R01.05.01.02 · 任务小类

防护、加密与备份

Protection, encryption & backup

Configure firewall, malware protection, disk encryption, backups and restore lost files or versions.

20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。

典型应用: FileVault · BitLocker · Time Machine · File History
小类 GUI 需求标签: HY · 混合

任务提案 · 20

展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。

R01.05.01.02-T01 Firewall with stealth mode and one blocked app

原始指令

Turn on the macOS firewall, enable stealth mode, and in Firewall Options set 'LegacyServer' to 'Block incoming connections' while leaving other app rules as they are.

平台: mac · macOS
应用: Privacy & Security · Network settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

socketfilterfw --getglobalstate enabled, --getstealthmode on, --listapps shows LegacyServer blocking; other app rules equal seed. Terminal withheld; eslogger detects socketfilterfw/defaults by the agent -> 0.

建议部分得分

30% firewall on; 30% stealth; 30% app blocked; 10% other rules unchanged

R01.05.01.02-T02 Inbound port rule for the Private profile only

原始指令

In Windows Defender Firewall with Advanced Security create an inbound rule 'DevServer 8080' allowing TCP 8080 for the Private profile only, any program, local subnet remote addresses only.

平台: win · Windows
应用: Windows Defender Firewall
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

Get-NetFirewallRule -DisplayName 'DevServer 8080': Inbound, Allow, Profile Private; port filter TCP 8080; address filter RemoteAddress LocalSubnet; exactly one such rule. cmd/PowerShell blocked by AppLocker; Sysmon detects New-NetFirewallRule/netsh advfirewall by the agent -> 0.

建议部分得分

30% rule exists inbound/allow; 30% protocol+port; 25% Private only; 15% local subnet scope

R01.05.01.02-T03 Put a deleted file back where it came from

原始指令

The user deleted example.txt from Documents\Projects\Q3 a minute ago. Restore it from the Recycle Bin to its original location.

平台: win · Windows
应用: File Explorer · Recycle Bin
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 hover · 悬停与上下文
工作产物: WP09 · 文件与文件夹
条件: 未声明
提案难度: 1 / 5

建议验证方式

Documents\Projects\Q3\example.txt exists with original hash; Recycle Bin no longer contains it; a same-named decoy deleted from another folder remains in the bin. cmd/PowerShell blocked by AppLocker; Sysmon detects scripted Shell.Application restores or $Recycle.Bin copies -> 0.

建议部分得分

70% restored to original path; 30% decoy untouched

R01.05.01.02-T04 Time Machine to a new disk with exclusions

原始指令

Set up Time Machine to back up to the attached disk 'TM-Backup' (encrypted, password in fixtures/tm_pw.txt), exclude ~/Downloads and ~/VMs, and start the first backup.

平台: mac · macOS
应用: Time Machine · System Settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

tmutil destinationinfo shows TM-Backup; destination encrypted (diskutil apfs list: FileVault yes); tmutil isexcluded both paths = Excluded; a completed snapshot exists (tmutil latestbackup). Terminal withheld; eslogger detects tmutil setdestination/addexclusion by the agent -> 0.

建议部分得分

30% destination; 20% encrypted; 30% exclusions; 20% first backup done

R01.05.01.02-T05 Restore yesterday's version of a document beside the current one

原始指令

Using the Time Machine browser, restore ~/Documents/report.pages as it was in the backup from yesterday 15:00, keeping both the current file and the restored one ('Keep Both').

平台: mac · macOS
应用: Time Machine · Finder
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 vis · 视觉判断
工作产物: WP09 · 文件与文件夹
条件: 未声明
提案难度: 4 / 5

建议验证方式

Folder contains report.pages (current hash unchanged) and 'report (original).pages' whose hash equals the 15:00 snapshot version (other snapshots at 11:00 and 18:00 are decoys). Terminal withheld; eslogger detects tmutil restore or cp from snapshots by the agent -> 0.

