Home labs & practical projects

Reconstruct a session across network evidence sources

A project to do with your own tools, with guidance on what to create and capture.

Local lab Suggested time: 2–3 hoursYour own authorised environment

What you could create

A network investigation has a packet capture, DNS records and a proxy log with different timestamp formats. The question is which events belong to the same session.

Example evidence format

Project evidence map (example)

Cross-source session timelineScope and inputs

Evidence correlation and visibility notesDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Cross-source session timeline	Show the inputs, scope and decisions behind this record. Correlation accounts for NAT, missing records or shared addresses where relevant.
Evidence correlation and visibility notes	Include the evidence supporting your conclusion. The narrative preserves gaps rather than filling them with assumptions.

What you'll need

Local lab

Generate harmless lab traffic and synthetic companion logs. Record capture position, timestamp zones and any missing intervals.

Project record

Keep the working files for cross-source session timeline and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

Uses your own computer. Confirm hardware capacity, software licences and download terms before setup.

Use disposable VMs, containers or a simulator. Keep the lab separate from your everyday machine and work network.

Suggested milestones

1
Plan and investigate
Normalise times while retaining the original values.
2
Develop your approach
Correlate endpoints, names and request identifiers across sources.
3
Verify and explain
Produce a session narrative and identify where the evidence cannot establish content or identity.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Cross-source session timeline
Show the inputs, scope and decisions behind this record. Correlation accounts for NAT, missing records or shared addresses where relevant.
2
Evidence correlation and visibility notes
Include the evidence supporting your conclusion. The narrative preserves gaps rather than filling them with assumptions.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your cross-source session timeline needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Generate harmless lab traffic and synthetic companion logs. Record capture position, timestamp zones and any missing intervals.

What a good result looks like

Correlation accounts for NAT, missing records or shared addresses where relevant.
The narrative preserves gaps rather than filling them with assumptions.

Finish the project

Save sanitised evidence, then remove the lab instances or revert to the clean snapshot. Remove temporary accounts and credentials.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.