Step 40. Level 0 Comprehensive Test — Examining Yourself

Level 0 — Getting Comfortable with Computers | Difficulty ★★★☆☆ | Estimated time: 4 hours (fine to split across two days)

Prerequisites: Steps 1–39 all complete. This chapter is a comprehensive exam with no new material to learn.

What you need: a notebook, a pen, your computer and virtual machine, and half a day of time.
Caution: today we learn no new commands. You take out what you’ve already learned and examine yourself. Grade strictly, record honestly — writing "don’t know" is also an excellent answer.

Think of driving school. The day before the road test, the instructor teaches no new techniques. They check "whether you can do what you’ve learned so far on your own." Today is exactly that day. Across the past 39 steps, you’ve traveled from the day you first opened PowerShell, through files and permissions, processes, scripts, remote access, and all the way to the network’s addresses, delivery, protocols, and maps. But you don’t grade your own self-assessment. The exam grades it.

1. Learning Objectives

By the end of this chapter, you will be able to:

Pinpoint what you know and what you don’t across all of Level 0
Measure your skill in three subjects: written (explanatory essays), practical (a day in the CLI), and oral (talking while drawing the map)
Gain the "self-diagnosis ability" to find weak spots and return to the relevant step to reinforce them
Distinguish the kinds of weaknesses (concept/command) and apply different relearning methods
Complete a one-page A4 cheat sheet as your Level 0 graduation work

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	PowerShell + bash (Ubuntu) + notebook and pen — everything learned so far
Today’s commands	No new commands. Pulling from memory is today’s assignment
Concepts needed	Studying verified by artifacts, the wrong-answer notebook, distinguishing concept/command weaknesses
Today’s artifacts	Written answer sheet, practical results, report card table, one A4 cheat sheet

2-1. Why Examine Yourself

The biggest trait of someone who hasn’t studied enough is "not knowing that they don’t know." Open the book and read, and it feels like you know it all; close the book, and no explanation comes out. That’s why skill is always verified through artifacts. Write it, do it, explain it. When something doesn’t work, that is the gap, and once you’ve found the gap, the exam is already half a success.

2-2. Today’s Three Exam Subjects

Writing explanations (written): explain learned concepts without the book. Where you stall = what you don’t know.
A day in the CLI (practical): organize files, gather information, and write documents without a mouse. Check whether your hands remember.
Talking while drawing (oral): draw the network map while explaining out loud. Check whether the concepts are structured.

Each subject has a passing bar. And it’s okay to fail. Failing this exam is not a punishment — all it does is tell you "the step number to go back to."

2-3. Grading Principles — Be Strict, but Record

The most common trap in self-grading is leniency. "I sort of vaguely know it" counts as wrong. Instead, for every miss, write the step number in a corner of your notebook. That list of numbers is today’s real report card.

Knowing the concept but not remembering the command is different from the concept itself being shaky. The former is fixed well enough by cheat-sheet review; the latter requires rereading that step. Distinguish the two as you write them down.

3. Follow Along

3-1. Subject 1: Writing Explanations (60 minutes)

Close the book and your notes. On a blank notebook, answer the eight items below. At least five sentences each. If you don’t know, don’t force filler — write "don’t know." That’s honest data.

Explain the difference between absolute and relative paths with an example.
Interpret what -rw-r--r-- means in Linux.
Explain the difference between a process and a program, and write one command that shows running processes.
Explain why SSH remote access uses a key file instead of a password.
Explain the difference in roles between MAC addresses and IP addresses using the "neighborhood delivery" analogy.
Explain why port numbers are needed, and write five major ports with their services.
Explain TCP’s 3-way handshake in sentences only, without a drawing.
Explain what NAT does in four steps.

Grading criteria: if you wrote six or more of the eight items without stumbling, you pass the written exam. If there are items marked "don’t know" or glossed over, write the corresponding step numbers in your notebook (each item’s step number and model-answer gist are in section 5).

Predict: before writing, mark in advance which of the eight items you’re most confident about and which you’re most anxious about. Compare with the results, and you’ll see the gap between "what I thought I knew" and "what I actually know." Knowing this gap is also a skill.

3-2. Subject 2: A Day in the CLI (half a day)

From now, for half a day, all file-related work is done by commands only. Opening File Explorer with the mouse is not allowed. There are three exam tasks.

