CPD · Telecommunications and IT

Configuring a secure network

Setting up a small network with sensible security. Practised in a lab, not on live systems.

about this course

What you will be able to do

L5 SpecialistAbout 4 hours (240 minutes) of CPDSelf-study plus role-playTelecommunications and IT

Setting up a small network with sensible security. Practised in a lab, not on live systems.

Configure a small network, given a lab diagram, with addresses, passwords policy and access rules in place.
Segment a network, given user groups, so guests cannot reach staff devices.
Test the setup, given a checklist, recording every result.
Document the configuration, given a template, so another person could rebuild it.

Task, condition and standard

Task

Divide a small network into staff, guest and device zones, configure standard secure settings in a lab, test the build and write a repeat-it guide

Condition

Given a lab diagram of a small office with public Wi-Fi, user groups, a check list and a guide template, in a 4-hour lab session on test equipment only

Standard

Show that guests reach the internet but not internal devices, replace every default password, apply a strong passphrase and current encryption, record every check result, and write a guide another person can follow

These courses teach process, communication and recording. They give no clinical, legal, tax, financial or engineering sign-off. A named subject expert must review every line, and you must check your own professional body's current CPD rules, before you rely on a certificate.

sessions

8 modules

Module 1 Zones: staff, guest, devices 30 min

A zone is a group of devices with the same trust.
Staff, guest and devices need separate zones.
A guest must never reach staff systems.

Worked example. Office with 8 staff laptops, public Wi-Fi, 1 printer and 2 cameras. Three zones, each a separate address range (a /24 range holds up to 254 devices): staff 192.168.10.0/24, guest 192.168.20.0/24, devices 192.168.30.0/24.

Practise: Practise with a case card or template for "zones: staff, guest, devices": configure a small network, given a lab diagram, with addresses, passwords policy and access rules in place.

Standard to meet. Organise a small network into staff, guest and device zones, given user groups, so a guest device cannot reach staff systems.

Module 2 Drawing a small network plan 40 min

Draw each zone and the traffic allowed between them.
Write each firewall rule in plain words.
Default is deny; allow only what is needed.

Worked example. Plan rules: staff to internet allow; guest to internet allow; guest to staff deny; guest to devices deny; staff to printer allow.

Practise: Practise with a case card or template for "drawing a small network plan": segment a network, given user groups, so guests cannot reach staff devices.

Standard to meet. Sketch a small network plan, given a lab diagram such as an office with public Wi-Fi, showing each zone, its traffic and the firewall rules between zones.

Module 3 Standard settings in the lab 50 min

Replace every default password at install.
Use a strong passphrase and current encryption.
Update firmware and keep the admin page away from guests.
A rule change is approved by the owner or the change approver.

Worked example. Lab router: admin password changed, staff passphrase of several random words (long and unique), current encryption on, firmware updated to the latest version offered (sample 4.2.1 to 4.2.3), admin page open to staff zone only.

Practise: Practise with a case card or template for "standard settings in the lab": test the setup, given a checklist, recording every result.

Standard to meet. Configure standard settings in the lab, replacing default passwords, applying a strong passphrase and current encryption, updating firmware, and keeping the admin page out of guest reach.

Module 4 Passing the check list 35 min

Run every line of the check list.
Record the result of each one.
Test from a guest device.

Worked example. Check list of 8 items. Guest laptop: web page loads (pass); connection to 192.168.10.5 times out (pass); printer unreachable (pass). Result 8 of 8 recorded.

Practise: Practise with a case card or template for "passing the check list": document the configuration, given a template, so another person could rebuild it.

Standard to meet. Apply the check list to the lab build, recording every result, and show that guests can reach the internet but not internal devices.

Module 5 Writing the repeat-it guide 40 min

Write the guide so someone else can rebuild it.
Add the date and the author.
Put steps in the order you built them.

Worked example. One-page guide: date 2026-03-14, author the lab technician; steps 1 create three zones, 2 set passphrases, 3 apply five rules, 4 update firmware, 5 run the 8-item check list.

Practise: Practise with a case card or template for "writing the repeat-it guide": document the configuration, given a template, so another person could rebuild it. Use a new case this time (round 2).

Standard to meet. Write a one-page repeat-it guide, given the configuration, with date and author, so another person could rebuild or audit the network.

Module 6 Assessment 25 min

Design a new network from a short brief.
Log changes and failed sign-ins.
Name who approves a rule change.

Worked example. New scenario: clinic with 5 staff and a waiting-room guest network. Pass needs 3 zones, 5 or more rules, 8 of 8 checks recorded, a change log, and a named approver.

Practise: Practise with a case card or template for "assessment": document the configuration, given a template, so another person could rebuild it. Use a new case this time (round 2).

