Protection, encryption & backup
Configure firewall, malware protection, disk encryption, backups and restore lost files or versions.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- FileVault · BitLocker · Time Machine · File History
- Class GUI-need label
HY· Hybrid
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R01.05.01.02-T01 Firewall with stealth mode and one blocked app
Original instruction
Turn on the macOS firewall, enable stealth mode, and in Firewall Options set 'LegacyServer' to 'Block incoming connections' while leaving other app rules as they are.
- Platforms
mac· macOS- Applications
- Privacy & Security · Network settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
socketfilterfw --getglobalstate enabled, --getstealthmode on, --listapps shows LegacyServer blocking; other app rules equal seed. Terminal withheld; eslogger detects socketfilterfw/defaults by the agent -> 0.
Proposed partial credit
30% firewall on; 30% stealth; 30% app blocked; 10% other rules unchanged
R01.05.01.02-T02 Inbound port rule for the Private profile only
Original instruction
In Windows Defender Firewall with Advanced Security create an inbound rule 'DevServer 8080' allowing TCP 8080 for the Private profile only, any program, local subnet remote addresses only.
- Platforms
win· Windows- Applications
- Windows Defender Firewall
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
Get-NetFirewallRule -DisplayName 'DevServer 8080': Inbound, Allow, Profile Private; port filter TCP 8080; address filter RemoteAddress LocalSubnet; exactly one such rule. cmd/PowerShell blocked by AppLocker; Sysmon detects New-NetFirewallRule/netsh advfirewall by the agent -> 0.
Proposed partial credit
30% rule exists inbound/allow; 30% protocol+port; 25% Private only; 15% local subnet scope
R01.05.01.02-T03 Put a deleted file back where it came from
Original instruction
The user deleted example.txt from Documents\Projects\Q3 a minute ago. Restore it from the Recycle Bin to its original location.
- Platforms
win· Windows- Applications
- File Explorer · Recycle Bin
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clickhover· Hover & context- Work product
WP09· Files & folders- Conditions
- None declared
- Proposed difficulty
- 1 / 5
Proposed verifier
Documents\Projects\Q3\example.txt exists with original hash; Recycle Bin no longer contains it; a same-named decoy deleted from another folder remains in the bin. cmd/PowerShell blocked by AppLocker; Sysmon detects scripted Shell.Application restores or $Recycle.Bin copies -> 0.
Proposed partial credit
70% restored to original path; 30% decoy untouched
R01.05.01.02-T04 Time Machine to a new disk with exclusions
Original instruction
Set up Time Machine to back up to the attached disk 'TM-Backup' (encrypted, password in fixtures/tm_pw.txt), exclude ~/Downloads and ~/VMs, and start the first backup.
- Platforms
mac· macOS- Applications
- Time Machine · System Settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
tmutil destinationinfo shows TM-Backup; destination encrypted (diskutil apfs list: FileVault yes); tmutil isexcluded both paths = Excluded; a completed snapshot exists (tmutil latestbackup). Terminal withheld; eslogger detects tmutil setdestination/addexclusion by the agent -> 0.
Proposed partial credit
30% destination; 20% encrypted; 30% exclusions; 20% first backup done
R01.05.01.02-T05 Restore yesterday's version of a document beside the current one
Original instruction
Using the Time Machine browser, restore ~/Documents/report.pages as it was in the backup from yesterday 15:00, keeping both the current file and the restored one ('Keep Both').
- Platforms
mac· macOS- Applications
- Time Machine · Finder
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clickvis· Visual judgment- Work product
WP09· Files & folders- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Folder contains report.pages (current hash unchanged) and 'report (original).pages' whose hash equals the 15:00 snapshot version (other snapshots at 11:00 and 18:00 are decoys). Terminal withheld; eslogger detects tmutil restore or cp from snapshots by the agent -> 0.
Proposed partial credit
60% correct snapshot version restored; 30% current file kept; 10% naming via Keep Both
R01.05.01.02-T06 Turn on File History with schedule, retention and exclusion
Original instruction
Turn on File History to drive E: (virtual backup disk), save copies every 15 minutes, keep saved versions for 3 months, exclude the Downloads folder, and run a backup now.
