Revoke a session mid-flight, not just refuse the next one

applied · 65 min · Objective 2.7

Task

Apply objective 2.7: demonstrate the capability most implementations lack -- terminating an existing session when a signal changes, rather than only declining a new authentication.

Steps

  1. Authenticate a test user and confirm access. Record the session lifetime in lab/session.md.
  2. Disable the account and, WITHOUT re-authenticating, attempt to use the existing session. Record how long access persisted in lab/session-persistence.txt.
  3. Configure continuous evaluation or a shorter lifetime so revocation takes effect, and repeat. Record the new persistence.
  4. Trigger a posture change instead of a disablement -- mark the device non-compliant -- and record whether the existing session was downgraded, terminated or unaffected.
  5. Write lab/session-note.md giving the session lifetime you would set for each sensitivity tier from your classification table, with the reasoning.

Verify

grep -Ec '[0-9]+' lab/session-persistence.txt
grep -Eci 'terminated|revoked|downgraded|unaffected' lab/session-persistence.txt
awk 'END {print NR" line(s) of reasoning"}' lab/session-note.md
grep -Eci 'restricted|confidential|internal|tier' lab/session-note.md

Persistence measured BEFORE and AFTER, the posture outcome recorded, and lifetimes tied to the classification tiers. The ability to revoke an existing session rather than only refuse a new one is the capability that matters during an incident.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.