ronutz

Study guides

Study guides

Two ways to study here, and they answer different questions. Curated reading paths follow a technology rather than an exam: read the Learn library in teaching order, with the tools to practise on as you go. Certification study guides live on their own page and do the opposite - they start from a vendor's published exam blueprint and map it objective by objective.

Training series

Fundamentals in order, one level at a time. Each series is a set of modules; each module says what you will be able to do at its end, lists its articles in reading order and names the tools to practise on. Articles still being written are named in their places.

NetFun Network Fundamentals 2 series

Curated reading paths

A path is a syllabus with no exam behind it. Nothing here is organised around a certification blueprint or scored against one: the order is the order the subject makes sense in, chosen so each article earns the next. Read straight through, or stop when you have what you came for. The tools they link compute in your browser, and nothing is paywalled.

Choose by subject

Four families, and the paths in each. Each card below says what you will understand at the end and opens on the first article.

Vendor-agnostic

HTTP, told forward Medium · 14 articles

HTTP (the Hypertext Transfer Protocol) across its five versions - from the one-line GET of 1991 to HTTP/3 on QUIC - then the operational layer: forward and reverse proxies, HSTS (HTTP Strict Transport Security), and curl beyond the browser.

At the end: you will understand what each of HTTP's five versions changed, from the one-line GET of 1991 to HTTP/3 on QUIC, and how proxies, HSTS and curl sit on top of it in daily operation.

Start the path →

Modern identity, from the token up Medium · 8 articles

The open standards behind single sign-on, in dependency order: the JWT (JSON Web Token) itself, the signatures and JWKS (JSON Web Key Set) that make it verifiable, the OAuth 2.0 and PKCE (Proof Key for Code Exchange) flows that mint it, OIDC (OpenID Connect) on top, and TOTP/HOTP (time-based and HMAC-based one-time passwords) as the second factor.

At the end: you will understand how a login becomes a token, how a signature and a key set make that token verifiable, how OAuth 2.0 with PKCE and OIDC mint and carry it, and where a one-time password enters as the second factor.

Start the path →

Regular expressions, properly Short · 5 articles

The craft skill under log analysis and every parser: quantifiers and classes, groups and backreferences, anchors and boundaries, flags and modes - ending on catastrophic backtracking, the failure mode every production regex must avoid.

At the end: you will understand how a regular expression engine matches, from classes and quantifiers to groups, backreferences, anchors and flags, and how to recognise and avoid the catastrophic backtracking that takes production systems down.

Start the path →

TLS from zero Short · 6 articles

TLS (Transport Layer Security) from the cipher suite string upward: what each part of a suite name means, what TLS 1.3 removed and why, how hybrid post-quantum key exchange works, and how TLS 1.2, TLS 1.3, DTLS (Datagram TLS), and QUIC relate as one family.

At the end: you will understand what each part of a cipher suite name promises, what TLS 1.3 removed and why, how hybrid post-quantum key exchange works, and how TLS 1.2, TLS 1.3, DTLS and QUIC belong to one family.

Start the path →

F5

F5 BIG-IP end to end Deep · 63 articles

Everything the retired 101, 201, 301A, and 301B blueprints listed, as this site's articles in teaching order: the networking fundamentals the modern track assumes (OSI (Open Systems Interconnection) to VPN (virtual private network)), the full administration arc from interfaces to high availability to the support workflows the new exams dropped, and the LTM (Local Traffic Manager) specialist craft - iRules, analytics, captures, SSL (Secure Sockets Layer) - closing with the two articles that compare the retired blueprints against the current ones.

At the end: you will understand how a BIG-IP carries, secures and reports on application traffic, from the networking floor it assumes through administration and high availability to the LTM craft of iRules, analytics and captures, and how the retired blueprints relate to the current ones.

