Take one lab VM from default install to defended, and measure every step

capstone · 130 min · Objective 2.5

Task

Pull Domain 2 together on a single machine: establish what it exposes, what an attacker would find, what evidence each weakness leaves, and then close them in the order that matters — measuring the change after each one so the work is evidence rather than assertion.

Steps

  1. Revert the target VM to the clean snapshot, so the starting measurement is a real default install rather than the result of earlier labs.
  2. Baseline from the other VM you built: a gentle service sweep of 10.99.0.20, recorded to /tmp/cap-before.txt. Every address here is a VM you built on the lab network you own.
  3. Baseline on the host itself: listening sockets, enabled services, accounts with shell access, sudo rights, password policy, and whether the host firewall is active. Record to /tmp/host-before.txt.
  4. Generate evidence of three of this domain's indicators against the target, using only your own accounts: a spray across several usernames, a burst of failures against one, and a beacon loop like the one from the malware lab. Collect the resulting log lines.
  5. Now mitigate, ONE control at a time, in this order: default credentials and unused accounts; unnecessary services and ports; host firewall default-deny with justified exceptions; least privilege on sudo; and finally monitoring that would have alerted on each indicator you generated.
  6. After each control, re-measure and append the numbers to /tmp/progress.csv as step,open_ports,enabled_services,shell_accounts,sudoers,detections.
  7. Re-generate the three indicators and confirm your monitoring now reports all three, where at the start it reported none.
  8. Write /tmp/capstone.md: the before and after figures, which single control produced the largest reduction, which produced none, and which mitigation you would do first with only an hour available.

Verify

python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/progress.csv')))
assert len(rows)>=5, 'fewer than five measured steps'
first,last=rows[0],rows[-1]
for k in ('open_ports','enabled_services','sudoers'):
    b,a=int(first[k]),int(last[k])
    print('%-18s %s -> %s' % (k,b,a))
    assert a<=b, k+' increased'
assert int(last['open_ports'])<int(first['open_ports']), 'no ports were closed'
assert int(last['detections'])>=3, 'monitoring does not catch all three indicators'
assert int(first['detections'])==0, 'the baseline already detected something - re-measure from clean'
print('hardening measured across', len(rows), 'steps')
PY
grep -icE "largest reduction|no effect|first hour" /tmp/capstone.md

The assertions are the whole capstone. Ports must genuinely have closed; detections must go from zero at the baseline to at least three at the end; and nothing may have increased along the way. A run where detections starts non-zero means the baseline was not taken from the clean snapshot, which makes every later comparison meaningless.

Notes

The question in the last step — which single mitigation you would do first with an hour — is the one worth having an answer to. It is the question a real organisation asks, the exam asks it as 'what is the BEST first step', and after this exercise you will have a number behind your answer rather than an opinion.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.