Curriculum: Ubuntu
This curriculum structures an Ubuntu workshop from fundamentals to advanced server, platform and security operations. It combines Linux basics, Ubuntu-specific tools, practical exercises, review criteria and operational maturity.
Curriculum Goal
After the full series you can install, administer, patch, monitor, harden and recover Ubuntu systems. You understand release lifecycle, package management, systemd, networking, storage, security and incident response.
Teaching Model
The workshop follows a repeating cycle:
Understand -> Configure -> Check -> Automate -> Monitor -> Secure -> Recover
| Step | Goal | Typical Activity |
|---|---|---|
| Concept | understand role and system model | release, package source, service, network |
| Configuration | describe state | systemd unit, Netplan, UFW, cloud-init |
| Check | prove result | status, logs, syntax check, diff |
| Automation | make repeatable | timer, cloud-init, Ansible model |
| Operations | set up monitoring and backup | health checks, restore probe |
| Security | create hardening and evidence | SSH, sudo, AppArmor, auditd, USG |
Level Structure
| Level | Focus | Outcome |
|---|---|---|
| Fundamentals | Ubuntu-Grundlagen, Shell, Dateisystem, Benutzer, Rechte, Pakete, Prozesse, Dienste und Logs | You can explain, locally check and operationally review the included Ubuntu patterns. |
| Intermediate | systemd, APT, Snap, ACLs, Storage, Netplan, UFW, SSH, Timer und Troubleshooting | You can explain, locally check and operationally review the included Ubuntu patterns. |
| Professional | Server-Baseline, cloud-init, Automatisierung, Patch Management, Monitoring, Backup und Performance | You can explain, locally check and operationally review the included Ubuntu patterns. |
| Advanced Security | Threat Modeling, Ubuntu Pro, USG, CIS, SSH/sudo/PAM, AppArmor, auditd, AIDE und Incident Response | You can explain, locally check and operationally review the included Ubuntu patterns. |
Roles and Learning Paths
- Developers focus on shell, packages, logs, local services and container hosts.
- Administrators focus on users, storage, network, systemd, patch management and restore.
- Platform engineers focus on cloud-init, baselines, automation, monitoring and fleet operations.
- Security engineers focus on SSH/sudo, AppArmor, auditd, USG, CIS, AIDE and incident response.
Lab Strategy
All labs run locally without production changes. Each example writes only below work/, analyzes sample configuration and creates evidence files.
Assessment Rubric
| Criterion | Basic | Good | Excellent |
|---|---|---|---|
| Correctness | configuration is readable | status and logs are explainable | error and recovery path is documented |
| Security | no secrets in repo | users, ports and services are reviewed | audit, hardening and exceptions are traceable |
| Operations | manual execution possible | monitoring and backup exist | restore and rollback are practiced |
| Architecture | single host understood | role and baseline model clear | fleet and lifecycle decisions are reviewable |
Sources and References
Review Checklist for Curriculum
- 01. check release and support status: Record the affected host, package, service, configuration and risk.
- 02. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
- 03. explain service status and logs: Record the affected host, package, service, configuration and risk.
- 04. document network assumption: Record the affected host, package, service, configuration and risk.
- 05. review user and sudo rule: Record the affected host, package, service, configuration and risk.
- 06. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
- 07. describe storage and backup path: Record the affected host, package, service, configuration and risk.
- 08. record patch and reboot window: Record the affected host, package, service, configuration and risk.
- 09. mark security baseline: Record the affected host, package, service, configuration and risk.
- 10. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
- 11. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
- 12. write team rule: Record the affected host, package, service, configuration and risk.
- 13. check release and support status: Record the affected host, package, service, configuration and risk.
- 14. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
- 15. explain service status and logs: Record the affected host, package, service, configuration and risk.
- 16. document network assumption: Record the affected host, package, service, configuration and risk.
- 17. review user and sudo rule: Record the affected host, package, service, configuration and risk.
- 18. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
- 19. describe storage and backup path: Record the affected host, package, service, configuration and risk.
- 20. record patch and reboot window: Record the affected host, package, service, configuration and risk.
- 21. mark security baseline: Record the affected host, package, service, configuration and risk.
