grceng.academy
YAML lab 40 bonus XP

Repair the appointment network plan

Start labRead the room

Objectives

Halcyon Clinics needs an entry tier, private workers with update access, and isolated data services. The draft puts an internet default route on every subnet and calls that 'private because the addresses start with 10'. Replace the draft with the constrained IPv4 design in the fixture.

Complete every empty YAML field. Gateway placement and public addressing in the fixture are already implemented. Use exactly the listed CIDRs, default destinations and target labels; document the supported service's private access mechanism and the peering property that forbids chained transit.

Approved allocations and design constraints

network: 10.48.0.0/16
entry allocation: 10.48.10.0/24
application allocation: 10.48.20.0/24
data allocation: 10.48.30.0/24
internet gateway: attached
NAT gateway: in entry subnet, public address assigned
route target labels: internet-gateway | nat-gateway | none
entry: internet default required
application: translated outbound default required; public_address must be false
data: no default; write none for destination and target
service: supported private endpoint; public service path forbidden
peering: A-B and B-C only; no transit service

Checks the server runs (6)

  • Use the approved network and three subnet allocations
  • Give entry the direct internet default
  • Give private workers translated outbound access
  • Omit a default route from data
  • Choose private managed-service access
  • Reject chained peering transit

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Check the allocations

    Compare every address block with its tier in the allocation register. Check boundaries and containment before considering traffic.

    Use the approved network and three subnet allocations

  2. Step 2

    Trace two egress paths

    For each internet-enabled tier, identify whether the next hop attaches directly to the internet or first translates a private source. Keep the worker interface's addressing consistent with its role.

    Give entry the direct internet defaultGive private workers translated outbound access

  3. Step 3

    Stop unwanted defaults

    Represent absence explicitly in both data route fields. Internal connectivity need not imply a catch-all external path.

    Omit a default route from data

  4. Step 4

    Separate service reachability from transit

    Name the mechanism that avoids the service's public access path. Then describe whether two peer links compose into a third path without another routing service.

    Choose private managed-service accessReject chained peering transit

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.