STATUS: STAGED — NOT YET AVAILABLE TO ACTIVE STUDENTS.
This lab becomes available when your instructor announces that CyDeploy
Community Edition has been installed in the lab environment.
Your pod gateway contains a rule that lets the pod LAN reach anything, anywhere.
ACS Network Security has approved a change to replace it with rules that permit
only the communication the environment actually needs, ending in an explicit
default deny.
The trap is obvious once you have done it in production: tighten a firewall
without knowing what depends on it and you break authentication, name
resolution, and policy delivery for everyone behind it.
Your job is to let discovered system and dependency information drive the network
change — then prove the required communication still works afterwards.
By the end of this lab you will be able to:
| System | Where | What you use it for |
|---|---|---|
PODXX-SRV (via Guacamole) |
Your Guacamole connection list | Reading lab documents and recording your response |
PXX-GW (pfSense) |
10.51.<pod number>.1 |
Applying the approved firewall change |
| CyDeploy Community Edition | As installed by your instructor | Discovering systems and dependencies in your pod |
| Your pod artifact folder | C:\CyberLab\PodXX\SC-Artifacts\CyDeploy\ |
Change request, matrix, worksheets, and your response file |
Work on your pod and your pod gateway only. Never touch another pod's
gateway, the shared domain controllers, or the management network. Discovery must
be scoped to your pod.
C:\CyberLab\PodXX\SC-Artifacts\CyDeploy\.PXX_Firewall_Scenario.txt and PXX_Firewall_Change_Request.docx. NotePXX_Required_Communication_Matrix.csv. Every path is listed with aPXX_Dependency_Worksheet.docx:
PXX-GW) as you did in the core SC labs.PXX_Change_Validation_Report.docx with the rules you changed, yourStudentResponses\SC-M5-L1.json in Notepad and fill in:
analyst — your student nameoverly_broad_rule — the rule you removedrequired_paths — the PathId values you kept, e.g. ["PATH-01", ...]unnecessary_paths — the PathId values you removeddependency_source — how you determined the dependencieschange_applied — "yes" once the change is on the gatewayconnectivity_validated — "yes" once you have re-testeddetermination — PASS or FAILevidence — what your tests showedcompleted — trueIf you lock yourself out of your own pod, that is a finding about your change
— record what happened, restore the previous rule set from the gateway
configuration history, and work out which dependency you missed.
| Evidence | File |
|---|---|
| Completed dependency worksheet | PXX_Dependency_Worksheet.docx |
| Completed validation report | PXX_Change_Validation_Report.docx |
| Completed response file | StudentResponses\SC-M5-L1.json |
| Gateway rule set | The applied change on PXX-GW |
Verification is automatic. You do not run anything yourself, and you do not need
access to AWX.
SC-M5-L1.json response file, and leave yourI lost connectivity to my pod after applying the change.
Restore the previous rule set from the gateway configuration history, then
re-check your dependency worksheet: you removed something the pod needs. Note
this in your validation report — it is part of the lesson, not a failure to hide.
Logon or Group Policy stopped working, but name resolution is fine.
Compare your applied rules against the required communication matrix path by
path. Authentication and policy delivery each need their own path.
A path I removed still seems to work.
Check rule order. A pass rule above your deny still matches first.
The permissive rule is not present on my gateway.
Tell your instructor — the gateway condition for this lab has not been staged for
your pod. Do not create the rule yourself.
The tracker says the permissive rule is still present.
The rule is still in your gateway configuration. Remove it (do not just disable a
copy) and re-check the rule list.
The tracker says a path must be retained / must be removed.
Your classification of that path does not match the business requirement in the
matrix. Re-read the purpose column for that path.
I cannot edit the JSON file.
Open it with Notepad. required_paths and unnecessary_paths are lists — keep
the square brackets and quote each PathId.