At Halcyon Clinics, an engineer made a patient export container public during a transfer. The configuration scanner caught the change six hours later, but the incident team could not establish who downloaded the records: administrative events were collected, object reads were not. The service owner called the green audit dashboard proof that nothing had been stolen.
Your job is to separate three questions: who changed the environment, who accessed its contents, and whether its current configuration violates policy. You will design an independently controlled logging destination, set explicit retention and health checks, and prioritise posture findings without treating a clean scan as proof of a clean incident history.
No recorded download can mean no download occurred, or that the relevant data-access events were never collected. Prove coverage before drawing conclusions.
Two planes, two different questions
Control-plane audit logs record management API operations such as creating a key, changing a storage access policy, or stopping a logging stream. Data-plane logs record operations on the contents, such as reading an object or querying a table. A public-policy change followed by 500 object reads is two linked event populations, not one. A network flow record can show bytes and endpoints without identifying the object or the authenticated caller; application logs add business context but do not replace authoritative service events.
Build a source inventory by account, region, service and event category. Verify whether reads and writes require separate selectors and whether anonymous access is represented. Data-plane volume can dominate cost: 2 million reads per day at 1 KB per event is roughly 2 GB per day before indexing or replication. Scope collection by data sensitivity rather than silently dropping successful reads. Preserve event time, ingestion time, actor or anonymous status, action, resource identifier, result, source address and request identifier for correlation; tolerate delayed and duplicate delivery.
For an audit-logging control, retain the selector configuration and a test pair: a harmless management change and a test object read with corresponding delivered events. The auditor's question is not 'is logging enabled?' but 'which accounts and operations are omitted, and how was end-to-end delivery tested?' A missing read event after a controlled test exposes a coverage gap, not evidence that production reads are absent.
Administrative changes and content access require distinct event coverage before they can be correlated.
Centralise without centralising the attacker’s permissions
Route logs from workload accounts to a dedicated security account with independent administration. Give a narrowly scoped delivery identity permission to append only for approved sources; workload administrators must not be able to delete the destination, shorten retention, or destroy its encryption keys. Encrypt transport and stored records, restrict investigative reads, and audit access to the archive itself. A different container in the compromised workload account does not create an independent trust boundary.
For this room's policy, keep 90 days searchable and 365 days in total, measured from ingestion; the archive therefore covers the remainder rather than adding another 365 days. Use time-bound deletion protection for the required period, governed legal holds when necessary, and separately protected keys whose lifetime supports recovery. Test a restore and query from the older tier. Retention duration is a risk and legal decision, not a universal statutory number; longer collection can also increase privacy exposure.
Monitor delivery rather than only stream configuration. Compare source inventory with destinations, track ingestion delay, and generate a controlled heartbeat every five minutes; alert if it has not arrived within fifteen minutes. Quiet production traffic alone cannot distinguish an idle service from a broken pipeline. Evidence for separation of duties includes destination permissions, denied deletion tests, retention settings and restore results; an auditor may ask whether a workload administrator can erase both the activity and its trail.
A separate account protects evidence only when permissions, retention and delivery monitoring preserve that boundary.
Configuration rules become a posture programme
A configuration rule evaluates resource attributes against a defined condition. Check storage policy and access lists for anonymous access; evaluate firewall ingress for TCP 22 and 3389 from both 0.0.0.0/0 and ::/0; compare credential last-used timestamps with an approved inactivity threshold; and reconcile required log sources with enabled streams. Age since key creation is not age since last use. Unknown last-use telemetry is not proof of inactivity, and a private address alone does not establish that an administrative path is authorised.
Posture management aggregates these rules across an inventory, adds ownership and exposure context, tracks exceptions and drives remediation. Event-triggered evaluation catches changes quickly; a daily full reconciliation catches missed events and newly discovered accounts. Report evaluated resources divided by in-scope resources: 180 passing checks among 200 evaluated resources is not 90% compliance if the true population contains 300 resources. Stale evaluations should become unknown, not silently remain passing.
Attach a rule version, evaluation timestamp, resource snapshot, owner and deadline to each finding. Exceptions need an approver, compensating controls and an expiry date; suppressing a finding indefinitely is not acceptance of residual risk. For configuration-management controls, an auditor should be able to trace a failed rule through a change record to a fresh passing evaluation. Screenshots of today's score cannot demonstrate that yesterday's failures were handled.
Prioritise exposure, then verify closure
Public storage containing confidential records warrants immediate containment and an incident assessment, even without an observed download. Restrict access while preserving evidence and checking dependent workflows. Internet-open administrative ports increase attack surface; replace unrestricted ingress with an approved management path and verify reachability. A genuinely unused long-lived key should be disabled after dependency checks, monitored for breakage, then revoked under the credential procedure; a still-used key needs controlled replacement, not an unsupported 'unused' label.
