Student Rescue Challenge Briefs
Ten new independent cloud-repair incidents. Investigate, diagnose and validate; solutions are intentionally not shown.
Rescue Challenge 01 — The Vanishing Customer Portal
Incident: After a routine network change, the Acme Arcade player portal stopped responding. The compute instance is running, but browser access fails and an old administrative rule may be overexposed.
Assignment: Restore a secure public web path to the existing workload without exposing remote administration to everyone.
Business success objectives
- A running application instance is reachable through an appropriate public subnet
- Its attached security group permits web traffic from customers
- The instance has a simulated public address
- No security group permits internet-wide SSH access
Rescue Challenge 02 — The Confidential Export Incident
Incident: An internal customer export was reported as anonymously readable. Operations also suspects privileged identity and audit controls were weakened during a migration.
Assignment: Contain the exposure and restore the minimum identity and audit protections needed to investigate it.
Business success objectives
- Private, encrypted object storage for the export
- No S3 bucket in this incident can be read publicly
- Privileged IAM identities require a second authentication factor
- At least one activity trail is recording events
Rescue Challenge 03 — The Checkout Zone Evacuation
Incident: A zonal facility alert threatens the checkout application. Both running web hosts are currently dependent on one zone, and the customer database has a single-zone recovery posture.
Assignment: Make the frontend continue serving through one zone outage while keeping the relational database private and highly available.
Business success objectives
- A healthy load balancer serves compute targets in two distinct Availability Zones
- The frontend load balancer is internet-facing with two public zonal subnets
- An encrypted, private Multi-AZ database has private subnet coverage in two zones
- The protected database belongs to the same VPC as the resilient application
Rescue Challenge 04 — The Unexpected Compute Bill
Incident: A test environment is still running on an oversized instance. The financial warning policy triggers only when almost the entire budget is spent.
Assignment: Reduce simulated monthly spend without taking the application offline and make financial warnings arrive earlier.
Business success objectives
- At least one application instance remains running
- All running instances are economical pilot-sized compute
- A positive monthly budget exists
- The same budget warns at or before 70 percent
Rescue Challenge 05 — The Silent Notification Queue
Incident: Customer purchases complete, but receipts and notifications disappear when a downstream email provider returns errors. The background queue lacks a failure recovery policy.
Assignment: Establish resilient asynchronous processing for customer notifications.
Business success objectives
- A queue exists for independent background work
- The processing queue has dead-letter handling enabled
- An active Lambda worker is connected to that queue
- The worker has a reasonable execution timeout
Rescue Challenge 06 — The Missing Operations Signal
Incident: The on-call team cannot reconstruct recent control-plane changes and does not receive capacity or error alerts. Privileged access also lacks second-factor protection.
Assignment: Restore audit visibility, operational alarms, and administrator login protection.
Business success objectives
- CloudTrail records audit events
- An enabled CPU-utilization CloudWatch alarm exists
- An enabled application-error CloudWatch alarm exists
- All administrator identities use MFA
Rescue Challenge 07 — The Overwritten Launch Artwork
Incident: A designer replaced the launch banner with an incorrect image. The original object may be unrecoverable, and the asset bucket has weak data-protection settings.
Assignment: Protect the original asset and future versions without discarding the existing object.
Business success objectives
- At least one bucket retains stored application objects
- The object-containing bucket blocks anonymous public access
- The object-containing bucket uses default encryption
- Versioning is enabled to preserve revisions
Rescue Challenge 08 — Eightfold Traffic Spike
Incident: Marketing predicts an 8× increase in visitors. Current frontend capacity is healthy but the scale-out policy cannot grow and no CPU alert is active.
Assignment: Prepare the application to increase capacity while preserving healthy multi-zone routing and utilization monitoring.
Business success objectives
- A healthy public application entry point spans two zones
- A connected Auto Scaling group supports at least eight instances
- Dynamic target-tracking scaling is enabled
- A functioning CPU alarm warns operations
Rescue Challenge 09 — The Broken Edge Distribution
Incident: A new static-content deployment is offline at the edge, and the origin bucket was mistakenly left open to anonymous traffic.
Assignment: Restore secure worldwide distribution of the retained object assets.
Business success objectives
- At least one S3 origin has an uploaded object
- Origin storage is private and encrypted
- A distribution is enabled and uses HTTPS
- The enabled distribution points to the protected origin bucket
Rescue Challenge 10 — The Final Go-Live Review
Incident: A prelaunch readiness audit finds weak application health routing, incomplete database recovery, missing identity/audit controls and late cost warnings.
Assignment: Resolve the findings and demonstrate a protected, resilient release environment.
Business success objectives
- A public two-zone load balancer has healthy application targets
- The database is private, encrypted, Multi-AZ and has a recoverable backup policy
- All asset buckets are protected against public access
- Privileged IAM access uses MFA and audit logging is enabled
- A monthly budget has an early warning threshold