S6. Security and hardening

Outcome: you can measure a server against a baseline and fix the gaps.

Skills: OS hardening, patching, Windows Defender and firewall, secure AD, least privilege, Linux firewall and SELinux or AppArmor, TLS and certificates, vulnerability scanning.

Labs

1. Apply a security baseline to SRV1 with GPO and document the differences before and after.
2. Configure Windows Firewall rules through policy and test them.
3. Deploy an internal certificate authority. Issue a certificate and bind it to a web service.
4. Review AD for risky settings (stale accounts, weak delegation, legacy protocols) and remediate.
5. Run a vulnerability scan (OpenVAS or similar) against the lab and rank the findings.
6. Linux lane: configure nftables or firewalld, enforce SELinux on LNX2, set SSH key-only login on LNX1.

Prove it: a hardening report with before-and-after evidence for at least ten controls.

Certs: AZ-802 (secure Windows Server and AD DS), Cloud+ (security), Security+ (security architecture and controls), Linux+ (security, 18%), LPIC-2 (system security), LPIC-3 303 (foundation).