0:00–0:30
Docker & Capstone Review
0:30–0:50
Exam Walkthrough
0:50–2:00
VM Health Check
0:00 – 0:30Docker & Capstone Review · 30 min
Containers, docker-compose, and the full reverse-proxy chain
- Quick-fire command reference:
docker ps -a · docker logs [container] · docker-compose ps · docker-compose up -d
- Concept recap: Image vs. container, why containers start in seconds compared to VMs, what a bind mount is for, and why docker-compose replaces a long docker run command with a version-controlled YAML file.
- Capstone chain walk-through: Re-trace the full path from the Week 6 capstone: DNS (Week 3) resolves the hostname → Nginx (Week 4) terminates SSL and matches the server block → proxy_pass (Week 6) forwards to the container → the container (Week 6) returns the response. This exact chain is what Task 7 on the practical exam will ask students to build.
0:30 – 0:50Exam Walkthrough · 20 min
Final exam format and expectations — read this section carefully
- Single sitting: Friday's exam is 20 minutes written, immediately followed by 100 minutes practical — no break between them beyond the time it takes to collect the written papers and hand out the practical scenario. There is no separate written day and practical day this time.
- Written portion (20 min): Closed book, pen and paper. Covers all six content weeks. Expect quick identification questions — short answer, command identification, one short scenario — rather than long-form essays. No computers, no notes.
- Practical portion (100 min): Students receive a printed scenario immediately after the written portion is collected — a new branch office deployment covering secure remote access, firewalling, NTP/logging, DHCP/DNS, Nginx/SSL/DNS views, a WireGuard VPN tunnel, and a Docker reverse-proxy chain. Man pages allowed. No internet, no notes.
- Minimum passing grade: The written and practical portions must each individually achieve at least 50% to pass the course. A strong practical result cannot compensate for a failing written score, and vice versa.
0:50 – 2:00VM Health Check · 70 min
Verify every service from every week is running correctly before Friday
Students work through this checklist independently. The instructor circulates to assist with anything that isn't working. A service that isn't running on exam day cannot be fixed during the exam — fix it now, and take a snapshot once everything is confirmed working.
Week 1 — SSH and NAT
- SSH with key auth on custom port:
ssh -p [port] student@[S1-IP] — must connect without a password prompt.
- fail2ban active:
sudo fail2ban-client status sshd — sshd jail active.
- NAT from S2:
ping -c 3 8.8.8.8 — receives replies.
Week 2 — Firewall, NTP, and Logging
- Firewall rules present and correctly ordered:
sudo iptables -L -n -v (or the equivalent nft/ufw command).
- NTP on S1:
sudo ntpq -p — at least one server with a * prefix.
- NTP on S2/S3:
timedatectl timesync-status — ServerName = S1's IP.
- rsyslog forwarding: a test event on S2 (
logger "healthcheck test") appears on S1 within 10 seconds.
Week 3 — DHCP and DNS
- DHCP server:
sudo systemctl status isc-dhcp-server — active on S1.
- DNS forward and reverse:
dig @[S1-IP] s1.yourname.net and dig @[S1-IP] -x [S1-IP] both resolve correctly.
- Secondary DNS: a query against S2 returns the same result as S1.
Week 4 — DNS Views and Nginx
- DNS views: an internal query and an external query for the same hostname return different addresses.
- Nginx running and valid:
sudo systemctl status nginx active, sudo nginx -t passes.
- HTTPS working:
curl -k https://yourname.net returns the site content, with a 301 redirect from HTTP.
Week 5 — VPN
- IPSec:
sudo ipsec status — Security Associations: 1 up.
- WireGuard:
sudo wg show — peer listed with a recent handshake timestamp.
- Tunnel connectivity: a ping across the tunnel's assigned addresses succeeds.
Week 6 — Docker
- Docker running:
sudo systemctl status docker — active.
- Capstone stack:
docker-compose ps — all services Up.
- Full chain: browsing to the capstone hostname loads content served from the container, confirmed in
docker logs.
Instructor note: Any service that isn't working today needs to be fixed today. The exam uses these same VMs — a broken service going into Friday is a problem the student will face during the exam, not the instructor. Once a student's checklist is fully green, have them take a Hyper-V snapshot before leaving.
Exam topic coverage at a glance
| Week | Key topics for exam | Most likely practical task |
|---|
| 1 | SSH key auth, sshd_config, fail2ban | Secure remote access from a fresh key pair |
| 2 | tcpdump/mz, IPTables/NFTables/UFW rule syntax, NTP stratum/ntpq, rsyslog forwarding | Implement a firewall spec, verify NTP and forwarded logging |
| 3 | DORA process, dhcpd.conf, DNS record types, zone file syntax, named-checkzone | Build a zone from spec, verify with dig |
| 4 | DNS views, Nginx server blocks, SSL, nginx -t, access.log/error.log | Split-horizon DNS + HTTPS virtual host |
| 5 | IKE phases, ipsec.conf/secrets, PKI, WireGuard [Interface]/[Peer] | Bring up a WireGuard tunnel from spec |
| 6 | Container vs VM, docker run flags, docker-compose YAML, proxy_pass | Docker container proxied through Nginx, verified end-to-end |