grceng.academy
YAML lab 40 bonus XP

Specify measurable operations controls

Start labRead the room

Objectives

Alder Quay's manager proposes 'regular' reviews, a fresh SLA clock after every scan, and closing tickets when patches are scheduled. Turn the actual requirements into structured policy instead.

Fill the starter with the fixture's exact values. This checks declared policy fields, not whether any live system enforces them.

Approved example operations baseline

access: review every 90 days; disable leavers within 4 hours
change: emergency authorization required before execution; retrospective review within 2 business days
vulnerabilities: calendar days from first confirmed detection; critical 7, high 30, medium 90, low 180
closure: verified remediation
exceptions: risk-owner approval and expiry required
logging: searchable 90 days; protected archive 365 days

Checks the server runs (6)

  • Set access review and leaver deadlines
  • Keep emergency authorization and retrospective oversight
  • Set all severity deadlines and the original clock trigger
  • Close only with verification
  • Require accountable, time-limited exceptions
  • Set searchable and archive retention separately

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Separate recurring and triggered access work

    Find the periodic entitlement check and the deadline triggered by departure. Map each to its own unit-bearing field.

    Set access review and leaver deadlines

  2. Step 2

    Preserve the urgent authorization path

    Identify what must happen before an urgent action and the separate oversight deadline after execution.

    Keep emergency authorization and retrospective oversight

  3. Step 3

    Make vulnerability aging reproducible

    Translate each severity's deadline and choose the policy's initial aging event, not the most recent observation.

    Set all severity deadlines and the original clock trigger

  4. Step 4

    Define completion

    Use the fixture's completion criterion rather than a planned maintenance action.

    Close only with verification

  5. Step 5

    Bound residual risk

    Represent both accountable authorization and the time boundary; neither is sufficient on its own.

    Require accountable, time-limited exceptions

  6. Step 6

    Distinguish retrieval tiers

    Read the two retention periods independently. The archive requirement does not replace the searchable requirement.

    Set searchable and archive retention separately

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.