GRC Engineering Academy logogrceng.academy
YAML lab 50 bonus XP

Secure the Hyper-V host

Start labRead the room

Objectives

Tomas is moving FS01 and SQL01 onto a new Hyper-V host, HV01. Write HV01's baseline as YAML before he builds anything.

A consultant suggests opening Remote Desktop to the internet "so we can fix things from home". The requirements say management network only, so do not follow that advice.

Agreed requirements for HV01

Virtual machines: generation 2, with Secure Boot and a virtual TPM switched on.
Credential Guard and memory integrity: on.
Remote Desktop: Network Level Authentication required. Allowed only from 10.0.8.0/24.
PowerShell script block logging: on.
Checkpoints: never counted as backups.

Checks the server runs (5)

  • Generation 2 with Secure Boot and virtual TPM
  • Credential Guard and memory integrity on
  • Remote Desktop only from the management network
  • Record every PowerShell script
  • Checkpoints are not backups

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Build safe machines

    Set the generation number and switch on Secure Boot and the virtual TPM. Done means the VM can measure its own start up. Do not pick generation 1.

    Generation 2 with Secure Boot and virtual TPM

  2. Step 2

    Protect the secrets

    Switch on Credential Guard and memory integrity. Done means both are true. Do not quote them.

    Credential Guard and memory integrity on

  3. Step 3

    Close the remote door

    Require Network Level Authentication and enter the management network range. Done means both match the requirements. Do not follow the consultant.

    Remote Desktop only from the management network

  4. Step 4

    Keep the record honest

    Switch script block logging on and mark that checkpoints do not count as backups. Done means both match. Do not confuse a checkpoint with a copy elsewhere.

    Record every PowerShell scriptCheckpoints are not backups

Rules summary

  • XP on pass

    50 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 13 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.