Format

• written questions
• practical configuration task
• review of a risky Ubuntu scenario
• short operations and security assessment

Expected Answer Profile

A good answer explains not only commands but supports release, package, service, network, storage and security decisions with concrete evidence.

Questions

Solution 01

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for classify Ubuntu release and support status.

Solution 02

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for operate shell, filesystem and processes safely.

Solution 03

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for review users, groups and sudo.

Solution 04

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for evaluate permissions, ACLs and umask.

Solution 05

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for analyze APT sources and package status.

Solution 06

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for classify Snap packages and confinement.

Solution 07

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for write systemd units and timers.

Solution 08

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for evaluate journald logs.

Solution 09

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for review Netplan configuration.

Solution 10

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for model UFW rules.

Solution 11

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for review SSH baseline and access controls.

Solution 12

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for explain storage, fstab and LVM.

Solution 13

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for plan backups and restore tests.

Solution 14

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for use cloud-init for first-boot configuration.

Solution 15

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for document server baselines and roles.

Solution 16

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for control unattended-upgrades.

Solution 17

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for create monitoring and performance baselines.

Solution 18

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for classify AppArmor profiles and status.

Solution 19

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for use auditd and AIDE for security evidence.

Solution 20

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for classify Ubuntu Pro, ESM and USG.

Solution 21

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for evaluate CIS and DISA-STIG hardening.

Solution 22

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for run incident response for compromised accounts.

Solution 23

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for classify Ubuntu release and support status.

Solution 24

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for operate shell, filesystem and processes safely.

Solution 25

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for review users, groups and sudo.

Solution 26

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for evaluate permissions, ACLs and umask.

Solution 27

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for analyze APT sources and package status.

Solution 28

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for classify Snap packages and confinement.

Solution 29

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for write systemd units and timers.

Solution 30

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for evaluate journald logs.

Solution 31

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for review Netplan configuration.

Solution 32

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for model UFW rules.

Solution 33

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for review SSH baseline and access controls.

Solution 34

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for explain storage, fstab and LVM.

Solution 35

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for plan backups and restore tests.

Solution 36

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for use cloud-init for first-boot configuration.

Solution 37

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for document server baselines and roles.

Solution 38

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for control unattended-upgrades.

Solution 39

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for create monitoring and performance baselines.

Solution 40

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for classify AppArmor profiles and status.

Solution 41

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for use auditd and AIDE for security evidence.

Solution 42

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for classify Ubuntu Pro, ESM and USG.

Solution 43

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for evaluate CIS and DISA-STIG hardening.

Solution 44

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for run incident response for compromised accounts.

Solution 45

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for classify Ubuntu release and support status.

Solution 46

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for operate shell, filesystem and processes safely.

Solution 47

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for review users, groups and sudo.

Solution 48

Expected: name host role, check configuration, explain operational impact, evaluate security risk and provide concrete evidence for evaluate permissions, ACLs and umask.

Practical Task

Create a local server baseline with systemd unit, Netplan sample, UFW rule model, unattended-upgrades configuration and incident runbook. Check everything with a local run.sh.

Review Checklist for Advanced Security

• 01. check release and support status: Record the affected host, package, service, configuration and risk.
• 02. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 03. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 04. document network assumption: Record the affected host, package, service, configuration and risk.
• 05. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 06. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 07. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 08. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 09. mark security baseline: Record the affected host, package, service, configuration and risk.
• 10. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 11. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 12. write team rule: Record the affected host, package, service, configuration and risk.
• 13. check release and support status: Record the affected host, package, service, configuration and risk.
• 14. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 15. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 16. document network assumption: Record the affected host, package, service, configuration and risk.
• 17. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 18. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 19. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 20. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 21. mark security baseline: Record the affected host, package, service, configuration and risk.
• 22. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 23. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 24. write team rule: Record the affected host, package, service, configuration and risk.
• 25. check release and support status: Record the affected host, package, service, configuration and risk.
• 26. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 27. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 28. document network assumption: Record the affected host, package, service, configuration and risk.
• 29. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 30. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 31. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 32. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 33. mark security baseline: Record the affected host, package, service, configuration and risk.
• 34. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 35. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 36. write team rule: Record the affected host, package, service, configuration and risk.
• 37. check release and support status: Record the affected host, package, service, configuration and risk.
• 38. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 39. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 40. document network assumption: Record the affected host, package, service, configuration and risk.
• 41. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 42. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 43. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 44. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 45. mark security baseline: Record the affected host, package, service, configuration and risk.

Practice Appendix: Advanced Security

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with sample configuration, shell commands and a Git repository.

A001. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A002. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A003. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A004. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A005. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A006. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A007. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A008. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A009. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A010. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A011. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A012. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A013. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A014. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A015. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A016. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A017. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A018. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A019. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A020. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A021. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A022. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A023. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A024. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A025. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A026. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A027. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A028. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A029. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A030. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A031. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A032. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A033. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A034. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A035. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A036. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A037. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A038. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A039. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A040. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A041. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A042. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A043. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A044. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A045. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A046. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A047. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A048. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A049. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A050. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A051. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A052. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A053. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A054. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A055. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A056. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A057. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A058. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A059. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A060. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A061. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A062. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A063. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A064. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A065. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A066. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A067. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A068. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A069. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A070. Review

• Task: name monitoring or alert rule and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A071. Operations

• Task: record rollback or recovery path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A072. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A073. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A074. Review

• Task: evaluate package and repository risk and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A075. Operations

• Task: explain service status and logs and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A076. Security

• Task: document network assumption and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A077. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A078. Review

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Review.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A079. Operations

• Task: describe storage and backup path and connect the observation explicitly to Operations.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A080. Security

• Task: record patch and reboot window and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.