He could cherry pick from the various security benchmark/checklists offered by:
The Center for Internet Security (CIS) is a non-profit enterprise whose Benchmarking and Metrics Division helps organizations reduce the risk of business and e-commerce disruptions resulting from inadequate technical security controls. The Division provides enterprises with consensus best practice standards for security configurations, as well as resources for measuring information security status and for making rational decisions about security investments.
Defense Information Systems Agency (DISA)
The National Checklist Program (NCP), defined by the NIST SP 800-70 Rev. 1, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.
Next, spin up a couple Unix based systems on Amazon EC2 or Linode (lots of distributions to choose from).
Then setup & install OSSEC and gain experience reading and understanding the alerts generated by OSSEC (host intrusion detection system).
Bonus: Install and/or fire up a few services & applications (ssh/ftp/mail/dns/pop/http/etc.) and expose them to the public Internet. The more the merrier (i.e. more logs will be generated and more OSSEC alerts will be triggered).