R03.04.01.03 · TASK CLASS

Cloud console operations

Configure resources, IAM, billing alerts and networking through cloud web consoles.

20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.

Typical applications: AWS Console · Azure Portal · GCP Console
Class GUI-need label: HY · Hybrid

Task proposals · 20

Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.

R03.04.01.03-T01 Grant an EC2 instance least-privilege S3 read in the AWS Console

Original instruction

In the AWS sandbox account (console sign-in only), create IAM role app-reader-role for EC2 with a customer-managed policy allowing s3:GetObject and s3:ListBucket only on bucket acme-reports under prefix 2025/, attach it via an instance profile to instance i-app01 (tag Name=app01), and verify from the instance with Session Manager.

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 3 / 5

Proposed verifier

Grader (read-only admin) runs IAM policy simulator: allowed on 2025/* objects, denied on other prefixes, buckets and actions. Instance profile attached to app01. CloudTrail shows the changes came from the console (userAgent), since the agent has no access keys.

Proposed partial credit

35% policy scope correct; 20% trust policy for EC2; 25% attached to instance; 20% verification from instance

R03.04.01.03-T02 Control pair of T01: grant the same S3 access with the AWS CLI

Original instruction

Control pair of T01. With AWS CLI credentials for the sandbox and no console access, create the same app-reader-role, policy and instance profile for instance app01 and verify the access scope.

Platforms: lin · Linux mac · macOS win · Windows
Applications: AWS CLI
Interfaces: term · Terminal
GUI need · task setting: CL · CLI-sufficient
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: code · Code & commands
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 2 / 5

Proposed verifier

Same policy-simulator and attachment checks as T01; reported as the CLI half of the T01 pair to measure the GUI gap.

Proposed partial credit

35% policy scope; 20% trust policy; 25% attached; 20% verification

R03.04.01.03-T03 Set a monthly cost budget with forecast alerts

Original instruction

In the AWS sandbox Billing console, create budget 'team-sandbox-monthly' of $200/month with alerts at 80% actual and 100% forecasted spend to finops@example.test, and a Cost Anomaly Detection monitor for services with a $25 individual alert threshold.

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 2 / 5

Proposed verifier

Grader reads Budgets and Cost Explorer anomaly APIs (admin): amount, period, two notifications with correct type/threshold/subscriber; anomaly monitor type SERVICE and subscription threshold 25.

Proposed partial credit

50% budget and alerts; 15% subscriber; 35% anomaly monitor

R03.04.01.03-T04 Build a two-tier VPC from a network diagram in the AWS Console

Original instruction

Following input/network_diagram.png, create in the sandbox (us-east-1) a VPC 10.20.0.0/16 with 2 public and 2 private subnets in two AZs, an internet gateway, one NAT gateway, route tables as drawn, and security groups web-sg (443 from anywhere) and app-sg (8080 from web-sg only).

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms vis · Visual judgment
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

Grader describes the VPC: CIDRs, AZ placement, route table associations and routes (0.0.0.0/0 via IGW for public, via NAT for private), SG rules exact (source SG reference). Reachability Analyzer path from web to app on 8080 succeeds, reverse fails.

Proposed partial credit

25% subnets/CIDRs; 30% routing; 30% security groups; 15% reachability

R03.04.01.03-T05 Lock down an Azure storage account behind a private endpoint

Original instruction

In the Azure Portal sandbox subscription, create storage account stacmereports (StorageV2, LRS, West Europe) with public network access disabled, a private endpoint for blob in vnet-app/snet-data with private DNS zone integration, and a lifecycle rule moving blobs under logs/ to Cool after 30 days and deleting after 365.

Platforms: web · Any OS (web)
Applications: Azure Portal
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Grader (Reader + ARM queries): account properties exact; publicNetworkAccess Disabled; private endpoint connection Approved with DNS A record in privatelink.blob.core.windows.net; lifecycle policy JSON equals spec. Blob access from vnet VM works; from internet fails.

