Home labs & practical projects

Build a complete assessment evidence chain

A project to do with your own tools, with guidance on what to create and capture.

Authorised security lab Suggested time: 3–4 hoursYour own authorised environment

What you could create

A training assessment has several observations across a small lab. The challenge is to organise them into a defensible narrative with clear validation boundaries.

Example evidence format

Project evidence map (example)

Assessment evidence indexScope and inputs

Linked findings report with retest criteriaDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Assessment evidence index	Show the inputs, scope and decisions behind this record. Evidence identifiers resolve to the correct sanitised artefacts.
Linked findings report with retest criteria	Include the evidence supporting your conclusion. A failed validation attempt is not reported as a confirmed vulnerability.

What you'll need

Authorised security lab

Select an authorised multi-stage training scenario. Create an evidence index with timestamps, affected components and the scope rules.

Project record

Keep the working files for assessment evidence index and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

Use a deliberately vulnerable local image or a licensed training range. Check the provider’s access terms and current price.

Only test systems you own or are explicitly authorised to assess. Keep targets isolated and use synthetic accounts and data.

Suggested milestones

1
Plan and investigate
Record observations and the reasoning for each permitted validation step.
2
Develop your approach
Separate independent findings from dependencies in the assessment path.
3
Verify and explain
Write a report that traces each conclusion to evidence and proposes a verification step after remediation.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Assessment evidence index
Show the inputs, scope and decisions behind this record. Evidence identifiers resolve to the correct sanitised artefacts.
2
Linked findings report with retest criteria
Include the evidence supporting your conclusion. A failed validation attempt is not reported as a confirmed vulnerability.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your assessment evidence index needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

HTB CPTS exam lab

Check relevance, platform versions and current access terms.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Select an authorised multi-stage training scenario. Create an evidence index with timestamps, affected components and the scope rules.

What a good result looks like

Evidence identifiers resolve to the correct sanitised artefacts.
A failed validation attempt is not reported as a confirmed vulnerability.

Finish the project

Revert target snapshots, remove test accounts and artefacts, and store a sanitised report. Do not publish credentials or working attack material.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.