Learning path
The Security+ domains in order, with real attacks from The Advisory, patching and end-of-life risk, email and certificate checks, and log work in the Shell Lab.
This path follows the five Security+ domains and pairs each one with the practical side: how a real attack worked, what to patch first, how to check a domain’s mail and certificate settings, and how to find the lines that matter in a log.
The Advisory steps are real incidents and campaigns written up on this site. Read them for the pattern: how the attacker got in, and which control would have stopped it.
Controls, authentication and change management: the words everything else uses.
Why a flood of sign-in prompts is an attack, and what to do about it.
A sign-in the user approves on a real Microsoft page, for the attacker.
Read one month: what was exploited before the fix, what CISA added to its exploited list, what to patch first.
Patching is a risk decision too: the fixes can cause outages of their own.
Software that is out of support gets no more security fixes. Find what runs out soon.
SPF, DKIM and DMARC are how a domain stops others sending mail in its name.
Check the TLS version and certificate chain a server offers.
See what a JSON Web Token claims, and why decoding it is not the same as verifying it.
Detection starts with reading logs quickly.
Is someone guessing passwords on this server? The first question in many investigations.
Accounts nobody uses are accounts nobody watches. Access reviews start here.
Policies, risk and audits: the part of the job that decides what the rest is for.
