grceng.academy
Query lab 40 bonus XP

Find the collectors that are lying to you

Start labRead the room

Objectives

Six evidence collectors feed the control platform. The dashboard is green because it colours on the `status` column, and status is written by the collector itself.

A collector is only useful if it ran recently and brought data back. Return the `name` of every collector whose most recent run cannot support evidence today.

Table: collectors

name          source  hours_since_run  rows_returned  status
okta-users    okta    2                412            ok
aws-config    aws     30               0              ok
github-prs    github  49               900            ok
jira-tickets  jira    3                0              error
gcp-iam       gcp     1                88             ok
vault-audit   vault   6                15             ok

Freshness rule: a collector must have run within the last 24 hours.
Return one column: name.

Checks the server runs (5)

  • Query runs and returns a name column
  • Silent failures are caught
  • Stale collectors are caught
  • Healthy collectors are left out
  • Exactly the unusable collectors

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Re-read the brief and name the trap

    The dashboard trusts a self-reported field. Two of the failing collectors never set it, which is exactly why the dashboard is green.

    Your query should be able to reach the same conclusion with the status column deleted.

  2. Step 2

    Two observable properties

    Every row carries a recency number and a volume number. Between them they answer "did it run" and "did it bring anything back", which is the whole definition of a working collector.

    The freshness boundary is stated in the rule and one row sits well past it while still claiming success.

    Query runs and returns a name columnStale collectors are caught

  3. Step 3

    An empty result is not a pass

    Ask what a control evaluator does with zero rows: it either asserts vacuously true or it errors. Both are worse than knowing the collector is broken.

    Include the volume condition even for collectors that ran minutes ago.

    Silent failures are caught

  4. Step 4

    Do not over-collect

    Two collectors are fine on both properties. Run your conditions mentally against them before you submit: if either appears, one boundary is off by one.

    Healthy collectors are left outExactly the unusable collectors

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.