SQL Security Analyst Practice: 6 SQLite Cases, Database, Runnable Queries and Explained Answers

Run SQL against a supplied local database, then explain what the result actually establishes. A focused practice pack for cyber/IT learners who know basic SELECT and want small, inspectable security-data exercises with executable solutions.

ONE ZIP - 23 FILES, 27 PDF PAGES
- Practice Workbook PDF: 14 pages; six new cases, all raw table views, 36 tasks and deliberately flawed queries to critique.
- Explained Answers PDF: 13 pages with worked reasoning, exact results and a completed manual-to-query example.
- Practice.sqlite: ready-to-query SQLite database with 63 synthetic rows across eight tables.
- Twelve .sql solution files in queries/: a main and changed-request query for each case.
- run_query.py: Python standard-library runner using a read-only database connection.
- Dataset.json and Expected_Results.json: all raw rows and exact ordered solution outputs.
- Data_Dictionary.md and Practice_Responses.md: definitions, execution guidance and editable response space.
- START_HERE.txt, LICENSE.txt and REFERENCES.txt.

SIX CASES
Authentication time-window counts; inventory versus heartbeat coverage; tenant-aware audit-delivery deduplication; closed-ticket mean versus open-ticket age; known outbound bytes and missing values; domain-query allowlist matching with NULL pitfalls. Six recurring task types are applied to different evidence, not 36 different SQL topics. Small synthetic teaching data, not realistic-scale native logs or a live SIEM.

HOW IT WORKS
Predict the rows manually, write a saved .sql SELECT/CTE, run it, explain the logic, critique the flawed candidate and solve the variant. Compare against the exact output and explanations. All twelve included solution queries and the runner were executed against the delivered database and checked independently. No attack or account connection is required.

REQUIREMENTS AND TESTED COMPATIBILITY
Desktop Python 3.12+ with its standard-library sqlite3 module, PDF reader and plain-text editor. Tested on Windows using Python 3.12.14 and SQLite 3.53.1; other versions, operating systems and graphical clients were not tested. No pip dependencies or paid account. Example command after extracting the whole ZIP: python run_query.py queries/Q01_main.sql. Installation of Python is not included or performed by the download. SQLite syntax only: no SQL Server, PostgreSQL, MySQL or vendor SIEM compatibility promised. PDFs are static printable US Letter, not fillable. No Word/Excel file, formulas, hosted template or cloud copy link.

ORIGINALITY, DISCLOSURE AND LICENSE
Original HRW content; these cases, datasets and worksheets are new, not reused from our SOC packs or previous releases. General evidence, authority and verification principles recur. All supplied records and examples are fictional. AI-assisted content revised and tested for release. No vendor affiliation, accreditation, certification, compliance, employment or operational outcome guarantee.

One buyer may edit, print and reuse for personal learning and their own internal work. You may share your own original completed analysis with the fictional nature and supplied source acknowledged. Do not redistribute supplied evidence/database files, blank templates, query solutions, answer keys or model/example text; resell, sublicense or deliver templates as a client product. No copyright transfer. Follow approved local procedures for real work. Full license included.

Digital download only; no physical shipment. Download after Etsy confirms payment. Contact the shop about file-access problems.