jperezduerto.info
Security in depth · Unit 19 · Lesson 8 of 8
Revocation is a defined behavior
Use a retirement timeline to distinguish blocked new sign-ins from continuing application sessions.
Helpful before thisInitial access and credentials
After this lesson you can
- Evaluate whether the supplied retirement evidence meets a stated access-stop deadline.
One idea. One situation. One reasoned decision.
How it works
Retiring a credential involves more than deleting an entry from an inventory. Determine which services accept it, how caches and active sessions behave, and how replacement work continues. Short expiration can limit some exposure but does not guarantee immediate revocation everywhere. Test the expected denial using approved synthetic identities and document the time and scope in which retirement becomes effective.
Read the supplied record
The fictional owner requires this account to lose both new sign-in and existing application access by 09:10 UTC. Clocks and identity references in these supplied records are already correlated.
| Time | Recorded observation |
|---|---|
| 09:00 | Identity service marks account disabled |
| 09:05 | New sign-in denied |
| 09:12 | Existing application session receives a protected report |
The application’s documented design checks that session’s expiry at 09:30 but does not consult account status for these requests. The packet therefore demonstrates a missed retirement requirement for the observed session. It does not demonstrate a failure to disable new sign-ins or establish every other application’s behavior.
Assign the session-lifecycle gap to the application and identity owners. Their plan needs a defined invalidation or other access-stop mechanism that meets the requirement, plus evidence under the relevant session context. Removing the credential’s inventory row or waiting for the later expiry would not prove timely completion. If the deadline changes, record that as an explicit owner decision, not a reinterpretation of these results.
The key distinction: Revocation semantics vary across identity and application layers.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Does the supplied packet establish that the 09:10 retirement requirement was met?
Show the answer
Correct answer: No; new sign-ins were denied, but an existing application session still received access after the deadline. Report the two boundaries separately and keep application-session retirement open for correction and verification.
Try it
- WriteWrite separate status lines for new sign-ins and existing sessions. Cite times, state the missed requirement, and identify the owner of the remaining acceptance evidence.