grceng.academy
Triage lab 40 bonus XP

Triage the operational evidence queue

Start labRead the room

Objectives

The coordinator calls every line critical because it contains security terminology. The queue includes normal observations and verified changes as well as actual defects.

Use this exercise scale: active destructive compromise is critical; a confirmed unauthorized modification path is high; an isolated test coverage gap is medium; verified-state documentation hygiene is low. Informational verified observations are noise.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

Observed events with scope and impact

IT2-1  ACTIVE: attacker-controlled account is currently deleting the sole process isolation evidence copy; stop ongoing destruction.
IT2-2  EXPOSED: unauthorized users can modify service privilege configuration; exploit path confirmed, no current exploitation.
IT2-3  LIMITED: one isolated test node lacks a required kernel boundaries observation; production unaffected.
IT2-4  HYGIENE: documentation heading for process isolation is stale, but measured state and coverage are verified.
IT2-5  The kernel mediates CPU scheduling, memory mappings and device access. Verified informational baseline observation, no gap.
IT2-6  A process is a running program with an identity, open descriptors and execution state. Verified informational mechanism observation, no gap.
IT2-7  Scheduled collector heartbeat received within the approved window; no missed collection.
IT2-8  Approved maintenance completed with independent post-change evidence and no unresolved finding.

Checks the server runs (4)

  • The right findings are raised
  • Benign lines are left out
  • Severity matches the actual exposure
  • Ranked worst first

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Read the fixture as a population, not a list

    Read the severity policy before scanning alarming words.

  2. Step 2

    Decide what actually qualifies

    Include actual defects, not verified routine observations.

    The right findings are raised

  3. Step 3

    Resist the loud lines

    Exclude observations that explicitly establish expected healthy operation.

    Benign lines are left out

  4. Step 4

    Grade the exposure, not the wording

    Compare current impact, exposure, scope and evidence certainty with the exercise scale.

    Severity matches the actual exposure

  5. Step 5

    Rank so the first line is the one you act on

    Sort selected findings by the defined severity policy; do not sort by fixture typography.

    Ranked worst first

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.