Week 6 Day 5 — NETW-0014

0:00–0:40
Structured Review

0:40–1:40
VM Health Check

1:40–2:00
Exam Walkthrough

0:00 – 0:40Structured Review · 40 min

Cumulative Q&A and command reference — the most important command from each week

Quick-fire command reference (20 min)

Go through each week's key command — ask students to supply the answer before showing it:
Week 1 — SSH: sudo sshd -t (test config before restart) · sudo fail2ban-client status sshd
Week 2 — Firewall: sudo iptables -L -n -v · sudo nft list ruleset · sudo ufw status numbered
Week 2 — NTP/Logging: sudo ntpq -p · timedatectl timesync-status · sudo journalctl -u rsyslog -n 20
Week 3 — DNS/DHCP: sudo named-checkzone yourname.net /etc/bind/db.yourname.net · dig @192.168.50.1 s1.yourname.net · sudo journalctl -u isc-dhcp-server -n 20
Week 4 — Nginx: sudo nginx -t · sudo tail -f /var/log/nginx/yourname.net.access.log
Week 5 — VPN: sudo ipsec status · sudo wg show · sudo grep charon /var/log/syslog | tail -20
Week 6 — Docker: docker-compose ps · docker-compose logs -f [service] · docker exec -it [container] bash

Open Q&A (20 min)

Take questions on any topic from any week. Common areas students want to revisit: DNS zone file trailing dot rule, the iptables NAT exclusion rule for VPN, WireGuard AllowedIPs dual function, docker-compose restart policies, the difference between docker exec and docker attach.
Walk through one practical scenario: "The website https://yourname.net stops loading. What is your diagnostic sequence?" — students should answer: check nginx -t, check systemctl status nginx, check access.log and error.log, check DNS resolution, check firewall. This is the pattern the practical exam will test.

0:40 – 1:40VM Health Check · 60 min

Verify every service from every week is running correctly before the final exam

Students work through this checklist independently. The instructor circulates to assist with anything that isn't working. A service that isn't running on exam day cannot be fixed during the exam — fix it now.

Week 1 — SSH and NAT

SSH with key auth on custom port: ssh -p [port] student@[S1-IP] — must connect without password prompt from Windows Terminal.
fail2ban active: sudo fail2ban-client status sshd — should show sshd jail active.
NAT from S2: ping -c 3 8.8.8.8 from S2 — receives replies.
iptables-persistent rules loaded: sudo iptables -t nat -L POSTROUTING -n — MASQUERADE rule present.

Week 2 — NTP and Logging

NTP on S1: sudo ntpq -p — at least one server with * prefix.
NTP on S2/S3: timedatectl timesync-status — ServerName = S1's IP, stratum 3.
rsyslog running: sudo systemctl status rsyslog — active on all three servers.

Week 3 — DHCP and DNS

DHCP server: sudo systemctl status isc-dhcp-server — active on S1.
DNS forward: dig @192.168.50.1 s1.yourname.net — returns 192.168.50.1.
DNS reverse: dig @192.168.50.1 -x 192.168.50.1 — returns s1.yourname.net.
DNS views: external query returns different IP from Windows host: nslookup s1.yourname.net [S1-external-IP].
Secondary DNS: dig @192.168.50.2 s1.yourname.net — S2 can answer queries.

Week 4 — Nginx

Nginx running: sudo systemctl status nginx — active.
nginx -t: sudo nginx -t — syntax ok, test successful.
301 redirect: curl -v http://yourname.net 2>&1 | grep "301\|Location" — shows 301 and HTTPS location.
HTTPS: curl -k https://yourname.net — returns the website content.

Week 5 — VPN

IPSec: sudo ipsec status — Security Associations: 1 up.
VPN connectivity: ping -c 3 192.168.51.2 from S2 — receives replies through tunnel.
WireGuard: sudo wg show — peer listed with recent handshake timestamp.

Week 6 — Docker

Docker running: sudo systemctl status docker — active.
Capstone app: docker-compose ps from ~/docker/app/ — app service Up.
Capstone chain: browse to https://app.yourname.net from Windows — "Served from Docker" page loads.

Instructor note: Any service that isn't working today needs to be fixed today. The exam uses these VMs — a broken service going into Week 7 is a problem the student will face during the exam, not the instructor. Use the remaining time productively: fix whatever is broken.

1:40 – 2:00Exam Walkthrough · 20 min

Final exam format and expectations

Week 7 schedule:
Monday — Structured review: Weeks 1–2
Tuesday — Structured review: Weeks 3–4
Wednesday — Structured review: Week 5 (VPN, PKI, WireGuard)
Thursday — Structured review: Week 6 + exam format walkthrough, VM health check #2
Friday — Final Exam, single sitting: 20 min written + 100 min practical
Written portion (20 min): Closed book. Covers all six content weeks. Same format as the weekly assessments — short answer, config identification, scenario analysis — but tighter: expect quick identification questions rather than long-form answers. No computers, no notes.
Practical portion (100 min): Students receive a printed scenario specification immediately after the written portion is collected. They must configure, verify, and demonstrate services on their own VMs. Man pages allowed. No internet, no notes. The practical will include: a networking task (firewall rule or NAT), a DNS task (zone modification), a service task (one of: Nginx, VPN, or Docker), and a log-based troubleshooting task.
Minimum passing grade: The written and practical portions must each individually achieve at least 50% to pass the course. A strong practical cannot compensate for a failing written score, and vice versa.

Exam topic coverage at a glance

Week	Key topics for exam	Most likely practical scenario
1	SSH key auth, sshd_config, fail2ban, NAT	Restore broken SSH config, verify fail2ban
2	tcpdump/mz, IPTables/NFTables/UFW rule syntax, NTP stratum/ntpq, rsyslog facilities/severity, logrotate	Implement a firewall spec, or diagnose broken rsyslog
3	DORA process, dhcpd.conf, DNS record types, zone file syntax, secondary DNS	Build a zone from spec, verify with dig
4	DNS views, Nginx server blocks, SSL, nginx -t, access.log/error.log	Diagnose broken Nginx using logs
5	IKE phases, ipsec.conf/secrets, PKI, WireGuard [Interface]/[Peer]	Configure WireGuard from spec
6	Container vs VM, docker run flags, docker-compose YAML, proxy_pass	Docker container with compose, verify running

← Day 4 Week 6 Overview Week 7 →