Secure Configuration & STIG Compliance

Lifetime course access · 20 lab hours over 90 days

When your lab time ends, your course access doesn’t.

About Course

Apply, scan and verify DISA STIG and secure-configuration baselines, then report what fails, why it matters and how to fix it.

What you’ll do

Read DISA STIGs the way assessors do: releases, severity categories (CAT I–III), check text and fix text
Work SCAP results from SCC and OpenSCAP (and run OpenSCAP yourself in an optional home lab), separating real findings from false positives, errors and stale results
Assess a Windows Server 2022 file server and a Rocky Linux 9 (RHEL-compatible) web host, and fill in STIG checklists with evidence
Prioritize by exposure, not just CAT, and plan fixes with Group Policy, Ansible and change control
Write POA&M entries and a risk acceptance request, and brief an ISSO on one page

Course facts

Tracks: Penetration Tester and GRC & Compliance (elective). Recommended after Penetration Tester II or GRC & Compliance I.
Format: 14 topics, 42 lessons and 12 hands-on labs built on evidence packets from a fictional university. Includes an optional private practice lab in your browser: a Rocky Linux 9 desktop and a Windows Server 2022 host, set up like the course’s Odapeeka servers. 20 lab hours over 90 days, starting when you first press Start my lab. Every lab can also be done from the evidence packets.
Capstone: a full STIG compliance assessment package for two new hosts, scored against a published rubric.
Certificate: 16 CPE hours, verifiable at cover6solutions.com/verify, and added to your Chrysalus profile.
Included: Security+ (SY0-701) exam prep.
DoD 8140: aligned with DoD 8140 work role 541, Vulnerability Assessment Analyst. It also practices System Administrator (451) and Security Control Assessor (612) tasks.

Taught by practitioners who do this work every day.

Cover6 Academy is independent of CompTIA. CompTIA and Security+ are trademarks of CompTIA, Inc.

Course Content

Welcome & Orientation

Lesson 0.1 — What this course is
Lesson 0.2 — The Odapeeka assignment and how the labs work
Lab 0 — Read the assignment memo

Secure Baselines: What “Configured Securely” Means
Maps to: Security+ 2.3 Types of vulnerabilities (misconfiguration) · 2.5 Mitigation techniques (hardening, configuration enforcement) · 4.1 Security techniques for computing resources (secure baselines) · 5.1 Security governance (policies, standards)

Anatomy of a STIG
Maps to: Security+ 4.1 Secure baselines and hardening targets · 4.3 Vulnerability management (analysis, classification) · 5.4 Security compliance

The Tooling: SCAP, SCC, OpenSCAP and STIG Viewer
Maps to: Security+ 4.4 Alerting and monitoring tools (SCAP, benchmarks, agents/agentless, vulnerability scanners) · 4.3 Vulnerability management (identification methods) · 4.7 Automation (standard configurations)

Assessing Windows Server 2022 (OSU-FS22)
Maps to: Security+ 4.1 Hardening targets (servers) · 4.3 Vulnerability management (identification, analysis, confirmation) · 4.5 Modify enterprise capabilities (Group Policy) · 4.6 Identity and access management

Assessing RHEL 9 and Apache (OSU-WEB09)
Maps to: Security+ 4.1 Hardening targets (servers) · 4.3 Vulnerability management (false positives, false negatives, confirmation) · 4.5 Modify enterprise capabilities (SELinux, secure protocols) · 1.4 Cryptographic solutions

Reading Results Honestly: False Positives, Evidence and Scores
Maps to: Security+ 4.3 Vulnerability management (analysis: confirmation, false positive, false negative; reporting) · 5.5 Audits and assessments · 5.4 Security compliance (reporting)

Prioritizing: CAT, Exposure and Evidence from Testing
Maps to: Security+ 4.3 Vulnerability management (prioritize, exposure factor, environmental variables, risk tolerance) · 2.2 Threat vectors and attack surfaces · 2.3 Vulnerabilities (misconfiguration) · 5.5 Audits and assessments (penetration testing, internal and external)

Remediation at Scale: Group Policy, Configuration as Code and Change Control
Maps to: Security+ 4.5 Modify enterprise capabilities (Group Policy, SELinux) · 4.7 Automation and orchestration (enforcing baselines) · 1.3 Change management · 4.1 Secure baselines (deploy, maintain)

POA&Ms, Deviations and Risk Acceptance
Maps to: Security+ 5.2 Risk management (risk register, risk acceptance, exceptions and exemptions, risk tolerance) · 4.3 Vulnerability management (response: compensating controls, exceptions) · 5.1 Security governance

