Cyber Security · What the Course Covers
Inside Uncodemy's Cybersecurity Course — What You Learn
Quick summary — inside Uncodemy's cybersecurity course
Inside Uncodemy's cybersecurity course, what you learn typically spans networking, Linux, security fundamentals, web security and defence. Expect OWASP-based web testing in safe labs, standard tools such as Nmap, Wireshark and Burp Suite on authorised targets, SOC basics like log analysis and alert triage, and writing clear reports. Confirm the current module list and duration with a counsellor before enrolling.
In this guide you will learn:
- Foundation modules — networking, Linux and core security concepts.
- Web security — the OWASP Top 10 practised in deliberately vulnerable labs.
- Lab tools — what Nmap, Wireshark and Burp Suite are used for, legally.
- SOC and reporting — reading logs, triaging alerts and writing findings.
- Checklists — questions to ask a counsellor and a study tracker.
SECTION 01Foundations: networking, Linux and security basics
Every serious cybersecurity course starts with the plumbing. You cannot defend a network you do not understand, so early modules usually cover networking: the OSI and TCP/IP models, IP addressing and subnets, common ports, and how protocols like DNS, HTTP, HTTPS and SSH actually move data. Alongside this comes Linux, because most servers, security tools and lab machines run it. You learn to move around the file system, manage users and permissions, read logs and run simple scripts.
The third foundation block is security fundamentals: the CIA triad of confidentiality, integrity and availability, authentication versus authorisation, hashing versus encryption, and common threat types such as phishing, malware and weak passwords. These are the areas most courses cover; the current Uncodemy module list, order and duration can change between batches, so please confirm it with a counsellor.
| Module area | Typical topics | Hands-on practice | Why it matters |
|---|---|---|---|
| Networking | OSI/TCP-IP, subnets, ports, DNS, HTTP | Capture and read traffic in Wireshark | Every attack and alert travels over a network |
| Linux | Files, permissions, users, processes, logs | Command-line tasks on a lab VM | Most servers and security tools run on Linux |
| Security fundamentals | CIA triad, auth, hashing, encryption | Compare hashes, inspect a TLS certificate | Shared vocabulary for every later module |
| Windows basics | Users, groups, event logs, Active Directory ideas | Read Windows event logs in a lab | Most office endpoints run Windows |
# Show your IP addresses (Linux)
ip addr show
# Which ports are listening on this machine?
ss -tulpn
# Resolve a domain name to IP addresses
dig example.com +short
# Trace the path packets take
traceroute example.com
# Fetch only the HTTP response headers
curl -I https://example.com# Who am I and which groups am I in?
whoami && id
# Long listing with permissions
ls -l /etc/passwd
# -rw-r--r-- 1 root root ... /etc/passwd
# Remove 'others' read access from a file you own
chmod o-r notes.txt
# Recent authentication events (Debian/Ubuntu)
sudo tail -n 50 /var/log/auth.log
# On systemd systems you can also use:
sudo journalctl -u ssh --since "1 hour ago"SECTION 02Web security and lab tools: OWASP in a safe environment
Most organisations run web applications, so web security is a core module in nearly every cybersecurity course. It is usually built around the OWASP Top 10, a widely used awareness list of the most critical web application risks, such as broken access control, injection, cryptographic failures and security misconfiguration. You learn how each risk happens, how it is found and, most importantly, how developers fix and prevent it.
Practice happens in deliberately vulnerable lab applications such as DVWA or OWASP Juice Shop, running on your own machine. Here you meet standard tools: Nmap for discovering hosts and open ports, Wireshark for inspecting traffic and Burp Suite for intercepting web requests. Using these tools against systems without written permission is illegal in India under the IT Act, so a good course teaches scope and authorisation before any tool.
