grceng.academy
YAML lab 40 bonus XP

Declare independent security layers

Start labRead the room

Objectives

Alder's manager proposes a training-only response to stolen credentials and ransomware. Translate the mandatory baseline into a layered policy.

This lab validates declared fields, not deployed enforcement or measured effectiveness. Use the exact values and booleans specified in the fixture.

Mandatory portal baseline

asset: customer-portal
identity: require multifactor authentication; shared approval accounts forbidden
access: least-privilege
monitoring: export alert threshold exactly 100 records; response owner incident-team
recovery: isolated backups required; restore test every 30 days
assurance: policy-only evidence is insufficient

Checks the server runs (6)

  • Identify the protected asset
  • Require a second factor and individual approval identities
  • Limit authorized reach
  • Set the export trigger and response owner
  • Specify isolated recovery and testing cadence
  • Reject policy-only assurance

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Set the scope

    Use the baseline's asset identifier so the policy has an explicit target.

    Identify the protected asset

  2. Step 2

    Protect identity and permissions

    Translate the second-factor requirement, prohibition on shared approvals, and authorization model into separate fields.

    Require a second factor and individual approval identitiesLimit authorized reach

  3. Step 3

    Make detection actionable

    Record the threshold in records, then assign the named team that must respond.

    Set the export trigger and response owner

  4. Step 4

    Plan recovery and evidence

    Declare isolation and the restore-test interval in days. Decide whether a policy document alone demonstrates operation.

    Specify isolated recovery and testing cadenceReject policy-only assurance

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.