Exercises: The Cybersecurity Career

These exercises are unusual for this book: most of them ask you to build your own plan, not analyze Meridian's. That is the point — this chapter's deliverable is a career, and you cannot outsource it. Difficulty is marked ⭐ (recall/application), ⭐⭐ (analysis/judgment), and ⭐⭐⭐ (synthesis/open-ended). A dagger (†) marks problems with a full worked solution in Appendix: Answers to Selected Exercises — try every problem before you read one.

Keep your answers in a private notebook or repository; several of these compound into the chapter's project checkpoint (your development plan). Where an exercise asks you to "rate" or "choose," there is no single right answer — the honesty and specificity of your reasoning is what matters.

Part A — The map and the neighborhoods ⭐

1.† In one sentence each, explain why "How do I get into cybersecurity?" is a poorly formed question and what better question replaces it. Reference §39.1's threshold concept.

2. Match each role to its neighborhood (blue / red / GRC / cloud / AppSec / engineering): (a) threat hunter; (b) penetration tester; (c) compliance auditor; (d) detection engineer; (e) code reviewer who models threats against new features; (f) someone who hardens a fleet of cloud storage buckets; (g) incident responder; (h) risk analyst maintaining a risk register.

3. Name the four most common entry-point roles into security and, for each, the part or chapters of this book that most prepare you for it.

4.† Explain why the offensive (red-team) neighborhood is generally a poor target for a first job despite being the most famous, and describe the usual path that does lead there.

5. For each specialization, write the one-line "is this you?" gut check in your own words: (a) blue team; (b) GRC; (c) cloud; (d) AppSec. Then circle the one that best fits you and write one sentence on why.

Part B — Certifications, decoded ⭐⭐

6.† State the "door-opener, not a skill" principle and explain its single most important practical consequence for how you prepare for a job interview.

7. Place each certification at its correct stage (foundational / intermediate / management-expert) and name the neighborhood it best serves: (a) CompTIA Security+; (b) CISSP; (c) CompTIA CySA+; (d) CISM; (e) an AWS/Azure/GCP security certification; (f) OSCP.

8.† A friend with no security experience says, "I'm going to study for the CISSP first — it's the most respected, so it'll get me hired fastest." Write a three-to-four-sentence response explaining why this is usually a mistake and what you would suggest instead.

9. This book's chapters map closely onto the CompTIA Security+ body of knowledge. Pick any three Security+-relevant topics (e.g., risk vocabulary, CIA triad, network defense, identity, compliance) and name the chapter(s) that prepare you for each.

10. True or false, with one sentence of justification: "Once you hold a certification, you do not need to demonstrate the underlying skill in an interview." Then explain how an interviewer typically tests whether a credential is backed by real competence.

11. ⭐⭐⭐ Build your cert roadmap. For your chosen neighborhood (Exercise 5), write your personal certification roadmap: your next one certification, the stage after it, and — crucially — the one you are deliberately not pursuing yet, with one sentence on why. (This feeds the project checkpoint.)

Part C — Build it: home lab and skills ⭐⭐

12.† Explain the "experience paradox" in your own words and name the two things that break it for a newcomer. Why does this field, more than most, let you manufacture the missing ingredient yourself?

13. Design it. Sketch (in words or a simple diagram, modeled on Figure 39.2) a minimal defensive home lab you could stand up this month. Name each virtual machine, its purpose, and — critically — the network setting that keeps the lab isolated from anything you do not own. State explicitly why the isolation matters legally and technically.

14. List four hands-on activities a defender's home lab should let you practice, and map each to the chapter of this book it draws on.

15.† Explain why a CTF (capture the flag) is a legal place to practice offensive-flavored skills when attacking an arbitrary website is not. What single property of a sanctioned CTF makes the difference?

16. Write it. Draft a short (one-paragraph) write-up of a lab exercise as it would appear in your portfolio: pick a simple scenario (e.g., "detected a burst of failed logins on my own Linux VM"), and write it so a hiring manager learns what you did, what you found, and what it means — demonstrating communication, not just the result.

17. ⭐⭐⭐ Design your home lab (full). Expand Exercise 13 into a plan with: the hypervisor and VMs you will use, the first three exercises you will run (with the chapter each maps to), the isolation guarantees, and the first portfolio artifact you will produce from it. (Feeds the project checkpoint.)

Part D — Self-assessment and the development plan ⭐⭐–⭐⭐⭐

18.† Self-assess your skills. Find a real, current job posting for an entry or next-step role in your target neighborhood. List its required skills (aim for 6–10). For each, rate yourself honestly: have it / partial / gap. Then write one sentence identifying your single biggest gap and the cheapest way to start closing it.