| OWASP risk (2021 list) | Simple meaning | How you practise it | Typical fix |
|---|---|---|---|
| A01 Broken Access Control | Users reach data or actions they should not | Change an ID in a lab URL and observe | Server-side permission checks on every request |
| A03 Injection | Untrusted input runs as a query or command | SQL injection exercises in DVWA | Parameterised queries and input validation |
| A05 Security Misconfiguration | Default settings, verbose errors, open admin pages | Review headers and error pages in the lab | Hardened configs and removing defaults |
| A07 Identification and Authentication Failures | Weak login, session or password handling | Test lockout and session behaviour in Juice Shop | MFA, rate limiting, secure session handling |
# Run OWASP Juice Shop locally (a deliberately vulnerable app)
docker run --rm -p 3000:3000 bkimminich/juice-shop
# Open in your browser:
# http://localhost:3000
# Point Burp Suite's browser or proxy (127.0.0.1:8080)
# at it and watch each request and response.
# Only ever test apps you run yourself or have
# written permission to test.# Scan ONLY your own lab machine or network
# Discover live hosts on your lab subnet
nmap -sn 192.168.56.0/24
# Service and version detection on one lab VM
nmap -sV -p 1-1000 192.168.56.101
# Save results for your report
nmap -sV 192.168.56.101 -oN lab-scan.txt
# 192.168.56.0/24 is a common VirtualBox host-only range;
# check yours with: ip addr showSECTION 03Defence: SOC basics, incident handling and reporting
Many entry-level cybersecurity jobs are on the defensive side, in a Security Operations Centre (SOC). A SOC analyst watches alerts, investigates suspicious activity in logs and escalates real incidents. Courses therefore typically include log analysis, the idea of a SIEM (a system that collects and correlates logs from many sources), common alert types such as repeated failed logins, and the basic incident response cycle of preparation, detection, containment, eradication, recovery and lessons learned.
The skill that ties everything together is reporting. Whether you found a vulnerability in a lab or investigated an alert, you must explain what happened, how serious it is and what to do next, in language both technical teams and managers understand. Ask a counsellor how much time the current batch spends on SOC practice and report writing, because these are the areas employers check first.
| SOC skill | What you do | Sample lab task | Output |
|---|---|---|---|
| Log analysis | Read authentication, web and system logs | Find repeated failed SSH logins | List of suspicious IPs and times |
| Alert triage | Decide true positive, false positive or escalate | Review a set of sample SIEM alerts | Triage notes with reasoning |
| Incident handling | Follow a response playbook step by step | Walk through a phishing incident scenario | Timeline and containment steps |
| Reporting | Explain findings, risk and fixes clearly | Write up one lab finding | Professional report with evidence |
# Count failed SSH password attempts by source IP
# (Debian/Ubuntu auth.log format)
sudo grep "Failed password" /var/log/auth.log \
| grep -oE "from [0-9.]+" \
| awk '{print $2}' \
| sort | uniq -c | sort -rn | head
# Example output
# 57 203.0.113.45
# 3 198.51.100.7
# 203.0.113.0/24 and 198.51.100.0/24 are documentation
# ranges, used here as placeholders.FINDING REPORT (lab exercise)
Title : SQL injection in login form (DVWA, lab only)
Severity : High
Asset : http://localhost/dvwa/vulnerabilities/sqli/
Scope : Own lab VM, authorised practice
Description: User input is placed directly into a SQL
query, allowing data to be read.
Evidence : Request/response screenshots, Burp history
Impact : Unauthorised access to user records
Fix : Use parameterised queries; validate input;
apply least-privilege database accounts
References : OWASP Top 10 A03:2021 InjectionSECTION 04Checklists: counsellor questions, lab setup and study tracker
Because module lists and durations change between batches, use the first template to confirm exactly what the current Uncodemy cybersecurity course covers. The other two help you set up a safe home lab and track your progress module by module.
QUESTIONS TO ASK A COUNSELLOR
[ ] What is the current module list, in order?
[ ] How long is the course and how many sessions per week?
[ ] Which modules are hands-on labs, and on what platform?
[ ] Which tools are used (e.g. Nmap, Wireshark, Burp Suite)?
[ ] How much time goes to SOC and log analysis?
[ ] Is report writing taught and reviewed?
[ ] Which certification, if any, does it prepare me for?
[ ] Weekday, weekend or live online batches available?
[ ] Can I repeat a batch if I miss modules?
[ ] Fees and inclusions in writingSAFE HOME LAB SETUP
[ ] 8 GB RAM or more recommended for running two VMs
[ ] Install VirtualBox or VMware Workstation Player
[ ] VM 1: Kali Linux (tools)
[ ] VM 2: a vulnerable target (e.g. Metasploitable 2)
[ ] Network: host-only adapter, NOT bridged to office Wi-Fi
[ ] Docker for OWASP Juice Shop / DVWA
[ ] Take a VM snapshot before each exercise
[ ] Rule: only test machines inside this labSTUDY TRACKER
Module area Started Lab done Notes Confident?
