Hardening & compliance baselines
Bring a host to a CIS/STIG baseline and prove compliance.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- OpenSCAP · Ansible · PowerShell
- Class GUI-need label
CL· CLI-sufficient
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R03.05.01.05-T01 Remediate CIS L1 failures with OpenSCAP
Original instruction
On a fresh RHEL/Ubuntu lab VM, run an OpenSCAP scan against the CIS Level 1 profile. For the 12 rule IDs listed in fixtures/scope.txt, apply fixes so a re-scan reports 0 failures for those rules, without breaking SSH access for the test admin.
- Platforms
lin· Linux- Applications
- OpenSCAP
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
oscap xccdf eval re-scan ARF shows pass for all 12 scoped rule IDs and no new fails among them; the test admin can still SSH in. Graded on the scan result XML.
Proposed partial credit
30% scan baseline captured; 50% scoped rules pass on re-scan; 20% SSH access preserved
R03.05.01.05-T02 Idempotent SSH hardening playbook
Original instruction
Write an Ansible playbook harden_ssh.yml that enforces: Protocol 2, PermitRootLogin no, PasswordAuthentication no, MaxAuthTries 4, and a login banner from fixtures/banner.txt on the target lab host. It must be idempotent and restart sshd only on change.
- Platforms
lin· Linux- Applications
- Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
sshd_config on the target shows all five settings; a second playbook run reports changed=0 (idempotent); sshd restarted exactly once (first run). Graded on target config + run summary.
Proposed partial credit
50% all directives enforced; 30% idempotent second run; 20% handler restart-on-change only
R03.05.01.05-T03 Set Windows password and lockout policy
Original instruction
On a Windows lab VM, set minimum password length to 14, password history to 24, maximum age to 60 days, and account lockout after 5 bad attempts with a 15-minute window, using PowerShell/secedit. Export the resulting policy for verification.
- Platforms
win· Windows- Applications
- PowerShell
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
net accounts and a secedit export show min length 14, history 24, max age 60, lockout threshold 5, window 15. Graded on the exported security policy values.
Proposed partial credit
40% length+history; 30% max age; 30% lockout threshold+window
R03.05.01.05-T04 Apply kernel and service hardening on Linux
Original instruction
On a lab VM, disable the cups, avahi, and rpcbind services and apply sysctl settings from fixtures/sysctl_cis.conf (e.g. net.ipv4.ip_forward=0, kernel.randomize_va_space=2). Persist across reboot and reload live.
- Platforms
lin· Linux- Applications
- OpenSCAP · Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
systemctl shows the 3 services disabled+masked; sysctl -a reports all fixture values live and the config is in a persisted /etc/sysctl.d file. Graded on service + sysctl state.
Proposed partial credit
40% services disabled+masked; 40% sysctl values live; 20% persisted across reboot
R03.05.01.05-T05 Generate and apply OpenSCAP remediation
Original instruction
From an initial OpenSCAP scan of the lab host against CIS L1, generate the Ansible remediation (oscap --fix-type ansible), review it against fixtures/exclude.txt (rules to skip), apply the trimmed remediation, and re-scan. Keep excluded rules untouched.
- Platforms
lin· Linux- Applications
- OpenSCAP · Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Re-scan ARF shows improvement on in-scope rules to pass and the excluded rules unchanged from baseline; the applied playbook omits excluded rule tasks. Graded on before/after scan results + playbook content.
Proposed partial credit
30% remediation generated; 30% exclusions respected; 40% in-scope rules pass on re-scan
R03.05.01.05-T06 Configure Windows advanced audit policy
Original instruction
On a Windows lab VM, enable advanced audit subcategories per fixtures/audit_cis.csv (e.g. Logon/Logoff Success+Failure, Process Creation Success, Account Lockout) using auditpol/PowerShell, and ensure command-line is included in process-creation events. Export the applied settings.
- Platforms
win· Windows- Applications
- PowerShell
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
auditpol /get /category:* matches the fixture csv for each subcategory and the ProcessCreationIncludeCmdLine_Enabled registry value is 1. Graded on the exported audit settings + registry value.
Proposed partial credit
60% subcategories match the fixture; 20% success/failure flags correct; 20% cmdline inclusion enabled
R03.05.01.05-T07 Apply macOS CIS L1 rules with mSCP
Original instruction
On a macOS lab VM, bring the host into compliance for these mSCP CIS L1 rules: screen saver <=20 min, application firewall on, Gatekeeper on, guest login off. Generate the mSCP compliance script and confirm it reports 0 failures for those rule IDs.
- Platforms
mac· macOS- Applications
- PowerShell · Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
The mSCP compliance script --check reports pass for the four listed rule IDs; underlying state (askForPasswordDelay/idle, socketfilterfw, spctl, guest flag) matches. Graded on the compliance script output.
