Stand the platform up: two bare hosts to the written baseline Start this lab

Why this matters

A hypervisor host is the single machine that can see, stop and copy every workload sitting on it, so the settings that look like housekeeping — an agreed clock, a closed shell, logs sent somewhere else, a real certificate — are the controls that decide whether anything you later find on it can be trusted. Building to a written baseline means the platform can be measured rather than argued about.

Concepts

Objectives graded

• Open the platform console and read the Baseline tab before changing a single setting.
• Work the failures in severity order, starting with the one critical gap.
• Set time sources, lockdown, the host shell, the log target, the certificate and migration encryption on both hosts.
• Turn failover on with admission control, set load balancing and processor compatibility on the cluster.
• Give management its own VLAN, reject forged transmits and MAC changes, and add the second path to both datastores.
• Start every guest, read the score again, and name the one gap the console cannot close.

MITRE ATT&CK coverage

An unhardened hypervisor hands an intruder the shell, the management network and every guest on it at once. Standing the platform up to the written baseline closes the same doors a hostile inventory of the host would walk through.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A reversible action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The platform was worked in the console rather than described from the ticket.

  investigation · weight 15

• The platform was measured before it was changed.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The size of the gap was counted rather than eyeballed.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• Work was ordered by severity, starting with the critical gap.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The weakest area was identified from the per-area totals.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The platform was actually configured and the improvement measured, not asserted.

  configuration · weight 15 · T1078 Valid Accounts (Defense Evasion)

• The residual gap was named honestly instead of being quietly left out.

  configuration · weight 10 · T1016 System Network Configuration Discovery (Discovery)

Common mistakes

• Changing settings first and reading the score afterwards, so there is nothing to compare against.
• Leaving the management network on the same VLAN as everything else because it works.
• Enabling failover without reserving the capacity to honor it.
• Calling the build finished while the checks nobody could close go unmentioned.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.