grceng.academy
YAML lab 40 bonus XP

Repair the evidence collection plan

Start labRead the room

Objectives

Halcyon's draft labels management events 'complete access history' and sends them to a workload-owned container. The platform lead says storage encryption makes administrator deletion impossible. Write a collection plan against the binding requirements below, not those claims.

Fill every empty field. Use booleans for toggles and numbers for days and minutes. The destination identifier is prescribed; describe the two remediation intents in short text, without executable commands.

Binding security requirements

source_account: care-prod
security_account: evidence-core
scope: management events and sensitive object reads
permissions: workload administrators cannot delete central records
retention: exactly 90 searchable days, exactly 365 total days from ingestion
archive: deletion protection enabled for required retention
health: alert after exactly 15 minutes without the controlled heartbeat
rules: enable public-storage and open-admin-port checks
remediation: restrict public storage; disable confirmed unused keys after dependency review

Checks the server runs (6)

  • Both required event categories are collected
  • Central evidence is outside workload deletion authority
  • Search and total retention match the policy
  • Retention is protected from deletion
  • Missing delivery raises an alarm on time
  • Exposure rules and remediation intents are present

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Trace both kinds of activity

    Compare settings changes with content access. Check that neither event category disappears in the collection plan.

    Both required event categories are collected

  2. Step 2

    Challenge the deletion path

    Identify which administrative domain owns the destination and whether a compromised source administrator can erase it.

    Central evidence is outside workload deletion authority

  3. Step 3

    Separate duration from enforcement

    Copy the policy's fast-query and whole-lifetime requirements into their respective fields. Then ask whether those durations can be bypassed by deletion.

    Search and total retention match the policyRetention is protected from deletion

  4. Step 4

    Detect pipeline silence

    Use the fixture's deadline for a missing controlled signal, rather than waiting indefinitely for natural traffic.

    Missing delivery raises an alarm on time

  5. Step 5

    Pair detection with safe action

    Enable each specified exposure check. Describe an access-reducing response for storage and a credential-lifecycle response for confirmed inactivity.

    Exposure rules and remediation intents are present

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.