LNK Learning Narrative Kit

Portland Desk (Book 0: Zero-to-One)

From zero knowledge to Tier 1 IT support and Junior Security Analyst readiness. Follow Ethan Brooks through 13 workplace incidents covering CompTIA A+, Network+, and Security+ operations.

13 Incident Stories 13 Hands-On Labs 328 Verified Glossary Terms Direct Bridge to Book 1 SOC
★ Launch Unified Courseware →
Act I

The Local Machine

CompTIA A+ Core 1 & 2 • Hardware Invariants, OS Boot & Event Log Triage
EP 00 A+ Foundations

The Four Rubber Bands

Late night at the kitchen table. Sifting through 800 pages of exam trivia to extract the four machine invariants (CPU, RAM, Disk, NIC) and study triage reflexes.

EP 01 A+ Core 1

The Paper Cert

Graveyard shift at the Gresham warehouse. Dead sorting terminal, hex POST codes, bent serial pins, and baud rate mismatches before the 5:00 AM dispatch.

EP 02 A+ Core 2

The Live Board

First day on the live phone queue under Jules Mercer. Isolating Accounting PC freezes with Safe Mode, Clean Boot, and Windows Event Viewer crash logs.

Act II

The Wire & The Boundary

CompTIA Network+ • Subnetting, DNS Plumbing, TCP Sockets & Disaster Recovery
EP 03 Network+ N10

The Default Gateway Doesn't Care

East Portland pump station switch reboot. APIPA 169.254.x.x trap, /26 subnet boundaries, ARP cache inspection, and local vs gateway frame rewriting.

EP 04 Network+ N10

The Name Is Not the Number

Early spring downpour. Remote VPN workers fail to reach internal portals while in-office staff succeed. Split-horizon DNS, resolver caches, and rogue hosts overrides.

EP 05 Network+ N10

The Wire Has Two Ends

Warehouse socket timeouts. Connection refused (RST) vs Connection timed out (Drop). TCP 3-way handshake mechanics, socket states, and ephemeral port exhaustion.

EP 06 ★ Midpoint Capstone

The Portland Flood

Pacific Northwest atmospheric river floods Building C basement at 04:00 AM. Physical switch swap, trunk VLAN configuration, and resolving a massive DHCP exhaustion storm.

Act III

Identity, Threats & Escalation

CompTIA Security+ SY0-701 • Attack Surfaces, Phishing, Malware, 802.1X & SOC Dossiers
EP 07 Security+ SY0

The Port That Is Open

Cleartext Telnet vs encrypted SSH, HTTP vs HTTPS, credential harvesting on unencrypted Wi-Fi, and firewall port boundary decisions.

EP 08 Security+ SY0

Prove Who You Are

Authentication factors (know, have, are), TOTP vs SMS, Password+PIN confusion, and Active Directory lockout triage with Event ID 4625 & 4740 caller computer detection.

EP 09 Security+ SY0

Don't Click That

Spear phishing and executive impersonation wire fraud. RFC 5322 MIME header dissection, SPF/DKIM/DMARC alignment checks, and typosquatted domains.

EP 10 Security+ SY0

Something on the Box

Rogue USB drive and fan pegged at 100%. Windows host persistence (Registry Run keys, Event ID 7045 service creation, scheduled tasks) and Base64 LOLBins analysis.

EP 11 Security+ SY0

The Air Is Shared

Rogue wireless router plugged into a warehouse cubicle. WPA2/WPA3-Enterprise 802.1X with RADIUS, EAP-TLS certificates vs PEAP passwords, and RSSI triangulation.

EP 12 ★ Final Capstone

When the Ticket Escalates

Multi-stage incident across plant telemetry and finance. Chain of custody, order of volatility, memory capture, and assembling the professional CSIRT/SOC handoff dossier.

Deep Dives

Supplementary Security Modules

Stand-alone focused deep dives
Security+ Physical

Badge, Lock, Eyes

Physical access control, mantrap tailgating, CCTV verification, and server room badge access telemetry.

Security+ PKI

Trust on Paper

Public key infrastructure, certificate authority trust chains, X.509 validity dates, and private key security.

Security+ IR

The Order You Do It In

Step-by-step walkthrough of the NIST/SANS 6-phase incident response lifecycle from preparation to post-mortem.