A lab you can break safely, and why your laptop is not it

This lesson maps to no SY0-701 objective. CompTIA does not examine "build a lab", and nothing here will be asked of you. It exists because the labs attached to objectives 1.4, 2.5, 3.4, 4.1, 4.3, 4.4, 4.5, 4.6, 4.8 and 4.9 all change settings, break things and read logs, and there has to be somewhere to do that which is not the machine you need working tomorrow.

Why this matters

Security+ is not a hands-on exam. You can pass it having never hardened anything. You will be worse at the job, and — this is the part people underestimate — you will also be worse at the exam, because a large share of SY0-701's questions are scenarios that assume you have seen the thing being described. "The baseline was applied but the service failed to start" means something concrete to someone who has applied a baseline and had a service fail to start. To everyone else it is a sentence to be guessed at.

The other reason is blunter. Several labs in this course tell you to turn things off, open ports, generate failed logins until an account locks, and restore from a backup you deliberately corrupted. Doing any of that to your own working machine is how a study session turns into an evening of recovery.

The lesson

Two virtual machines, one network, no route to anything you did not build

The whole lab is two guests on an internal-only virtual network.

Any hypervisor will do — VirtualBox, VMware Workstation Player, Hyper-V on Windows Pro, or KVM. What matters is the network mode. Use the one your hypervisor calls internal, host-only or private: the guests can see each other and nothing else. Do not use bridged. Do not leave NAT enabled once you have finished installing packages.

There is a real reason beyond tidiness. Two of the later labs generate traffic that looks exactly like an attack — repeated failed authentications, a port scan of a host you own, a DNS query flood against your own resolver. On an isolated segment that is a lesson. On your home network it is noise your ISP's abuse desk may eventually ask you about, and on a corporate network it is a conversation with your employer.

Give each guest a fixed address in a range you will recognise later, something like 10.99.0.10 and 10.99.0.20. When you are reading a firewall log in Domain 4, addresses you chose yourself are far easier to reason about than whatever DHCP handed out.

A Windows target and a Linux target, because the exam assumes both

SY0-701 is vendor-neutral but it is not platform-blind. Group Policy, BitLocker and Windows Event Log appear in it. So do SELinux, syslog, iptables or nftables, and file permissions expressed as owner/group/other. You need one of each to have seen both.

For Windows, an evaluation copy of Windows Server or a Windows 10/11 evaluation image is enough; Microsoft publishes time-limited evaluation VMs for exactly this purpose. For Linux, take a current long-term-support Ubuntu Server or a Rocky/AlmaLinux minimal install. Server editions, not desktop: you want the command line, and you want the smaller default footprint so that when you harden it you can see what changed.

Two gigabytes of RAM each and 20GB of disk is plenty. This lab runs comfortably on a machine with 8GB.

Snapshots, so a broken hardening experiment costs thirty seconds

Take a snapshot of each guest the moment the install finishes, before you change anything, and name it clean. Take another after you install the tooling in the next section and name it tooled.

This single habit is what makes the rest of the course usable. Hardening is iterative and most of the learning is in the failures: you disable a service and something unrelated stops working, you apply a permissions change and lock yourself out of your own shell, you turn on a firewall default-deny and lose the session you were typing in. All of those are good outcomes to have had, and all of them cost half a minute to undo if there is a snapshot and most of an evening if there is not.

Revert to tooled between labs unless a lab says otherwise. Carrying the wreckage of one exercise into the next makes it impossible to tell which change caused what.

Installing the log and monitoring tooling the later lessons measure with

Install these once, then snapshot:

• On the Linux guest: auditd, rsyslog (usually already present), nmap, tcpdump, openssl and curl. Objective 4.9's lab reads auditd output; 4.4's lab reads rsyslog.
• On the Windows guest: nothing extra is strictly required — Event Viewer, Get-WinEvent, Windows Defender Firewall and Local Security Policy ship with it. Install Sysmon if you want the Domain 4 logging labs to be considerably more interesting; the lessons work without it.
• Optionally, on the Linux guest, a small log-collection stack. The labs are written to work with plain files so that nobody is blocked on getting a SIEM running, but if you already know one, point it at both guests.

Everything above is free and none of it requires a licence you do not already have.

Proving the isolation before the first lesson that changes a setting

Do not take the hypervisor's word for it. From the Linux guest:

ping -c 2 10.99.0.20        # the other guest: should succeed
ping -c 2 1.1.1.1           # the internet: should fail
curl -s -m 5 https://example.com    # should time out, not return HTML
ip route                    # there should be no default route

The last one is the real test. A guest with no default route cannot reach anything off its own subnet regardless of what the hypervisor claims about network modes, and it is a single line to verify.

From the Windows guest, Test-NetConnection 10.99.0.10 should succeed and Test-NetConnection example.com -Port 443 should fail.

If the internet checks succeed, your network mode is wrong. Fix it before you continue. A lab that is "mostly isolated" is not isolated, and the first time it matters will be the time you generate something you would rather had stayed inside.

Snapshot both guests as clean once this passes.

What to take into the exam

Nothing here is examinable. What the lab buys you is the ability to answer scenario questions from memory of having done the thing rather than from a definition — and that is worth more marks in Domain 4 than any single fact in this lesson.