YanoSec
Progress0 of 152 lessons complete

Course / 12 Testing / Lesson 08 of 11

Where Active Directory practice stays

Estimated time: 16 min reading · 16 min activity

A VPN, virtual private network, provides a connection to another network. It can make several hosts reachable, including systems assigned to other learners. Reachability means a route exists; authorization states whether you may perform a particular action on a particular target.

The required path uses an original fictional scope card and sanitized session note. Sanitized means sensitive details have been removed or replaced. No domain setup, VPN client, account or live machine is required. Any later platform room needs its own current assignment and rules.

Before you begin

Estimated time
16 min reading, 16 min activity. Setup and optional practice may take longer.
Where you work
Use only the supplied North Desk fictional cards and source in a desktop or mobile browser. Keep predictions in private notes. No login attempt, recovery tool, framework module, permission change, domain setup or target connection is required. Optional later lab setup has a separate budget.
Without a lab
All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.

After this lesson you can:

  • Copy the assigned host and one excluded host from the scope card.
  • Treat a VPN list as reachability, not as permission.
  • Write an ungraded note that names the flow, the overbroad edge, and the excluded host.

01Example

Fresh hypothetical assignment comparison. The supplied vm-desk activity follows below.

Grant: read one assigned worksheet on lab-copper.invalid.
Network list also shows lab-silver.invalid.
Decision: only the named worksheet action is granted.
Neither a shared route nor a nearby name widens that scope.

02Assigned means named

An assignment must name target, allowed actions, time/window and stopping conditions. A platform may own infrastructure around the challenge that remains excluded. Do not infer permissions from technical connectivity or from actions a tool can perform.

The fictional session records reading ad-lab-scope.txt, with no connection, lookup, share open or ticket request. Its host labels illustrate an assignment; they are not runnable endpoints. If a later room is inaccessible or its assignment is unclear, stop at that gap rather than testing a neighboring host.

Use a lab’s named assignment and action limits instead of treating VPN reachability as permission.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Read the assigned copper worksheetUse nearby silver host
Named assignment

Grant: read one assigned worksheet on lab-copper.invalid.

met · lab-copper.invalid is the named host.
Read that worksheet

Decision: only the named worksheet action is granted.

met · Read one assigned worksheet.
Apply the stated rule
Matches grant

The host and read action both match the hypothetical assignment.

Reachability and neighboring names never expand an assignment; no connection occurs.

The host and read action both match the hypothetical assignment.

Follow the explanation

  1. The host and read action both match the hypothetical assignment.
  2. A shared route, neighboring name or VPN reachability does not widen scope.
Read every state and value

1. The host and read action both match the hypothetical assignment.

Case
copper
Conditions inspected
Named assignment · Read that worksheet
Decision shown
Yes

2. A shared route, neighboring name or VPN reachability does not widen scope.

Case
silver
Conditions inspected
Named assignment · Read that worksheet
Decision shown
Yes
Reachability and neighboring names never expand an assignment; no connection occurs.

03Mark the host that stays out

Read the scope and note together without resolving either hostname.

Assigned directory lab
Label: original fictional grant. No VPN was connected.

Assigned host: vm-desk-3.lab.invalid
Directory name on the card: club.lab.invalid
Allowed action: read this scope card and the printed session note.
Time: this reading.
Excluded: vm-other-9.lab.invalid and every other host a VPN list might show.
Stop: reachability is not a grant. No ticket request, no share listing, no password reset.

A platform room, if you use one later, must name its own host. This fictional card does not assign a live host.
Building a domain controller is not required and is not part of the grant.

Download the assigned-lab scope card

Sanitized session note
Label: original fictional note. Not a capture. No credential, ticket, or hash is in this note.

Assigned host: vm-desk-3.lab.invalid
Also visible on a VPN list: vm-other-9.lab.invalid
Action recorded: read ad-lab-scope.txt
Action not recorded: no connection, no name lookup, no share open, no ticket request.
Stop: vm-other-9 stays outside the grant.

Download the sanitized session note

  1. Copy vm-desk-3.lab.invalid as assigned and reading the scope/session card as the permitted action.
  2. Find vm-other-9.lab.invalid in the excluded list and note that its appearance on a VPN list would not change that exclusion.
  3. Write the activity result as a scope decision with no connection performed.
  4. Stop after the note. Do not request a ticket, open a share or substitute a reachable system.

04Directory case

For about fifteen minutes, combine the ticket/challenge distinction, share intersection and permission graph with the assignment card. Each line needs a source, supported interpretation and limit. This ungraded case practises directory reasoning without creating a domain.

Directory case
Label: ungraded synthesis. About fifteen minutes. No credential.

1. Name the printed flow that has a KDC and a service ticket.
2. Name edge E-4 and the job it exceeds.
3. Name the assigned host and one excluded host from the session note.
4. Say what a VPN list does not grant.
5. Stop: nothing was connected and nothing was reset.

The note is not graded.

Download the ungraded directory case

  1. Name the actor/message difference between K and N, keeping secret material out.
  2. Identify E-4’s excess relative to document read and retain the separate delegation concept.
  3. Record the assigned and excluded hosts and the current reading-only action.
  4. Stop with a private evidence note; no directory operation follows from completing it.

05Optional challenge

For about ten optional minutes, draft a checklist for a later platform room: exact assigned target, permitted techniques, time, exclusions, access/cost requirements and stop/cleanup. Leave those current external details unconfirmed rather than creating an account now.

06Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Assignment card A: fictional printed-only scopeOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Assigned host label: vm-cedar-6.lab.invalid.
Excluded host label: vm-birch-2.lab.invalid; every other host is also excluded.
Allowed action: read the printed directory worksheet and saved session note during this reading.
No lookup, connection, ticket request or share opening is allowed.
A VPN list happens to show both host labels. It supplies no additional grant.

Evidence card B: independent synthesis packetOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

B1 flow: client gets a TGT, asks the KDC for a service ticket, then presents it to Archive.
B2 graph: readers should read doc-4; edge Z8 additionally allows an administrator password reset.
B3 grant: worksheet reading only, assigned vm-willow-8.lab.invalid; neighboring host excluded.
No flow was executed, permission changed or host contacted.

07Explain the evidence and its limit

Optional self-check: write a sanitized source → conclusion → limit note for the ticket, graph and assignment cards.

Review it: distinguish DNS labels from directory roles, name only the permitted action, and avoid all credential bytes or invented connections.

08Common mistakes

If a visible VPN peer becomes a target, compare it with the grant’s named target list and stop at exclusion.

If building a domain seems required, return to the complete printed model; that setup is outside this activity.

If the sanitized note is called a capture, preserve its source as original fiction with no connection performed.

References