Home labs & practical projects

Triage a suspicious sign-in and recommend controls

A project to do with your own tools, with guidance on what to create and capture.

Design project Suggested time: 60–90 minutesNo hardware required for the design

What you could create

A fictional employee reports an unexpected MFA prompt. A helpdesk ticket, a sign-in record and a device inventory provide incomplete evidence.

Example evidence format

Project evidence map (example)

Incident triage noteScope and inputs

Control recommendations with reasonsDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Incident triage note	Show the inputs, scope and decisions behind this record. An unfamiliar location is not automatically labelled a confirmed compromise.
Control recommendations with reasons	Include the evidence supporting your conclusion. The response considers account access, user verification and evidence preservation.

What you'll need

Document, spreadsheet or diagram tool

Create six timestamped sign-in records: normal office activity, a failed login, an unfamiliar location and a later successful login. Include a possible travel explanation.

Project record

Keep the working files for incident triage note and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.

The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.

Suggested milestones

1
Plan and investigate
Build a timeline and separate observations from assumptions.
2
Develop your approach
Choose proportionate immediate actions and explain what evidence would change them.
3
Verify and explain
Recommend preventative and detective controls for the access path.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Incident triage note
Show the inputs, scope and decisions behind this record. An unfamiliar location is not automatically labelled a confirmed compromise.
2
Control recommendations with reasons
Include the evidence supporting your conclusion. The response considers account access, user verification and evidence preservation.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your incident triage note needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

CompTIA CertMaster Practice for Security+

Check relevance, platform versions and current access terms.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Create six timestamped sign-in records: normal office activity, a failed login, an unfamiliar location and a later successful login. Include a possible travel explanation.

What a good result looks like

An unfamiliar location is not automatically labelled a confirmed compromise.
The response considers account access, user verification and evidence preservation.

Finish the project

Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.