Teacher Guide — Simulation Labs

What this lab library is & how submission works

This is a library of 81 self-contained, browser-based simulation labs for AP Cybersecurity (mapped to CompTIA Security+ SY0-701). Each lab is a single HTML file that runs entirely in the browser — no installs, no logins, and they work offline. A student opens a lab, enters a hacker name (a nickname — never their real name), completes the interactive tasks, and clicks submit. Their result posts to a shared Google Apps Script endpoint you control, so you see who completed what without collecting any personal data.

Setup checklist

Create a Google Apps Script web app to receive submissions. Deploy as a web app (Execute as: you; Who has access: Anyone) and copy the /exec URL.
Paste that URL into each lab. Find "appsScriptUrl": "PASTE_SHARED_/exec_URL_HERE" near the top of each lab file and replace the placeholder with your real /exec URL. (See the CHANGELOG for the exact file + line list — it appears in all 81 labs.)
Set your name/institution. Replace © 2026 [AUTHOR / INSTITUTION] with your own attribution if you wish.
Host the files. They're already part of apcyber.net under /labs/. To host elsewhere, upload the folder (with unit-N/ subfolders intact) to any static host or drop the single-file labs into your LMS.
Confirm submissions land. Open a lab, submit with a test hacker name, and check that a row appears in your linked Google Sheet.

Offline-capable: each lab is one self-contained file, so students can run them with no internet once loaded. Only the final submit needs connectivity (it POSTs to your Apps Script URL).

Coverage map

How the 81 labs map across units and topics. Empty topics are flagged — you'll supply your own activities there.

Unit	Topic	Labs
Unit 1 — Introduction to Security	1.1 Understanding Social Engineering	1
	1.2 Suspicious Website Logins	1
Unit 2 — Securing Spaces	2.1 Securing Spaces — Foundations	0	needs your own activity
	2.2 Securing Spaces — Controls	0	needs your own activity
	2.3 Protecting Physical Spaces	2
	2.4 Detecting Physical Attacks	0	needs your own activity
Unit 3 — Securing Networks	3.1 Network Vulnerabilities and Attacks	6
	3.2 Protecting Networks: Managerial Controls and Wireless Security	10
	3.3 Protecting Networks: Segmentation	2
	3.4 Protecting Networks: Firewalls	4
	3.5 Detecting Network Attacks	7
Unit 4 — Securing Devices	4.1 Securing Devices — Foundations	0	needs your own activity
	4.2 Authentication	22
	4.3 Protecting Devices	16
	4.4 Detecting Attacks on Devices	1
Unit 5 — Securing Applications and Data	5.1 Application and Data Vulnerabilities and Attacks	1
	5.2 Protecting Applications and Data: Managerial Controls and Access Controls	2
	5.3 Protecting Stored Data with Cryptography	4
	5.4 Asymmetric Cryptography	1
	5.5 Protecting Applications	1
	5.6 Securing Applications and Data — Capstone	0	needs your own activity

Gaps to plan for: Topics 2.1, 2.2, 4.1, and 5.6 currently have no labs.

Suggested teaching sequence & pacing

The order on the main lab page is the recommended path — unit by unit, topic by topic. A few notes:

High-density topics — don't assign all of them

4.2 Authentication (22 labs) — pick a representative subset: one account-creation, one group/OU, one password-policy, one deprovisioning lab. Use one as an in-class demo, assign 2–3 as homework.
4.3 Protecting Devices (16 labs) — choose across the sub-themes (host firewall, Defender/AppLocker, backups, mobile hardening). The rest make good extra practice.
3.2 Protecting Networks (10 labs) — switch/router labs overlap; one switch-hardening + one VTY/ACL + one wireless is enough for most classes.

Good in-class demos vs. homework

Demos: the first lab of each unit, plus packet-capture/attack-analysis labs (ARP poisoning, SYN flood, DNS spoofing) — they spark discussion.
Homework: configuration-style labs (ACLs, GPO, NTFS, account lifecycle) where students follow steps and submit.

Per-lab reference table

Every lab with its unit, topic, Security+ objectives, and AP skills. Click a header to sort; filter with the box.