Proposed partial credit

20% account settings; 35% private endpoint + DNS; 30% lifecycle rule; 15% access tests

R03.04.01.03-T06 Grant time-limited BigQuery access with an IAM condition

Original instruction

In the GCP Console sandbox project, grant contractor@example.test the BigQuery Data Viewer role on dataset 'analytics_eu' only, with an IAM condition expiring at 2025-12-31T23:59:59Z and titled 'contract-end'. Do not grant any project-level roles.

Platforms: web · Any OS (web)
Applications: GCP Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 3 / 5

Proposed verifier

Grader reads dataset IAM policy (version 3): binding with the condition expression exact; no project-level binding for the principal; Policy Troubleshooter shows access to the dataset and denial elsewhere.

Proposed partial credit

40% dataset-level binding; 35% condition exact; 25% no project-level grants

R03.04.01.03-T07 Close public S3 access without breaking the CDN

Original instruction

Security flagged public buckets in the AWS sandbox. Find every bucket readable by anyone, make them private (Block Public Access, policy cleanup), but keep site assets served via CloudFront distribution E-STATIC working through Origin Access Control. Record the changed buckets in output/buckets.txt.

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click vis · Visual judgment type · Text & forms
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 4 / 5

Proposed verifier

Grader: no bucket is publicly readable (anonymous GET fails for 5 seeded public objects); CloudFront URL still returns 200 for assets; bucket policy for the assets bucket allows only the distribution's OAC principal; buckets.txt equals the seeded set.

Proposed partial credit

40% all public access removed; 35% CDN still works via OAC; 25% list exact

R03.04.01.03-T08 Create an MFA conditional access policy in report-only mode

Original instruction

In the Microsoft Entra admin center (sandbox tenant), create Conditional Access policy 'Require MFA for admins' targeting the directory roles Global Administrator and Security Administrator, all cloud apps, requiring MFA, excluding the break-glass account bg-admin@sandbox.test, in report-only mode.

Platforms: web · Any OS (web)
Applications: Microsoft Entra admin center · Azure Portal
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 4 / 5

Proposed verifier

Grader reads the policy via Graph (admin): state enabledForReportingButNotEnforced; included roles exact; exclusion contains bg-admin; grant control mfa. Enabling enforcement fails the safety gate.

Proposed partial credit

30% roles targeted; 25% grant control; 25% exclusion; 20% report-only (gate)

R03.04.01.03-T09 Set up an uptime check and alerting policy in Cloud Monitoring

Original instruction

In the GCP Console sandbox, create an HTTPS uptime check for https://shop-sbx.example.test/healthz from 3 regions every 1 minute, an alert policy that fires when 2 regions fail for 2 minutes, and an email notification channel oncall@example.test with documentation linking the runbook.

Platforms: web · Any OS (web)
Applications: GCP Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Grader reads the uptime config and alert policy via Monitoring API: check settings exact, condition threshold and duration exact, channel attached, documentation contains the runbook URL. Grader takes the endpoint down: an incident opens within 4 min.

Proposed partial credit

30% uptime check; 35% alert condition; 15% channel/docs; 20% incident fires

R03.04.01.03-T10 Create a CloudWatch alarm and operations dashboard

Original instruction

In the AWS sandbox console, create CloudWatch alarm alb-5xx-high on the ALB 'web-alb' HTTPCode_Target_5XX_Count sum >50 for 3 of 5 one-minute periods, notifying SNS topic ops-alerts, and a dashboard 'web-ops' with 4 widgets: request count, target response time p95, 5xx count, healthy host count.

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Grader: alarm config exact (metric, stat, threshold, evaluation, datapoints, action); dashboard body JSON has the 4 metrics with correct stats (p95 for latency). Synthetic 5xx burst moves alarm to ALARM and publishes to SNS.

