Build the network in a hypervisor and prove the isolation actually isolates

applied · 90 min · Objective 2.2

Task

Build a two-segment network in virtual machines, put a guest segment behind a boundary, and then attempt the things the boundary is supposed to deny -- because a control observed only succeeding has been observed doing nothing in particular.

Steps

  1. Build two guests on an isolated virtual network with static addresses in a private range, and record their configuration in lab/isolate/hosts.csv with header host,address,mask,gateway.
  2. CAPTURE A BASELINE SUCCESS FIRST: prove the two guests can reach each other, and record the successful output in lab/isolate/baseline-success.txt. Without this, a later refusal could mean the operation never worked at all.
  3. Apply a host firewall rule on one guest denying traffic from the other, and record the rule in lab/isolate/rule.txt.
  4. Attempt the same reachability test and record the refusal, with its exact output and elapsed time, in lab/isolate/denied.txt.
  5. Remove the rule, re-prove the baseline, and record the restoration in lab/isolate/restored.txt -- so the file set contains success, denial and success again.

Verify

awk -F, 'NR>1 && NF>=4 {n++} END {print n" host(s) configured"}' lab/isolate/hosts.csv
grep -c . lab/isolate/baseline-success.txt
grep -c . lab/isolate/rule.txt
grep -c . lab/isolate/denied.txt
grep -c . lab/isolate/restored.txt

All five files non-empty, with the success file recorded BEFORE the denial file. The evidence this lab produces is the sequence success, denial, success -- a denial on its own proves only that something did not work.

Notes

The baseline-success step is the one people skip, and it is the one that makes the rest evidence. It is the same discipline every check in this repository is held to: prove the instrument can show both outcomes.

This is an independent study companion for CompTIA A+ Core 1 220-1201 and is not produced by or endorsed by CompTIA.