Make a small business network with firewalls, IDS/IPS, and VPNs. Use tools like Nmap and Nessus to scan for vulnerabilities, and then take steps to make the network more secure against common attacks.

Use Burp Suite and OWASP ZAP to find security holes in a web app that is open to attack, like OWASP Juice Shop. These holes could include SQL Injection, Cross-Site Scripting (XSS), and CSRF. Write a full report with ways to fix the problems.

Pretend that a system has been attacked by malware or someone who shouldn't have access, and then follow your incident response plan. Use Wireshark or SIEM tools to look at logs, gather digital evidence, and write up your findings in a forensic investigation report.