Proposed partial credit

45% alarm exact; 15% fires on burst; 40% dashboard widgets

R03.04.01.03-T11 Find last month's top cost increases in Cost Explorer

Original instruction

In the AWS sandbox console, use Cost Explorer to compare September vs August 2025 unblended cost by service and by tag 'team'. Report the 3 services with the largest absolute increase and the team tag responsible for most of the top increase in output/answer.json.

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click vis · Visual judgment
Work product: WP12 · Answer/decision
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Answers exact vs the seeded billing data (services in order, increases ±$1, team tag exact). Agent has console access only; no Cost Explorer API permissions.

Proposed partial credit

60% top 3 services and order; 20% increase values; 20% team tag

R03.04.01.03-T12 Resize an Azure VM and enable backups with a retention policy

Original instruction

In the Azure Portal sandbox, resize VM vm-erp-01 to Standard_D4s_v5 during its maintenance window (stop allowed), and protect it with Recovery Services vault rsv-weu using a new policy: daily backup at 23:00 UTC, retain 30 daily and 12 monthly points. Trigger an on-demand backup.

Platforms: web · Any OS (web)
Applications: Azure Portal
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Grader: VM size exact and VM running; backup item protected with policy settings exact; one completed backup job; data disk unchanged (disk ID same).

Proposed partial credit

30% resize; 40% backup policy exact; 20% backup job completed; 10% disks intact

R03.04.01.03-T13 Deploy a container to Cloud Run with environment settings

Original instruction

In the GCP Console sandbox, deploy image europe-docker.pkg.dev/sbx/apps/catalog:1.4 to Cloud Run service 'catalog' in europe-west1 with min instances 1, max 5, 512 MiB memory, env vars from input/env.txt, secret DB_PASSWORD from Secret Manager, and unauthenticated access disabled.

Platforms: web · Any OS (web)
Applications: GCP Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 2 / 5

Proposed verifier

Grader reads the service spec: image, scaling, memory, env vars exact, secret reference (not literal), IAM without allUsers invoker. Authenticated request to /healthz returns 200.

Proposed partial credit

20% image/region; 25% scaling/memory; 30% env + secret; 25% auth settings

R03.04.01.03-T14 Migrate DNS records into Route 53 with weighted routing

Original instruction

Create public hosted zone example-sbx.test in the AWS sandbox console and recreate the 26 records from input/zonefile.txt, then make api.example-sbx.test a weighted record (80/20 between two ALBs) with health checks on /healthz.

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

Grader lists record sets: 26 records equal the zone file (name, type, TTL, values); weighted pair with weights 80/20, set identifiers, and health check ids on both; health checks probe /healthz. dig against the zone's name servers resolves correctly.

Proposed partial credit

50% records exact; 30% weighted routing; 20% health checks

R03.04.01.03-T15 Assign and remediate an Azure Policy initiative

Original instruction

In the Azure Portal sandbox, assign the built-in initiative requiring tags (CostCenter, Owner) inherited from resource groups to subscription 'sbx-apps', create remediation tasks for existing resources, and report compliance before and after in output/compliance.json.

Platforms: web · Any OS (web)
Applications: Azure Portal
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms vis · Visual judgment
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

Grader: assignment exists with correct parameters and managed identity; remediation tasks succeeded; Policy Insights shows ≥95% compliant afterwards; before/after numbers in JSON match the logged states ±1 resource.

Proposed partial credit

30% assignment; 35% remediation; 20% compliance after; 15% report

R03.04.01.03-T16 Restrict an AWS organization to two regions with an SCP

Original instruction

In the sandbox AWS Organizations management console, create SCP 'region-guardrail' denying all actions outside us-east-1 and eu-west-1 except global services (IAM, Organizations, Route 53, CloudFront, Support), attach it to OU 'Workloads' only, and confirm from a member account that us-west-2 calls fail and eu-west-1 calls succeed.

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 5 / 5

Proposed verifier

Grader: SCP JSON uses aws:RequestedRegion with the exemption list (NotAction) per spec; attached only to Workloads; tests in a member account: ec2:DescribeInstances denied in us-west-2, allowed in eu-west-1, iam:ListRoles allowed. Management account unaffected.

