Top Questions About Cybersecurity Courses Answered in 2026

#!/usr/bin/env bash
# Basic commands a security learner should be comfortable with
whoami                 # current user
pwd                    # current directory
ls -la /etc | head     # list files with permissions
grep -i "error" /var/log/syslog 2>/dev/null | tail -5
ps aux | head -5       # running processes
ss -tuln | head        # listening ports

import socket
import ipaddress

print("localhost resolves to:", socket.gethostbyname("localhost"))

net = ipaddress.ip_network("192.168.1.0/24")
print("network:", net, "usable hosts:", net.num_addresses - 2)
print("is 192.168.1.50 private?", ipaddress.ip_address("192.168.1.50").is_private)

COMMON_PORTS = {22: "SSH", 53: "DNS", 80: "HTTP", 443: "HTTPS"}
for port, name in COMMON_PORTS.items():
    print(port, name)

from collections import Counter

# Sample web server log lines (lab data)
logs = [
    '203.0.113.5 - - [05/Nov/2026:10:00:01] "GET /login HTTP/1.1" 401',
    '203.0.113.5 - - [05/Nov/2026:10:00:02] "GET /login HTTP/1.1" 401',
    '203.0.113.5 - - [05/Nov/2026:10:00:03] "GET /login HTTP/1.1" 401',
    '198.51.100.7 - - [05/Nov/2026:10:01:00] "GET /home HTTP/1.1" 200',
]
failed = Counter(line.split()[0] for line in logs if line.endswith("401"))
for ip, n in failed.items():
    print(f"{ip}: {n} failed login attempts" + ("  <- investigate" if n >= 3 else ""))

Lab: Investigating repeated failed logins
Environment: isolated lab VM and sample logs
Objective: identify suspicious login activity

Steps:
1. Filtered log for HTTP 401 responses on /login
2. Counted attempts per source IP
3. Checked for any later successful login from the same IP

Finding: one IP with repeated failures, no success
Action (lab): blocked IP in lab firewall; noted MFA recommendation

from collections import Counter

# Note the certifications mentioned in listings you read
listings = [
    ["Security+"], ["CEH", "Security+"], [], ["CCNA"],
    ["Security+"], [], ["CEH"],
]
counts = Counter(c for l in listings for c in l)
print("listings read:", len(listings))
print("no certification mentioned:", sum(1 for l in listings if not l))
for cert, n in counts.most_common():
    print(f"{cert:10} {n}")

Security lab portfolio

1. Home lab setup (VMs, isolated network) with diagram
2. Linux hardening checklist, before and after
3. Log analysis write-ups (3)
4. Incident report from a simulated alert
5. Vulnerability scan of your own lab VM, with fixes

Every item: objective, steps, findings, lessons learned.

Does the course cover...                 Yes / No
Networking fundamentals                    ___
Linux and Windows basics                   ___
Security concepts (CIA, risk, controls)    ___
Logs, SIEM and monitoring                  ___
Incident response basics                   ___
Vulnerability assessment (authorised)      ___
Cloud security basics                      ___
Laws, ethics and authorisation             ___
Hands-on labs every week                   ___

1. How many hours are hands-on labs?
2. Can I see a sample lab and lab environment?
3. Who are the trainers and what is their experience?
4. How are labs kept legal and isolated?
5. Which certifications does the content relate to?
6. What placement support is offered, and what is expected of me?
7. Can I attend a demo class before paying?

Criteria (score 1-5)        Course A   Course B
Fundamentals coverage         ___        ___
Hands-on labs                 ___        ___
Defensive skills              ___        ___
Trainer experience            ___        ___
Ethics and legality           ___        ___
Honest career support         ___        ___
Schedule fit                  ___        ___
Total                         ___        ___