Deliver the account remediation contract

Objectives

Northwind Freight needs an executable remediation contract for the export below. The operations lead wants only a new encryption default and a closed ticket: 'The encrypted archive cannot leak.' Your plan must cover identity, network, storage, legacy encryption, logging and closure evidence.

Fill every starter field. Use the exact approved subnet, listener and timing bounds in the fixture. Action and validation fields are short prose; explicitly name the key action or test. Supply an accountable role and a deadline in hours for each of the five control workstreams. The evidence field must mention a fresh export or snapshot and a behavioural test or probe.

account: freight-prod
collected_at: 2026-06-10T09:00:00Z
identity: {principal: batch-worker, role: account-admin, credential_age_days: 210, last_used: today}
network: {public_address: true, internet_route: true, source: 0.0.0.0/0, tcp_port: 5432, ipv6: false}
storage: {container: manifests, anonymous_read: true, data: sensitive}
encryption: {new_write_default: true, legacy_objects_unencrypted: 1200}
logging: {management: true, object_reads: false, retention_days: 7}
constraints:
  approved_application_source: 10.42.8.0/24
  required_tcp_port: 5432
  anonymous_access: contain within 1 hour
  identity_and_network: remediate within 4 hours
  legacy_encryption: finish within 72 hours after access containment
  logging: restore within 24 hours; retain at least 90 days
  rollback: never restore anonymous access
  closure: fresh configuration export plus behavioural testing

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Replace and constrain the machine identity

   Identify what must happen to the old secret as well as the excessive permission set. Give the change an accountable role and compare its deadline to the approved limit.

   Revoke the persistent credential and narrow privileges on time

2. Step 2

   Keep the legitimate service path

   Copy the application's approved boundary and listener from the constraints, not from the exposed rule. Check the owner's deadline.

   Preserve only the approved application path

3. Step 3

   Test access using an existing object

   Choose the state that prevents unauthenticated reads and describe a negative test with an existing manifest. Check the fastest containment deadline and accountable role.

   Contain anonymous access and test its denial

4. Step 4

   Handle the retained population

   Describe a transformation of the legacy objects themselves, not a setting for future writes. Sequence it after exposure containment and assign its completion window.

   Remediate existing objects, not just future writes

5. Step 5

   Observe a harmless operation

   Restore the missing event scope and retention duration. Describe how a harmless read produces an event that arrives at the destination, with an owner and delivery deadline.

   Restore retained read telemetry and verify delivery

6. Step 6

   Make closure independently repeatable

   Pair a new configuration observation with a runtime check. Prevent rollback from reopening the original exposure and set a recurring comparison interval consistent with the daily policy.

   Prove closure without an unsafe rollback

Rules summary

• XP on pass

  60 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 15 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.