- Run container on each Team server and have it do something worth checking network-wise - Add firewall rule and block a port on localhost that you need to hit, so they have to fix the rules table - sslyze as part of scoring step that checks local app (e.g. in container) for if the participants set up TLS for the app