Task A. Organization project: classify the files on your Desktop (or Downloads folder) into folders by extension. PowerShell on Windows, bash on Ubuntu:

cd ~/Downloads
mkdir -p images docs archives others
mv *.png *.jpg images/ 2>/dev/null
mv *.pdf *.md *.txt docs/ 2>/dev/null
mv *.zip *.tar.gz archives/ 2>/dev/null
ls -R

How to read it: 2>/dev/null means "quietly hide the error message if there are no files with that extension." You must be able to explain what each command does, one by one. Copying and using a command you can’t explain loses points on the exam.

Task B. Information gathering: using only commands, find the five things below and write them in your notebook:

Today’s date and the current time
My computer’s IP address and default gateway
Two currently open ports in LISTENING state
The process using the most memory
Remaining disk space

Task C. Document writing: write your impressions of today’s exam as a text file. Use an editor inside the terminal (nano, vim, or PowerShell redirection):

nano level0_reflection.txt

How to read it: pull the save-and-exit shortcuts from memory. nano: Ctrl+O (save), Ctrl+X (exit). If your body doesn’t remember, Step 22 is calling.

Grading criteria: if you completed the three tasks without File Explorer, you pass the practical. If your hand went to the mouse midway, record which task it went to. That task is your weak muscle.

3-3. Subject 3: Talking While Drawing (30 minutes)

On one notebook page, draw the travel map of a single letter. No book, memory only.

What to draw: my computer → router (NAT, gateway) → routers (hops) → destination server. And the tags attached at each segment: MAC address (inside the neighborhood), IP address (world address), port number (room number), TCP handshake or UDP.

While drawing, explain out loud. "Here the MAC gets attached, at the router the sender gets swapped…" If there’s a point where the explanation stops, circle it. Those circles are the oral exam’s wrong-answer notebook.

Grading criteria: if you completed the drawing and explained for 3+ minutes without stopping, you pass the oral exam.

3-4. Organizing the Report Card (20 minutes)

Organize the results of the three subjects into one table:

Subject	Result	Weakness step number	Kind of weakness (concept/command)
Written	Pass/Fail	e.g., 35	Concept
Practical	Pass/Fail	e.g., 22	Command
Oral	Pass/Fail	e.g., 39	Concept

If you have three or fewer weakness steps, pick just those steps, reread them this week, and retake the exam. If more than three, it’s efficient to skim the entire network segment (Steps 31–39) once more. That segment is connected as a single story, so it firms up fastest when reviewed together.

3-5. Relearning Methods for Weak Steps — Going Back Is Also a Skill

Rereading the same way likely yields the same result. The method differs by kind:

Concept weakness: read that step’s ‘## 2. Background Knowledge’ out loud, close the book, and recast the analogy into your own words. If the book said "parcel delivery," you say "school lunch line." Being able to coin a new analogy means you understood the structure.
Command weakness: redo only that step’s ‘## 3. Follow Along.’ This time, cover the output examples, write your prediction first, then run it. If prediction and output differ, that difference is the thing to learn.
Hand weakness (slow typing): type that step’s commands once a day for three days. From day two, you’ll feel the speed picking up.

When relearning is done, retake the exam on just those items. If you pass, write "passed on retake" in that cell of the report card. Those scribbles piling up are this book’s real progress bar.

3-6. Building an Archive — Organizing 39 Steps of Traces

The exam is over, so let’s organize the spoils:

mkdir -p ~/level0_archive
cp ~/level0_reflection.txt ~/level0_archive/
ls ~/level0_archive

How to read it: you made an archive folder and put today’s reflection in it. Into this, steadily gather the scripts you’ve made, photos of practice notes, and photos of cheat sheets. This archive is both the evidence for checking "I’ve come this far" on tiring days, and the raw material for a future portfolio.

4. Missions & Exercises

Mission — Make a One-Page Cheat Sheet

Compress the commands and concepts learned in Level 0 onto a single A4 page. Two rules:

Don’t try to fit everything — select by the criterion "if I could bring exactly one page into the exam room?"
Don’t print it; write it by hand — the process of writing by hand is itself the final review

The layout is yours to decide, but when finished, put it into the archive (3-6) together with the 3-4 report card.

Exercises

The four items below are a self-check spanning all of Level 0. Close the book and answer:

Q1. List the four "auto-start locations" where malware registers itself to survive reboots.

Q2. When you find a suspicious process in Task Manager, what are the two numbers (PID and its partner) used to trace "who ran it," and with which command can you view them together?

Q3. In ipconfig results, my IP starts with 169.254.x.x. What’s the situation, and which equipment should you suspect first?

