grceng.academy
YAML lab 40 bonus XP

Specify the reception switch handover

Start labRead the room

Objectives

Halcyon Clinics needs a declarative handover plan for reception port p7 and uplink p24. The installer proposes making p7 a trunk and calls VLAN membership an access-control rule. Use the approved requirements in the fixture, not that proposal.

Fill every empty field. Numeric fields hold VLAN IDs, allowed_vlans is a list, and booleans state whether safeguards are enabled. For enforcement and evidence, use short descriptions naming an actual routed policy mechanism and a denied-connection test. This plan records requirements; it does not configure a physical switch.

Approved design and test scope

p7: reception endpoint; untagged; VLAN 20; never a switch uplink
p24: fixed 802.1Q trunk to peer; carry exactly VLAN 20 and VLAN 30 as tagged traffic
native policy: both ends VLAN 999, no endpoint membership, excluded from allowed data VLAN list
ARP inspection: required on reception VLAN; valid dynamic and static bindings supplied separately
edge safety: p7 uses BPDU guard; spanning tree remains enabled
routing: reception must not reach clinical administration; enforce at routed boundary
handover evidence: record a denied connection test, not just VLAN configuration

Checks the server runs (6)

  • Endpoint port has fixed access membership
  • Uplink permits exactly the approved tagged VLANs
  • Native classification agrees without endpoint membership
  • Local address claims are inspected
  • Tree and endpoint bridge safeguards remain enabled
  • Routed enforcement has denied-path evidence

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Classify each port by its peer

    Compare the endpoint role with the uplink role. Choose fixed modes appropriate to those peers and take membership from the approved design, not the installer's shortcut.

    Endpoint port has fixed access membershipUplink permits exactly the approved tagged VLANs

  2. Step 2

    Resolve the tagless case

    Compare both ends' untagged-frame classification and check whether any endpoint could enter that membership. Keep this separate from the tagged data allow-list.

    Native classification agrees without endpoint membership

  3. Step 3

    Protect neighbour resolution and topology

    Use real boolean values for required safeguards. Distinguish checks on local address claims from controls on redundant links and unexpected bridges at an endpoint.

    Local address claims are inspectedTree and endpoint bridge safeguards remain enabled

  4. Step 4

    Prove the forbidden path fails

    Name the mechanism that makes routed permission decisions, then describe evidence from attempting a prohibited connection. A membership label alone answers neither question.

    Routed enforcement has denied-path evidence

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.