Practical / Project Work and Case Studies
Domain focus
Practical / Project Work and Case Studies tests whether you can plan authorised work, document evidence, analyse a real scenario and communicate findings without causing harm.
Core rules and concepts
- Obtain written permission and define scope, targets, time window and prohibited actions before any scanning or testing.
- Isolate lab systems: use host-only or internal virtual networks, snapshots and disposable test accounts.
- Record baseline configuration, commands, timestamps, outputs and tool versions so work is reproducible.
- Analyse case studies by separating facts, assumptions, vulnerabilities, controls and impact; avoid blaming users without evidence.
- A useful report states objective, scope, method, findings, evidence, risk rating, remediation and limitations.
- Clean up test accounts, files and network changes; do not retain personal data unnecessarily.
Worked example
A student builds a lab with a vulnerable virtual machine on a host-only network. They record the baseline, scan only that lab IP, confirm a default login, change it, re-test, and report the finding with before-and-after evidence. Reasoning: isolation prevents harm to college systems; baseline and re-test prove the fix; scope documentation shows authorisation.
Traps that cost marks
Do not scan public or college systems without permission. Do not present screenshots without context or timestamps. Do not test destructive actions on shared systems. Do not claim a fix without re-testing. Do not copy another project's case analysis without attribution. Do not expose real personal data in a report.