Rewrite an evidence request as a specification

Objectives

The auditor emails: "Please send a screenshot showing MFA is on." Your predecessor answered this by opening the admin console, screenshotting the toggle, and pasting it into a folder called Q3-FINAL-v2-real.

A screenshot proves a setting existed on the day someone looked. Specify the evidence properly: what artefact, from which source system, covering which period, produced how, and retained for how long.

From: auditor
"Send a screenshot showing MFA is on."

Audit period: 2026-01-01 to 2026-03-31
Source of truth for MFA enrolment: Okta API
Retention expected by the audit firm: 7 years

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Re-read the brief and name the trap

   The auditor asked for a screenshot. Auditors ask in the vocabulary they inherited; the underlying requirement is proof that the control operated throughout the period, not proof that a toggle looked right once.

   Answering the literal request is the trap. Answer the requirement instead.

2. Step 2

   Read the fixture

   The request thread quietly states three facts: the audit window, the system that is the source of truth, and how long the firm expects the evidence to be kept. Every value you need is stated there: nothing has to be invented.

3. Step 3

   Read the starter

   One field is filled in with the wrong kind of thing, two are empty dates, one collection value is wrong, and one number is zero. Five of the six lines need attention.

4. Step 4

   Artefact and source

   Ask: is my artefact something that can be re-generated and diffed, or is it an image? Name the class of data the source system can export about enrolment.

   Then name the source system itself, exactly as the fixture names it, so the specification points at one authority rather than at "the console".

   Artefact is a dataset, not a screenshotSource system is named

5. Step 5

   Period coverage

   Evidence covers a window, not a moment. Both boundary dates come straight from the fixture; a specification that stops short of either end leaves an uncovered gap the auditor will find.

   Covers the full audit period

6. Step 6

   Collection and retention

   Collection describes how the artefact is produced next time. Ask whether your value means a job runs or a person remembers.

   Retention is a number, and the fixture states the expectation. Meeting it is the bar; under-shooting fails.

   Collection is automatedRetention meets the 7-year expectation

7. Step 7

   Run and read the failures

   If a check fails, go back to the fixture line that covers it. This lab is graded against the stated facts, not against your judgement of what is reasonable.

Rules summary

• XP on pass

  30 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 8 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.