Proposed partial credit
25% screen-saver rule passes; 25% firewall rule passes; 25% Gatekeeper rule passes; 25% guest-login rule passes
R03.05.01.05-T08 Enforce sensitive-file permission baseline
Original instruction
On a Linux lab host, set the CIS-mandated permissions/ownership on /etc/passwd, /etc/shadow, /etc/gshadow, /etc/ssh/sshd_config, and the cron directories per fixtures/perm_baseline.csv. Fix any world-writable files found under /etc.
- Platforms
lin· Linux- Applications
- Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
stat on each listed path matches the baseline mode+owner+group; find /etc -perm -0002 returns none. Graded on the filesystem permission state.
Proposed partial credit
60% listed files correct mode/owner; 40% no world-writable files under /etc
R03.05.01.05-T09 Deploy a STIG auditd ruleset
Original instruction
On a lab VM, deploy auditd rules covering the STIG-required events from fixtures/audit.rules (time changes, identity file edits, privileged command use, module load), make them immutable (-e 2), and confirm auditd loads them without error after reboot.
- Platforms
lin· Linux- Applications
- Ansible · OpenSCAP
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
long· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
auditctl -l shows all required rules; the ruleset is immutable (auditctl -s enabled=2); auditd restarts clean and rules persist after reboot; an OpenSCAP audit-rule check passes. Graded on loaded rules + status.
Proposed partial credit
40% required rules loaded; 30% immutable flag; 30% persist across reboot + clean load
R03.05.01.05-T10 Enforce Windows firewall profiles via PowerShell
Original instruction
On a Windows lab VM, configure Defender Firewall: all three profiles enabled with default inbound Block/outbound Allow, logging of dropped packets to a 16 MB log, and exactly one inbound allow rule for TCP 3389 limited to the Domain profile. Export the configuration.
- Platforms
win· Windows- Applications
- PowerShell
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Get-NetFirewallProfile shows all enabled with correct default actions and drop-logging at 16384 KB; exactly one enabled inbound 3389 rule scoped to Domain. Graded on the exported firewall state.
Proposed partial credit
40% profiles enabled+default actions; 30% drop logging configured; 30% single scoped 3389 rule
R03.05.01.05-T11 Harden PAM password quality and login.defs
Original instruction
On a Linux lab host, configure pam_pwquality (minlen 14, 4 character classes, remember 5) and login.defs (PASS_MAX_DAYS 365, PASS_MIN_DAYS 1, UMASK 027). A test user password change must be rejected if it violates the policy.
- Platforms
lin· Linux- Applications
- Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
The PAM/pwquality config and login.defs match the values; a scripted passwd attempt with a weak password is rejected and a compliant one accepted (test user). Graded on config + the enforcement test.
Proposed partial credit
40% pwquality settings; 30% login.defs values; 30% weak-password rejection works
R03.05.01.05-T12 CIS-benchmarked web server via Ansible role
Original instruction
Write an Ansible role that deploys nginx with a CIS-aligned config on the lab host: TLS1.2+ only, HSTS, server_tokens off, limited request body, a non-root worker user, and secure log permissions. Prove compliance with a provided check script. Role must be idempotent.
- Platforms
lin· Linux- Applications
- Ansible · OpenSCAP
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
long· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
nginx -t passes; the check script reports all CIS items pass (TLS versions, HSTS header present, server_tokens off, worker user, log mode 0640); second run changed=0. Graded on the check-script result + idempotency.
Proposed partial credit
30% secure nginx config; 40% all check items pass; 30% idempotent role
R03.05.01.05-T13 Disable legacy protocols on Windows
Original instruction
On a Windows lab VM, disable SMBv1, disable TLS 1.0 and 1.1 (client+server) and enable TLS 1.2, and disable LM/NTLMv1 (LmCompatibilityLevel 5). Export the resulting registry/feature state. A reboot is allowed.
- Platforms
win· Windows- Applications
- PowerShell
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Get-WindowsOptionalFeature shows SMB1 disabled; SCHANNEL registry disables TLS1.0/1.1 and enables TLS1.2; LmCompatibilityLevel=5. Graded on the exported feature + registry state.
Proposed partial credit
35% SMB1 disabled; 40% TLS versions correct; 25% NTLM level
R03.05.01.05-T14 Establish an AIDE file-integrity baseline
Original instruction
On a Linux lab host, install and configure AIDE to monitor /etc, /bin, /sbin, and /boot per fixtures/aide.conf, initialize the baseline database, and schedule a daily check via a systemd timer. Demonstrate it detects a planted change.
- Platforms
lin· Linux- Applications
- Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
aide.db exists for the configured dirs; a daily systemd timer is enabled; after a planted edit to a watched file, aide --check reports exactly that change. Graded on DB presence, timer, and the detection output.
