Home labs & practical projects

Design a controlled assessment of endpoint defences

A project to do with your own tools, with guidance on what to create and capture.

Design project Suggested time: 2–3 hoursNo hardware required for the design

What you could create

An advanced assessment team needs to evaluate endpoint controls in a dedicated range. The sponsor wants evidence of control behaviour without exposing production systems.

Example evidence format

Project evidence map (example)

Endpoint control experiment planScope and inputs

Outcome classification and restoration checklistDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Endpoint control experiment plan	Show the inputs, scope and decisions behind this record. Every experiment has an expected observation and a measurable result.
Outcome classification and restoration checklist	Include the evidence supporting your conclusion. A lack of alert is not equated with successful prevention or invisibility.

What you'll need

Document, spreadsheet or diagram tool

Define a fictional lab workstation, approved simulation behaviours and defender telemetry. Specify what is excluded; no live evasion tooling is required for this written exercise.

Project record

Keep the working files for endpoint control experiment plan and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.

The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.

Suggested milestones

1
Plan and investigate
Write an experiment plan with control and observation points.
2
Develop your approach
Separate prevention, detection and response outcomes.
3
Verify and explain
Define safe stop, restoration and evidence-handling procedures for the range.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Endpoint control experiment plan
Show the inputs, scope and decisions behind this record. Every experiment has an expected observation and a measurable result.
2
Outcome classification and restoration checklist
Include the evidence supporting your conclusion. A lack of alert is not equated with successful prevention or invisibility.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your endpoint control experiment plan needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Define a fictional lab workstation, approved simulation behaviours and defender telemetry. Specify what is excluded; no live evasion tooling is required for this written exercise.

What a good result looks like

Every experiment has an expected observation and a measurable result.
A lack of alert is not equated with successful prevention or invisibility.

Finish the project

Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.