Decommission one asset completely, and prove nothing survived

applied · 70 min · Objective 1.4

Task

Apply objective 1.4: retire one lab asset through every artefact class it accumulated, and demonstrate that each is gone rather than asserting it.

Steps

  1. Before destroying anything, write lab/decom-inventory.md listing every artefact the asset holds: identities, credentials, certificates, DNS records, firewall or security group entries, backups and snapshots, monitoring and log forwarding, licences, CMDB record.
  2. Destroy the asset and remove each artefact, recording the command or action used for each in lab/decom-log.csv as artefact,action,evidence_command.
  3. Run each evidence_command and capture its output into lab/decom-evidence.txt -- the DNS lookup returning nothing, the identity absent from the directory listing, the rule absent from the policy export.
  4. Deliberately leave ONE artefact in place, then write lab/decom-gap.md describing what an attacker could do with it.
  5. Remove the last artefact and re-run the evidence commands.

Verify

grep -c . lab/decom-inventory.md
awk -F, 'NR>1 && NF>=3 {n++} END {print n" artefact(s) with evidence"}' lab/decom-log.csv
grep -c . lab/decom-evidence.txt
grep -Eci 'takeover|reuse|reallocat|impersonat' lab/decom-gap.md

Six or more artefact classes enumerated, an evidence command for each, and the gap note naming a concrete attack. If your inventory listed only the machine, re-read the lesson -- the machine is the easy half.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.