grceng.academy
YAML lab 40 bonus XP

Repair the portal boundary plan

Start labRead the room

Objectives

Halcyon Clinics needs a machine-readable target plan for its portal boundary. The change requester says a private database address and an alerting mirror sensor already provide prevention, so retaining the emergency any-any allowance would be harmless.

Fill the fixed plan fields using the approved dependency sheet. These are target decisions, not a complete device configuration. Preserve only the specified application-to-database initiation, select connection-aware filtering, remove the broad allowance, and define usable review evidence.

Approved dependency sheet and evidence requirements

Public listener zone: DMZ
Application subnet: 10.40.20.0/24
Database host: 10.40.30.8/32
Only database initiation: application subnet -> database host, TCP 5432
Return handling: connection table; no blanket reverse ephemeral-port opening
Unmatched traffic: deny
Emergency any-any: must not remain enabled
Threat requirement: inline blocking, not a mirrored alert feed
Evidence: flow logging enabled; review every 90 days; record rule owner and approval

Checks the server runs (6)

  • Public listener has the approved boundary role
  • Filtering and default action enforce constrained initiation
  • Emergency broad access is disabled
  • Database dependency has exact endpoints and service
  • Inspection can block inline
  • Logging and accountable periodic review are specified

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Place the public listener

    Choose the perimeter role from the sheet, not a claim of trust based on address space.

    Public listener has the approved boundary role

  2. Step 2

    Constrain new conversations

    Determine whether reverse handling depends on remembered connections, what happens to unmatched packets, and whether the emergency bypass survives.

    Filtering and default action enforce constrained initiationEmergency broad access is disabled

  3. Step 3

    Transcribe one dependency

    Compare both address scopes, the transport, and the destination listener against the approved dependency. Do not expand a host requirement into a whole network.

    Database dependency has exact endpoints and service

  4. Step 4

    Verify enforcement and accountability

    Choose inspection based on the required forwarding action. Then include collection status, the stipulated review interval, and the two accountability records requested by the evidence sheet.

    Inspection can block inlineLogging and accountable periodic review are specified

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.