Stand up the four components and write the four documents

short · 90 min

Task

Build the smallest environment in which the rest of this course's exercises are possible, and create the paper artefacts that are half of what this exam assesses. Do this first: every later lab assumes both halves exist.

Steps

  1. Create the cloud account's budget alert and a hard spending cap BEFORE creating any resource, and record both threshold values in lab/budget.txt. This is the one control that cannot be applied retroactively to money already spent.
  2. Stand up the four components: an identity provider with two users and two groups, two network segments with a policy point between them, a log collector receiving from at least three sources, and one cloud account. Write each component's free-tier limit into lab/limits.txt as component,limit,units.
  3. Write lab/policy/information-security-policy.md (two pages, no technology named), lab/policy/standard-crypto.md and lab/policy/standard-logging.md (both naming versions and values), and one procedure in lab/policy/procedure-*.md.
  4. Write lab/risk-register.csv with header id,asset,threat,vulnerability,existing_control,impact,likelihood,owner,treatment,residual and ten rows describing YOUR lab, not an imaginary company.
  5. Write lab/cmdb.csv with header id,type,owner,classification,environment,lifecycle,source covering every asset in the lab -- including the ones with no hardware: each identity, key, DNS name and cloud account.
  6. Write lab/control-matrix.csv with header control,implemented,framework_a_clause,framework_b_clause,evidence and at least eight controls mapped against two frameworks.

Verify

test -s lab/budget.txt && echo "budget recorded"
awk -F, 'NR>1 && NF>=3 {n++} END {print n" limit(s) recorded"}' lab/limits.txt
ls lab/policy/*.md | wc -l
awk -F, 'NR>1 && NF>=10 {n++} END {print n" risk row(s)"}' lab/risk-register.csv
awk -F, 'NR>1 {print $2}' lab/cmdb.csv | sort -u | wc -l
awk -F, 'NR>1 && NF>=5 {n++} END {print n" mapped control(s)"}' lab/control-matrix.csv

Four or more policy documents, ten risk rows, at least four distinct asset types in the CMDB, and eight or more mapped controls. If the CMDB has only one type, you have listed machines and missed identities, keys and DNS names -- which is the gap the asset lesson is about.

Notes

Keep all of this in version control from the first commit. Watching a policy document acquire a commit history is the cheapest possible demonstration of why review cycles exist, and every later lab appends to these files rather than starting new ones.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.