grceng.academy
Triage lab 40 bonus XP

Triage the evidence store audit

Start labRead the room

Objectives

An internal review of the evidence store produced eight observations. You can escalate only the ones that would stop an auditor relying on the artefacts.

Raise what genuinely compromises integrity, custody or availability of evidence. Leave the housekeeping.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

Evidence store review: observations

I-1  The collector holds write and delete permissions on the bucket; February digests no longer match the run log.
I-2  Run log timestamps are recorded in local time rather than UTC.
I-3  A lifecycle rule deletes objects after 90 days; the audit period is twelve months and reports land three months later.
I-4  Object names still contain the pre-rebrand project code.
I-5  The digest register is a spreadsheet maintained by a contractor whose engagement ended in April.
I-6  Stored payloads carry no run id, so an artefact cannot be traced to the execution that produced it.
I-7  The storage console lists artefacts in a different order than the review checklist.
I-8  Bucket storage cost rose 12% after the estate grew.

Checks the server runs (4)

  • The right findings are raised
  • Benign lines are left out
  • Severity matches the actual exposure
  • Ranked worst first

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Read the fixture as a population, not a list

    Judge each observation against a single sentence: can we still show an auditor the artefact that was produced, prove nothing changed it, and say what produced it?

  2. Step 2

    Decide what actually qualifies

    Four observations break that sentence: one destroys evidence outright, one allows silent overwrites, one puts the integrity register in an editable document owned by nobody, and one removes the link between an artefact and its run.

    The right findings are raised

  3. Step 3

    Resist the loud lines

    Timezone formatting, stale naming, console ordering and storage cost are all real tidiness issues and none of them changes what the evidence proves.

    Benign lines are left out

  4. Step 4

    Grade the exposure, not the wording

    Irreversible loss outranks everything: an artefact deleted before the report lands cannot be recovered by any later fix.

    Overwritable storage comes next because it already produced a digest mismatch, then the unowned digest register, then the missing run id.

    Severity matches the actual exposure

  5. Step 5

    Rank so the first line is the one you act on

    Rank by what you cannot undo. Deletion first, then tampering exposure, then the ability to attribute a record.

    Ranked worst first

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.