--------------------- ------- -------- ----- ----------
Networking [ ] [ ] [ ] 1 2 3 4 5
Linux [ ] [ ] [ ] 1 2 3 4 5
Security fundamentals [ ] [ ] [ ] 1 2 3 4 5
Web security / OWASP [ ] [ ] [ ] 1 2 3 4 5
Lab tools [ ] [ ] [ ] 1 2 3 4 5
SOC basics [ ] [ ] [ ] 1 2 3 4 5
Reporting [ ] [ ] [ ] 1 2 3 4 5SECTION 05Tips to get the most from a cybersecurity course
These habits help you turn module topics into real, job-ready skill:
- Do not skip networking — learners who rush the basics usually struggle later with scans, traffic analysis and alerts.
- Practise between classes — thirty minutes of lab work on non-class days builds muscle memory.
- Write notes as reports — record every lab in finding-report format so your portfolio grows naturally.
- Stay legal and in scope — use your own lab and authorised platforms only, never real sites.
- Learn the defender's view — for every attack you study, write down how it would be detected and prevented.
SECTION 06Interview Q&A — entry-level cybersecurity
Q1What is the difference between hashing and encryption?
Encryption is reversible with the right key and protects data you need to read later. Hashing is one-way: it produces a fixed-length value used to verify integrity or store passwords. Passwords should be hashed with a slow, salted algorithm such as bcrypt or Argon2.
Q2What is the difference between a vulnerability, a threat and a risk?
A vulnerability is a weakness, like an unpatched server. A threat is something that could exploit it, such as an attacker or malware. Risk combines the likelihood of that happening with the impact if it does.
Q3How would you investigate many failed login attempts on a server?
I would check the authentication logs for source IPs, times and usernames, see whether any attempt succeeded, compare with normal patterns, and escalate if it looks like an attack. I would suggest blocking the source and enforcing MFA or key-based login.
Q4What is the OWASP Top 10?
It is a regularly updated awareness document from OWASP listing the most critical web application security risks, such as broken access control and injection. Teams use it to prioritise secure coding, testing and training.
Q5What does a SOC analyst do?
A SOC analyst monitors security alerts, investigates suspicious activity in logs and tools like a SIEM, separates false positives from real incidents, escalates confirmed issues following playbooks and documents what happened.
SECTION 07Test yourself — cybersecurity course basics
Five questions. No sign-up.
0 / 5Pick an answer to see why it is right or wrong.
SECTION 08Frequently asked questions
What topics are covered in a cybersecurity course?
Most courses cover networking, Linux and Windows basics, security fundamentals, web application security based on the OWASP Top 10, hands-on lab tools, SOC monitoring and incident response, and report writing. Confirm the exact current module list with the institute.
Do I need coding to join a cybersecurity course?
Not to start. Networking and Linux matter more at the beginning. Basic scripting in Bash or Python becomes useful for automating tasks and reading exploit or detection code later, and many courses introduce it gradually.
When is practising ethical hacking legal in India?
Testing is legal only when you have explicit written permission from the system owner and stay within the agreed scope. Accessing or scanning systems without authorisation can be an offence under the IT Act, so always practise in your own lab.
Which jobs can I apply for after a cybersecurity course?
Common entry-level roles include SOC analyst, security analyst, junior vulnerability assessment roles and IT support with a security focus. Your labs, reports and any certifications help show employers what you can actually do.
What laptop do I need for cybersecurity training?
A laptop with a modern multi-core processor, at least 8 GB RAM and enough free disk space to run two virtual machines works for most labs. 16 GB RAM makes running several VMs smoother. Ask the institute about lab requirements.
SECTION 09Related reads
Classroom & online · Noida
Learn cybersecurity the hands-on, legal way
Our Cyber Security Training Course covers networking, Linux, security fundamentals, web security and defensive skills through practical labs, in Noida, Delhi and live online. Confirm the current module list with a counsellor.
Talk to a counsellor for current fees- Hands-on lab practice
- Classroom & live online
- Mock interviews & resume help
- Weekday & weekend batches