Approve and recover a hosted application release

10:14:02 database role created 10:14:03 empty database created 10:14:04 wrote C:\ProgramData\Northwind\portal.env; inheritance removed 10:14:19 hosted-settings: OAUTH_CLIENT_ID is empty 10:14:19 hosted-settings: STAFF_PROVIDER_SUBJECT is empty 10:14:19 process exit code=1

portal=> \dt django_migrations Did not find any relation named "django_migrations". PS> Get-ScheduledTask -TaskName NorthwindPortal Get-ScheduledTask: No matching task was found. PS> Get-NetTCPConnection -State Listen -LocalPort 8443 <no objects> PS> Get-NetFirewallRule -DisplayName 'Northwind Portal 8443' Get-NetFirewallRule: No matching rule was found. edge probe: GET https://learn.northwind.test/ -> 502

& $python -m pip install --requirement requirements.lock & $python manage.py check_hosted_settings --strict if ($LASTEXITCODE -ne 0) { throw 'Hosted settings rejected' } & $python manage.py check --deploy & $python manage.py migrate & $python manage.py collectstatic --noinput Register-ScheduledTask -TaskName NorthwindPortal ... New-NetFirewallRule -DisplayName 'Northwind Portal 8443' ... Start-ScheduledTask -TaskName NorthwindPortal

Source	Observed extract
Cloud audit	interactive administrator sign-in; second factor=TOTP
Gateway audit	policy=owner-console; decision=allow; amr=mfa; aud=console-prod
Gateway policy	owner-console session duration=expires immediately; every request is re-challenged
Origin request	Cf-Access-Jwt-Assertion=[redacted]; request path=/login
Application settings	REQUIRE_OWNER_TOTP=True; owner_session_max_age=900
Review proxy	upstream=127.0.0.1; auth header added by server process
Browser capture	review API bearer header absent
Content manifest	approval sha256=91a…; package sha256=c42…
Backup report	task result=0; archive size=38 MiB; pg_restore list=not run; restore test=none
Firewall draft	TCP 8443 inbound; remote address=Any

Source

Observed extract

Cloud audit

interactive administrator sign-in; second factor=TOTP

Gateway audit

policy=owner-console; decision=allow; amr=mfa; aud=console-prod

Gateway policy

owner-console session duration=expires immediately; every request is re-challenged

Origin request

Cf-Access-Jwt-Assertion=[redacted]; request path=/login

Application settings

REQUIRE_OWNER_TOTP=True; owner_session_max_age=900

Review proxy

upstream=127.0.0.1; auth header added by server process

Browser capture

review API bearer header absent

Content manifest

approval sha256=91a…; package sha256=c42…

Backup report

task result=0; archive size=38 MiB; pg_restore list=not run; restore test=none

Firewall draft

TCP 8443 inbound; remote address=Any

host=edge-review-01; enforcing mode=enabled change record: reviewed proxy artifact=/opt/northwind/nginx/portal.conf.reviewed current link=/etc/nginx/conf.d/portal.conf nginx.service: inactive; boot state: disabled journal: unexpected '}' in portal.conf:18 firewalld: runtime services=ssh; permanent services=ssh SELinux: denied name_connect; source httpd_t; target http_port_t tcp 8443 semanage port -l: http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 getsebool: httpd_can_network_relay --> off; httpd_can_network_connect --> off policy note: httpd_can_network_relay permits httpd_t to connect to HTTP, HTTP-cache, FTP and a few other proxy-related port types, not any port; httpd_can_network_connect permits any TCP port

matching

Using the audit and request extracts, match each control to the boundary it is meant to protect.

5 pts

Cloud account TOTP → Access-gateway TOTP → Application TOTP → Gateway JWT validation → Internal owner-review API token →

Need a hint?

Start with the row and choice that have the most distinctive purpose, then use that pair to narrow the rest.

Show another hint

For each remaining pair, explain the relationship in one sentence before selecting it.

multi select

The gateway policy re-challenges every request. It interrupts a POST to `/login/totp` and later resumes that URL with GET. Select the THREE safe fixes or diagnostics.

3 pts

Use a bounded gateway session instead of expiring it immediately Make GET `/login/totp` return safely to the signed application login flow Label the three authenticator entries and log outcomes without recording codes Have the gateway replay the intercepted POST body after authentication Expand application TOTP acceptance to ten minutes on either side Skip JWT audience validation only during the login handoff

Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

single choice

What is the strongest inference from the deployment state and installer order?

3 pts

The settings gate exited before migrations and runtime installation stages began The first schema migration failed and cleanup removed every runtime artifact Task registration failed after migrations and static collection had completed The application started correctly but the edge route targets the wrong origin

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

multi select

Select the FOUR controls required before releasing the portal.

4 pts

Generate independent secrets and keep the production environment in an ACL-protected file outside Git Bind private-source approval to the exact content digest and reject stale decisions Allow the application port only from the reverse proxy while preserving a tested management exception Require backup-task success, parse the archive, and perform an isolated restore test Send the internal review service token as an HttpOnly cookie on owner-console responses Treat a successful backup task and a nonempty archive file as sufficient recovery proof

Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

linux cli

Use the isolated training shell to diagnose and recover the failed edge proxy. Select the reviewed configuration, restore current and boot-time service, keep SELinux enforcing while enabling only the narrowest boolean that allows the proxy connection to the HTTP-labelled port, and publish HTTPS persistently through the host firewall.

5 pts

edge-review-01systemd service recovery

Browser shell

Need a hint?

Inspect the current files, permissions, logs, or service state before changing anything; use help to review the bounded command set.

Show another hint

Make the smallest state change supported by the evidence, then rerun the relevant checks to verify the result.

Original practice · Review pending

Inspect the evidence

Bootstrap transcript

Host observations after the bootstrap

Relevant installer excerpt

Authentication and release review extracts

Failed edge-proxy handoff

Complete the response

Using the audit and request extracts, match each control to the boundary it is meant to protect.

The gateway policy re-challenges every request. It interrupts a POST to `/login/totp` and later resumes that URL with GET. Select the THREE safe fixes or diagnostics.

What is the strongest inference from the deployment state and installer order?

Select the FOUR controls required before releasing the portal.

Review your result

Attempt history

Question or answer look wrong?