Q4. You received a report: "the site won’t open." When diagnosing in the order ping the router → ping 8.8.8.8 → nslookup → Test-NetConnection, which segment do you suspect if each step fails?

5. Model Answers & Completion Criteria

Mission Model Answer

Recommended cheat-sheet layout (it doesn’t have to be exactly this arrangement — bundling by purpose is the key):

Left column — files/directories: ls, cd, cp, mv, mkdir, rm, find, grep…
Middle column — system: permissions (chmod), users, processes (Get-Process/ps), services, SSH…
Right column — network: ipconfig/ip addr, ping, nslookup, tracert, Test-NetConnection + a mini map of the seven layers
Very bottom — questions to ask when stuck: "Does ping work? Is the port open? Does the name resolve?"

How to verify: ① Did it fit on one page (throwing things out when it overflows is also a skill)? ② Are the commands bundled by purpose, not alphabetically — tools must be remembered by purpose to be retrievable. ③ Did you write it by hand? This one page is Level 0’s graduation work.

Subject 1 (Written) Model-Answer Gist

Absolute vs relative paths (Steps 2, 18): an absolute path is an address written in full from the root (C:\Users\..., /home/...); a relative path is an address written relative to "where I’m standing now" (.., ./docs). The same file’s relative path changes with your current location.
-rw-r--r-- (Step 23): the first - is a regular file; then three characters each: owner (rw- = read+write), group (r– = read), others (r– = read).
Process vs program (Steps 13, 26): a program is a file stored on disk; a process is the living entity of it running in memory. Check commands: Get-Process (Windows) or ps (Linux).
SSH key files (Step 29): passwords are weak to guessing, brute force, and leakage, but a key file is proof of possession that only "the one who has it" passes, making it far stronger against remote brute-force attacks.
MAC vs IP (Steps 31, 32): IP is an address that works anywhere in the world (inner envelope); MAC is the address used for direct delivery to a same-neighborhood neighbor (outer envelope). The farther the letter travels, the more the outer envelope’s MAC keeps changing to the next signpost’s.
Ports (Step 34): "room numbers" distinguishing multiple services inside one computer (one IP). E.g., 22 SSH, 53 DNS, 80 HTTP, 443 HTTPS, 25 SMTP.
3-way handshake (Step 35): the client sends SYN (I’d like to connect) → the server sends SYN-ACK (sure, I’m ready too) → the client sends ACK (confirmed). Only after the three lines does data flow.
NAT’s four steps (Step 38): an inside device sends a letter with its private IP → the router swaps the sender to its public IP → records "unit such-and-such’s conversation" in the ledger → when the reply arrives, reads the ledger and delivers to the right device.

Exercise Solutions

Q1 solution. Registry Run keys, the Startup folder, scheduled tasks, auto-start services (Step 15). Full marks if you can also say that attackers don’t make new doors but blend into doors that already exist.

Q2 solution. PID (Process ID) and ParentProcessId (parent PID). You can view both together with Get-CimInstance Win32_Process (Step 13). Also remember that a "broken link" — a parent already terminated so the number has no owner — is a normal situation.

Q3 solution. It’s a DHCP assignment failure signal. The address the operating system attaches temporarily on its own when the router couldn’t give one out (Step 38, Wall 3). The first things to suspect are the router (DHCP server) and the connection between — start from step 1 of Step 36’s ladder (ping the router).

Q4 solution. ① ping the router fails → the segment from my device to the router (cable, Wi-Fi); ② ping 8.8.8.8 fails → the router-to-ISP line; ③ nslookup fails → DNS; ④ Test-NetConnection fails → the far server or a middle firewall. The principle is to ask from the lower floors, from the nearest place (Step 36).

Completion Criteria Checklist

[ ] I wrote the 8 explanation items without the book and recorded weakness steps
[ ] I completed a day in the CLI (the 3 tasks: organize, gather, write) without File Explorer
[ ] I drew the network travel map while explaining out loud for 3+ minutes
[ ] I wrote the report card table and distinguished the kinds of weaknesses (concept/command)
[ ] I made a relearning plan for the weakness steps
[ ] I completed a one-page A4 cheat sheet by hand
[ ] I organized today’s artifacts into the level0_archive

6. Common Pitfalls & Fixes

Wall 1. I can’t write a single explanation

Symptom: it feels like you know it, but sentences won’t come out.
Cause: reading and writing are different muscles. Someone who has only read freezes on their first writing, everyone does. It’s not lack of skill but lack of training.
Fix: first muster the courage to write "don’t know." Then reread that step, and while reading, write a five-line summary yourself. Without looking at the summary, write it again. This cycle builds the writing muscle.

