Curriculum Goal

After the full series you can install, administer, patch, monitor, harden and recover Ubuntu systems. You understand release lifecycle, package management, systemd, networking, storage, security and incident response.

Teaching Model

The workshop follows a repeating cycle:

Understand -> Configure -> Check -> Automate -> Monitor -> Secure -> Recover

Level Structure

Roles and Learning Paths

• Developers focus on shell, packages, logs, local services and container hosts.
• Administrators focus on users, storage, network, systemd, patch management and restore.
• Platform engineers focus on cloud-init, baselines, automation, monitoring and fleet operations.
• Security engineers focus on SSH/sudo, AppArmor, auditd, USG, CIS, AIDE and incident response.

Lab Strategy

All labs run locally without production changes. Each example writes only below work/, analyzes sample configuration and creates evidence files.

Assessment Rubric

Sources and References

• Ubuntu Server Documentation
• Ubuntu Release Cycle
• Ubuntu Pro
• Ubuntu Security Documentation
• Ubuntu Security Guide
• Canonical Academy
• Netplan Documentation
• cloud-init Documentation
• systemd Manuals
• Debian APT User Manual

Review Checklist for Curriculum

• 01. check release and support status: Record the affected host, package, service, configuration and risk.
• 02. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 03. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 04. document network assumption: Record the affected host, package, service, configuration and risk.
• 05. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 06. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 07. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 08. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 09. mark security baseline: Record the affected host, package, service, configuration and risk.
• 10. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 11. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 12. write team rule: Record the affected host, package, service, configuration and risk.
• 13. check release and support status: Record the affected host, package, service, configuration and risk.
• 14. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 15. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 16. document network assumption: Record the affected host, package, service, configuration and risk.
• 17. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 18. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 19. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 20. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 21. mark security baseline: Record the affected host, package, service, configuration and risk.
• 22. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 23. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 24. write team rule: Record the affected host, package, service, configuration and risk.
• 25. check release and support status: Record the affected host, package, service, configuration and risk.
• 26. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 27. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 28. document network assumption: Record the affected host, package, service, configuration and risk.
• 29. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 30. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 31. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 32. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 33. mark security baseline: Record the affected host, package, service, configuration and risk.
• 34. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 35. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 36. write team rule: Record the affected host, package, service, configuration and risk.
• 37. check release and support status: Record the affected host, package, service, configuration and risk.
• 38. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 39. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 40. document network assumption: Record the affected host, package, service, configuration and risk.
• 41. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 42. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 43. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 44. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 45. mark security baseline: Record the affected host, package, service, configuration and risk.
• 46. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 47. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 48. write team rule: Record the affected host, package, service, configuration and risk.
• 49. check release and support status: Record the affected host, package, service, configuration and risk.
• 50. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 51. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 52. document network assumption: Record the affected host, package, service, configuration and risk.
• 53. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 54. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 55. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 56. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 57. mark security baseline: Record the affected host, package, service, configuration and risk.
• 58. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 59. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 60. write team rule: Record the affected host, package, service, configuration and risk.
• 61. check release and support status: Record the affected host, package, service, configuration and risk.
• 62. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 63. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 64. document network assumption: Record the affected host, package, service, configuration and risk.

Practice Appendix: Curriculum

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with sample configuration, shell commands and a Git repository.

A001. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A002. APT

• Task: evaluate package and repository risk and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A003. systemd

• Task: explain service status and logs and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A004. Netplan

• Task: document network assumption and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A005. Storage

• Task: review user and sudo rule and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A006. Monitoring

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A007. Security

• Task: describe storage and backup path and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A008. Recovery

• Task: record patch and reboot window and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A009. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A010. APT

• Task: name monitoring or alert rule and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A011. systemd

• Task: record rollback or recovery path and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A012. Netplan

• Task: write team rule and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A013. Storage

• Task: check release and support status and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A014. Monitoring

• Task: evaluate package and repository risk and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A015. Security

• Task: explain service status and logs and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A016. Recovery

• Task: document network assumption and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A017. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A018. APT

• Task: evaluate firewall rule and exposure and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A019. systemd

• Task: describe storage and backup path and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A020. Netplan

• Task: record patch and reboot window and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A021. Storage

• Task: mark security baseline and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A022. Monitoring

• Task: name monitoring or alert rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A023. Security

• Task: record rollback or recovery path and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A024. Recovery

• Task: write team rule and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A025. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A026. APT

• Task: evaluate package and repository risk and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A027. systemd

• Task: explain service status and logs and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A028. Netplan

• Task: document network assumption and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A029. Storage

• Task: review user and sudo rule and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A030. Monitoring

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A031. Security

• Task: describe storage and backup path and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A032. Recovery

• Task: record patch and reboot window and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A033. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A034. APT

• Task: name monitoring or alert rule and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A035. systemd

• Task: record rollback or recovery path and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A036. Netplan

• Task: write team rule and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A037. Storage

• Task: check release and support status and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A038. Monitoring

• Task: evaluate package and repository risk and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A039. Security

• Task: explain service status and logs and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A040. Recovery

• Task: document network assumption and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A041. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A042. APT

• Task: evaluate firewall rule and exposure and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A043. systemd

• Task: describe storage and backup path and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A044. Netplan

• Task: record patch and reboot window and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A045. Storage

• Task: mark security baseline and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A046. Monitoring

• Task: name monitoring or alert rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A047. Security

• Task: record rollback or recovery path and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A048. Recovery

• Task: write team rule and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A049. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A050. APT

• Task: evaluate package and repository risk and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A051. systemd

• Task: explain service status and logs and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A052. Netplan

• Task: document network assumption and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A053. Storage

• Task: review user and sudo rule and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A054. Monitoring

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A055. Security

• Task: describe storage and backup path and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A056. Recovery

• Task: record patch and reboot window and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A057. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A058. APT

• Task: name monitoring or alert rule and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A059. systemd

• Task: record rollback or recovery path and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A060. Netplan

• Task: write team rule and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A061. Storage

• Task: check release and support status and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A062. Monitoring

• Task: evaluate package and repository risk and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A063. Security

• Task: explain service status and logs and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A064. Recovery

• Task: document network assumption and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A065. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A066. APT

• Task: evaluate firewall rule and exposure and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A067. systemd

• Task: describe storage and backup path and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A068. Netplan

• Task: record patch and reboot window and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A069. Storage

• Task: mark security baseline and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A070. Monitoring

• Task: name monitoring or alert rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A071. Security

• Task: record rollback or recovery path and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A072. Recovery

• Task: write team rule and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A073. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A074. APT

• Task: evaluate package and repository risk and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A075. systemd

• Task: explain service status and logs and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A076. Netplan

• Task: document network assumption and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A077. Storage

• Task: review user and sudo rule and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A078. Monitoring

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A079. Security

• Task: describe storage and backup path and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A080. Recovery

• Task: record patch and reboot window and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A081. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A082. APT

• Task: name monitoring or alert rule and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A083. systemd

• Task: record rollback or recovery path and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A084. Netplan

• Task: write team rule and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A085. Storage

• Task: check release and support status and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A086. Monitoring

• Task: evaluate package and repository risk and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A087. Security

• Task: explain service status and logs and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A088. Recovery

• Task: document network assumption and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A089. Ubuntu

• Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A090. APT

• Task: evaluate firewall rule and exposure and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A091. systemd

• Task: describe storage and backup path and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A092. Netplan

• Task: record patch and reboot window and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A093. Storage

• Task: mark security baseline and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A094. Monitoring

• Task: name monitoring or alert rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A095. Security

• Task: record rollback or recovery path and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A096. Recovery

• Task: write team rule and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A097. Ubuntu

• Task: check release and support status and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A098. APT

• Task: evaluate package and repository risk and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A099. systemd

• Task: explain service status and logs and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A100. Netplan

• Task: document network assumption and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A101. Storage

• Task: review user and sudo rule and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A102. Monitoring

• Task: evaluate firewall rule and exposure and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A103. Security

• Task: describe storage and backup path and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A104. Recovery

• Task: record patch and reboot window and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A105. Ubuntu

• Task: mark security baseline and connect the observation explicitly to Ubuntu.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A106. APT

• Task: name monitoring or alert rule and connect the observation explicitly to APT.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A107. systemd

• Task: record rollback or recovery path and connect the observation explicitly to systemd.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A108. Netplan

• Task: write team rule and connect the observation explicitly to Netplan.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A109. Storage

• Task: check release and support status and connect the observation explicitly to Storage.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A110. Monitoring

• Task: evaluate package and repository risk and connect the observation explicitly to Monitoring.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A111. Security

• Task: explain service status and logs and connect the observation explicitly to Security.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A112. Recovery

• Task: document network assumption and connect the observation explicitly to Recovery.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.