建议部分得分

60% correct snapshot version restored; 30% current file kept; 10% naming via Keep Both

R01.05.01.02-T06 Turn on File History with schedule, retention and exclusion

原始指令

Turn on File History to drive E: (virtual backup disk), save copies every 15 minutes, keep saved versions for 3 months, exclude the Downloads folder, and run a backup now.

平台: win · Windows
应用: File History · Control Panel
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

File History config XML (AppData\Local\Microsoft\Windows\FileHistory\Configuration): target E:, DPFrequency 900, retention 3 months, exclusion Downloads; E:\FileHistory\<user> has a completed backup set. cmd/PowerShell blocked by AppLocker; Sysmon detects fhmanagew or config XML edits by the agent -> 0.

建议部分得分

25% enabled to E:; 25% frequency; 20% retention; 30% Downloads excluded and backup run

R01.05.01.02-T07 Recover an older spreadsheet version with File History

原始指令

Restore the version of Documents\Finance\budget.xlsx from two days ago (the one where Summary!B4 = 12,750) to D:\Restore\budget.xlsx without overwriting the current file.

平台: win · Windows
应用: File History · Excel
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 vis · 视觉判断
工作产物: WP09 · 文件与文件夹
条件: licensed · 授权专业软件
提案难度: 3 / 5

建议验证方式

D:\Restore\budget.xlsx hash equals the targeted File History version (cell check B4=12750); current Documents file unchanged. Copying directly from E:\FileHistory via Explorer is allowed only if correct version chosen. PowerShell blocked by AppLocker; Sysmon detects scripted copies or Excel COM reads -> 0.

建议部分得分

60% correct version; 25% restored to D:\Restore; 15% current file untouched

R01.05.01.02-T08 Enable FileVault and escrow the recovery key

原始指令

Turn on FileVault on the test Mac, choose 'Create a recovery key and do not use my iCloud account', and record the recovery key into the local escrow form at http://localhost:8443/escrow (test system). Do not write the key anywhere else.

平台: mac · macOS
应用: FileVault · System Settings · Safari
交互表面: desk · 桌面 GUI brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 multi · 跨应用
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 4 / 5

建议验证方式

fdesetup status On (or encryption in progress); fdesetup validaterecovery accepts the escrowed key; no iCloud escrow; filesystem scan finds the key string in no file outside Safari's form submission. Terminal withheld; eslogger detects fdesetup enable by the agent -> 0.

建议部分得分

40% FileVault on; 20% local key (no iCloud); 30% escrowed key valid; 10% key not leaked to files

R01.05.01.02-T09 Check BitLocker and back up the recovery key to a file

原始指令

Check whether BitLocker is on for C:, and if so back up the recovery key with 'Back up your recovery key' > 'Save to a file' to E:\keys\. Then write C:\out\bitlocker.txt with protection status and the key ID.

平台: win · Windows
应用: BitLocker · Control Panel
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 3 / 5

建议验证方式

E:\keys contains BitLocker Recovery Key <ID>.TXT whose numerical password matches manage-bde -protectors -get C: (grader); bitlocker.txt states 'Protection On' and the matching key ID.

建议部分得分

50% key file saved and valid; 30% status correct; 20% key ID correct

R01.05.01.02-T10 BitLocker To Go on a removable drive in compatible mode

原始指令

Encrypt the removable drive E: (virtual USB) with BitLocker To Go using the password in fixtures\usb_pw.txt, encrypt used disk space only, choose Compatible mode for older devices, and save its recovery key to D:\keys.

平台: win · Windows
应用: BitLocker · Control Panel
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 4 / 5

建议验证方式

manage-bde -status E: (grader): Encryption Method AES-CBC 128 (or XTS-AES-128 not allowed), used-space only, password protector present; recovery key file matches recovery protector. cmd/PowerShell blocked by AppLocker; Sysmon detects manage-bde -on by the agent -> 0.

建议部分得分

30% encrypted with password; 25% compatible mode; 20% used space only; 25% recovery key saved

R01.05.01.02-T11 Scan, quarantine, and restore one false positive with a narrow exclusion

原始指令

Run a Microsoft Defender custom scan on D:\Incoming. Quarantine the EICAR test files it finds, but restore 'D:\Incoming\tools\tool.exe' (a known-good internal build per fixtures\allowlist.txt) and add an exclusion for that exact file only.