Standard to meet. Design and document a small network for a new scenario, with zones, settings, a log of changes and failed sign-ins, and a clear approver for rule changes.

Module 7 Second worked case: a cafe till kept apart 10 min

Add a fourth zone for the till.
Deny guest traffic to the till zone.
Test from a guest device.

Worked example. Case card 2: zones guest 192.168.20.0/24, staff 192.168.10.0/24, devices 192.168.30.0/24 and till 192.168.40.0/24. Rule: guest to till deny. Test: guest laptop to 192.168.40.10 times out.

Practise: Practise with a case card or template for "second worked case: a cafe till kept apart": document the configuration, given a template, so another person could rebuild it. Use a new case this time (round 2).

Standard to meet. Design four zones for a cafe so guest Wi-Fi cannot reach the till, list the firewall rules, and test the result from a guest device.

Module 8 Teach-back and peer check 10 min

Give your guide to a partner.
The partner follows it without asking questions.
Note every step that was unclear.

Worked example. Pairs of 2: the partner rebuilds the staff zone from the guide in 15 minutes. Target: all 5 steps followed with no question asked; each unclear step is rewritten.

Practise: Practise with a case card or template for "teach-back and peer check": document the configuration, given a template, so another person could rebuild it. Use a new case this time (round 2).

Standard to meet. Evaluate a partner's repeat-it guide by following it, note every unclear step, and suggest a clearer wording for each one.

practice

Worked example and case cards

Worked example

Two networks: staff and guest. Staff: strong passphrase, current encryption, admin page not reachable from guest. Guest: internet only. Default passwords changed; firmware updated; settings written in a one-page record with date and who.

Case card

a small office with 8 staff and public Wi-Fi.

Case card 2

A café wants guest Wi-Fi that cannot reach the till. Learners design the zones and list settings.

checks

10 check questions with model answers

Why separate guest and staff?

Model answer: A guest cannot reach internal devices. (Covered in module 1: Zones: staff, guest, devices. To pass that module: Organise a small network into staff, guest and device zones, given user groups, so a guest device cannot reach staff systems.)

First change on a new router?

Model answer: Replace default passwords. (Covered in module 3: Standard settings in the lab. To pass that module: Configure standard settings in the lab, replacing default passwords, applying a strong passphrase and current encryption, updating firmware, and keeping the admin page out of guest reach.)

Why document?

Model answer: Someone else can repeat or audit it. (Covered in module 5: Writing the repeat-it guide. To pass that module: Write a one-page repeat-it guide, given the configuration, with date and author, so another person could rebuild or audit the network.)

How often update firmware?

Model answer: Regularly, per policy. (Covered in module 3: Standard settings in the lab. To pass that module: Configure standard settings in the lab, replacing default passwords, applying a strong passphrase and current encryption, updating firmware, and keeping the admin page out of guest reach.)

Why separate guests?

Model answer: A guest device cannot reach staff systems. (Covered in module 1: Zones: staff, guest, devices. To pass that module: Organise a small network into staff, guest and device zones, given user groups, so a guest device cannot reach staff systems.)

What is a default password risk?

Model answer: Known to attackers; change at install. (Covered in module 3: Standard settings in the lab. To pass that module: Configure standard settings in the lab, replacing default passwords, applying a strong passphrase and current encryption, updating firmware, and keeping the admin page out of guest reach.)

What to log?

Model answer: Changes and failed sign-ins. (Covered in module 6: Assessment. To pass that module: Design and document a small network for a new scenario, with zones, settings, a log of changes and failed sign-ins, and a clear approver for rule changes.)

Who approves a rule change?

Model answer: The owner or change approver. (Covered in module 3: Standard settings in the lab. To pass that module: Configure standard settings in the lab, replacing default passwords, applying a strong passphrase and current encryption, updating firmware, and keeping the admin page out of guest reach.)

Why write the guide?

Model answer: Another person can repeat it. (Covered in module 5: Writing the repeat-it guide. To pass that module: Write a one-page repeat-it guide, given the configuration, with date and author, so another person could rebuild or audit the network.)

A guest on the cafe Wi-Fi tries to open the till's address. Which result shows the build is correct?

