IT Fundamentals Capstone
Understand estate audit, control testing, evidence pack and test the resulting controls with reproducible evidence.
Brief
Northwind Freight needs defensible evidence for it fundamentals capstone, not a vocabulary quiz. Start with the system boundary and trace how a technical state changes the confidentiality, integrity or availability of the service. A passing document is not a passing running system.
You will examine estate audit, control testing, evidence pack, then make short incident decisions and author a testable specification. Keep desired state, observed state and evidence separate: an approved requirement tells you what should happen, while a dated observation tells you what actually happened.
Never convert missing evidence into a passing control result.
Reconcile the estate before rating controls
Northwind Freight lists twelve managed nodes, but the collection export contains only eleven unique identifiers. Duplicate rows cannot close that gap. Reconcile hardware inventory, directory devices and service ownership, then classify unmatched nodes as unresolved rather than assuming absent evidence means an absent asset.
Build a control matrix across boot integrity, runtime privilege, filesystem access, lifecycle, logging, patching and recovery. Each observation needs a scoped asset, source, timestamp and test procedure. A configuration template describes intent; only an observed state or execution test supports operating-effectiveness conclusions.
Scope completeness is itself an assurance control. Keep population queries and reconciliation exceptions; an auditor asks how the missing node affects every percentage in the report.
Follow attack paths across controls
A stale privileged account can modify service configuration, replace a writable executable and suppress local logs. Separate findings may share one attack path, so test both effective access and independent detection. Signature enforcement at boot does not stop an authorized but overprivileged user from deleting application data.
Use explicit time comparisons: departure to disablement, finding to remediation, event to ingestion and restore start to accepted recovery. Correct for measured clock offsets before asserting sequence. Combine immutable external logs with runtime versions and user-level permission tests rather than relying on an administrator screenshot.
Integrated controls need evidence that survives the failure of one component. An auditor asks whether the administrator being monitored can modify the purported independent record or every recovery copy.
Package claims, exceptions and recovery results
Create an evidence index mapping each control to its source, collection interval, population, test result and owner. Preserve original artefacts separately from analysis and record cryptographic digests in a protected manifest. A hash proves consistency with a reference, not that collection covered every device or that the initial statement was true.
A useful final report separates pass, fail and unknown. Assign remediation owners and due dates and record compensating controls for accepted exceptions. Demonstrate recovery using a bounded restore test: compare data age against RPO and end-to-end duration against RTO, including identity dependencies and application acceptance.
Audit readiness depends on reproducibility, not a green summary slide. An auditor should be able to select one asset, replay the evidence trail and understand the limits of every conclusion without asking the report author to reconstruct missing context.
This room is the track's final project. Every lab below is one step of a single deliverable - clear them all and the IT Fundamentals track is complete.
Locked: sign in and finish the track to unlock
Next on your path · Networking Fundamentals
Network Models and Encapsulation
Trace a request through two network models, calculate payload budgets, and choose evidence that actually supports a control claim.
Community
Discussion & writeups
Share how you approached the room or ask where you got stuck. Never paste task answers or full lab solutions: write the reasoning, not the key.
Loading discussion…