平台: win · Windows
应用: Windows Security
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 5 / 5

建议验证方式

Get-MpThreatDetection: EICAR files quarantined and absent from disk; tool.exe present (hash equals allowlist); Get-MpPreference ExclusionPath contains exactly that file path (no folder/extension exclusions). cmd/PowerShell blocked by AppLocker; Sysmon detects Set-MpPreference/MpCmdRun by the agent -> 0.

建议部分得分

30% scan run and EICARs quarantined; 30% tool.exe restored; 40% exclusion exact and narrow

R01.05.01.02-T12 Controlled folder access with one allowed app

原始指令

Turn on Controlled folder access in Windows Security, add D:\Projects as a protected folder, and allow C:\Tools\Backup.exe through so it can still write there.

平台: win · Windows
应用: Windows Security
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Get-MpPreference: EnableControlledFolderAccess=1, ControlledFolderAccessProtectedFolders contains D:\Projects, ControlledFolderAccessAllowedApplications contains Backup.exe path; grader runs a test writer (blocked) and Backup.exe (allowed). PowerShell blocked by AppLocker; Sysmon detects Set-MpPreference/reg.exe -> 0.

建议部分得分

30% enabled; 30% folder protected; 30% app allowed; 10% behavior test

R01.05.01.02-T13 Recover a project folder after a simulated ransomware run

原始指令

At 14:05 a test script encrypted ~/Projects into *.locked files. Restore ~/Projects to its state in the last Time Machine backup before 14:05, but keep ~/Projects/new_notes.md created at 14:20, and do not touch other folders.

平台: mac · macOS
应用: Time Machine · Finder
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 vis · 视觉判断
工作产物: WP09 · 文件与文件夹
条件: risk · 高风险 / 不可逆
提案难度: 5 / 5

建议验证方式

~/Projects manifest equals the 14:00 snapshot plus new_notes.md (hash); no *.locked files; other home folders hash-equal to seed. Terminal withheld; eslogger detects tmutil restore by the agent -> 0.

建议部分得分

50% files restored from the right snapshot; 20% no .locked left; 20% new file kept; 10% other folders untouched

R01.05.01.02-T14 Encrypted restic backup with schedule and restore test

原始指令

Back up ~/Work to the external disk /Volumes/Ext/restic-repo with restic (password from fixtures/restic_pw.txt, excluding node_modules), schedule it daily at 01:30 with launchd, and prove recoverability by restoring the latest snapshot to /tmp/restore-test.

平台: mac · macOS
应用: restic · launchd
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

restic snapshots lists ≥1 snapshot of ~/Work; no node_modules paths in it; LaunchAgent plist StartCalendarInterval 01:30 loaded; /tmp/restore-test hash manifest equals source minus exclusions.

建议部分得分

35% encrypted repo with snapshot; 15% exclusion; 25% schedule; 25% restore verified

R01.05.01.02-T15 System protection limits and a named restore point

原始指令

Turn on System Protection for C: with Max Usage 5%, leave other drives off, and create a restore point named 'Before driver update'.

平台: win · Windows
应用: System Properties · Control Panel
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Get-ComputerRestorePoint lists 'Before driver update'; vssadmin list shadowstorage C: max ≈5% (±0.5); other volumes protection off. cmd/PowerShell blocked by AppLocker; Sysmon detects Checkpoint-Computer/vssadmin resize by the agent -> 0.

建议部分得分

35% protection on C:; 25% Max Usage limit correct; 40% named restore point

R01.05.01.02-T16 Encrypted disk image vault with Disk Utility

原始指令

With Disk Utility create an encrypted sparse bundle ~/Vault.sparsebundle, 2 GB, AES-256, APFS, volume name 'Vault', password from fixtures/vault_pw.txt. Copy ~/Sensitive/* into it and eject it.

