Home labs & practical projects
Close a cross-project data access gap
A project to do with your own tools, with guidance on what to create and capture.
What you could create
An analytics project can read a sensitive dataset in a separate production project. The data owner cannot explain which identities have inherited access.
| Evidence | What to capture |
|---|---|
| Cross-project access map | Show the inputs, scope and decisions behind this record. Both inherited and direct permissions are represented. |
| Remediation and verification plan | Include the evidence supporting your conclusion. The analytics use case still has an explicit allowed path. |
What you'll need
Document, spreadsheet or diagram tool
Invent an organisation, two projects, three groups and a service account. Include one inherited role and one direct dataset grant.
Project record
Keep the working files for cross-project access map and record assumptions as you go.
Current reference material
Use the linked provider resources to verify the features, access terms and version relevant to your project.
Access & cost
No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.
The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.
Suggested milestones
- 1
Plan and investigate
Build an effective-access map from organisation to dataset.
- 2
Develop your approach
Propose scoped access, audit visibility and a controlled exception route.
- 3
Verify and explain
Define tests for intended analytics access and an unauthorised export attempt.
Useful resources
Use these resources to deepen your understanding and check key details.
Review the current provider requirements and relevant subject areas.
Check relevance, platform versions and current access terms.
Find relevant providers and check features, access requirements and costs.
A useful starting point
Invent an organisation, two projects, three groups and a service account. Include one inherited role and one direct dataset grant.
What a good result looks like
- Both inherited and direct permissions are represented.
- The analytics use case still has an explicit allowed path.
- The proposed export control states its limits and how it would be verified.
Finish the project
Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.
Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.