Unit ▲▼	Topic ▲▼	Lab Title ▲▼	Sec+ Obj ▲▼	AP Skills ▲▼
1	1.1 Understanding Social Engineering	Mail Triage Lab — Identify Social Engineering \| Security+ SY0-701	2.2, 5.6	1.B
1	1.2 Suspicious Website Logins	Larkspur Mail — Safety Center \| Security+ Lab	4.5, 2.4, 5.6	2.D
2	2.3 Protecting Physical Spaces	Site Survey — Physical Security Deployment (SY0-701 1.2.6)	1.1, 1.2	2.D
2	2.3 Protecting Physical Spaces; 2.4 Detecting Physical Attacks	Secure a Research Wing with Physical Access Controls	1.2, 2.4, 4.6	2.D, 3.D
3	3.1 Network Vulnerabilities and Attacks	Lab 7.2.6-CR — Scan an Asset for Cleartext-Transport Vulnerabilities	2.2, 3.3, 4.3, 4.4	1.B
3	3.1 Network Vulnerabilities and Attacks	Lab — Scan an FTP Server for Vulnerabilities \| VANTAGE VM	2.2, 4.3, 4.4, 4.9	1.B
3	3.1 Network Vulnerabilities and Attacks	Lab — Scan and Remediate Windows Host Vulnerabilities (SY0-701 5.2.3)	4.3, 5.2	1.B
3	3.1 Network Vulnerabilities and Attacks	ScanForge Lab — Scan a Linux Network for Vulnerabilities	4.3	1.B
3	3.1 Network Vulnerabilities and Attacks	SentryScope Lab — Domain Controller Vulnerability Scan	4.3	1.B
3	3.1 Network Vulnerabilities and Attacks	TLS Vulnerability Scan — Security+ Lab	4.3, 4.4	1.B
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Lab — Secure Management Access on a Network Firewall Appliance	1.2, 4.1, 4.6	2.D
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Harden a Wireless Network — Lab Simulation	2.2, 2.5, 4.1	2.D
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Lab — Harden a Factory-Default Access Switch	2.2, 2.5, 4.1, 4.6	2.D
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Lab: Switch Port Hardening	2.5, 3.2, 4.1	2.D
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Restrict Devices with a MAC-Based ACL	2.5, 3.2, 4.1	2.D
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Restrict VTY (Telnet/SSH) Access	2.5, 4.5	2.D
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Secure Switch Access (Hardening)	2.5, 4.1, 4.6	2.D
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Lab — Configure an IPSec VPN (iPadOS)	3.2	2.D
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Stand Up a Remote-Access VPN — Tidewater Edge Console	3.2	2.D
3	3.2 Protecting Networks: Managerial Controls and Wireless Security	Configure a WPA2-Personal Wireless Network	4.1	2.D
3	3.3 Protecting Networks: Segmentation	Lab — Stand Up a Guest BYOD Wireless Network	2.5, 4.1	2.D
3	3.3 Protecting Networks: Segmentation	Lab — Deploy a Screened Subnet (Sentinel Gateway OS)	3.2, 4.5	2.D
3	3.4 Protecting Networks: Firewalls	Permit Traffic on a Standard ACL	2.5, 4.5	2.D
3	3.4 Protecting Networks: Firewalls	Standard ACL: Block Source Hosts	2.5, 4.5	2.D
3	3.4 Protecting Networks: Firewalls	AegisWall Console — Edge Appliance Setup Lab	3.2	2.D
3	3.4 Protecting Networks: Firewalls	Lab: Publish a DMZ Web Server Through the Perimeter Firewall	3.2, 4.5	2.D
3	3.5 Detecting Network Attacks	WaveCore Controller — RF Hardening Lab	2.2, 2.4, 4.1	3.D
3	3.5 Detecting Network Attacks	Lab — Analyze a SYN Flood Attack	2.4	3.D
3	3.5 Detecting Network Attacks	Lab — Configure Wireless Intrusion Prevention (Halonet WC-7)	2.4, 4.1	3.D
3	3.5 Detecting Network Attacks	Lab — Detect ARP Poisoning with a Packet Capture	2.4, 4.9	3.D
3	3.5 Detecting Network Attacks	On-Path DNS Spoofing — Security+ Lab	2.4	3.D
3	3.5 Detecting Network Attacks	Edge IPS Lab — Configure Snort Inline Protection (pfSense)	3.2, 4.5	3.D
3	3.5 Detecting Network Attacks	Severity-Tiered Switch Logging — Security+ Lab	4.4, 4.9	3.D
4	4.2 Authentication	Lab — Create a Security Group (Directory Console)	1.1, 4.6	2.D
4	4.2 Authentication	Provision Active Directory User Accounts — Security+ Lab	1.2, 2.5, 4.6	2.D
4	4.2 Authentication	Hashfall — Rainbow Table Hash Recovery	1.4, 2.4	2.D
4	4.2 Authentication	Password-Strength Audit Lab — Northwind Diagnostics	1.4, 2.4	2.D
4	4.2 Authentication	Lab — Configure Account Password & Lockout Policies	2.4, 4.5, 4.6	2.D
