A home lab for certification study: virtual machines, networks, and snapshots

The base

A laptop or desktop with 16 GB of RAM or more can run several virtual machines in VirtualBox, VMware Workstation, or Proxmox. Use a host-only or internal network so lab traffic never touches your home network or the internet unless you deliberately allow it, and take snapshots before each exercise so you can reset quickly.

• Hypervisor: VirtualBox, VMware, or Proxmox
• Isolated internal network
• Snapshots before every exercise
• Evaluation licenses for Windows Server and Windows client

A layout that covers most exams

One Windows Server as a domain controller, one or two Windows clients joined to the domain, a Linux server running a web application, an attacker or analyst VM such as Kali or a Linux workstation, and a log collector such as Wazuh, Security Onion, or the Elastic Stack. This supports both defensive and offensive objectives.

lab network 10.10.10.0/24 (internal only)
10.10.10.10  dc01      Windows Server, AD DS, DNS
10.10.10.21  ws01      Windows 11, domain joined, Sysmon
10.10.10.30  web01     Ubuntu, intentionally vulnerable training app
10.10.10.50  analyst   Kali or Ubuntu with tools
10.10.10.60  siem      Wazuh or Security Onion

Lab: build and verify isolation

Create the internal network and the first two VMs. From the analyst VM, confirm you can reach the other lab host and cannot reach your home router or the internet. Take a baseline snapshot of every VM named with the date. Then map three exam objectives to exercises this lab supports, such as reviewing authentication logs, scanning your own lab subnet, or configuring a firewall rule.

ping -c1 10.10.10.10          # lab host: should reply
ping -c1 192.168.1.1          # home router: should fail
curl -m5 https://example.com  # internet: should fail unless intended
VBoxManage snapshot dc01 take baseline-2026-11-02

Grow it with your study

Add components only when an objective needs them: a pfSense firewall for network objectives, a cloud free-tier account for cloud objectives, or a vulnerable training app for web objectives. Keep a short lab notebook of what each VM is for and its credentials, stored only inside the lab.