- 22. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
- 23. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
- 24. write team rule: Record the affected host, package, service, configuration and risk.
- 25. check release and support status: Record the affected host, package, service, configuration and risk.
- 26. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
- 27. explain service status and logs: Record the affected host, package, service, configuration and risk.
- 28. document network assumption: Record the affected host, package, service, configuration and risk.
- 29. review user and sudo rule: Record the affected host, package, service, configuration and risk.
- 30. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
- 31. describe storage and backup path: Record the affected host, package, service, configuration and risk.
- 32. record patch and reboot window: Record the affected host, package, service, configuration and risk.
- 33. mark security baseline: Record the affected host, package, service, configuration and risk.
- 34. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
- 35. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
- 36. write team rule: Record the affected host, package, service, configuration and risk.
- 37. check release and support status: Record the affected host, package, service, configuration and risk.
- 38. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
- 39. explain service status and logs: Record the affected host, package, service, configuration and risk.
- 40. document network assumption: Record the affected host, package, service, configuration and risk.
- 41. review user and sudo rule: Record the affected host, package, service, configuration and risk.
- 42. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
- 43. describe storage and backup path: Record the affected host, package, service, configuration and risk.
- 44. record patch and reboot window: Record the affected host, package, service, configuration and risk.
- 45. mark security baseline: Record the affected host, package, service, configuration and risk.
- 46. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
- 47. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
- 48. write team rule: Record the affected host, package, service, configuration and risk.
- 49. check release and support status: Record the affected host, package, service, configuration and risk.
- 50. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
- 51. explain service status and logs: Record the affected host, package, service, configuration and risk.
- 52. document network assumption: Record the affected host, package, service, configuration and risk.
- 53. review user and sudo rule: Record the affected host, package, service, configuration and risk.
- 54. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
- 55. describe storage and backup path: Record the affected host, package, service, configuration and risk.
- 56. record patch and reboot window: Record the affected host, package, service, configuration and risk.
- 57. mark security baseline: Record the affected host, package, service, configuration and risk.
- 58. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
- 59. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
- 60. write team rule: Record the affected host, package, service, configuration and risk.
- 61. check release and support status: Record the affected host, package, service, configuration and risk.
- 62. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
- 63. explain service status and logs: Record the affected host, package, service, configuration and risk.
- 64. document network assumption: Record the affected host, package, service, configuration and risk.
Practice Appendix: Curriculum
This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with sample configuration, shell commands and a Git repository.
A001. Ubuntu
- Task: check release and support status and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A002. APT
- Task: evaluate package and repository risk and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A003. systemd
- Task: explain service status and logs and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A004. Netplan
- Task: document network assumption and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A005. Storage
- Task: review user and sudo rule and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A006. Monitoring
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A007. Security
- Task: describe storage and backup path and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A008. Recovery
- Task: record patch and reboot window and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A009. Ubuntu
- Task: mark security baseline and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A010. APT
- Task: name monitoring or alert rule and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A011. systemd
- Task: record rollback or recovery path and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A012. Netplan
- Task: write team rule and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A013. Storage
- Task: check release and support status and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A014. Monitoring
- Task: evaluate package and repository risk and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A015. Security
- Task: explain service status and logs and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A016. Recovery
- Task: document network assumption and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A017. Ubuntu
- Task: review user and sudo rule and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A018. APT
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A019. systemd
- Task: describe storage and backup path and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A020. Netplan
- Task: record patch and reboot window and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A021. Storage
- Task: mark security baseline and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A022. Monitoring
- Task: name monitoring or alert rule and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A023. Security
- Task: record rollback or recovery path and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A024. Recovery
- Task: write team rule and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A025. Ubuntu
- Task: check release and support status and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A026. APT
- Task: evaluate package and repository risk and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A027. systemd
- Task: explain service status and logs and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A028. Netplan
- Task: document network assumption and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A029. Storage
- Task: review user and sudo rule and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A030. Monitoring
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A031. Security
- Task: describe storage and backup path and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A032. Recovery
- Task: record patch and reboot window and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A033. Ubuntu
- Task: mark security baseline and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A034. APT
- Task: name monitoring or alert rule and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A035. systemd
- Task: record rollback or recovery path and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A036. Netplan
- Task: write team rule and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A037. Storage
- Task: check release and support status and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A038. Monitoring
- Task: evaluate package and repository risk and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A039. Security