4	4.2 Authentication	Account Recovery Lab — Reset a Linux User Password	4.6, 2.5	2.D
4	4.2 Authentication	Lab — Harden Default & Local Accounts	2.5, 4.6	2.D
4	4.2 Authentication	Lab — Rotate Your Linux Account Password	4.6, 2.5	2.D
4	4.2 Authentication	Lab: Lock and Unlock Linux User Accounts — Tidewater Marine Analytics	2.5, 4.6	2.D
4	4.2 Authentication	Build an Active Directory OU Structure — Security+ Lab	4.5, 4.6	2.D
4	4.2 Authentication	Lab — Lock Down the Local Administrators Group (Group Policy)	4.5, 4.6	2.D
4	4.2 Authentication	Lab — Remove Redundant Organizational Units (AD)	4.5, 4.6	2.D
4	4.2 Authentication	Lab · Revoke Supplementary Group Access	4.6	2.D
4	4.2 Authentication	Lab — Deprovision a Departed Linux User	4.6	2.D
4	4.2 Authentication	Lab — Manage Domain User Accounts (LARK-DC01)	4.6	2.D
4	4.2 Authentication	Lab: Add Users to a Secondary Group (Linux) — Security+ SY0-701	4.6	2.D
4	4.2 Authentication	Lab: Enforce Smart Card Logon via Group Policy	4.6	2.D
4	4.2 Authentication	Lab: Reorganize Linux Groups — Provisioning & De-provisioning	4.6	2.D
4	4.2 Authentication	Offboarding: Remove a Departed Linux User — Security+ Lab	4.6	2.D
4	4.2 Authentication	Provisioning Desk — Create a Linux User Account	4.6	2.D
4	4.2 Authentication	Rename and Relocate a Linux User Account	4.6	2.D
4	4.2 Authentication	Shadow Groups Lab — Helmsman Directory Console	4.6	2.D
4	4.3 Protecting Devices	Lab — Create, Link, and Harden a GPO	1.2, 4.1, 4.5	2.D
4	4.3 Protecting Devices	Bench Lab — Stand Up Two Virtual Machines	2.3, 3.1	2.D
4	4.3 Protecting Devices	Configure Microsoft Defender	2.5, 4.1	2.D
4	4.3 Protecting Devices	Data Execution Prevention (DEP) Configuration	2.5, 4.1	2.D
4	4.3 Protecting Devices	Host Firewall Lab — Protect the Public Profile	2.5, 4.5	2.D
4	4.3 Protecting Devices	Lab — Application Allowlisting with AppLocker	2.5, 4.1	2.D
4	4.3 Protecting Devices	Lab — Harden User Account Control (UAC)	2.5, 4.5	2.D
4	4.3 Protecting Devices	Lab — Tuning the Update Cadence on a Workstation	2.5, 4.1	2.D
4	4.3 Protecting Devices	Lab: Clear Browsing Data — Aurora Browser (Security+ SY0-701)	2.5, 3.2	2.D
4	4.3 Protecting Devices	Virtual Switch Manager Lab — Northwind Cyber Range	3.1	2.D
4	4.3 Protecting Devices	Lab: Harden Mobile Mail & Browser on a Tablet	4.1, 3.2	2.D
4	4.3 Protecting Devices	Configure File History Backups	3.4	2.D
4	4.3 Protecting Devices	Recover Prior File Versions with File History	3.4	2.D
4	4.3 Protecting Devices	Sentinel Backup Console — DC System State Lab	3.4	2.D
4	4.3 Protecting Devices	Lab — Harden a Front-Desk Tablet (SY0-701 4.1)	4.1	2.D
4	4.3 Protecting Devices	Lab — Host Firewall for Untrusted Networks	4.5	2.D
4	4.4 Detecting Attacks on Devices	Lab — Configure an Advanced Audit Policy	4.4, 5.1	3.D
5	5.1 Application and Data Vulnerabilities and Attacks	SQLi Lab — Account Lookup Tampering	2.3, 4.1	1.B
5	5.2 Protecting Applications and Data: Managerial Controls and Access Controls	Lab — Restrict a Folder with NTFS Permissions & Disable Inheritance	2.5, 4.6	2.D
5	5.2 Protecting Applications and Data: Managerial Controls and Access Controls	Lock Down Shared Folders with NTFS Permissions	2.5, 4.6	2.D
5	5.3 Protecting Stored Data with Cryptography	Lab · Verify a Download with an MD5 Hash	1.4	2.D
5	5.3 Protecting Stored Data with Cryptography	Lab — Hide a Recipient Marker with OpenStego (Steganography)	1.4, 4.1	2.D
5	5.3 Protecting Stored Data with Cryptography	Lab — Protect Bid Files with EFS	1.4, 2.5	2.D
5	5.3 Protecting Stored Data with Cryptography	Lab: Encrypt the System Volume with BitLocker and a TPM	1.4, 2.5	2.D
5	5.4 Asymmetric Cryptography	Lab: Manage Certificates on an Issuing CA	1.4	2.D
5	5.5 Protecting Applications	Lab: Enable HTTPS on a Web Server Binding — Security+ SY0-701	1.4, 3.2	2.D

Answer keys: labs grade themselves in-browser and report pass/fail on submission; no separate answer-key pages are bundled. Keep any keys you build off student-facing pages.