Format

• written questions
• practical configuration task
• review of a risky Ubuntu scenario
• short operations and security assessment

Notes

Work without production systems. Document assumptions. If a tool is missing locally, use static review rules and record the boundary of the evidence.

Questions

Question 01

Explain how you classify Ubuntu release and support status. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 02

Explain how you operate shell, filesystem and processes safely. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 03

Explain how you review users, groups and sudo. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 04

Explain how you evaluate permissions, ACLs and umask. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 05

Explain how you analyze APT sources and package status. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 06

Explain how you classify Snap packages and confinement. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 07

Explain how you write systemd units and timers. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 08

Explain how you evaluate journald logs. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 09

Explain how you review Netplan configuration. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 10

Explain how you model UFW rules. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 11

Explain how you review SSH baseline and access controls. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 12

Explain how you explain storage, fstab and LVM. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 13

Explain how you plan backups and restore tests. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 14

Explain how you use cloud-init for first-boot configuration. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 15

Explain how you document server baselines and roles. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 16

Explain how you control unattended-upgrades. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 17

Explain how you create monitoring and performance baselines. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 18

Explain how you classify AppArmor profiles and status. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 19

Explain how you use auditd and AIDE for security evidence. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 20

Explain how you classify Ubuntu Pro, ESM and USG. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 21

Explain how you evaluate CIS and DISA-STIG hardening. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 22

Explain how you run incident response for compromised accounts. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 23

Explain how you classify Ubuntu release and support status. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 24

Explain how you operate shell, filesystem and processes safely. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 25

Explain how you review users, groups and sudo. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 26

Explain how you evaluate permissions, ACLs and umask. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 27

Explain how you analyze APT sources and package status. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 28

Explain how you classify Snap packages and confinement. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 29

Explain how you write systemd units and timers. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 30

Explain how you evaluate journald logs. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 31

Explain how you review Netplan configuration. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 32

Explain how you model UFW rules. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 33

Explain how you review SSH baseline and access controls. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 34

Explain how you explain storage, fstab and LVM. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 35

Explain how you plan backups and restore tests. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 36

Explain how you use cloud-init for first-boot configuration. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 37

Explain how you document server baselines and roles. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 38

Explain how you control unattended-upgrades. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 39

Explain how you create monitoring and performance baselines. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 40

Explain how you classify AppArmor profiles and status. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 41

Explain how you use auditd and AIDE for security evidence. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 42

Explain how you classify Ubuntu Pro, ESM and USG. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 43

Explain how you evaluate CIS and DISA-STIG hardening. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 44

Explain how you run incident response for compromised accounts. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 45

Explain how you classify Ubuntu release and support status. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 46

Explain how you operate shell, filesystem and processes safely. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 47

Explain how you review users, groups and sudo. Name at least one command, one error case, one status or log evidence item and one security risk.

Question 48

Explain how you evaluate permissions, ACLs and umask. Name at least one command, one error case, one status or log evidence item and one security risk.

Practical Task

Create a local server baseline with systemd unit, Netplan sample, UFW rule model, unattended-upgrades configuration and incident runbook. Check everything with a local run.sh.

Review Checklist for Advanced Security

• 01. check release and support status: Record the affected host, package, service, configuration and risk.
• 02. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 03. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 04. document network assumption: Record the affected host, package, service, configuration and risk.
• 05. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 06. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 07. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 08. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 09. mark security baseline: Record the affected host, package, service, configuration and risk.
• 10. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 11. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 12. write team rule: Record the affected host, package, service, configuration and risk.
• 13. check release and support status: Record the affected host, package, service, configuration and risk.
• 14. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 15. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 16. document network assumption: Record the affected host, package, service, configuration and risk.
• 17. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 18. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 19. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 20. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 21. mark security baseline: Record the affected host, package, service, configuration and risk.
• 22. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 23. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 24. write team rule: Record the affected host, package, service, configuration and risk.
• 25. check release and support status: Record the affected host, package, service, configuration and risk.
• 26. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 27. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 28. document network assumption: Record the affected host, package, service, configuration and risk.
• 29. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 30. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 31. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 32. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 33. mark security baseline: Record the affected host, package, service, configuration and risk.
• 34. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 35. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 36. write team rule: Record the affected host, package, service, configuration and risk.
• 37. check release and support status: Record the affected host, package, service, configuration and risk.
• 38. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 39. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 40. document network assumption: Record the affected host, package, service, configuration and risk.
• 41. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 42. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 43. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 44. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 45. mark security baseline: Record the affected host, package, service, configuration and risk.

Practice Appendix: Advanced Security

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with sample configuration, shell commands and a Git repository.

A001. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A002. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A003. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A004. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A005. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A006. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A007. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A008. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A009. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A010. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A011. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A012. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A013. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A014. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A015. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A016. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A017. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A018. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A019. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A020. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A021. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A022. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A023. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A024. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A025. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A026. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A027. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A028. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A029. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A030. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A031. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A032. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A033. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A034. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A035. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A036. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A037. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A038. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A039. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A040. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A041. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A042. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A043. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A044. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A045. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A046. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A047. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A048. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A049. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A050. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A051. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A052. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A053. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A054. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A055. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A056. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A057. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A058. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A059. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A060. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A061. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A062. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A063. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A064. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A065. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A066. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A067. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A068. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A069. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A070. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A071. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A072. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A073. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A074. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A075. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A076. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A077. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A078. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A079. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A080. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.