Disabled logging is both a configuration failure and an evidence gap. Re-enable collection, preserve disable events already delivered centrally, establish the missing interval and investigate activity through independent sources. Enabling it today cannot recreate yesterday's unrecorded object reads. Automatic remediation can safely enforce some public-access blocks, but blind key deletion or firewall rewrites can interrupt care systems; use scoped permissions, approvals where impact demands them, and tested rollback paths.
Close a finding only after a fresh rule evaluation and a functional test confirm the intended result. Retain detection time, containment time, owner, exception or approval, before-and-after configuration and evidence of restored logging. These support incident-response and corrective-action controls. An auditor asking 'how quickly did you remove exposure?' needs a defensible timeline, not a ticket marked complete without a retest.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The green dashboard
Scenario sim+65 XP
Read the brief and answer both questions.
Incident brief
A storage policy became public at 09:00. The investigator finds the policy-change event but no object-read events. The owner says, 'Our audit log proves nobody read it.' The event selector records only management operations, and object reads were never enabled.
Term bank, not all of these are right
control planedata planenetwork flowapplication trace
1.1Which plane produced the policy-change event? (two words)
1.2Which plane's logging is missing for the object reads? (two words)
Task 2: A second container is not separation
Scenario sim+65 XP
Read the brief and answer both questions.
Incident brief
An engineer labels a second container in the workload account 'independent archive', although the workload administrator can delete both containers. The approved design instead uses an independently administered account and requires 90 searchable days within 365 total retained days. Procurement proposes deleting everything on day 90 to save money.
Term bank, not all of these are right
separate accountseparate container90365
2.1Which destination boundary does the approved design require? (two words)
2.2How many total days must records remain retained under this policy? (a number)
Task 3: An old key and an old silence
Scenario sim+65 XP
Read the brief and answer both questions.
Incident brief
A reviewer calls a 200-day-old key 'unused', despite a successful authenticated request yesterday. Its creation timestamp does not satisfy the inactivity rule. Meanwhile, a scanner discovers a disabled log stream: the last delivered event was Tuesday 14:00 and restoration is confirmed Thursday 14:00. The owner claims restoration backfilled all missing reads, but the service has no retrospective event recovery.
Term bank, not all of these are right
last usedcreation date480
3.1Which timestamp should the inactivity rule use instead of key creation? (two words)
3.2How many hours of collection gap must the investigation record? (a number)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Halcyon's draft labels management events 'complete access history' and sends them to a workload-owned container. The platform lead says storage encryption makes administrator deletion impossible. Write a collection plan against the binding requirements below, not those claims.
Fill every empty field. Use booleans for toggles and numbers for days and minutes. The destination identifier is prescribed; describe the two remediation intents in short text, without executable commands.
Binding security requirements
source_account: care-prod
security_account: evidence-core
scope: management events and sensitive object reads
permissions: workload administrators cannot delete central records
retention: exactly 90 searchable days, exactly 365 total days from ingestion
archive: deletion protection enabled for required retention
health: alert after exactly 15 minutes without the controlled heartbeat
rules: enable public-storage and open-admin-port checks
remediation: restrict public storage; disable confirmed unused keys after dependency review
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Checks
Both required event categories are collected
Central evidence is outside workload deletion authority
Search and total retention match the policy
Retention is protected from deletion
Missing delivery raises an alarm on time
Exposure rules and remediation intents are present
The dashboard sorted findings by key age, putting a working credential above public clinical records. Triage only the actionable failures in this snapshot; older does not automatically mean riskier.
Use this exercise's explicit severity policy: confirmed public confidential records are critical; unrestricted internet administration is high; a disabled required log stream is medium; a confirmed unused key with no effective permissions is low. Rank in that order. Documented, unexpired exceptions with tested compensating controls are noise for this queue.
List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.
08:00 posture snapshot
CLP-1 | Object container permits anonymous reads of confidential patient exports; test confirms access.
CLP-2 | Public web listener TCP 443; approved public service, valid certificate, no administration route.
CLP-3 | Host administration TCP 22 reachable from 0.0.0.0/0 and ::/0; no approved exception.
CLP-4 | Required management log stream disabled for one workload; no recovery source for missing events.
CLP-5 | Key unused for 120 days, beyond the 90-day policy; reliable usage telemetry, no dependencies and no effective permissions; still enabled.
CLP-6 | Key created 220 days ago, used yesterday; follows approved replacement schedule.
CLP-7 | Sensitive read-log test arrived at central archive; selector and delivery verified today.
CLP-8 | TCP 3389 restricted to approved management network; unexpired reviewed exception, access controls and reachability tested.
1
2
3
4
5
6
7
8
9
10
11
12
Checks
The right findings are raised
Benign lines are left out
Severity matches the actual exposure
Ranked worst first
Next on your path · Cloud Fundamentals
Cloud Fundamentals Capstone
Reconstruct cloud attack paths, rank account control gaps, and deliver a testable remediation plan.
