Introduction

TryHackMe’s Cyber Security 101 (SEC1) is the platform’s foundational certificate; the step up from the SEC0 (Pre Security) path. One learning path, six domains, covering both sides of the fence: operating system skills, network traffic analysis, web application security, security operations, password attacks, and malware analysis fundamentals. The exam is scenario-based and fully hands-on, with no multiple choice and no theory questions. You get 24 hours to work through six sections of practical tasks.

I passed it, and this time I earned it. The SEC0 quick win was a confidence boost more than a challenge; SEC1 made me sweat. Inside the 24 hours each section has a limit of 1 hour. On the two red team sections, I ran our of time for the last assignment or two.

What SEC1 covers

Six domains are covered within the exam, spanning attack and defense.

Domain	What it tests
Operating system skills	Working in Linux and Windows, Active Directory, and the command line
Network traffic analysis	Reading packets in Wireshark and tcpdump, and spotting what a capture gives away
Web application security	Web fundamentals, the OWASP Top 10, and proxying requests with Burp or Caido
Security operations	SOC work, SIEM, log analysis, and incident response
Password attacks	Hashing, John the Ripper, and Hydra against real credentials
Malware analysis fundamentals	First-look triage with tools like CyberChef and REMnux

If you have done any of the SEC1 learning path, none of these come out of nowhere. The exam just asks you to use them for real, with no walkthrough holding your hand.

Red teaming was the best part, and the worst

The offensive tasks were my favorite and the hardest. Attacking a box asks you to build a picture from scraps and then act on it, and that puzzle is what pulls me toward red teaming. Under the exam clock, though, “fun” and “difficult” pull in opposite directions.

The pressure changes how you think. On a normal day I test an idea, watch it fail, and move on without a second thought. During the exam that same dead end nags at you: was the idea wrong, or the execution? I caught myself doubting steps I already knew, which is its own kind of tax. Three tasks in particular stuck with me, and each one taught me something about staying level-headed when under pressure.

Cracking a ZIP

One task handed me a password protected ZIP archive, and inside it were a loose passwd file and a loose shadow file. On a Linux system these two live in /etc. The passwd file holds the account details, and the shadow file holds the actual password hashes, split apart so normal users can read one but not the other.

To crack the hashes with John the Ripper you first have to glue the two files back together into one format John understands. That is what the unshadow tool does, and it ships with John:

unshadow passwd shadow > combined.txt
john combined.txt

I had never run unshadow before, so I burned real minutes remembering that the merge step even existed.

Intercepting web traffic

Another task wanted me to intercept and tamper with web traffic using an interception proxy; either Burp Suite or Caido works. A proxy like this sits between your browser and the target so you can pause a request, read it, change it, and send it on.

The path forward did not jump out at me. The fix was the least clever move possible: send the request, capture it, and read what it contained. Once I could see the raw request, the next step became obvious, and then the one after that. Simple in hindsight; really basic stuff even; but at the time it was a struggle.

DHCP tells you more than you would think

The task that was an eye opener to me, was a packet capture (PCAP) analysis in Wireshark. I opened up the Dynamic Host Configuration Protocol (DHCP) traffic, the automatic conversation a device has with the network to lease an IP address, and it was chatty. Hostnames, requested addresses, vendor details, gateway address, DNS server; a lot of a machine’s and the network’s identity leaks out during that handshake. I want to spend more time in Wireshark after this. Watching a network describe itself packet by packet is my kind of fun.

The rest was smooth sailing

The Windows, Linux, and networking sections were comfortable. Years of platform engineering pay dividends here; a lot of it was muscle memory rather than new ground. That gap between the easy defensive-leaning tasks and the harder offensive ones is a clear signal about where my weak spots sit, and where I want to push next.

Bottom line

SEC1 is a proper step up from SEC0. It rewards knowing your tooling cold and keeping a clear head under a bit of pressure, which is a fair approximation of the actual job. SEC0 was a confidence boost; SEC1 is the first cert on this path that felt earned.

Next

I am leaning toward the Junior Penetration Tester path, plus a steady stream of rooms alongside it. The plan for now is simple: practice, practice, practice. Expect write-ups as I go.