Practise containment in the right order

short · 45 min · Objective 6.3

Task

Rehearse the response sequence on your own environment with a credential you created for the purpose. The ordering is the lesson -- contain before you investigate -- and the step people miss is invalidating sessions already established.

Steps

  1. Create a scratch identity with modest permissions and obtain a credential for it. Use it to establish an active session, and confirm the session can perform an action.
  2. Now treat it as compromised. Deactivate the credential -- do not delete it -- and record in lab/ir/contain.md why deletion would destroy evidence you need.
  3. With the credential deactivated, retry the action using the STILL-OPEN session. Record whether it still works. This is the step people miss.
  4. Invalidate active sessions for that identity and retry again. Record the result, and the elapsed time from your first containment action.
  5. List everything that credential could have read and would therefore need rotating. Record the list length, and write one sentence on why it is longer than the credential itself.

Verify

grep -Eci 'deactivat|disable' lab/ir/contain.md
grep -Eci 'session' lab/ir/contain.md
grep -Eci 'evidence' lab/ir/contain.md
grep -Eci 'rotat' lab/ir/contain.md

All four non-zero, and the file must record the session still working after the credential was deactivated. If it did not, the session was not established before containment and the most important observation was missed.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.