- Task: explain service status and logs and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A040. Recovery
- Task: document network assumption and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A041. Ubuntu
- Task: review user and sudo rule and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A042. APT
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A043. systemd
- Task: describe storage and backup path and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A044. Netplan
- Task: record patch and reboot window and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A045. Storage
- Task: mark security baseline and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A046. Monitoring
- Task: name monitoring or alert rule and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A047. Security
- Task: record rollback or recovery path and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A048. Recovery
- Task: write team rule and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A049. Ubuntu
- Task: check release and support status and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A050. APT
- Task: evaluate package and repository risk and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A051. systemd
- Task: explain service status and logs and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A052. Netplan
- Task: document network assumption and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A053. Storage
- Task: review user and sudo rule and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A054. Monitoring
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A055. Security
- Task: describe storage and backup path and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A056. Recovery
- Task: record patch and reboot window and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A057. Ubuntu
- Task: mark security baseline and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A058. APT
- Task: name monitoring or alert rule and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A059. systemd
- Task: record rollback or recovery path and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A060. Netplan
- Task: write team rule and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A061. Storage
- Task: check release and support status and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A062. Monitoring
- Task: evaluate package and repository risk and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A063. Security
- Task: explain service status and logs and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A064. Recovery
- Task: document network assumption and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A065. Ubuntu
- Task: review user and sudo rule and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A066. APT
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A067. systemd
- Task: describe storage and backup path and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A068. Netplan
- Task: record patch and reboot window and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A069. Storage
- Task: mark security baseline and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A070. Monitoring
- Task: name monitoring or alert rule and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A071. Security
- Task: record rollback or recovery path and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A072. Recovery
- Task: write team rule and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A073. Ubuntu
- Task: check release and support status and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A074. APT
- Task: evaluate package and repository risk and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A075. systemd
- Task: explain service status and logs and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A076. Netplan
- Task: document network assumption and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A077. Storage
- Task: review user and sudo rule and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A078. Monitoring
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A079. Security
- Task: describe storage and backup path and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A080. Recovery
- Task: record patch and reboot window and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A081. Ubuntu
- Task: mark security baseline and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A082. APT
- Task: name monitoring or alert rule and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A083. systemd
- Task: record rollback or recovery path and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A084. Netplan
- Task: write team rule and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A085. Storage
- Task: check release and support status and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A086. Monitoring
- Task: evaluate package and repository risk and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A087. Security
- Task: explain service status and logs and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A088. Recovery
- Task: document network assumption and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A089. Ubuntu
- Task: review user and sudo rule and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A090. APT
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A091. systemd
- Task: describe storage and backup path and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A092. Netplan
- Task: record patch and reboot window and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A093. Storage
- Task: mark security baseline and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A094. Monitoring
- Task: name monitoring or alert rule and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A095. Security
- Task: record rollback or recovery path and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A096. Recovery
- Task: write team rule and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A097. Ubuntu
- Task: check release and support status and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A098. APT
- Task: evaluate package and repository risk and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A099. systemd
- Task: explain service status and logs and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A100. Netplan
- Task: document network assumption and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A101. Storage
- Task: review user and sudo rule and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A102. Monitoring
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A103. Security
- Task: describe storage and backup path and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A104. Recovery
- Task: record patch and reboot window and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A105. Ubuntu
- Task: mark security baseline and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A106. APT
- Task: name monitoring or alert rule and connect the observation explicitly to
APT. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A107. systemd
- Task: record rollback or recovery path and connect the observation explicitly to
systemd. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A108. Netplan
- Task: write team rule and connect the observation explicitly to
Netplan. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A109. Storage
- Task: check release and support status and connect the observation explicitly to
Storage. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A110. Monitoring
- Task: evaluate package and repository risk and connect the observation explicitly to
Monitoring. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A111. Security
- Task: explain service status and logs and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A112. Recovery
- Task: document network assumption and connect the observation explicitly to
Recovery. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.