Proposed partial credit
40% baseline DB initialized for correct scope; 30% daily timer; 30% detects planted change
R03.05.01.05-T15 Produce a compliance report and remediate residuals
Original instruction
Run an OpenSCAP CIS L1 evaluation on the lab host, export an HTML report, identify the 5 highest-severity remaining failures, remediate the three that are safe per fixtures/safe_to_fix.txt, and re-scan to confirm those three now pass.
- Platforms
lin· Linux- Applications
- OpenSCAP · Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
An HTML/ARF report is generated; the three safe-to-fix rules move from fail to pass on re-scan while the other two remain unchanged and documented. Graded on the two scan results + report.
Proposed partial credit
30% report generated; 30% correct top failures identified; 40% three safe fixes pass on re-scan
R03.05.01.05-T16 Verify a GPO applies via RSoP (control pair of T03)
Original instruction
Control pair of T03: on a Windows domain lab VM, using the Group Policy Management / gpresult GUI tooling, confirm the 'Kiosk Hardening' GPO applies to user 'kiosk' and save the RSoP report to C:\evidence\rsop.html. Use the GUI console, not raw registry edits.
- Platforms
win· Windows- Applications
- Group Policy Management Console · gpresult
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
tutorial· Follow docs/tutorial- Proposed difficulty
- 3 / 5
Proposed verifier
C:\evidence\rsop.html lists the Kiosk Hardening GPO as applied to the kiosk user with the expected settings. Graded on the saved RSoP report; contrasts with the CLI policy-setting approach in T03. AppLocker blocks powershell.exe, cmd.exe and gpresult.exe for the agent account, so the RSoP report can only be saved from the GPMC console.
Proposed partial credit
50% GPO shown applied to the user; 30% expected settings present; 20% report saved to path
R03.05.01.05-T17 Fleet banner, idle timeout, and umask role
Original instruction
Write an Ansible role applying to a 3-host lab inventory: a legal login banner from fixtures/banner.txt (/etc/issue + sshd), a 900s shell idle timeout (TMOUT, readonly), and default umask 027 in /etc/profile. Run against all hosts idempotently.
- Platforms
lin· Linux- Applications
- Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
On all 3 hosts: banner matches on login and sshd, TMOUT=900 readonly in profile, umask 027 default; a second run reports changed=0. Graded on per-host state + idempotency.
Proposed partial credit
40% banner on all hosts; 30% idle timeout; 30% umask + idempotent
R03.05.01.05-T18 Enable FileVault and firewall stealth on macOS
Original instruction
On a macOS lab VM, enable the application firewall with stealth mode and block-all-incoming, enable FileVault for the test user, and escrow the recovery key to key.txt. Confirm all states via the command line.
- Platforms
mac· macOS- Applications
- PowerShell
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 3 / 5
Proposed verifier
socketfilterfw --getglobalstate/--getstealthmode/--getblockall all enabled; fdesetup status reports FileVault On; key.txt matches the generated recovery key. Graded on the reported system states. FileVault enablement confirmed at a boundary before encrypting.
Proposed partial credit
40% firewall stealth+block-all; 40% FileVault on; 20% recovery key escrowed
R03.05.01.05-T19 Set local security policy in secpol.msc (control pair of T03)
Original instruction
Control pair of T03: on a Windows lab VM, use the Local Security Policy MMC (secpol.msc) GUI to set 'Interactive logon: Machine inactivity limit' to 900s, 'Do not display last user name' Enabled, and the account lockout threshold to 5. Use the GUI console only.
- Platforms
win· Windows- Applications
- Local Security Policy (secpol.msc)
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrolltype· Text & forms- Work product
WP08· App/system state- Conditions
tutorial· Follow docs/tutorial- Proposed difficulty
- 2 / 5
Proposed verifier
A secedit export (grader side) shows inactivity limit 900, DontDisplayLastUserName=1, and lockout threshold 5. Graded on the resulting policy values; contrasts with the scripted T03 route. AppLocker blocks powershell.exe, cmd.exe, secedit.exe and reg.exe for the agent account, so these values can only be set in the secpol.msc console.
Proposed partial credit
35% inactivity limit; 35% last-user-name hidden; 30% lockout threshold
R03.05.01.05-T20 Full CIS L1 baseline with evidence bundle
Original instruction
Bring a fresh lab VM to CIS Level 1 using an Ansible playbook so an OpenSCAP scan reports 0 failures across the rule subset in fixtures/profile_subset.txt. Produce an evidence bundle: before/after ARF scans, the playbook, and a signed manifest of what changed. Keep SSH and the test admin working.
- Platforms
lin· Linux- Applications
- Ansible · OpenSCAP
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
long· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
After-scan ARF shows pass for every rule in the subset; before/after scans and playbook are in the bundle; the manifest hash of changed files is consistent; test admin SSH still works; second playbook run changed=0. Graded on the after-scan + bundle completeness.
Proposed partial credit
30% baseline captured; 40% subset fully passing; 20% idempotent + access preserved; 10% evidence bundle complete
Mapped research references
Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.