Set 6

51. Incident Forensics – Extract Connection Failures

Scenario During a network incident, engineers need to isolate connection failure messages from logs.

Instructions:

• Navigate to ~/kactii29

• Create folder connection_failures

• Assume network.log exists

• Extract lines containing FAILED

• Save output to failed_connections.log

Commands Expected: grep, output redirection

---

52. Storage Inspection – Directory Size Snapshot

Scenario Infra team needs a quick snapshot of directory sizes for comparison during audits.

Instructions:

• Navigate to ~/kactii29

• Create storage_snapshot

• Measure disk usage of directories

• Display in human-readable format

• Save output to storage_sizes.txt

Commands Expected: du -h

---

53. Security Audit – Logged User Evidence

Scenario Security team requires proof of all users logged into the system at audit time.

Instructions:

• Navigate to ~/kactii29

• Create security_audit

• Capture logged-in users

• Append date and time

• Save to security_users.log

Commands Expected: who, date, output redirection

---

54. Binary Availability – Verify Operational Commands

Scenario Before executing incident scripts, engineers must ensure core utilities exist.

Instructions:

• Navigate to ~/kactii29

• Create binary_availability

• Locate paths for grep, du, and ss

• Save output to available_bins.txt

Commands Expected: which

---

55. Service Validation – SSH Service Check

Scenario Remote access is mandatory during recovery; SSH service health must be verified.

Instructions:

• Navigate to ~/kactii29

• Create ssh_validation

• Check SSH service status

• Start service if inactive

• Save status output to ssh_check.txt

Commands Expected: systemctl status, systemctl start

---

56. Deferred Execution – Audit Pending Jobs

Scenario Operations leadership wants confirmation of all pending one-time jobs.

Instructions:

• Navigate to ~/kactii29

• Create pending_jobs

• List all scheduled at jobs

• Save output to pending_jobs.txt

Commands Expected: atq

---

57. Runtime Context – Environment Variable Capture

Scenario Debugging requires capturing runtime variables during execution.

Instructions:

• Navigate to ~/kactii29

• Create runtime_env

• Display all environment variables

• Save output to runtime_env.txt

Commands Expected: printenv

---

58. Network Audit – Active Listening Ports

Scenario Security needs a fresh snapshot of all listening ports on the host.

Instructions:

• Navigate to ~/kactii29

• Create active_ports

• Capture all listening TCP and UDP sockets

• Save output to active_ports.txt

Commands Expected: ss -tuln

---

59. Data Sanitization – Unique Sorted Identifiers

Scenario Data engineering needs a clean list of unique identifiers from raw input.

Instructions:

• Navigate to ~/kactii29

• Create identifier_cleanup

• Assume ids.log exists

• Sort and remove duplicate entries

• Save output to unique_ids.txt

Commands Expected: sort, uniq

---

60. Reliability Evidence – System Uptime Snapshot

Scenario Leadership demands proof of system reliability during operations.

Instructions:

• Navigate to ~/kactii29

• Create reliability_evidence

• Capture system uptime

• Append timestamp

• Save to reliability.log

Commands Expected: uptime, date, output redirection

---