Understand posix shell, exit handling, evidence collection and test the resulting controls with reproducible evidence.
45 min 150 XPSkills: POSIX shell, Exit handling, Evidence collection
Brief
Northwind Freight needs defensible evidence for command line and safe automation, not a vocabulary quiz. Start with the system boundary and trace how a technical state changes the confidentiality, integrity or availability of the service. A passing document is not a passing running system.
You will examine posix shell, exit handling, evidence collection, then make short incident decisions and author a testable specification. Keep desired state, observed state and evidence separate: an approved requirement tells you what should happen, while a dated observation tells you what actually happened.
Never convert missing evidence into a passing control result.
Paths and expansion
A POSIX shell parses command text, performs expansions and then launches commands. An absolute path starts at the root directory, whereas a relative path is interpreted from the current working directory. Establish the working directory explicitly in automation because scheduled execution may start somewhere different from an interactive session.
Quote parameter expansions when they represent one argument: an unquoted value may undergo field splitting and pathname expansion. A filename containing spaces or wildcard characters can then become several arguments or match unrelated files. Input is data, not code; avoid constructing shell text from untrusted filenames and evaluating it.
Safe automation supports evidence completeness and change integrity. Retain the script version, working directory and invocation parameters; an auditor asks whether special filenames could silently change the scope of a collection.
Paths and expansion requires both a declared boundary and independently testable observations.
Streams, pipes and statuses
Each process normally receives standard input and has separate standard output and standard error streams. A pipe connects one command output to another input, but errors do not automatically travel through the pipe. Output redirection can truncate an existing file before the command runs; append preserves existing bytes but does not prevent duplicate results.
A zero exit status conventionally signals success, while nonzero indicates a failure or other documented condition. In a basic POSIX pipeline, the visible status is normally that of the last command; an upstream collector can fail while a formatter succeeds. Do not assume a nonstandard pipeline option exists: collect to a temporary file, check status, then transform it.
Evidence controls require failure visibility. Keep error streams and explicit collection status separate from the output artefact; an auditor asks whether an empty report means no findings or a collector that never ran successfully.
Streams, pipes and statuses requires both a declared boundary and independently testable observations.
Reproducible scripts
A script should validate prerequisites before changing anything: required arguments, readable inputs, writable destinations and expected command availability. Use restrictive temporary-file creation and cleanup handlers so concurrent runs cannot overwrite each other. Reject missing input instead of interpreting it as an empty population and reporting a pass.
Make repeated runs safe by defining whether actions replace desired state or append an event. Record start and end timestamps and counts at every transformation; a filter that discards malformed lines must report rejections. A dry run is useful but cannot replace a post-change test of actual permissions and service health.
Automation assurance needs a controlled script version, execution identity and retained failed runs. An auditor asks how the system prevents a permission error from becoming a successful zero-findings report.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: Two streams
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A collector prints records normally but sends permission failures on its error stream. The formatter receives only the normal records. The lead calls both streams one complete audit feed.
Term bank, not all of these are right
stderrstdoutstdinpipe
1.1Which standard stream carries the errors? (one word)
1.2Which standard stream carries normal records? (one word)
Task 2: Success at the wrong stage
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
The collector exits with status 1. The last formatter exits with status 0, so the basic pipeline appears successful. The lead says both statuses mean successful collection.
Term bank, not all of these are right
012127
2.1Which status conventionally means success? (a number)
2.2Which status did the failing collector return? (a number)
Task 3: A filename is data
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A filename containing spaces becomes multiple arguments after expansion. The engineer tries adding more processors rather than preserving it as one argument. The collector also logs no completion status.
Term bank, not all of these are right
quotingexit statusparallelismstdout
3.1What shell practice preserves an expansion as one argument? (one word)
3.2What process result must be checked for failure? (two words)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Lab 1 · YAML lab
Build the command line and safe automation specification
The control owner calls the current summary complete because every field has a label. Several labels confuse a technical mechanism with assurance, and missing observations have been treated as passing.
Use the fixture as the authoritative requirement. Replace the empty fields with typed, testable values and identify the evidence needed to substantiate the claim. Do not copy the owner's optimistic summary.
Approved requirement and measured facts
Collector success is status 0. Any upstream failure must fail the job even if formatting succeeds. Preserve error output, input/output counts and execution identity.
The coordinator calls every line critical because it contains security terminology. The queue includes normal observations and verified changes as well as actual defects.
Use this exercise scale: active destructive compromise is critical; a confirmed unauthorized modification path is high; an isolated test coverage gap is medium; verified-state documentation hygiene is low. Informational verified observations are noise.
List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.
Observed events with scope and impact
IT4-1 ACTIVE: attacker-controlled account is currently deleting the sole posix shell evidence copy; stop ongoing destruction.
IT4-2 EXPOSED: unauthorized users can modify exit handling configuration; exploit path confirmed, no current exploitation.
IT4-3 LIMITED: one isolated test node lacks a required evidence collection observation; production unaffected.
IT4-4 HYGIENE: documentation heading for posix shell is stale, but measured state and coverage are verified.
IT4-5 A POSIX shell parses command text, performs expansions and then launches commands. Verified informational baseline observation, no gap.
IT4-6 Each process normally receives standard input and has separate standard output and standard error streams. Verified informational mechanism observation, no gap.
IT4-7 Scheduled collector heartbeat received within the approved window; no missed collection.
IT4-8 Approved maintenance completed with independent post-change evidence and no unresolved finding.
1
2
3
4
5
6
7
8
9
10
11
12
Checks
The right findings are raised
Benign lines are left out
Severity matches the actual exposure
Ranked worst first
Next on your path · IT Fundamentals
Identity and Authentication
Understand mfa factors, federation, identity lifecycle and test the resulting controls with reproducible evidence.
