Home labs & practical projects

Design a security architecture for a hybrid merger

A project to do with your own tools, with guidance on what to create and capture.

Design project Suggested time: 3–4 hoursNo hardware required for the design

What you could create

Two organisations with separate identities, devices and cloud estates must share a sensitive application after a merger.

Example evidence format

Project evidence map (example)

Hybrid target security architectureScope and inputs

Control traceability and transition planDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Hybrid target security architecture	Show the inputs, scope and decisions behind this record. The architecture links controls to explicit threats and business requirements.
Control traceability and transition plan	Include the evidence supporting your conclusion. Temporary exceptions have a migration owner and measurable exit conditions.

What you'll need

Document, spreadsheet or diagram tool

Create two current-state diagrams and business requirements for access, visibility and recovery. Include one legacy system that cannot adopt the target controls immediately.

Project record

Keep the working files for hybrid target security architecture and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.

The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.

Suggested milestones

1
Plan and investigate
Define target trust boundaries and identity assumptions.
2
Develop your approach
Map preventative, detective and recovery controls across the architecture.
3
Verify and explain
Plan staged adoption and an exception for the legacy dependency.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Hybrid target security architecture
Show the inputs, scope and decisions behind this record. The architecture links controls to explicit threats and business requirements.
2
Control traceability and transition plan
Include the evidence supporting your conclusion. Temporary exceptions have a migration owner and measurable exit conditions.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your hybrid target security architecture needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Microsoft Official Practice Assessment

Check relevance, platform versions and current access terms.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Create two current-state diagrams and business requirements for access, visibility and recovery. Include one legacy system that cannot adopt the target controls immediately.

What a good result looks like

The architecture links controls to explicit threats and business requirements.
Temporary exceptions have a migration owner and measurable exit conditions.

Finish the project

Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.