Domain 2 capstone: prove every boundary by attempting its denies

capstone · 150 min · Objective 2.7

Task

Assemble every boundary this domain built and demonstrate each one refusing what it is supposed to refuse -- then record the result as evidence with an age, because a boundary proven six months ago is a historical fact.

Steps

  1. Write lab/boundary-register.csv with header boundary,claim,test_command,expected,observed,tested_on listing every boundary: guardrail, data perimeter, segmentation, zone egress, admission policy, key separation, federation scope, session revocation.
  2. For each, write a test that ATTEMPTS THE DENIED ACTION and record what actually happened. Every row must have a real observed value, not a prediction.
  3. Find at least one boundary whose test does NOT produce the expected refusal -- there will be one -- and fix it, then re-test.
  4. Enumerate from the platform rather than from the design: list every resource policy, trust relationship and egress route by API, compare against lab/boundary-register.csv, and record the difference in lab/boundary-drift.csv.
  5. Write lab/boundary-runner.sh that executes every test in sequence and exits non-zero if any boundary fails to refuse. Run it, then break one boundary deliberately and run it again to confirm it goes non-zero.
  6. Write lab/boundary-evidence.md recording the date of the run and the age at which you would consider the evidence stale.

Verify

awk -F, 'NR>1 {n++} END {print n" boundary(ies)"}' lab/boundary-register.csv
awk -F, 'NR>1 && $5=="" {n++} END {print n+0" untested"}' lab/boundary-register.csv
awk -F, 'NR>1 {n++} END {print n" drift row(s)"}' lab/boundary-drift.csv
sh lab/boundary-runner.sh; echo "all-boundaries exit=$?"
grep -Ec '[0-9]{4}' lab/boundary-evidence.md

Six or more boundaries, ZERO untested, the drift comparison run, the runner exiting 0 when everything holds and non-zero when one is broken, and a date in the evidence file. A boundary that has never been observed refusing anything has never been observed working -- which is this domain's whole argument, and this file is the only thing that discharges it.

Notes

Keep lab/boundary-runner.sh and run it after any architecture change. It is the single most reusable artefact in this course: it converts every boundary claim in domain 2 from a drawing into something with a timestamp and an exit code.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.