Shrink an implicit trust zone and measure the difference

applied · 80 min · Objective 1.2

Task

Measure what one of your lab VMs can reach, then apply a host firewall policy that permits only the flows you can justify, and measure again. The difference between the two measurements is the implicit trust zone you removed.

Steps

  1. From the Linux VM, record what the Windows VM currently exposes to it. Use a gentle sweep of the machine you built — for example nmap -Pn --top-ports 100 10.99.0.20 -oN /tmp/before.txt. Every target here is a VM you built yourself on the lab network you own.
  2. List each open port and write, beside it, the business reason it should be reachable from this specific source. Most will have none.
  3. On the Windows VM, set the inbound policy to block by default and add explicit rules only for the flows you justified: Set-NetFirewallProfile -Profile Domain,Private -DefaultInboundAction Block and New-NetFirewallRule for each permitted flow.
  4. Re-run the same sweep to /tmp/after.txt.
  5. Do the reverse direction too: restrict what the Linux VM may initiate outbound to the Windows VM, so the trust is not one-way by accident.
  6. Write /tmp/trustzone.md recording the before and after counts, the flows you kept, and the justification for each.

Verify

grep -c '^[0-9]*/tcp *open' /tmp/before.txt
grep -c '^[0-9]*/tcp *open' /tmp/after.txt
python3 -c "
b=len([l for l in open('/tmp/before.txt') if '/tcp' in l and 'open' in l])
a=len([l for l in open('/tmp/after.txt') if '/tcp' in l and 'open' in l])
print('reduced from',b,'to',a); assert a<b, 'the trust zone did not shrink'"
grep -c . /tmp/trustzone.md

The Python line is the verification: it asserts the second count is genuinely lower than the first, so the lab cannot be passed by running two sweeps and declaring success. If it fails, the policy was not applied to the profile the VM is actually on — check Get-NetConnectionProfile.

Notes

What you have measured is the implicit trust zone from the lesson: everything reachable once a subject is inside. The number you started with is the reason microsegmentation exists, and the number you finished with is what 'threat scope reduction' means when it is a configuration rather than a phrase.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.