# Security from Zero — Topic 02 workbook

Goal: trace one web request and write a connection note you can explain.
Lesson: https://secopsnomad.si/blog/security-from-zero-02-networking/

## Environment

Windows version / browser and version:
Date, observation time and time zone:
Device label for the public copy:
Shell used: Windows PowerShell / Command Prompt:

## A. Configuration and name lookup

Active adapter and why you selected it:
Local IPv4 / IPv6 address:
Default gateway:
Configured DNS server:
Hostname queried:
A response and lookup time:
AAAA response and lookup time:
Error or missing record, if any:

Explain how a local address differs from the DNS answer:
Could a VPN, proxy or NAT change what another observer sees?

## B. Browser request

URL:
Method:
Status code:
Protocol column:
Remote address and port, if displayed:
Observation time and time zone:
Was the response cached or was Disable cache selected?

What does the status establish? What does it not establish?

## C. Connection and process

| Transport | Local address | Local port | Remote address | Remote port | PID | Process | Time / zone |
| --- | --- | --- | --- | --- | --- | --- | --- |
| | | | | | | | |

Did this row actually match the browser request? What supports that association?
If there was no match, what might explain it (timing, QUIC/UDP, caching, reuse)?
What additional evidence would you need?

## One-page connection note

Question:
Environment and method:
Evidence (two or three annotated observations):
Interpretation:
Limits:
Next check and why:

## Before sharing

- [ ] I used my own observations, not the lesson’s example addresses.
- [ ] I kept DNS, connection and HTTP observations separate.
- [ ] Every association includes time and transport context.
- [ ] I did not call a destination safe or malicious based only on its address or port.
- [ ] Names and network details are consistently redacted; no tokens, cookies or signed-in HAR exports are included.
- [ ] I can explain a five-tuple, NAT, A vs AAAA, and why h3 may not appear in a TCP-only view.
- [ ] I describe this as a personal learning exercise.