Three tickets, one resolver: Kerberos, baseline drift and a stale gold image Start this lab

Why this matters

A live migration that fails authentication is almost never an authentication setting. Kerberos identifies both nodes by name, so a node that does not resolve forward and back cannot be trusted by the other, and the same missing record takes the event forwarding and the clock with it.

Concepts

Objectives graded

• Sort the failing checks by cause before closing any of them.
• Read the authentication reason a refused live migration returns.
• Compare the resolvers on every node, forwards and in reverse.
• Bring the drifted node back to the baseline the cluster shares.
• Patch the golden image before sysprepping it, and say why that order matters.

MITRE ATT&CK coverage

Kerberos authenticates cluster operations by name, so name resolution is an authentication dependency rather than a convenience, and a golden image is a supply chain of one — a shared machine identity in a template is inherited by every clone.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A reversible action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The cluster was worked in the console rather than described from the ticket.

  investigation · weight 15

• The cluster was measured before it was touched.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• Three separate-looking failures were traced back to a single node.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The cause was named as a specific resolver rather than as 'DNS problems'.

  investigation · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The quieter fault - the image every new server inherits - was found too.

  investigation · weight 10 · T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (Initial Access)

• The image's currency was recorded as a figure the next reviewer can check.

  investigation · weight 5 · T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (Initial Access)

• Name resolution, baseline drift and the golden image were all put right and the result measured.

  configuration · weight 15 · T1078 Valid Accounts (Defense Evasion)

Common mistakes

• Weakening migration authentication to work around a name-resolution fault.
• Testing resolution in one direction only.
• Trying to remediate a node baseline without draining it first.
• Sysprepping a stale image instead of patching it first.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.