State scope
Label the file a fictional learning example and limit work to the supplied text.
Concrete output: One scope statement.
FICTIONAL LEARNING EXERCISE
Research notes for fictional event cards
Organise fictional reports into observations, missing information and questions. No connection to or testing of a real system is needed.
Inspect the sample file
6 sample rows · 3 columns
| event_id | reported_observation | available_context |
|---|---|---|
| E01 | A user reports an unexpected sign-in message | Report only; no event log supplied |
| E02 | A sample device record has a missing owner field | Fictional inventory export |
| E03 | Two report timestamps use different time zones | No normalisation performed |
| E04 | A training note refers to an unknown file version | No actual file supplied |
The table shows the first four rows. The file is fictional; some exercises intentionally include missing or conflicting values. Do not interpret them as real operational outcomes.
Download fictional sample CSV ↓Separate observation and assumption
Put observed statements in a separate column. Do not rename a report as a confirmed attack.
Concrete output: Separated observations and assumptions.
Prioritise questions
Choose two pieces of additional information for one card. Explain how answers affect your judgement rather than applying technical actions.
Concrete output: Two questions and their reasons.
Write a short report
Use known, unknown and handover headings. Do not assert business impact not established by the record.
Concrete output: A one-page tabletop exercise report.
My own project narrative
Write what you actually did and its limits in your own words rather than copying a prewritten achievement.
Ask yourself before saving
- Did I separate observation from interpretation?
- Did I incorrectly label an unconfirmed event as a definite attack?
- Did I work without real systems or sensitive data?