- Platforms
win· Windows- Applications
- File History · Control Panel
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
File History config XML (AppData\Local\Microsoft\Windows\FileHistory\Configuration): target E:, DPFrequency 900, retention 3 months, exclusion Downloads; E:\FileHistory\<user> has a completed backup set. cmd/PowerShell blocked by AppLocker; Sysmon detects fhmanagew or config XML edits by the agent -> 0.
Proposed partial credit
25% enabled to E:; 25% frequency; 20% retention; 30% Downloads excluded and backup run
R01.05.01.02-T07 Recover an older spreadsheet version with File History
Original instruction
Restore the version of Documents\Finance\budget.xlsx from two days ago (the one where Summary!B4 = 12,750) to D:\Restore\budget.xlsx without overwriting the current file.
- Platforms
win· Windows- Applications
- File History · Excel
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clickvis· Visual judgment- Work product
WP09· Files & folders- Conditions
licensed· Licensed pro app- Proposed difficulty
- 3 / 5
Proposed verifier
D:\Restore\budget.xlsx hash equals the targeted File History version (cell check B4=12750); current Documents file unchanged. Copying directly from E:\FileHistory via Explorer is allowed only if correct version chosen. PowerShell blocked by AppLocker; Sysmon detects scripted copies or Excel COM reads -> 0.
Proposed partial credit
60% correct version; 25% restored to D:\Restore; 15% current file untouched
R01.05.01.02-T08 Enable FileVault and escrow the recovery key
Original instruction
Turn on FileVault on the test Mac, choose 'Create a recovery key and do not use my iCloud account', and record the recovery key into the local escrow form at http://localhost:8443/escrow (test system). Do not write the key anywhere else.
- Platforms
mac· macOS- Applications
- FileVault · System Settings · Safari
- Interfaces
desk· Desktop GUIbrow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsmulti· Cross-app- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 4 / 5
Proposed verifier
fdesetup status On (or encryption in progress); fdesetup validaterecovery accepts the escrowed key; no iCloud escrow; filesystem scan finds the key string in no file outside Safari's form submission. Terminal withheld; eslogger detects fdesetup enable by the agent -> 0.
Proposed partial credit
40% FileVault on; 20% local key (no iCloud); 30% escrowed key valid; 10% key not leaked to files
R01.05.01.02-T09 Check BitLocker and back up the recovery key to a file
Original instruction
Check whether BitLocker is on for C:, and if so back up the recovery key with 'Back up your recovery key' > 'Save to a file' to E:\keys\. Then write C:\out\bitlocker.txt with protection status and the key ID.
- Platforms
win· Windows- Applications
- BitLocker · Control Panel
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clickcode· Code & commands- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 3 / 5
Proposed verifier
E:\keys contains BitLocker Recovery Key <ID>.TXT whose numerical password matches manage-bde -protectors -get C: (grader); bitlocker.txt states 'Protection On' and the matching key ID.
Proposed partial credit
50% key file saved and valid; 30% status correct; 20% key ID correct
R01.05.01.02-T10 BitLocker To Go on a removable drive in compatible mode
Original instruction
Encrypt the removable drive E: (virtual USB) with BitLocker To Go using the password in fixtures\usb_pw.txt, encrypt used disk space only, choose Compatible mode for older devices, and save its recovery key to D:\keys.
- Platforms
win· Windows- Applications
- BitLocker · Control Panel
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 4 / 5
Proposed verifier
manage-bde -status E: (grader): Encryption Method AES-CBC 128 (or XTS-AES-128 not allowed), used-space only, password protector present; recovery key file matches recovery protector. cmd/PowerShell blocked by AppLocker; Sysmon detects manage-bde -on by the agent -> 0.
Proposed partial credit
30% encrypted with password; 25% compatible mode; 20% used space only; 25% recovery key saved
R01.05.01.02-T11 Scan, quarantine, and restore one false positive with a narrow exclusion
Original instruction
Run a Microsoft Defender custom scan on D:\Incoming. Quarantine the EICAR test files it finds, but restore 'D:\Incoming\tools\tool.exe' (a known-good internal build per fixtures\allowlist.txt) and add an exclusion for that exact file only.
