Measure what a local breakout removes

short · 45 min · Objective 2.6

Task

Compare what is inspected when traffic goes through a central egress point against what is inspected when it goes direct, using your own lab as both.

Steps

  1. With the client routed through the policy point, generate a set of requests and record what the policy point saw in lab/inspected-routed.csv as request,seen,action.
  2. Reconfigure the client for direct egress, repeat the identical requests, and record what the policy point saw in lab/inspected-direct.csv.
  3. Diff the two and write the specific controls lost in lab/breakout-loss.md -- filtering, data loss inspection, logging, reputation checks.
  4. Implement ONE compensating control at the endpoint and re-run, recording what it recovered.
  5. Write one paragraph on why full tunnelling is not automatically the safer answer, naming the behaviour it induces.

Verify

awk -F, 'NR>1 {n++} END {print n" routed request(s) seen"}' lab/inspected-routed.csv
awk -F, 'NR>1 {n++} END {print n" direct request(s) seen"}' lab/inspected-direct.csv
grep -Ec . lab/breakout-loss.md
grep -Eci 'disconnect|bypass|performance|users' lab/breakout-loss.md

The direct count LOWER than the routed count, the lost controls named, and the paragraph addressing the behaviour full tunnelling induces -- users disconnecting to work, which makes the strict option the less safe one.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.