grceng.academy
Review lab 40 bonus XP

Review the control library records

Start labRead the room

Objectives

Six control records have been merged into the library as YAML. The team lead says they are all machine-readable because they parse.

Parsing is not the bar. Accept the records a scheduler and an evaluator could actually act on; reject the ones whose fields are prose in a data costume.

Verdicts are accept or reject. Every rejection needs one reason code from: prose-assertion | unstable-id | unschedulable-frequency | evidence-not-rerunnable.

controls/*.yaml (field summary)

Y-1  id: AC-PROD-MFA | owner: platform-security | frequency: daily | assertion: "zero admin accounts without mfa" | evidence_query: okta-api /admins
Y-2  id: AC-REVIEW | owner: platform-security | frequency: quarterly | assertion: "access is reviewed appropriately by management" | evidence_query: okta-api /admins
Y-3  id: control 7 (new) | owner: risk-office | frequency: monthly | assertion: "no bucket is publicly readable" | evidence_query: aws-config query
Y-4  id: EV-RETENTION | owner: data-platform | frequency: monthly | assertion: "every evidence object is retained at least 2555 days" | evidence_query: s3-api lifecycle rules
Y-5  id: VM-PATCH | owner: platform-security | frequency: "as needed" | assertion: "zero critical findings older than 24 hours" | evidence_query: scanner-api /findings
Y-6  id: VN-REVIEW | owner: vendor-management | frequency: annually | assertion: "every tier-1 vendor has a current assessment" | evidence_query: screenshot of the vendor tracker

Checks the server runs (3)

  • Every line in the fixture carries a verdict
  • Accept and reject land on the right lines
  • Each rejection cites a valid reason code

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Read the request before the artefact

    Controls as data means each field has a consumer. Before judging, name the consumer of every field: who reads the id, who reads the frequency, who evaluates the assertion.

  2. Step 2

    Judge every line, including the boring ones

    Six records, six verdicts. Two are genuinely ready to schedule; the library needs to know which so the rest can be fixed rather than argued about.

    Every line in the fixture carries a verdict

  3. Step 3

    Separate what is wrong from what is merely ugly

    Take the fields in consumer order. An id must be stable and matchable; a frequency must be a value a scheduler recognises; an assertion must resolve to true or false without a human interpreting an adverb.

    Then check evidence: is it a call something can re-run, or an artefact a person captured once?

    Accept and reject land on the right lines

  4. Step 4

    Say why, in the vocabulary the programme uses

    Name the field that fails, not the record's general quality. Each defect has a different fix and a different owner.

    Each rejection cites a valid reason code

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.