Accept or bounce an evidence bundle

Objectives

A control owner has uploaded six artefacts for the Q3 access control test and marked the request complete. The audit is in nine days.

Accept the artefacts that would let an independent reviewer reach the same conclusion you would. Reject the rest: the ones that are out of period, cannot be tied back to a source, cover the wrong population, or are not evidence of the control at all.

Verdicts are accept or reject. Every rejection needs one reason code from: unverifiable | outside-period | wrong-population | not-evidence.

E-1  okta_admins_2025-09-30.csv: API export, run id 8841, covers all admin roles, period end date.
E-2  screenshot_admin_page.png: a photo of a laptop screen showing the Okta admin page.
E-3  access_review_signoff.pdf: signed 2 Oct, lists reviewers and decisions for the Q3 population.
E-4  okta_admins_2025-06-30.csv: same export shape, dated the end of Q2.
E-5  production_users.csv: every user with any production login, not only administrators.
E-6  policy_access_control_v4.pdf: the access control policy document.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the request before the artefact

   Evidence has to answer a question an independent reviewer can pose: what was true, about which population, during which window, and how do I know this file reflects it?

2. Step 2

   Judge every line, including the boring ones

   All six upload lines need a verdict. Sending back a partial review invites a second partial upload and burns the nine days you have.

   Every line in the fixture carries a verdict

3. Step 3

   Separate what is wrong from what is merely ugly

   Separate the date the artefact was produced from the date the artefact describes. Those are different questions and only one of them decides period fit.

   Then ask whether the file names its own provenance, a run id, an export path, something that lets a reviewer regenerate it, and whether its population matches the control's scope.

   Accept and reject land on the right lines

4. Step 4

   Say why, in the vocabulary the programme uses

   A photo of a screen and a policy PDF fail for different reasons. One cannot be traced to a source; the other is not about what happened at all.

   Each rejection cites a valid reason code

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.