Start the path →

Extreme Networks

Extreme fabric and the two operating systems Short · 7 articles

ExtremeXOS for the configuration model, then why VOSS feels so different (it came from another company entirely), then Fabric Connect built up from IS-IS through I-SIDs to the resilience features.

At the end: you will understand the ExtremeXOS configuration model, why VOSS is a different operating system from a different company, and how Fabric Connect is built from IS-IS through I-SIDs to its resilience features.

Start the path →

Fortinet

Fortinet beyond the single firewall Short · 5 articles

What shows up once a FortiGate is not alone: inspection choices, the branch overlay, cloud integration, the SOC, and the operational technology edge.

At the end: you will understand what changes once a FortiGate is not alone: the inspection choices, the branch overlay, the cloud integration, the SOC and the operational technology edge.

Start the path →

Netskope

Netskope SASE, End to End Medium · 11 articles

The whole platform in reading order: architecture and NewEdge, every steering method, the client, TLS decryption, the two protection paths, CCI-driven policy, Private Access, Cloud Firewall, and the analytics layer - with the PAC and SAML tools to practice on. Built to walk the accreditation and certification domains from this site.

At the end: you will understand the Netskope platform in reading order: NewEdge and the architecture, every steering method and the client, TLS decryption, the inline and API protection paths, CCI-driven policy, Private Access, Cloud Firewall and the analytics layer.

Start the path →

Ping Identity and ForgeRock

PingFederate administration, end to end Deep · 16 articles

The blueprint's assumed fundamentals first - the directory model and the Kerberos ticket machinery - then the ten product articles in teaching order, SCIM beside the provisioning stop, and the SSO flows to close. The reading spine behind the PFP-001 certification guide.

At the end: you will understand the directory and Kerberos fundamentals the product assumes, then PingFederate itself in teaching order, provisioning with SCIM beside it, and the SSO flows that close the PFP-001 blueprint.

Start the path →

The Ping Identity Platform Deep · 15 articles

The whole Ping estate in reading order: the PingOne platform map and the ForgeRock lineage first, so every product name resolves; then PingAccess policy, the PingDirectory data platform, and DaVinci orchestration; closing with the PingFederate shelf - the self-managed federation core - in its established teaching order. The companion walk to the Certified Professional guides on the certifications hub.

At the end: you will understand how the Ping estate fits together, from the PingOne map and the ForgeRock lineage that explains the product names to PingAccess policy, the PingDirectory data platform, DaVinci orchestration and the PingFederate core.

Start the path →

Zscaler

Zscaler Zero Trust Exchange Deep · 31 articles

From tunnels and fundamentals to the full policy brain: forwarding, firewall order, TLS inspection, web and file controls, DLP, CASB, and ZPA's segments, policy, and posture - with the three native tools to practice on.

At the end: you will understand how traffic reaches the Zero Trust Exchange and how its policy brain is ordered: forwarding, firewall, TLS inspection, web and file controls, DLP and CASB, and ZPA's segments, policy and posture.

Start the path →

Check Point

Check Point security administration Medium · 14 articles

The platform in the order the CCSA teaches it: the three-tier split first, because nothing else makes sense until you know the management server and the gateway are different machines with different jobs, then the rule base, then the layer semantics that catch everyone.

At the end: you will understand the three-tier split of management server, gateway and console, the rule base built on it, and the layer semantics that decide which rule fires, in the order the CCSA teaches them.

Start the path →

NGINX

NGINX, from configuration to cache Short · 6 articles

In the order the confusions actually arrive: the configuration tree, then which location block wins, then what path the backend receives, then what gets cached and served to whom.

At the end: you will understand how NGINX reads its configuration tree, which location block wins, what path the backend receives, and what is cached and served to whom.

Start the path →

Certification study guides

These are the exam-shaped ones, and they live on the certifications page. Each follows a vendor's own published blueprint objective by objective, tying every objective to the articles that teach it, the tools that exercise it, and the manual pages that remain the source of truth.

All certifications and guides →