> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/06-network-security-basics/network-security-checkpoint.md).

# Network Security Basics Checkpoint

Use this checkpoint to confirm that the ZyberLab network foundation is working before moving to more advanced monitoring or web security exercises.

## Systems

Confirm that these systems are available:

```
DC01
CLIENT01
KALI01
```

## Verify Addressing

You should be able to identify the current IPv4 address, default gateway, and DNS configuration for each system.

## Verify Connectivity

Confirm that the systems can communicate as expected on the VMware NAT network.

If ping is blocked, document the firewall behavior instead of disabling controls without a reason.

## Verify DNS

From `CLIENT01`, confirm that the lab domain and `DC01` can be resolved through the domain DNS service.

Useful commands include:

```
nslookup DC01.zyberlab.test
nslookup zyberlab.test
```

## Verify Local Network Visibility

On `CLIENT01`, confirm that you can use:

```
netstat -ano
```

You should be able to identify at least one listening port, one active connection, and a related process ID.

## Verify Service Discovery

From `KALI01`, perform the basic lab-only Nmap exercise against `CLIENT01` and record which ports are reported as open, closed, or filtered.

Compare the result with the local Windows view.

## Verify Endpoint Evidence

If Sysmon network logging is enabled, review recent network events on `CLIENT01` and compare them with activity generated from `KALI01`.

## What You Should Understand

By this point, you should be able to explain:

* The role of an IP address, subnet, gateway, and DNS server
* Why ping can fail even when a system is reachable
* The relationship between ports and services
* The difference between a local listening port and a remotely reachable port
* How `netstat` and Nmap provide different views
* Why network and endpoint evidence are more useful when correlated

## Lab Status

When these checks pass, the basic ZyberLab environment now supports Windows, Active Directory, endpoint telemetry, and network investigation exercises.

Take a snapshot of `KALI01` if you have not already done so, and update your lab notes with the current system addresses before continuing.