Run the whole procedure against a scenario and defend clean against rebuild

applied · 50 min · Objective 2.2

Task

Take a written incident scenario, work the full procedure, and produce the decision -- clean, rebuild or escalate -- with the reasoning stated in the form a manager could act on. The decision is the applied skill; the scanning is the part anyone can do.

Steps

  1. Write lab/incident/scenario.md describing a plausible incident: what the user reports, what they did, what is on the machine, and what the machine has access to.
  2. Work the procedure and record it in lab/incident/log.csv with header time,action,finding,evidence_captured -- a contemporaneous log rather than a summary written afterwards.
  3. Write lab/incident/questions.md recording the three questions you asked the user and what each answer changed.
  4. Write lab/incident/decision.md giving clean, rebuild or escalate, with the specific findings that support it -- including whether you could establish how it arrived.
  5. Write lab/incident/credentials.md listing what has to change after this, in order, and what survives a password change.

Verify

grep -Ec '^[-*#0-9A-Za-z]' lab/incident/scenario.md
awk -F, 'NR>1 && NF>=4 {n++} END {print n" logged action(s)"}' lab/incident/log.csv
awk -F, 'NR>1 && $4!="" {n++} END {print n" action(s) with evidence"}' lab/incident/log.csv
grep -Ec '^[-*0-9]' lab/incident/questions.md
grep -Eic 'clean|rebuild|escalate' lab/incident/decision.md
grep -Eic 'session|token|grant|forward|rule' lab/incident/credentials.md

Six or more logged actions with evidence captured, three questions, a stated decision, and a credentials list naming the things that survive a password change. A decision with no mention of whether the route in was established is missing the clause that usually settles it.

Notes

The sentence worth being able to say: "I can clean this in an hour and I cannot tell you how it got in, or I can rebuild it in three and you will know it is clean." The decision belongs to whoever owns the risk; the trade-off is yours to state.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.