Continuous Configuration Monitoring and Drift
Maps to: Security+ 4.1 Secure baselines (maintain) · 4.3 Vulnerability management (validation of remediation: rescanning, audit, verification) · 4.4 Monitoring concepts · 5.4 Compliance monitoring

Reporting to the ISSO and the AO
Maps to: Security+ 4.3 Vulnerability management (reporting) · 5.4 Compliance reporting · 5.5 Audits and assessments · 5.2 Risk management (risk reporting)

Capstone: The Odapeeka STIG Assessment Package (graded)
Maps to: Security+ 4.3 Vulnerability management · 4.1 Secure baselines · 5.2 Risk management · 5.4 Compliance · 5.5 Audits and assessments

Final Check & Your Next Step

Student Ratings & Reviews

No Review Yet

About Course

What you’ll do

Course facts

Course Content

Welcome & Orientation

Lesson 0.1 — What this course is

Lesson 0.2 — The Odapeeka assignment and how the labs work

Lab 0 — Read the assignment memo

Lesson 1.1 — Misconfiguration is a vulnerability class

Lesson 1.2 — Where baselines come from: CIS, DISA, vendors and NIST

Lesson 1.3 — Where baselines sit in the control framework

Lesson 1.4 — Core terms: the vocabulary of secure configuration

Lab 1 — Choose the baseline

Anatomy of a STIG <p><strong>Maps to:</strong> Security+ 4.1 Secure baselines and hardening targets · 4.3 Vulnerability management (analysis, classification) · 5.4 Security compliance</p>

Lesson 2.1 — Releases, versions and applicability

Lesson 2.2 — Reading a rule

Lesson 2.3 — Severity: CAT I, CAT II, CAT III

Lesson 2.4 — Checklist statuses and what each one claims

Lab 2 — Dissect three rules

The Tooling: SCAP, SCC, OpenSCAP and STIG Viewer <p><strong>Maps to:</strong> Security+ 4.4 Alerting and monitoring tools (SCAP, benchmarks, agents/agentless, vulnerability scanners) · 4.3 Vulnerability management (identification methods) · 4.7 Automation (standard configurations)</p>

Lesson 3.1 — SCAP in plain terms, DISA benchmarks and SCC

Lesson 3.2 — OpenSCAP and the SCAP Security Guide

Lesson 3.3 — STIG Viewer and the checklist (.ckl and .cklb)

Lab 3 — Build the checklist shells

Assessing Windows Server 2022 (OSU-FS22) <p><strong>Maps to:</strong> Security+ 4.1 Hardening targets (servers) · 4.3 Vulnerability management (identification, analysis, confirmation) · 4.5 Modify enterprise capabilities (Group Policy) · 4.6 Identity and access management</p>

Lesson 4.1 — Preparing a credentialed scan

Lesson 4.2 — Reading the OSU-FS22 results

Lesson 4.3 — Manual checks on Windows

Lab 4 — Triage the OSU-FS22 results

Assessing RHEL 9 and Apache (OSU-WEB09) <p><strong>Maps to:</strong> Security+ 4.1 Hardening targets (servers) · 4.3 Vulnerability management (false positives, false negatives, confirmation) · 4.5 Modify enterprise capabilities (SELinux, secure protocols) · 1.4 Cryptographic solutions</p>

Lesson 5.1 — Scanning OSU-WEB09 with OpenSCAP

Lesson 5.2 — Reading the OSU-WEB09 results

Lesson 5.3 — Manual checks on Linux and the Apache layer

Lab 5 — Triage the OSU-WEB09 results

Reading Results Honestly: False Positives, Evidence and Scores <p><strong>Maps to:</strong> Security+ 4.3 Vulnerability management (analysis: confirmation, false positive, false negative; reporting) · 5.5 Audits and assessments · 5.4 Security compliance (reporting)</p>

Lesson 6.1 — Why tools disagree with reality

Lesson 6.2 — Evidence that holds up

Lesson 6.3 — Why “90% compliant” isn’t the answer

Lab 6 — Rule on the disputed findings

Lesson 7.1 — CAT is where you start, not where you stop

Lesson 7.2 — Pentest reports as an input, and verifying closure

Lesson 7.3 — Building the prioritized remediation list

Lab 7 — Rank the top ten

Lesson 8.1 — Fixing Windows with Group Policy

Lesson 8.2 — Configuration as code: Ansible and PowerShell DSC

Lesson 8.3 — Change control: hardening without breaking the university

Lab 8 — Write three change plans

POA&Ms, Deviations and Risk Acceptance <p><strong>Maps to:</strong> Security+ 5.2 Risk management (risk register, risk acceptance, exceptions and exemptions, risk tolerance) · 4.3 Vulnerability management (response: compensating controls, exceptions) · 5.1 Security governance</p>

