grceng.academy
YAML lab 35 bonus XP

Split one document into three layers

Start labRead the room

Objectives

The company has a single three-page "Password Policy" that contains an intent statement, key lengths, click-by-click reset steps and an Okta configuration snippet. Every change to any of those requires the CISO to re-sign the whole document.

Sort the five statements into the layer each belongs to, then say where the standard is actually enforced and how often the policy layer is reviewed.

Statements lifted from the current document

S1  The company protects accounts with authentication
    strong enough for the sensitivity of the system.
S2  Passwords are at least 14 characters and MFA is required
    for all administrative access.
S3  To reset your password, open the IT portal, choose Reset,
    then approve the push notification on your phone.
S4  okta_password_policy: { min_length: 14, mfa_required: true }
S5  Exceptions are granted by the CISO and expire after 90 days.

Layers: policy (intent and authority) | standard (measurable
requirements) | procedure (how a human performs a task)
Systems in play: okta, it-portal, confluence

Checks the server runs (5)

  • Every statement appears exactly once
  • Policy layer holds intent and authority
  • Standard layer holds measurable requirements
  • Procedure layer holds the human task
  • Enforcement point is a system

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Re-read the brief and name the trap

    The pain is not that the document is wrong; it is that four different change cadences are stapled together. A key length changes with the threat model, a portal screen changes with a vendor release, intent changes almost never.

  2. Step 2

    Classify by question, not by tone

    Read each statement and decide whether it answers why we care, what must be true, or how a person does something. Formality is misleading: the most technical-looking line is not automatically the procedure.

    Exactly one statement describes a human performing steps.

    Policy layer holds intent and authorityStandard layer holds measurable requirementsProcedure layer holds the human task

  3. Step 3

    Account for all five

    Every identifier from the fixture must land in exactly one list. Duplicating a statement across layers recreates the problem you are solving, and dropping one silently deletes a requirement.

    Every statement appears exactly once

  4. Step 4

    Where does the standard actually bite?

    A document does not reject a 12-character password. Name the system from the fixture that refuses the login, so the standard has somewhere to be tested against.

    Enforcement point is a system

  5. Step 5

    Give the policy layer a cadence

    The policy layer is the slow one. Give it a review cadence a scheduler could act on rather than a description of when someone remembers.

    Enforcement point is a system

Rules summary

  • XP on pass

    35 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 9 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.