Rank the follow-up export

Objectives

A follow-up export comes from a separate account with no evidence of active compromise. An analyst marks every line critical because 'a cloud gap is a breach'. Select exactly four actual gaps and rank them using the explicit rubric, not the analyst's labels.

For this exercise: critical means confirmed unauthenticated access to sensitive production data; high means an active account-wide credential without an approved exception; medium means missing required sensitive-read telemetry; low means a required non-production metadata control is missing with no direct data path. Rank those severities worst first. Known compliant configurations are noise, not extra findings.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

CF-1 | Sensitive production manifests: anonymous GET of existing file succeeds; at-rest encryption enabled.
CF-2 | Active automation credential: account-wide administration; no exception or workload session replacement.
CF-3 | Sensitive manifest store: management events delivered; required object-read events disabled.
CF-4 | Non-production empty test container: required cost-owner metadata absent; no sensitive data or public grants.
CF-5 | Database: no public address; no forwarding path; only approved application subnet reaches TCP 5432.
CF-6 | Legacy objects: complete inventory confirms encryption with approved key; authorised restore test passed.
CF-7 | Archive: management and read events delivered; deletion denied to workloads; locked retention 90 days meets policy.
CF-8 | Emergency human role: MFA required, time-limited approved session, reviewed use; no persistent secret.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the fixture as a population, not a list

   Treat each line as an independent assertion with enough context to compare against the rubric. Do not invent compromise or unsupported network paths.

2. Step 2

   Decide what actually qualifies

   Find the controls that fail their explicit requirements and select the required number of findings.

   The right findings are raised

3. Step 3

   Resist the loud lines

   Exclude lines whose scope, configuration and verification already meet the requirement; unusual does not mean noncompliant.

   Benign lines are left out

4. Step 4

   Grade the exposure, not the wording

   Distinguish proven data exposure, broad credential power, missing visibility and administrative metadata using the supplied definitions.

   Severity matches the actual exposure

5. Step 5

   Rank so the first line is the one you act on

   Sort selected rows by impact category from most urgent to least. Preserve the fixture identifiers so the next engineer can trace every decision.

   Ranked worst first

Rules summary

• XP on pass

  60 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 15 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.