19. From your self-assessment in Exercise 18, what one thing would most increase your hireability in the next 90 days — a certification, a lab project, a portfolio artifact, or a connection? Justify the choice using the chapter's ideas (door-openers vs. demonstrated skill).

20. ⭐⭐⭐ Write your development plan. Assemble the chapter's full project checkpoint: (1) target neighborhood, (2) skills-gap self-assessment, (3) certification roadmap, (4) home-lab and portfolio plan, (5) learning and ethics commitments. Keep it to one or two pages. Honesty over impressiveness — a short, true plan beats a long, aspirational one.

21. Critique a bad development plan: "My plan is to get Security+, CySA+, CISSP, CCSP, and OSCP, master red and blue teaming, learn cloud and AppSec, and become a CISO in three years." Identify at least three things wrong with it and rewrite the first 18 months as something defensible.

Part E — Ethics and authorization ⭐⭐

22.† Respond to this scenario. A classmate tells you: "I found an obvious SQL-injection flaw on my old high school's public website. I'm going to run a quick scan to confirm how bad it is, then email them the proof." Walk through what is and is not authorized here, what law is implicated (in general terms), and what the ethical path actually is. (This is a judgment exercise — be specific about the line.)

23. State the field's core ethical commitment (professional ethics in security) in your own words, then explain why authorization, not capability, is the line between a defender and a criminal.

24. Define responsible disclosure. An organization publishes a security.txt file with a contact for reporting vulnerabilities. Explain how that changes the ethics and legality of testing — and what it does not authorize.

25. ⭐⭐⭐ Write the authorization rule from §39.5 in your own words as a personal commitment you would actually keep, including what you will do when you are unsure whether you have permission. (This is part 5 of the project checkpoint.)

Part F — The ladder and the long game ⭐⭐

26.† Name the three major transitions on the career ladder (analyst→engineer→architect→CISO) and the new skill each one demands — not "more of the same." Why do careers most often stall at the engineer→architect transition?

27. Explain, in three or four sentences, why the CISO job "is barely technical." What does a CISO mostly do, and why does this surprise technically excellent people who reach that altitude?

28. "Up is not the only direction." Describe the senior-individual-contributor path and explain why it is a legitimate and well-compensated alternative to climbing into management. When would you choose it?

29. ⭐⭐⭐ Map your ladder. For the neighborhood you chose, sketch the likely ladder of titles from entry to senior, name the rung you are aiming at in five years, and identify the one skill you should start building now to make that rung's transition (per the chapter's threshold concept).

Part G — CTF-style challenge ⭐⭐⭐

30.† The résumé that doesn't add up. You are helping screen entry-level SOC candidates. One résumé lists CISSP, CISM, and OSCP, claims "expert in all domains of security," lists zero work experience, and has no portfolio, no lab, and no public write-ups. Another lists Security+ (in progress), a public repository of detection rules and three lab write-ups, an active CTF profile, and a help-desk job. (a) Which candidate would you advance to an interview, and why? (b) What does the first résumé most likely signal, using this chapter's "door-opener, not a skill" idea? (c) What single question would you ask the first candidate to test whether the credentials are real? (Part of the challenge is recognizing that more certifications is not more qualified.)

Part H — Interleaved & forward-looking ⭐⭐

31. (Interleave Ch.1, Ch.27.) This chapter's skills-gap self-assessment uses the same honest-rating discipline as a risk register. Explain the parallel: how is rating "have it / partial / gap" against a job posting like rating likelihood × impact against an asset, and why does honesty matter more than the rating in both?

32. (Interleave Ch.37.) Chapter 37 covered the talent shortage and build-vs-buy for a SOC. Explain how the field's talent gap (§39.1) is simultaneously good news for a career changer (Case Study 2) and a strategic problem for a CISO trying to staff a team.

33. (Interleave Ch.30.) The 🛡️ Defender's Lens in §39.3 notes that attackers exploit the "trust-the-credential" reflex in social engineering. Connect this to Chapter 30's human firewall: how does the same psychology that makes a forged credential effective in phishing also make a real credential a liability in an interview if you can't back it?

34. Of the certifications listed in §39.3, which two are you most likely to pursue in the next three years, and which one will you deliberately not pursue yet? Write one sentence of justification for each of the three choices. (Revisit this note after a year of work.)

35. ⭐⭐⭐ Open reflection. Re-read the threshold concept in §39.6 ("the skill that earns each promotion is not the skill the next rung requires"). Write half a page on a domain outside security — sports, music, medicine, the trades — where the same pattern holds, and what that field does to help people make the transition that security could borrow.

Solutions to daggered (†) problems are in the Answers appendix. The remaining problems are deliberately personal or open — bring them to a study group, a mentor, or your own honest notebook.