Model answer: The connection times out or is blocked, while normal web pages still load. (Covered in module 7: Second worked case: a cafe till kept apart. To pass that module: Design four zones for a cafe so guest Wi-Fi cannot reach the till, list the firewall rules, and test the result from a guest device.)

glossary

Words used in this course

zone, firewall rule, default setting, log, repeatable build.

marking

How the practice and assessment are marked

Level	Meaning	Marks of 4
Secure	Meets the standard in the outcome every time, no prompts	4
Meeting	Meets the standard with one small slip, corrected when prompted	3
Developing	Meets part of the standard; needs a re-attempt	2
Not yet	Standard not met	1

Pass = average 3 or more, and no outcome at 1. You may re-attempt after feedback. The subject expert sets any stricter pass mark.

where next

Ladder L1 to L7, slide by slide with notes

Slide 1: L1 Basic: What a network is. Speaker note: A network links devices so they can share a connection and files. At this first step the learner can name a router, a Wi-Fi network and a device, and say why a default password is risky.
Slide 2: L2 Awareness: Zones and trust. Speaker note: The learner can explain why staff, guest and device networks are kept apart and why a guest should reach only the internet. They know that settings must be written down so others can repeat or audit them.
Slide 3: L3 Foundation: Plan and settings. Speaker note: The learner can sketch three zones for a small office and name the first settings to change on a new router. They follow the worked example with default passwords replaced and firmware updated.
Slide 4: L4 Practitioner: Build, test and document. Speaker note: This course sits here. The learner divides a small network into zones, configures standard settings in a lab, runs the check list from a guest device and writes a one-page repeat-it guide.
Slide 5: L5 Specialist: More sites and rules. Speaker note: The specialist builds networks with extra zones such as a till or a camera network, tighter rules and logging. They test every rule from both sides and keep a change log with named approvers.
Slide 6: L6 Advanced: Review and audit. Speaker note: The advanced practitioner reviews other people's builds against the check list, reads logs for failed sign-ins, and finds rules that are too wide, such as guests able to reach a printer.
Slide 7: L7 Super expert: Standard builds. Speaker note: The super expert writes the standard build and training for a team. They set rules for change approval, plan regular firmware updates, and mentor others to make every build repeatable.

This course sits at L5 Specialist. Credits stack; aligned with, not accredited by, any framework.

jobs this leads to

Where this takes you

IT support technician
Network technician
Junior systems administrator
Helpdesk analyst
Office IT assistant

assessment and certificate

How you are checked

Each outcome is checked against its standard with a checklist or a short test. A digital CPD record shows the hours. Keep evidence in My page. Aligned with common CPD practice; not accredited. Learners check their own body's rules.

ten locations and global

Your place

Use your own body's forms, units and currency. Local professional bodies set the rules for CPD hours; check them first.

India (Bengaluru)

Language: English, Hindi, Kannada. Personal data: Digital Personal Data Protection Act 2023. Credit and levels: National Skills Qualifications Framework (NSQF) and the national credit framework.

Netherlands (Eindhoven area)

Language: Dutch, English. Personal data: EU GDPR (Dutch: AVG), supervised by the Autoriteit Persoonsgegevens. Credit and levels: the Dutch qualification framework (NLQF) linked to the European Qualifications Framework.

UAE (Dubai and Abu Dhabi)

Language: Arabic, English. Personal data: Federal Decree-Law No. 45 of 2021 (personal data protection). Credit and levels: the emirate education and training regulators (for example KHDA in Dubai) and the national qualifications framework.

Brazil (Sao Paulo)

Language: Portuguese (Spanish and English support). Personal data: LGPD (Lei Geral de Protecao de Dados). Credit and levels: the national technical-education catalogue and the national S-system training bodies.

Canada (Toronto)

Language: English, French. Personal data: PIPEDA, with provincial rules where they apply. Credit and levels: the provincial colleges framework and the national credential-recognition guidance.

United States

Language: English, Spanish. Personal data: state privacy laws (for example California), and COPPA for children under 13. Credit and levels: state and community-college credit systems.

Singapore

Language: English, Mandarin, Malay, Tamil. Personal data: Personal Data Protection Act (PDPA). Credit and levels: the Singapore national skills frameworks and the national credit system.

Australia

Language: English. Personal data: the Privacy Act 1988 and the Australian Privacy Principles. Credit and levels: the Australian Qualifications Framework (AQF) levels.

Hong Kong (Eastern Asia)

Language: Chinese (Cantonese, Mandarin), English. Personal data: the Personal Data (Privacy) Ordinance. Credit and levels: the Hong Kong Qualifications Framework.

Georgia and Israel (Western Asia)

Language: Georgian, Hebrew, Arabic, English. Personal data: the personal data law of the country where the learner lives. Credit and levels: the national qualifications framework of that country.

Cayman Islands (Caribbean)

Language: English. Personal data: the Data Protection Act. Credit and levels: the local education and training framework.

Mexico

Language: Spanish, English. Personal data: the federal law on personal data held by private parties. Credit and levels: the national competency certification system and the education ministry levels.

Draft

Draft CPD course. It opens only after final checks. No fee is shown.

All CPD courses