平台: mac · macOS
应用: Disk Utility · Finder
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 drag · 拖放
工作产物: WP09 · 文件与文件夹
条件: 未声明
提案难度: 3 / 5

建议验证方式

hdiutil isencrypted: AES-256; imageinfo: sparse bundle, size 2 GB; attaching with the password shows volume 'Vault' containing files hash-equal to ~/Sensitive; not mounted at end. Terminal withheld; eslogger detects hdiutil create by the agent -> 0.

建议部分得分

35% encrypted AES-256; 20% format/size/name; 35% contents; 10% ejected

R01.05.01.02-T17 LUKS-encrypt a backup drive with GNOME Disks

原始指令

Using GNOME Disks, format the virtual USB disk /dev/loop7 (16 GB) with a single partition: LUKS encryption + ext4, label 'Backup', passphrase from fixtures/luks_pw.txt. Then unlock and mount it once.

平台: lin · Linux
应用: GNOME Disks
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 4 / 5

建议验证方式

cryptsetup luksDump on loop7p1: LUKS2; unlocking with passphrase works; inner filesystem ext4 label Backup; mounted under /media/<u>/Backup at end. Terminal withheld; auditd detects cryptsetup/mkfs by the agent -> 0; other loop devices untouched.

建议部分得分

30% partitioned; 40% LUKS + passphrase; 20% ext4 label; 10% mounted

R01.05.01.02-T18 Handle a BitLocker request on an unsupported edition

原始指令

The user asks to 'turn on BitLocker for C:' on this Windows 11 Home VM without a TPM. Check what Windows Security and Settings offer, do not change unrelated settings, and explain what is possible (or not) and why.

平台: win · Windows
应用: BitLocker · Windows Settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP12 · 答案 / 决策
条件: clarify · 需要澄清
提案难度: 3 / 5

建议验证方式

Final message states BitLocker management is unavailable on Home and Device Encryption needs TPM/Modern Standby (rubric); system settings diff empty. Claims of enabling encryption -> 0. cmd/PowerShell blocked by AppLocker; Sysmon detects manage-bde/reg.exe use -> 0.

建议部分得分

60% correct explanation; 20% checked Device encryption page; 20% no changes

R01.05.01.02-T19 Harden Windows Security core protections

原始指令

In Windows Security turn on Tamper Protection, reputation-based protection 'Potentially unwanted app blocking' (block apps and downloads), and Core isolation Memory integrity; restart when asked and confirm all three show on.

平台: win · Windows
应用: Windows Security
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Get-MpComputerStatus IsTamperProtected true; Get-MpPreference PUAProtection=1 and Edge SmartScreenPuaEnabled; HVCI registry Enabled=1 and Win32_DeviceGuard SecurityServicesRunning includes 2 after reboot. PowerShell blocked by AppLocker; Sysmon detects Set-MpPreference/reg.exe writes -> 0 (Tamper Protection can only be enabled in the Windows Security UI or via Intune).

建议部分得分

30% tamper protection; 30% PUA both; 40% memory integrity running

R01.05.01.02-T20 Bring a Mac into line with a backup and protection policy

原始指令

Make this Mac satisfy input/protection_policy.md: FileVault on with local recovery key, firewall + stealth, Time Machine encrypted to two rotating destinations ('TM-A', 'TM-B'), exclusions for ~/Downloads and ~/Library/Caches, and a completed backup on each destination.

平台: mac · macOS
应用: FileVault · Time Machine · System Settings
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: long · 长流程 risk · 高风险 / 不可逆
提案难度: 5 / 5

建议验证方式

Policy checker script (mSCP-style) over fdesetup, socketfilterfw, tmutil destinationinfo (2 destinations, both encrypted), isexcluded, latestbackup per destination; each check pass/fail with weights.

建议部分得分

25% FileVault; 15% firewall; 30% two encrypted destinations; 30% exclusions and backups on both

已有研究映射

以下沿用研究目录中的基准与小类映射，不是逐题标注、执行记录或产品背书。

防护、加密与备份

任务提案 · 20

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

已有研究映射

同工作流族的小类