Triage the query results

Objectives

You inherit eight compliance queries that feed the evidence pack. Each is described with its result and how it was written.

Raise the queries whose output would mislead a reviewer. Leave the ones that are merely inelegant.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

Q-1  Admin MFA gap: INNER JOIN to mfa_enrolments, so admins with no enrolment row vanish and the result reads zero gaps.
Q-2  Leaver access: filters WHERE terminated_at > '2025-01-01' but the column is nullable; nulls silently dropped.
Q-3  Change approvals: correct join, returns 8,142 rows, matches the source count.
Q-4  Vulnerability SLA: uses SELECT * rather than named columns.
Q-5  Access review: compares status = 'Approved' against data that stores 'approved' lowercase; returns zero.
Q-6  Backup restores: query is 90 lines with no comments.
Q-7  Encryption config: correct, but run against the read replica lagging 40 hours behind production.
Q-8  Vendor list: results ordered non-deterministically without ORDER BY.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the fixture as a population, not a list

   In evidence queries the dangerous defect is the one that silently shrinks the population. Read each description for how a real violation could disappear.

2. Step 2

   Decide what actually qualifies

   Four queries can hide a true violation: an inner join that drops the exact rows you are hunting, a null-eating predicate, a case mismatch, and a stale data source.

   The right findings are raised

3. Step 3

   Resist the loud lines

   SELECT *, an uncommented query and a missing ORDER BY are maintainability issues. Log them; do not escalate them as evidence defects.

   Benign lines are left out

4. Step 4

   Grade the exposure, not the wording

   Rank by how invisible the loss is. A join that removes the unenrolled admins is worse than a lagging replica, because the replica at least reports real rows.

   A case mismatch that returns zero is loud once anyone looks; a null-dropped subset never announces itself.

   Severity matches the actual exposure

5. Step 5

   Rank so the first line is the one you act on

   Worst first is the query most likely to have already produced a false clean result in a signed pack.

   Ranked worst first

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.