Assemble the evidence pack an auditor would ask for

applied · 90 min · Objective 4.4

Task

Produce the artefacts an assessor actually samples, for an environment you control. The point is the lesson's central claim: evidence generated continuously is cheap, and evidence reconstructed at audit time is expensive and often impossible.

Steps

  1. Produce lab/audit/inventory.csv: every in-scope resource with its owner, its classification and its environment, generated by QUERY rather than typed by hand. Record the command that produced it.
  2. Produce lab/audit/access.md: who has access to what, how it was granted, and evidence of a review -- including at least one permission you removed as a result of looking.
  3. Produce lab/audit/change.md: for three sampled changes, the request, the review or approval, the automated check results, and what was deployed. Take these from real commit and pull-request history if you have it.
  4. Produce lab/audit/config.md: evidence that encryption is on, logging is enabled and retained, and no resource is publicly exposed -- each with the query that demonstrates it rather than a screenshot.
  5. Produce lab/audit/recovery.md: the restore test results from the domain 3 labs, with dates, measured durations and who signed them. Then write one page on which of these five you could NOT have reconstructed after the fact, and why.

Verify

for f in inventory access change config recovery; do test -s lab/audit/$f.* && echo "$f ok"; done
grep -Eci 'query|command|generated by' lab/audit/config.md
grep -Eci 'removed|revoked' lab/audit/access.md
grep -Ec '[0-9]{4}-[0-9]{2}-[0-9]{2}' lab/audit/recovery.md

All five artefacts, evidence produced by query rather than assertion, and dated restore results. The access review must record something actually removed -- a review that changes nothing has not been performed, only attended.

Notes

This is the applied lab for an objective with no short lab, and deliberately so: a twenty-minute exercise cannot be an audit of anything, while assembling the evidence pack is exactly what a candidate is expected to be able to do.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.