Wall 2. I know the commands but can’t match them to situations

Symptom: individual commands come to mind, but given a task like "find the process eating the most memory," you stall, not knowing which command to pull out.
Cause: you memorized commands without "organizing them into a toolbox."
Fix: re-organize your cheat sheet by purpose, not alphabetically. Like "when I want to find," "when I want to delete," "when I want to see status." Tools must be remembered by purpose to be retrievable.

Wall 3. A day in the CLI is so slow I want to give up

Symptom: a 3-second job in File Explorer takes 3 minutes by command, and you feel deflated.
Cause: normal. A familiar tool being faster than a new tool is only natural. Being slow now isn’t lack of skill but lack of repetition.
Fix: speed is not the result but a byproduct. "Slow but finish" is today’s passing condition, and speed follows on its own after about ten more repetitions of the same work. In the first place, the goal is not speed but "the freedom of being able to do it without a mouse."

Wall 4. The exam results are worse than expected

Symptom: weakness steps exceed five and motivation breaks.
Cause: forgetting is the human default specification. Nobody remembers 39 steps perfectly in one pass.
Fix: think of it not as an exam but as obtaining a review schedule. Today’s report card is not a failure list but "the list of steps to read next." Learn → test → gaps → relearn: this cycle is the study engine of this entire book, and since you learned how to run that engine today, today is a gain regardless of the results.

Wall 5. The VM is off, so practical Task A can’t be done in bash

Symptom: you can’t boot Ubuntu, or your environment has no virtual machine.
Cause: the task’s example is bash, so a Windows-only environment gets stuck.
Fix: the same task can be done well enough in PowerShell. The corresponding commands are:

cd ~\Downloads
mkdir images, docs, archives, others
Move-Item *.png, *.jpg images\ -ErrorAction SilentlyContinue
Move-Item *.pdf, *.md, *.txt docs\ -ErrorAction SilentlyContinue
Get-ChildItem -Recurse

-ErrorAction SilentlyContinue corresponds to bash’s 2>/dev/null — "go on quietly even if an error occurs." Whichever side you did it on, the criterion is the same: you pass only if you can explain each command.

7. Summary

Today’s Concepts

Concept	One-line description
Artifact verification	You know your skill only by writing it, doing it, explaining it
Three-subject exam	Written (explanations) · Practical (a day in the CLI) · Oral (talking the map)
Wrong-answer notebook	A miss is not a punishment but a step number to return to
Concept/command distinction	The two kinds of weaknesses that change the relearning method
Cheat sheet	A single A4 page compressed by purpose — Level 0’s graduation work

Level 0 Core Command Summary (Diagnostic Excerpt)

Situation	Command
"It doesn’t work" report received	`ping router` → `ping 8.8.8.8` → `nslookup` → `Test-NetConnection -Port`
Check my address	`ipconfig` / `ip addr`
Who ran it	`Get-CimInstance Win32_Process` (PID + ParentProcessId)
Auto-start inspection	Run keys / `shell:startup` / `Get-ScheduledTask` / `Get-Service`

The Instinct That Matters More Than Commands

Today’s exam is, in fact, a miniature of security practice. A security professional’s daily routine is a repetition of "testing for yourself what you believe is safe" — verifying that the firewall blocks, verifying that backups restore. "Don’t trust; verify" — this one sentence is both today’s exam rule and this field’s first commandment. And the scope of verification is always your own. All offensive practice happens only in your own lab and on legal platforms. Unauthorized attacks on live services are a crime.

One more as study technique — the most efficient review is not rereading but recall (testing). When you fail to pull something from memory, that failure itself engraves the memory more strongly. The items you marked "don’t know" today are, in fact, the spots where you grew the most. Carry it on with a thirty-second habit before sleep: "three things I learned today."

You, who once opened PowerShell for the first time and feared the black window, today lived a whole day through that black window, drew a network map, and examined yourself. Nobody gifted you this change. Your own feet made it, crossing forty steps one at a time. What you’ll learn ahead runs deeper, but the method doesn’t change — learn, do it with your hands, close the book, take the test, return to the gaps. You’ve already run this five-beat cycle forty times.

Level 0 — sincere congratulations on your graduation. You did it.

Once every box is checked, Step 40 is complete. Click the checkbox in the sidebar to save your progress.