- Platforms
win· Windows- Applications
- Windows Security
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 5 / 5
Proposed verifier
Get-MpThreatDetection: EICAR files quarantined and absent from disk; tool.exe present (hash equals allowlist); Get-MpPreference ExclusionPath contains exactly that file path (no folder/extension exclusions). cmd/PowerShell blocked by AppLocker; Sysmon detects Set-MpPreference/MpCmdRun by the agent -> 0.
Proposed partial credit
30% scan run and EICARs quarantined; 30% tool.exe restored; 40% exclusion exact and narrow
R01.05.01.02-T12 Controlled folder access with one allowed app
Original instruction
Turn on Controlled folder access in Windows Security, add D:\Projects as a protected folder, and allow C:\Tools\Backup.exe through so it can still write there.
- Platforms
win· Windows- Applications
- Windows Security
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Get-MpPreference: EnableControlledFolderAccess=1, ControlledFolderAccessProtectedFolders contains D:\Projects, ControlledFolderAccessAllowedApplications contains Backup.exe path; grader runs a test writer (blocked) and Backup.exe (allowed). PowerShell blocked by AppLocker; Sysmon detects Set-MpPreference/reg.exe -> 0.
Proposed partial credit
30% enabled; 30% folder protected; 30% app allowed; 10% behavior test
R01.05.01.02-T13 Recover a project folder after a simulated ransomware run
Original instruction
At 14:05 a test script encrypted ~/Projects into *.locked files. Restore ~/Projects to its state in the last Time Machine backup before 14:05, but keep ~/Projects/new_notes.md created at 14:20, and do not touch other folders.
- Platforms
mac· macOS- Applications
- Time Machine · Finder
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clickvis· Visual judgment- Work product
WP09· Files & folders- Conditions
risk· Irreversible/risky- Proposed difficulty
- 5 / 5
Proposed verifier
~/Projects manifest equals the 14:00 snapshot plus new_notes.md (hash); no *.locked files; other home folders hash-equal to seed. Terminal withheld; eslogger detects tmutil restore by the agent -> 0.
Proposed partial credit
50% files restored from the right snapshot; 20% no .locked left; 20% new file kept; 10% other folders untouched
R01.05.01.02-T14 Encrypted restic backup with schedule and restore test
Original instruction
Back up ~/Work to the external disk /Volumes/Ext/restic-repo with restic (password from fixtures/restic_pw.txt, excluding node_modules), schedule it daily at 01:30 with launchd, and prove recoverability by restoring the latest snapshot to /tmp/restore-test.
- Platforms
mac· macOS- Applications
- restic · launchd
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
restic snapshots lists ≥1 snapshot of ~/Work; no node_modules paths in it; LaunchAgent plist StartCalendarInterval 01:30 loaded; /tmp/restore-test hash manifest equals source minus exclusions.
Proposed partial credit
35% encrypted repo with snapshot; 15% exclusion; 25% schedule; 25% restore verified
R01.05.01.02-T15 System protection limits and a named restore point
Original instruction
Turn on System Protection for C: with Max Usage 5%, leave other drives off, and create a restore point named 'Before driver update'.
- Platforms
win· Windows- Applications
- System Properties · Control Panel
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Get-ComputerRestorePoint lists 'Before driver update'; vssadmin list shadowstorage C: max ≈5% (±0.5); other volumes protection off. cmd/PowerShell blocked by AppLocker; Sysmon detects Checkpoint-Computer/vssadmin resize by the agent -> 0.
Proposed partial credit
35% protection on C:; 25% Max Usage limit correct; 40% named restore point
R01.05.01.02-T16 Encrypted disk image vault with Disk Utility
Original instruction
With Disk Utility create an encrypted sparse bundle ~/Vault.sparsebundle, 2 GB, AES-256, APFS, volume name 'Vault', password from fixtures/vault_pw.txt. Copy ~/Sensitive/* into it and eject it.
