Network Change Management Lab
Network changes sit under everything else: a bad rule or a failed cutover takes down stores, remote staff or card machines. Here you decide how much process three network changes deserve: a routine firewall rule cleanup, a VPN to zero-trust cutover, and an emergency DNS block during a live phishing campaign.
For each one you classify the change, rate its risk, pick approvers, plan the test, rollback, window, communications and verification, and a seeded outcome shows whether your plan held. Penalties apply for classic mistakes. The debrief exports a change record per change and a CSV register.
You are the change manager at Brackenridge Outfitters
Brackenridge Outfitters (brackenridge.example) is the fictional outdoor retailer from the Firewall Lab, with a head office, a data centre and about 40 stores. Black Friday trading is a change freeze on everything store-facing from Mon 16 Nov to Mon 30 Nov, the network team works 08:00 to 18:00 US Eastern, and the stores span two time zones. You are the change manager, and three network requests need three different weights of process.
- 1Classify it: standard, normal or emergency
- 2Rate the risk: impact, likelihood, blast radius, reversibility
- 3Pick the approvers and the CAB path
- 4Choose the test and validation plan
- 5Choose a rollback plan
- 6Pick the change window
- 7Choose communications and post-change verification
- 8See what happened, from a seeded outcome
3 changes. Pro hides the hints. A good test plan uncovers hidden dependencies as you choose it. Passing score is 70%.
Loading…
TL;DRWhat this lab is
5 points
- A network change management lab: you are the change manager at a fictional outdoor retailer reviewing three changes, a zero-hit firewall rule cleanup, a VPN to zero-trust network access cutover, and an emergency DNS block.
- For each change you classify it (standard, normal or emergency), rate impact, likelihood, blast radius and reversibility, pick approvers, a test plan, a rollback plan, a window, communications and a post-change verification.
- A seeded outcome resolves hidden problems (a missed dependency, drift, a rollback needed, an out-of-hours failure) and shows whether your plan held. Runs are repeatable with a ?seed= link.
- Penalties apply for classic mistakes: emergency used to skip testing, no rollback, an untested rollback, a change in a freeze, a single approver for a wide blast radius, and no verification.
- The debrief exports a Markdown change record (RFC) per change and a CSV change register. Downloading documents is Pro; reading them on the page is not.
Frequently asked questions
What is the Network Change Management Lab?
A browser-based training lab where you act as change manager for a fictional retailer. Over three network changes you classify the change, assess risk, choose approvers, plan testing, rollback, the window, communications and verification, and then see a seeded outcome of what happened. It trains judgement about process weight, not product commands.
Why is a rule cleanup a standard change?
In ITIL change enablement terms, a standard change is pre-authorised, low risk and follows a documented procedure. Disabling zero-hit rules with a hold period, an owner, an export and a clean history fits. The lab still asks you to check that the template's conditions hold, because hit counters can reset on failover and miss annual jobs.
Why does a VPN to ZTNA cutover need so many approvers?
It replaces the way many people reach internal systems, and a failure removes remote access for everyone at once. The architect owns the design, identity owns sign-on and device checks, the service desk takes the calls, and store IT owns a system with a hard-coded allowlist. A single approver for a change with a large blast radius is a penalised mistake.
Is an emergency change allowed to skip testing?
No. An emergency change is approved by a faster path and reviewed afterwards, but a short test, here a canary resolver group and a log check, is still part of it. Emergency is for active harm that cannot wait for the next board; it is not a reason to skip testing or a rollback.
Why does the DNS block need the SOC incident lead?
Blocking a domain stops the next click but not the credentials already handed over. The credential reset and the hunt run in parallel with the block, so the person who owns them is part of the change.
What makes a good rollback for a cutover?
The old path stays live and usable until a clean cycle proves the new one, groups can be moved back by a switch, and the move back has been rehearsed. A VPN that is merely powered on, with no routing tested, is not a rollback.
How does the seeded outcome work?
Each change hides a few risks, such as a rare rule, a legacy allowlist or a shared hosting domain. The seed fixes the dice. Choosing tests, approvals, windows and rollbacks that address a risk makes it much less likely to fire, and a good rollback or verification limits the damage if it does. The same seed, level and plan give the same outcome.
How do the difficulty levels differ?
Rookie shows a hint at each step and a "watch for" list of hidden dependencies and has the lowest chance that an unmitigated risk fires. Pro hides the hints, but a good test plan reveals a hidden dependency as you choose it. Elite hides everything until the outcome and raises the chance that an unmitigated risk fires.
What do I get in the export, and which frameworks apply?
A Markdown change record per change and a CSV register of all three; downloading documents is Pro, and the same records can be read on the debrief page. The terms follow ITIL change enablement, and the controls echo NIST SP 800-53 CM-3, CM-4 and CM-5, ISO/IEC 27001 Annex A 8.32 and CIS Controls. It is a training exercise, not a compliance checklist.
Is any of this real?
No. Brackenridge Outfitters, its people and the brackenridge.example domain are invented, and every outcome is simulated in your browser. Nothing here connects to a real firewall, resolver or network.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.