Host orientation and change boundaries
Inventory a supplied systemd-based lab host: distribution, kernel, identity, time source, mounts, services, and change context. Record which source is authoritative before following a runbook.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Services, logs, and lifecycle evidence
Diagnose one named lab service through state, unit provenance, bounded logs, listener, and dependency evidence. Active state alone does not prove useful service readiness.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Identity, SSH, permissions, and hardening
Explain a prepared access denial through user and group identity, parent-path traversal, ACL or MAC policy, sudo, SSH, and least privilege. Escalate a security event rather than widening access.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Storage, capacity, and restore evidence
Distinguish block, inode, deleted-open-file, read-only mount, quota, and device symptoms. Verify a tiny sandbox restore and record that service owners set business recovery acceptance.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Host networking, DNS, firewall, and time
Trace local link, address, route, policy, listener, NSS or resolver, and clock boundaries using course-provided values. A ping or resolver answer alone is incomplete evidence.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Resource evidence and performance
Compare bounded CPU, memory, I/O, and process evidence across time. Use host evidence to refine a hypothesis, not as an invitation to tune a production kernel.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Patching, boot, and controlled maintenance
Plan an approved maintenance change with inventory, prechecks, canary, backup confidence, console plan, rollback criteria, monitoring window, and post-change handoff.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Automation, configuration management, and fleet operations
Move from local inventory to idempotent, reviewed, scoped fleet automation with inventory ownership, canary waves, secrets boundaries, and rollback documentation.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Incident contribution, recovery, and handoff
Provide host evidence, recommend authorized containment or restore, verify the result, and write impact, knowns, unknowns, owner, next check, and escalation route.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.