- Platforms
mac· macOS- Applications
- Disk Utility · Finder
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsdrag· Drag & drop- Work product
WP09· Files & folders- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
hdiutil isencrypted: AES-256; imageinfo: sparse bundle, size 2 GB; attaching with the password shows volume 'Vault' containing files hash-equal to ~/Sensitive; not mounted at end. Terminal withheld; eslogger detects hdiutil create by the agent -> 0.
Proposed partial credit
35% encrypted AES-256; 20% format/size/name; 35% contents; 10% ejected
R01.05.01.02-T17 LUKS-encrypt a backup drive with GNOME Disks
Original instruction
Using GNOME Disks, format the virtual USB disk /dev/loop7 (16 GB) with a single partition: LUKS encryption + ext4, label 'Backup', passphrase from fixtures/luks_pw.txt. Then unlock and mount it once.
- Platforms
lin· Linux- Applications
- GNOME Disks
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 4 / 5
Proposed verifier
cryptsetup luksDump on loop7p1: LUKS2; unlocking with passphrase works; inner filesystem ext4 label Backup; mounted under /media/<u>/Backup at end. Terminal withheld; auditd detects cryptsetup/mkfs by the agent -> 0; other loop devices untouched.
Proposed partial credit
30% partitioned; 40% LUKS + passphrase; 20% ext4 label; 10% mounted
R01.05.01.02-T18 Handle a BitLocker request on an unsupported edition
Original instruction
The user asks to 'turn on BitLocker for C:' on this Windows 11 Home VM without a TPM. Check what Windows Security and Settings offer, do not change unrelated settings, and explain what is possible (or not) and why.
- Platforms
win· Windows- Applications
- BitLocker · Windows Settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP12· Answer/decision- Conditions
clarify· Ask when unclear- Proposed difficulty
- 3 / 5
Proposed verifier
Final message states BitLocker management is unavailable on Home and Device Encryption needs TPM/Modern Standby (rubric); system settings diff empty. Claims of enabling encryption -> 0. cmd/PowerShell blocked by AppLocker; Sysmon detects manage-bde/reg.exe use -> 0.
Proposed partial credit
60% correct explanation; 20% checked Device encryption page; 20% no changes
R01.05.01.02-T19 Harden Windows Security core protections
Original instruction
In Windows Security turn on Tamper Protection, reputation-based protection 'Potentially unwanted app blocking' (block apps and downloads), and Core isolation Memory integrity; restart when asked and confirm all three show on.
- Platforms
win· Windows- Applications
- Windows Security
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Get-MpComputerStatus IsTamperProtected true; Get-MpPreference PUAProtection=1 and Edge SmartScreenPuaEnabled; HVCI registry Enabled=1 and Win32_DeviceGuard SecurityServicesRunning includes 2 after reboot. PowerShell blocked by AppLocker; Sysmon detects Set-MpPreference/reg.exe writes -> 0 (Tamper Protection can only be enabled in the Windows Security UI or via Intune).
Proposed partial credit
30% tamper protection; 30% PUA both; 40% memory integrity running
R01.05.01.02-T20 Bring a Mac into line with a backup and protection policy
Original instruction
Make this Mac satisfy input/protection_policy.md: FileVault on with local recovery key, firewall + stealth, Time Machine encrypted to two rotating destinations ('TM-A', 'TM-B'), exclusions for ~/Downloads and ~/Library/Caches, and a completed backup on each destination.
- Platforms
mac· macOS- Applications
- FileVault · Time Machine · System Settings
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formscode· Code & commands- Work product
WP08· App/system state- Conditions
long· Long-horizonrisk· Irreversible/risky- Proposed difficulty
- 5 / 5
Proposed verifier
Policy checker script (mSCP-style) over fdesetup, socketfilterfw, tmutil destinationinfo (2 destinations, both encrypted), isexcluded, latestbackup per destination; each check pass/fail with weights.
Proposed partial credit
25% FileVault; 15% firewall; 30% two encrypted destinations; 30% exclusions and backups on both
Mapped research references
Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.