Blog
Learning out loud — honest notes from the study desk and the career
transition. What worked, what didn't, and what I'd tell someone a
few months behind me on the same road.
6 July 2026 · CPSA study
Recognition is not recall
I got 87% on a practice exam a while back and felt pretty good about
it. Second time through the same question bank, mind — same questions,
shuffled order. I did it in 29 minutes. The first run took me 44. That
should have told me something.
A week or so later I sat a harder bank cold. Questions I'd never seen.
62%. That's the real number.
What happened on the first one is I wasn't remembering the material, I
was remembering the questions. You see the shape of one and you know
which answer felt right last time. It feels exactly like knowing the
subject. It isn't. In the real exam the wording will be new and
there's nothing to recognise, so the only thing that counts is what I
can pull out of my head cold.
A few things I've changed since.
I don't trust any score off a repeated bank now. It's a warm-up,
nothing more. If I'm quoting a mock score as evidence I'm ready, it
has to come from questions I'd never seen before that sitting.
I book the re-test on the day of the mock. Learned that one the hard
way. I had a topic at 70% after a good session and assumed it was
sorted. Six weeks later it was at 20%. Nothing warned me, because I
never scheduled anything to warn me. The gap between a cold first pass
and a re-sit a few weeks later is the only retention signal you get,
and you don't get it unless you actually book the re-sit.
And when I was marking the cold paper I noticed I'd put dpkg
-l down for a Solaris question and a Red Hat question. Two
wrong answers, one mistake: under pressure I default to the tool I
know best. One line sorted both. dpkg is Debian, rpm is Red Hat,
pkginfo is Solaris, pkg_info is BSD. Worth checking your own wrong
answers for that. If a few of them have the same cause, fix the cause.
None of this is new. But nobody selling practice exams is going to
tell you your 87% might be mostly memory of the questions. Sit a paper
you've never seen and trust that number instead.
6 July 2026 · CPSA study
Theory needs something you can break
I spent two evenings, about four hours all in, on firewall theory and
a virtual machine installer that wouldn't play. At the end of it I
hadn't written a single firewall rule.
By then I could describe a default-deny policy in exam-ready language.
I just hadn't built one. The plan said pfSense lab, the installer kept
failing, and I kept pushing at it because that was the plan. The
mistake wasn't the installer. It was me not changing course sooner.
The reset took twenty minutes. I binned the VM (virtual machine) lab
and used iptables instead, which was already sitting on my Kali box.
Default-deny on the INPUT chain, then allow rules for loopback,
established connections and pings. Generated some traffic and watched
the packet counter on rule 2 tick up. 1 packet to 5, 76 bytes to 412.
Four packets, hardly anything. But they were my packets hitting my
rule, and the concept landed in a way four hours of reading never
managed.
I'm doing this as a career changer, so I don't get hands-on exposure
at work. It has to come from study time, which means study time can't
be all reading. What I've changed:
Every session now has to produce something I can see. A rule written,
a counter going up, scan output on the screen. If nothing visible
happened, the session isn't done, whatever I've read.
The cheapest tool that shows the concept wins. Twenty minutes of
iptables beat a ninety-minute pfSense build that never got past the
installer. The proper lab can come later. The concept can't wait for
it.
And I've set myself a tripwire. Thirty minutes with nothing to show,
stop and ask whether a simpler tool shows the same idea. So far the
answer has always been yes.
In my old trade we'd never sign off a repair on theory alone. You run
the system and watch it work. Study is no different. If nothing moved,
nothing counted up and nothing broke, I'm not convinced the knowledge
went in either.
6 July 2026 · Building in public
What a no-build website forces you to learn
My site has one hard rule: clone it, open index.html, and
it runs. No build step, no framework, no bundler. Plain HTML, CSS and
JavaScript, plus two CDN (Content Delivery Network) dependencies, and
that's it.
I set the rule because I'm a beginner at front-end and I wanted to
learn the platform itself, not a framework's version of it. This week
I ran a full audit of the site, and the results showed me what that
rule has actually been teaching me.
The contrast finding stung a bit. My light-theme green measured
roughly 3.8:1 against the page background, and the WCAG (Web Content
Accessibility Guidelines) standard wants 4.5:1 for body text. It
looked fine to me. That's the point though. My eye signed it off and
my eye was wrong. The fix was one shade darker, checked with the
actual luminance maths rather than by squinting at the screen. A
framework theme would have handled all that for me, and I'd never have
learned it was a thing you check.
The one that bothered me more: my chart library was loading from its
CDN unpinned. Whatever version they shipped next is what my site would
have got, and a breaking release would have quietly killed the skills
chart on my qualifications page. It's pinned now, with an integrity
hash, so the browser refuses the file if it ever changes underneath
me. For someone heading into security work that's a bit embarrassing
to have missed. Supply-chain hygiene starts on your own site.
Smaller one, but it taught me something too. The site was all-
monospace, everywhere, because that was the terminal look I wanted.
Turns out monospace is measurably harder to read at length, so I've
moved to a split: monospace for headings, navigation and labels, where
the character of the site lives, and a normal system font for
paragraphs, where the reading happens. On a framework that's a theme
toggle. In plain CSS I had to understand the decision: two font
stacks, custom properties, and a call on which elements carry identity
and which carry reading.
The habit underneath all of this isn't technical. In my old trade,
nothing got signed off just because it looked right. Someone
independent inspects it, every time, and the audit caught exactly the
faults my own eye had passed. Websites deserve the same suspicion.
The repo is public on my GitHub if you want to see the
working. Mistakes, fixes and commit history included.