PortfolioDive editorial guide · Review official vendor requirements before scheduling an exam or purchasing any training.
Define a safe environment
Use virtual machines or hardware you own or have permission to administer. Keep practice traffic inside your lab, and never scan or attack systems without authorization.
Start with visibility
Learn Windows Event Viewer, Linux logs, networking basics and the value of timestamps. Add Sysmon or an appropriate collection agent to test devices.
Generate simple test events
Create a test user, change a file, start a benign process, or trigger a known safe event. Capture the logs and explain what each field means.
Create a portfolio report
Write the objective, setup, relevant evidence, findings and limitations. Screenshots should not expose passwords, tenant information or private data.
Keep your learning plan focused: choose one milestone, build a small practical example, and document what you have learned.