Chapter 17 — Contained laboratory II
Lesson map
Lesson 17 published. Map, example, EX065.
flowchart TD
N0["Learning outcomes"]
N1["17.1 The scenario"]
N2["17.2 Steps"]
N3["17.3 Report"]
N4["17.4 Timing"]
N5["17.5 Lab safety"]
N6["17.6 Lessons"]
N7["Debrief"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX065"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 The scenario"]
N2["17.2 Steps"]
N3["17.3 Report"]
N4["17.4 Timing"]
N5["17.5 Lab safety"]
N6["17.6 Lessons"]
N7["Debrief"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX065"]
[Learning outcomes]
|
v
[17.1 The scenario]
|
v
[17.2 Steps]
|
v
[17.3 Report]
|
v
[17.4 Timing]
|
v
[17.5 Lab safety]
|
v
[17.6 Lessons]
|
v
[Debrief]
|
v
[Worked example] --> [Exercise EX065]
Learning outcomes
You will (1) rehearse a full plugin advisory response in a contained lab; (2) combine inventory, verification, logs and headers; (3) produce a short report.
17.1 The scenario
A synthetic high-severity advisory for resize-plugin is published. In the lab, Tomás uses the earlier scripts together on synthetic records. Choosing resize-plugin connects the rehearsal to the Ferncroft case and lets each earlier lab play its part. The advisory comparison, hash check, header check and log summary all run on the same synthetic records. Using existing scripts tests whether they work together, not only alone. Tomás runs the rehearsal on a timer to measure how long a full response takes.
17.2 Steps
Run the advisory comparison to find affected sites (ferncroft-books, high). Verify the fixed release's hash against the vendor manifest (official file MATCH; mirror file MISMATCH, rejected). Check headers on affected sites (ferncroft-books OK). Summarise logs for signs of problems (failed admin sign-ins from one address reaching REVIEW). Each step reuses a lab output unchanged, so results can be checked against the earlier chapters. The results agree with each lab's verified output, which shows the scripts combine without changing each other's behaviour. Any disagreement would have pointed to a bug in combining them.
17.3 Report
The lab report lists affected sites, verified files, configuration status, log observations and the update plan with due dates. For the rehearsal, the report lists ferncroft-books as affected (high), the official file as verified and the mirror file as rejected. It records headers as OK, the REVIEW line for 198.51.100.7, and the update due within 7 days. Grace later uses this report as the template for real advisory responses. The report fits on one page, with an appendix holding the raw outputs of all four scripts.
17.4 Timing
The rehearsal is timed: from advisory to complete plan in 35 minutes. Timing gives a baseline for later rehearsals and for real responses. The 35 minutes include finding the vendor's official hash, the step that took longest because the vendor's download page had moved. A month later, the contact-form advisory is handled with the same steps in under an hour, including real-style checks. Grace records the 35 minutes with the rehearsal scores, so the next rehearsal six months later can be compared against the same steps.
17.5 Lab safety
All data synthetic; no real sites contacted. The rehearsal combines four scripts but still reads only synthetic files. No vendor site, customer site or log server is contacted, so a mistake cannot affect anyone. The advisory, sites and addresses are invented, and documentation addresses such as 198.51.100.7 keep the log step safe for training material. The outputs are labelled as rehearsal results and stored with the lab scripts. Grace checks those labels herself before the report is used as a template.
17.6 Lessons
The rehearsal shows the log summary needs the site name in its output for multi-site use. The log lab was written for one site, so its output names addresses but not sites. When the rehearsal combines results across sites, a REVIEW line without a site name cannot be routed to the right ticket. Adding the site name is a small change with a clear test. The fix is tested with the same synthetic log well before the next rehearsal runs.
Debrief
After the rehearsal, Tomás and Grace discuss what went well and what slowed them. Finding the vendor's official hash took longest, because the vendor's download page moved. They add each major vendor's official release page to the procedure. They also agree to rerun the rehearsal every six months with new synthetic advisories, so new technicians practise before facing a real one. The debrief notes are filed with the lab report so the next rehearsal starts from them.
Scoring the rehearsal
Grace scores the rehearsal on completeness, accuracy and time, and records the scores for comparison.
Files kept
The lab scripts and synthetic inputs are stored together for reuse.
Worked example
Grace reviews the lab report and uses it as the template for real advisory responses. A month later, a real-style synthetic advisory for contact-form is handled with the same steps in under an hour.
Synthetic case. The lab is synthetic.
Errors and limits
Rehearsals cannot include every real-world complication.
Exercises
- EX065 — Steps. List the four lab steps. Rubric: 3 = compare, verify, headers, logs; 2 = three; 1 = one; 0 = none.
- EX066 — Rejected file. Which file was rejected and why? Rubric: 3 = mirror file; hash mismatch; 2 = partial; 1 = vague; 0 = none.
- EX067 — Timing. How long did the rehearsal take? Rubric: 3 = 35 minutes; 2 = partial; 1 = vague; 0 = none.
- EX068 — Lesson. What improvement did the rehearsal show? Rubric: 3 = site name in log output; 2 = partial; 1 = vague; 0 = none.
Synthesis
Rehearse the full response with the tools together.
Continue studying — chapter 17 of 18
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →