Ubuntu Workshop – Overview · Ubuntu

Overview

This workshop covers the path from Linux and server fundamentals to platform operations, automation, hardening, monitoring and incident response.

The focus is on:

Ubuntu LTS, interim releases, Ubuntu Pro and support lifecycle
shell, filesystem, users, groups, sudo and processes
APT, dpkg, Snap and package sources
systemd, journald, timers and service operations
Netplan, DNS, UFW, SSH, storage, LVM and backups
cloud-init, baselines, patch management, monitoring and performance
AppArmor, auditd, AIDE, USG, CIS and incident response

Quickstart

# Workshop content is provided through the Orthevs Academy.
chmod +x scripts/provision_ubuntu.sh
./scripts/provision_ubuntu.sh --dry-run
./examples/00-lab-skeleton/run.sh

Audience

Developers, administrators, DevOps engineers, SREs, platform engineers, cloud engineers, tech leads and security engineers who operate, automate or secure Ubuntu systems.

Learning Path

Level	Focus	Outcome
Fundamentals	Ubuntu-Grundlagen, Shell, Dateisystem, Benutzer, Rechte, Pakete, Prozesse, Dienste und Logs	You can explain, locally check and review the related Ubuntu patterns.
Intermediate	systemd, APT, Snap, ACLs, Storage, Netplan, UFW, SSH, Timer und Troubleshooting	You can explain, locally check and review the related Ubuntu patterns.
Professional	Server-Baseline, cloud-init, Automatisierung, Patch Management, Monitoring, Backup und Performance	You can explain, locally check and review the related Ubuntu patterns.
Advanced Security	Threat Modeling, Ubuntu Pro, USG, CIS, SSH/sudo/PAM, AppArmor, auditd, AIDE und Incident Response	You can explain, locally check and review the related Ubuntu patterns.

Structure

Workshop Structure

.
├── assessments/
├── docs/
├── examples/
├── exercises/
├── media/
├── scripts/
├── workshops/
├── LICENSE.md
└── README-EN.md

Prerequisites

Ubuntu, Linux, WSL or a VM
Bash
Git
Python 3
optional systemd, cloud-init, ufw, AppArmor, auditd, AIDE and Ubuntu Pro for real system labs

Official Documentation

Working Mode

Do not use production hosts, secrets or customer data in labs.
Examples write only below work/ and do not change system configuration.
Real system changes require change window, backup and rollback.
Ubuntu Pro, USG, FIPS and compliance features are documented instead of assumed.

Sources and References

Review Checklist for the Workshop

01. check release and support status: Record the affected host, package, service, configuration and risk.
02. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
03. explain service status and logs: Record the affected host, package, service, configuration and risk.
04. document network assumption: Record the affected host, package, service, configuration and risk.
05. review user and sudo rule: Record the affected host, package, service, configuration and risk.
06. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
07. describe storage and backup path: Record the affected host, package, service, configuration and risk.
08. record patch and reboot window: Record the affected host, package, service, configuration and risk.
09. mark security baseline: Record the affected host, package, service, configuration and risk.
10. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
11. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
12. write team rule: Record the affected host, package, service, configuration and risk.
13. check release and support status: Record the affected host, package, service, configuration and risk.
14. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
15. explain service status and logs: Record the affected host, package, service, configuration and risk.
16. document network assumption: Record the affected host, package, service, configuration and risk.
17. review user and sudo rule: Record the affected host, package, service, configuration and risk.
18. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
19. describe storage and backup path: Record the affected host, package, service, configuration and risk.
20. record patch and reboot window: Record the affected host, package, service, configuration and risk.
21. mark security baseline: Record the affected host, package, service, configuration and risk.
22. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
23. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
24. write team rule: Record the affected host, package, service, configuration and risk.
25. check release and support status: Record the affected host, package, service, configuration and risk.
26. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
27. explain service status and logs: Record the affected host, package, service, configuration and risk.
28. document network assumption: Record the affected host, package, service, configuration and risk.
29. review user and sudo rule: Record the affected host, package, service, configuration and risk.
30. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
31. describe storage and backup path: Record the affected host, package, service, configuration and risk.
32. record patch and reboot window: Record the affected host, package, service, configuration and risk.
33. mark security baseline: Record the affected host, package, service, configuration and risk.
34. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
35. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
36. write team rule: Record the affected host, package, service, configuration and risk.

Practice Appendix: Workshop

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with sample configuration, shell commands and a Git repository.

A001. Ubuntu

Task: check release and support status and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A002. APT

Task: evaluate package and repository risk and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A003. systemd

Task: explain service status and logs and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A004. Security

Task: document network assumption and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A005. Ubuntu

Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A006. APT

Task: evaluate firewall rule and exposure and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A007. systemd

Task: describe storage and backup path and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A008. Security

Task: record patch and reboot window and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A009. Ubuntu

Task: mark security baseline and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A010. APT

Task: name monitoring or alert rule and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A011. systemd

Task: record rollback or recovery path and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A012. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A013. Ubuntu

Task: check release and support status and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A014. APT

Task: evaluate package and repository risk and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A015. systemd

Task: explain service status and logs and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A016. Security

Task: document network assumption and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A017. Ubuntu

Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A018. APT

Task: evaluate firewall rule and exposure and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A019. systemd

Task: describe storage and backup path and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A020. Security

Task: record patch and reboot window and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A021. Ubuntu

Task: mark security baseline and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A022. APT

Task: name monitoring or alert rule and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A023. systemd

Task: record rollback or recovery path and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A024. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A025. Ubuntu

Task: check release and support status and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A026. APT

Task: evaluate package and repository risk and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A027. systemd

Task: explain service status and logs and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A028. Security

Task: document network assumption and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A029. Ubuntu

Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A030. APT

Task: evaluate firewall rule and exposure and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A031. systemd

Task: describe storage and backup path and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A032. Security

Task: record patch and reboot window and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A033. Ubuntu

Task: mark security baseline and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A034. APT

Task: name monitoring or alert rule and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A035. systemd

Task: record rollback or recovery path and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A036. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A037. Ubuntu

Task: check release and support status and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A038. APT

Task: evaluate package and repository risk and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A039. systemd

Task: explain service status and logs and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A040. Security

Task: document network assumption and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A041. Ubuntu

Task: review user and sudo rule and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A042. APT

Task: evaluate firewall rule and exposure and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A043. systemd

Task: describe storage and backup path and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A044. Security

Task: record patch and reboot window and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A045. Ubuntu

Task: mark security baseline and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A046. APT

Task: name monitoring or alert rule and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A047. systemd

Task: record rollback or recovery path and connect the observation explicitly to systemd.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A048. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A049. Ubuntu

Task: check release and support status and connect the observation explicitly to Ubuntu.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A050. APT

Task: evaluate package and repository risk and connect the observation explicitly to APT.
Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.