Proposed partial credit

35% SCP logic; 20% exemptions; 25% attachment scope; 20% verification

R03.04.01.03-T17 Tighten overly permissive GCP firewall rules

Original instruction

In the GCP Console sandbox, review VPC 'prod-net' firewall rules, identify every ingress rule open to 0.0.0.0/0 on ports other than 443, and restrict them to the IAP range 35.235.240.0/20 (for SSH/RDP) or remove them per input/policy.md, keeping the app reachable on 443.

Platforms: web · Any OS (web)
Applications: GCP Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click vis · Visual judgment type · Text & forms
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 3 / 5

Proposed verifier

Grader lists firewall rules: no 0.0.0.0/0 ingress except tcp:443; SSH via IAP still works (test tunnel); app on 443 reachable; changed rules list in output/rules.txt equals seeded set.

Proposed partial credit

45% risky rules fixed; 25% IAP SSH works; 20% app reachable; 10% list exact

R03.04.01.03-T18 Re-encrypt an EBS volume with a customer-managed KMS key

Original instruction

In the AWS sandbox console, the data volume of instance db01 is encrypted with the default aws/ebs key. Create customer-managed key db-cmk with rotation enabled, then replace the volume with a copy encrypted under db-cmk (snapshot, copy with re-encryption, swap) without data loss and with ≤10 minutes of instance downtime.

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 4 / 5

Proposed verifier

Grader: attached volume KmsKeyId = db-cmk; key rotation enabled; file checksum manifest on the volume equals pre-task manifest; instance stopped ≤10 min (CloudTrail Stop/Start timestamps); old volume retained (not deleted).

Proposed partial credit

20% key + rotation; 35% volume re-encrypted and attached; 30% data intact; 15% downtime bound

R03.04.01.03-T19 Configure audit log export in AWS, Azure and GCP consoles

Original instruction

Set up organization-level audit log retention in all three sandbox clouds via their consoles: an AWS CloudTrail trail (all regions, management + S3 data events) to bucket audit-logs-sbx with log file validation; Azure Activity Log diagnostic setting to storage account staudit; and a GCP log sink of admin activity + data access logs to bucket gcs-audit-sbx.

Platforms: web · Any OS (web)
Applications: AWS Console · Azure Portal · GCP Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms multi · Cross-app
Work product: WP08 · App/system state
Conditions: multiapp · Multi-app long · Long-horizon
Proposed difficulty: 5 / 5

Proposed verifier

Grader per cloud: configuration read via admin APIs (trail settings, diagnostic categories, sink filter and destination with writer identity granted), then generates a test event and confirms it lands in each destination within 15 min.

Proposed partial credit

30% AWS trail; 30% Azure diagnostic setting; 30% GCP sink; 10% test events delivered

R03.04.01.03-T20 Launch an EC2 instance to exact spec despite a session timeout

Original instruction

In the AWS sandbox console, launch instance 'batch-01' from AMI in input/ami.txt, type c7g.large, gp3 root volume 40 GiB 4000 IOPS, IMDSv2 required, user data from input/userdata.sh, tags per input/tags.csv, in subnet private-a. The console session is set to expire once mid-task; sign back in and finish without creating duplicates.

Platforms: web · Any OS (web)
Applications: AWS Console
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: interrupt · Interruptions
Proposed difficulty: 3 / 5

Proposed verifier

Grader describes instances: exactly one batch-01 (no orphan instances or volumes); AMI, type, volume settings, IMDSv2 HttpTokens required, subnet, tags exact; user data hash matches.

Proposed partial credit

40% instance settings; 20% volume settings; 20% tags/user data; 20% no duplicates after interruption

Mapped research references

Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.

Cloud console operations

Task proposals · 20

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Original instruction

Proposed verifier

Proposed partial credit

Mapped research references

In this workflow family