grceng.academy
Query lab 40 bonus XP

Report only the findings actually in breach

Start labRead the room

Objectives

The monitoring platform raises findings continuously and the weekly report currently lists every open one, so nobody reads it.

Return the `id` of the findings that are genuinely past their remediation window: open, not covered by an active waiver, and older than the deadline for their own severity.

Table: findings

id   control_id       severity  age_days  state   waiver_active
101  IA-MFA-ADMIN     high      12        open    false
102  CM-CHANGE        low       40        open    false
103  EV-BACKUP        high      3         open    false
104  AC-LEAST         critical  2         open    false
105  IA-MFA-ADMIN     high      30        closed  false
106  EV-DRIFT         high      20        open    true

Remediation SLA: critical 1 day, high 7 days, low 90 days.
An active waiver suspends the clock until it expires.
Return one column: id.

Checks the server runs (5)

  • Query runs and returns an id column
  • Deadlines vary by severity
  • Closed findings are excluded
  • Waived findings are excluded
  • Exactly the findings in breach

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Re-read the brief and name the trap

    The current report is the starter query: technically correct, operationally ignored. Alert fatigue is a control failure, because the one breach that mattered was on page three.

  2. Step 2

    Separate the filters from the deadlines

    Two conditions apply to every row regardless of severity, one about state, one about waivers, and they must hold for anything you return.

    The severity deadlines are alternatives to each other, so they need to be grouped before being combined with the always-on filters. Parentheses decide whether your query means what you think.

    Query runs and returns an id columnClosed findings are excludedWaived findings are excluded

  3. Step 3

    One comparison per severity

    Take each severity in turn, pair it with its own deadline from the rule, and note that the rule says older than, so a finding sitting exactly on its deadline is not yet a breach.

    Check the low-severity row specifically: it is the oldest in the table and it is not in breach.

    Deadlines vary by severity

  4. Step 4

    Verify against the table

    Walk all six rows and predict included or excluded before you run. If your result count differs from your prediction, the disagreement is almost always the grouping, not the thresholds.

    Exactly the findings in breach

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.