Home labs & practical projects

Design compensating controls for an unpatchable service

A project to do with your own tools, with guidance on what to create and capture.

Design project Suggested time: 2–3 hoursNo hardware required for the design

What you could create

A legacy service cannot be patched before a critical business deadline. Technical leadership must limit exposure while arranging a durable replacement.

Example evidence format

Project evidence map (example)

Interim architecture and validation planScope and inputs

Technical risk exception with exit criteriaDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Interim architecture and validation plan	Show the inputs, scope and decisions behind this record. Compensating controls address the actual exposure path.
Technical risk exception with exit criteria	Include the evidence supporting your conclusion. The exception is time-bound and does not become an undocumented permanent design.

What you'll need

Document, spreadsheet or diagram tool

Define the service dependencies, data classification and known weakness at a conceptual level. Include an availability constraint and a replacement date.

Project record

Keep the working files for interim architecture and validation plan and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.

The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.

Suggested milestones

1
Plan and investigate
Map the exposure paths and evaluate isolation, access and monitoring options.
2
Develop your approach
Choose a technically feasible interim design with failure modes.
3
Verify and explain
Define validation, rollback and the conditions that end the exception.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Interim architecture and validation plan
Show the inputs, scope and decisions behind this record. Compensating controls address the actual exposure path.
2
Technical risk exception with exit criteria
Include the evidence supporting your conclusion. The exception is time-bound and does not become an undocumented permanent design.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your interim architecture and validation plan needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

CompTIA CertMaster Learn CASP+ (now SecurityX CAS-005)

Check relevance, platform versions and current access terms.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Define the service dependencies, data classification and known weakness at a conceptual level. Include an availability constraint and a replacement date.

What a good result looks like

Compensating controls address the actual exposure path.
The exception is time-bound and does not become an undocumented permanent design.

Finish the project

Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.