Survey a real space and map each gap to the control that closes it

short · 30 min · Objective 2.1

Task

Walk a space you are entitled to assess -- your own home office, a shared study area, a workplace with permission -- and produce a findings list where every observation names the layer it belongs to and the control that would address it. The exercise is the mapping: a control at one layer is not a substitute for one at another, and the exam's questions describe the gap between two layers.

Steps

  1. Write lab/physec/layers.csv with header layer,control_present,control_absent,what_it_would_stop covering site, building, room, rack or cabinet, and device.
  2. Record at least eight specific observations in lab/physec/findings.csv with header observation,layer,risk,control_that_closes_it.
  3. Write lab/physec/tailgating.md describing how someone would enter the space behind an authorised person, and which control -- structural or procedural -- would address it. Do not attempt it.
  4. Assess your own working position in lab/physec/desk.csv with header item,state,risk covering screen lock timeout, screen visibility from elsewhere, written credentials, documents left out and removable media.
  5. Write lab/physec/transit.md listing what you carry between places and, for each item, whether it is encrypted and what its loss would expose.

Verify

awk -F, 'NR>1 && NF>=4 {n++} END {print n" layer(s)"}' lab/physec/layers.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" finding(s)"}' lab/physec/findings.csv
awk -F, 'NR>1 {print $2}' lab/physec/findings.csv | sort -u | wc -l
awk -F, 'NR>1 && NF>=3 {n++} END {print n" desk item(s)"}' lab/physec/desk.csv
grep -Eic 'vestibule|turnstile|guard|challenge' lab/physec/tailgating.md
grep -Eic 'encrypt' lab/physec/transit.md

Five layers, eight findings spanning at least three distinct layers, five desk items, and a tailgating note naming a structural or procedural control. A findings list that sits entirely at one layer is a survey of one layer.

Notes

The desk assessment is the uncomfortable one and it is the one that changes behaviour. Most people find at least one written credential or one document that should not be face up.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.