Lesson 9.1 — What a POA&M is, and what goes in it

Lesson 9.2 — Writing a POA&M entry that survives review

Lesson 9.3 — Deviations, mitigations and risk acceptance

Lab 9 — Write three POA&M entries and one risk acceptance request

Continuous Configuration Monitoring and Drift <p><strong>Maps to:</strong> Security+ 4.1 Secure baselines (maintain) · 4.3 Vulnerability management (validation of remediation: rescanning, audit, verification) · 4.4 Monitoring concepts · 5.4 Compliance monitoring</p>

Lesson 10.1 — Drift: how compliant systems stop being compliant

Lesson 10.2 — Building a monitoring cadence

Lesson 10.3 — Verifying fixes and closing findings

Lab 10 — Read the 30-day rescan

Reporting to the ISSO and the AO <p><strong>Maps to:</strong> Security+ 4.3 Vulnerability management (reporting) · 5.4 Compliance reporting · 5.5 Audits and assessments · 5.2 Risk management (risk reporting)</p>

Lesson 11.1 — Know your audience

Lesson 11.2 — The assessment report

Lesson 11.3 — The one-page ISSO summary

Lab 11 — Write the one-page summary

Capstone: The Odapeeka STIG Assessment Package (graded) <p><strong>Maps to:</strong> Security+ 4.3 Vulnerability management · 4.1 Secure baselines · 5.2 Risk management · 5.4 Compliance · 5.5 Audits and assessments</p>

Lesson 12.1 — Your capstone brief

Lesson 12.2 — The evidence packet

Lesson 12.3 — How your capstone is graded

Lab 12 — Capstone: STIG compliance assessment package

Final Check & Your Next Step

Lesson 13.1 — Final knowledge check

Final Knowledge Check

Lesson 13.2 — Your next step: Advanced Penetration Testing or RMF & ATO

Student Ratings & Reviews

Academy

Services

Latest from the blog

Careers & Partners

Legal

Anatomy of a STIG
<p><strong>Maps to:</strong> Security+ 4.1 Secure baselines and hardening targets · 4.3 Vulnerability management (analysis, classification) · 5.4 Security compliance</p>

The Tooling: SCAP, SCC, OpenSCAP and STIG Viewer
<p><strong>Maps to:</strong> Security+ 4.4 Alerting and monitoring tools (SCAP, benchmarks, agents/agentless, vulnerability scanners) · 4.3 Vulnerability management (identification methods) · 4.7 Automation (standard configurations)</p>

Assessing Windows Server 2022 (OSU-FS22)
<p><strong>Maps to:</strong> Security+ 4.1 Hardening targets (servers) · 4.3 Vulnerability management (identification, analysis, confirmation) · 4.5 Modify enterprise capabilities (Group Policy) · 4.6 Identity and access management</p>

Assessing RHEL 9 and Apache (OSU-WEB09)
<p><strong>Maps to:</strong> Security+ 4.1 Hardening targets (servers) · 4.3 Vulnerability management (false positives, false negatives, confirmation) · 4.5 Modify enterprise capabilities (SELinux, secure protocols) · 1.4 Cryptographic solutions</p>

Reading Results Honestly: False Positives, Evidence and Scores
<p><strong>Maps to:</strong> Security+ 4.3 Vulnerability management (analysis: confirmation, false positive, false negative; reporting) · 5.5 Audits and assessments · 5.4 Security compliance (reporting)</p>

POA&Ms, Deviations and Risk Acceptance
<p><strong>Maps to:</strong> Security+ 5.2 Risk management (risk register, risk acceptance, exceptions and exemptions, risk tolerance) · 4.3 Vulnerability management (response: compensating controls, exceptions) · 5.1 Security governance</p>

Continuous Configuration Monitoring and Drift
<p><strong>Maps to:</strong> Security+ 4.1 Secure baselines (maintain) · 4.3 Vulnerability management (validation of remediation: rescanning, audit, verification) · 4.4 Monitoring concepts · 5.4 Compliance monitoring</p>

Reporting to the ISSO and the AO
<p><strong>Maps to:</strong> Security+ 4.3 Vulnerability management (reporting) · 5.4 Compliance reporting · 5.5 Audits and assessments · 5.2 Risk management (risk reporting)</p>

Capstone: The Odapeeka STIG Assessment Package (graded)
<p><strong>Maps to:</strong> Security+ 4.3 Vulnerability management · 4.1 Secure baselines · 5.2 Risk management · 5.4 Compliance · 5.5 Audits and assessments</p>