functionality always matters
The goal is not to disable everything unfamiliar. Preserve required services while hardening the system.
Lab rules
The habits every practice lab reinforces
Read the scenario first
Every lab begins with fictional requirements. Required services, users, roles, and connectivity must be understood before remediation.
Inspect before changing
The first phase of each lab emphasizes read-only checks so you can establish the current state.
Preserve useful evidence
Record hashes, paths, timestamps, PIDs, log entries, task details, and network state before changing evidence-bearing configuration.
Make narrow changes
Labs reward justified corrections, not broad cleanup or disabling everything unfamiliar.
Verify after remediation
After each defensive change, re-check the system and confirm required functionality still works.
Explain the reasoning
Each lab includes short reflection prompts so the learner practices explaining why a finding matters.
Practice pathway
Twelve competition-style labs
Open any lab below to practice the platform skills, evidence review, remediation decisions, and verification workflow.
Windows 11
Windows 11 Baseline Review
Focus
Review local accounts, groups, services, firewall profiles, updates, startup items, scheduled tasks, and basic network state.
Mission
Build a repeatable first-pass inspection routine without making blind changes.
Windows 11
Windows 11 Account & Service Investigation
Focus
Investigate unusual local accounts, administrator membership, service configuration, process ownership, and recent event evidence.
Mission
Separate suspicious-looking configuration from evidence that actually supports a conclusion.
Windows Server
Windows Server Roles & Shares
Focus
Identify required server roles, review SMB shares, services, firewall state, event logs, and role dependencies.
Mission
Harden a server without breaking the services the fictional organization depends on.
Windows Server
Windows Server Identity Review
Focus
Review local or domain-aware users, privileged groups, authentication evidence, remote access, and account changes.
Mission
Determine which identity changes are expected and which need deeper investigation.
Ubuntu / Mint
Linux Users, Sudo & Permissions
Focus
Review users, groups, sudo permissions, file ownership, mode bits, ACLs, packages, and common security-sensitive paths.
Mission
Correct narrowly scoped permission problems without using broad fixes.
Ubuntu / Mint
Linux Services, Logs & Scheduled Activity
Focus
Investigate running services, SSH, journal entries, auth logs, cron jobs, systemd timers, processes, and network listeners.
Mission
Correlate service state with logs and scheduled activity before deciding what should change.
Cisco / Networking
Cisco VLAN & Routing Troubleshooting
Focus
Use interface state, VLAN membership, trunks, routing tables, ARP, and path testing to locate a connectivity problem.
Mission
Troubleshoot from Layer 1 upward instead of changing configuration by guesswork.
Cisco / Networking
Cisco ACL & Port Security Review
Focus
Review ACL placement, rule order, switch-port configuration, port-security state, management access, and logging.
Mission
Identify the smallest justified network change while preserving required connectivity.
Forensics
Forensics Evidence Timeline
Focus
Correlate account activity, file metadata, hashes, logs, scheduled tasks, processes, and network evidence.
Mission
Build a defensible timeline that separates direct observations from inference.
Forensics
Forensics Suspicious Download Case
Focus
Trace a fictional browser download through file metadata, process execution clues, scheduled activity, and network context.
Mission
Determine what the evidence proves without assuming that download automatically means execution.
Mixed Environment
Mixed-System Incident Triage
Focus
Combine Windows, Linux, networking, and forensics evidence across several fictional hosts.
Mission
Prioritize findings, preserve evidence, and decide which systems require immediate defensive attention.
Mixed Environment
Full Competition Simulation
Focus
Work through a longer fictional competition-style environment with required services, multiple platforms, evidence questions, and verification checkpoints.
Mission
Practice disciplined competition workflow from initial read-through to final verification without live-round answers.
Lab flow
A consistent practice rhythm without forcing one lesson format
The lab sequence stays predictable, but the evidence and troubleshooting structure changes naturally by platform.
Mission briefing
Read the fictional organization, system role, required services, restrictions, and what must remain functional.
Initial inventory
Inspect accounts, services, processes, packages, interfaces, logs, shares, tasks, or other evidence relevant to the platform.
Findings
Classify observations as expected, questionable, misconfigured, or requiring more evidence.
Evidence check
Corroborate important findings with a second source before making a high-impact change.
Defensive action
Make the smallest justified change and record what you changed.
Verification
Re-run the relevant checks and confirm required users, services, access, and connectivity still work.
Debrief
Answer reflection questions about what evidence mattered, what could have been misleading, and how you verified the result.
Progression
Labs become more ambiguous as you advance
Foundation
Labs 01 and 05
Build platform-specific inspection habits and learn to avoid broad changes.
Intermediate
Labs 02, 03, 06, 07 and 09
Correlate multiple evidence sources and troubleshoot configuration more systematically.
Advanced
Labs 04, 08, 10 and 11
Handle ambiguity, dependencies, mixed evidence, and higher-impact decisions.
Challenge
Lab 12
Combine competition strategy, operating systems, networking, and forensics in one longer simulation.
Completion standard
A lab is complete when the reasoning is defensible
Identify the system role before making high-impact changes.
Use evidence to explain why each finding is important.
Record the original state before changing evidence-bearing configuration.
Avoid unnecessary or unrelated changes.
Preserve required services and connectivity.
Verify each major remediation step.
Separate direct observations from assumptions or inference.
Complete the final debrief without relying on hidden answer keys during the lab.
Safety boundary
Authorized defensive training only
All scenarios are fictional and intended for authorized training systems or virtual machines.
Labs focus on defensive configuration, evidence review, troubleshooting, and verification.
No live CyberPatriot round answers or hidden scoring keys are provided.
No persistence, credential theft, evasion, or destructive activity is taught.
Commands that modify state appear only when the fictional scenario clearly justifies the defensive action.
The learner is expected to preserve evidence and required functionality before remediation.
Start here
Begin with Windows 11 Baseline Review
Work through the labs in order to reuse skills from the earlier CyberPatriot training while adding more realistic decision-making.
Start Lab 01 →