Challenge Archive

An organization's only CloudTrail trail was created with the commands below and never modified afterwards. An attacker steals an IAM user's access key, enumerates the account, adds a second access key for persistence, reads an encrypted SSM parameter, and then downloads every object in the acme-reports bucket. Which of the attacker's actions leaves NO entry in that trail?

A linear model is fit on two features that are almost the same column. The fitted coefficients come out enormous and opposite in sign, yet R-squared is essentially identical to a fit on x1 alone. What is going on, and what does the Variance Inflation Factor measure?

What two lines does this code log?

You run the first command below on your laptop against a cluster whose current kubeconfig context is named kind-prod, then immediately run kubectl get pods. What changed, and which Pods are listed?

A co-working space upgrades its access point to WPA3-Personal but leaves WPA3/WPA2 transition mode enabled so older devices still connect, with the same passphrase used for both. The network team reports that members now get SAE's resistance to offline dictionary attacks. What can an attacker within radio range still do?

What does this Go program print, given what time.Time.Truncate rounds down to?

What does the compiler report for the two enum declarations below?

What three values, then what fourth line, does this code log?

You run the command below against the app.properties file shown. What keys does the resulting ConfigMap contain?

A health startup publishes a "de-identified" research extract. It drops the name, email and national-ID columns and replaces the internal patient id with a fresh random UUID per row; the mapping table stays in-house. Every published row still carries exact date of birth, 5-digit ZIP code, sex and diagnosis. Legal signs off because "no direct identifier remains". Why is that reasoning wrong?

What does this Go program print on its three lines, given how strconv.Quote and strconv.QuoteToASCII treat a printable non-ASCII rune?

With `strict` enabled, which of the four assignments below does the compiler reject?

What four values does this code log?

The Service below already exists in namespace shop and is serving traffic. You now create a second NodePort Service in a DIFFERENT namespace, analytics, whose port block also asks for nodePort: 30080. What does the API server do with the second Service?

A developer stores API credentials in a config file and, to "encrypt" them, wraps each value in Base64. They argue that even if the file leaks, the credentials are safe because they are "encrypted." Why is this reasoning wrong?

What does this Go program print, given how fallthrough behaves in an expression switch?

What is the inferred type of `n` below?

What string does this code log?

The CustomResourceDefinition below declares additionalPrinterColumns on its v1 version. What do these entries actually change?

A developer enables SSH agent forwarding so they can run `git clone git@github.com:...` directly on a shared build host. Other engineers hold root on that host. While the session is open, what can an attacker on the build host actually do?

Given the state of this Docker host, which of the listed objects does `docker system prune -f` actually delete?

With `strict` enabled on TypeScript 4.4+, what does the compiler do with `input.toFixed(1)` and `input.trim()` below?

What does this code log?

The image myapp:1.0 was built with ENTRYPOINT ["/app/server"] and CMD ["--port=8080"]. The Pod below sets args but no command. What process line does the container actually run?

A backend generates the link below so a customer can download an invoice. The bucket has S3 Block Public Access enabled and every object ACL is private. The developer pastes the resulting link into a shared support-ticket thread, arguing that "the bucket is private, so only the customer's browser can use it". What does that URL actually grant?

What does this Go program print, given how path.Join treats its elements?

With `strict` enabled, which of the three calls below does the compiler reject?

What three values does this code log?

The ResourceQuota below is applied to namespace team-a. What do these two entries actually limit?

A laptop boots with UEFI Secure Boot enabled, as shown. Malware that already has Administrator privileges tries to install a bootkit by replacing the bootloader, and the machine refuses to boot it. What does Secure Boot actually enforce, and what does it NOT protect against?

What does this Go program print, given how iota behaves across the const block?

What does this Go program print?

What does this code log to the console?

A container in Pod web has crashed and been restarted by the kubelet. You want to read the log output from the instance that crashed, not the one now running. Which command retrieves the logs of the previous, terminated container instance?

This Java EE security constraint requires the 'admin' role for /admin/*. An unauthenticated attacker retrieves a protected admin page by sending a request with a method that is NOT listed, such as HEAD. Why does the constraint fail to stop them?

What does this Go program print?

What does the following code log?

What does this code log to the console?

You run the command below as user `jane`. How does `kubectl auth can-i` actually produce its yes/no answer?

A team stores a database password in a Kubernetes Secret (below) and concludes it is now safely encrypted inside the cluster. A security reviewer disagrees. What is actually true about how this Secret is protected, and what fix is required?

What does this Go program print?

Using the built-in `ThisParameterType` utility type below, what is the resolved type of `T`?

What does this code log to the console?

A container defines the preStop lifecycle hook below. Its image is built FROM scratch (no shell, no coreutils). What does this hook do, and will it work?

On an Ethernet LAN with no switch-level protections, an attacker connects a machine running its own DHCP server. It races the legitimate server to answer clients' broadcast DHCPDISCOVER messages and hands out a lease whose default gateway and DNS server point to the attacker's host, so victim traffic flows through the attacker. Why does this succeed, and which switch feature most directly prevents it?

What does this program print?

Given the class union below, what does the TypeScript compiler do with animal.bark() and animal.meow()?

What does this code log to the console?

A Job is created with the pod template below, which sets restartPolicy: Always. What happens when you apply it?

On a switched Ethernet LAN, an attacker on the same subnet repeatedly sends unsolicited ARP replies mapping the default gateway's IP to the attacker's own MAC address. Victim hosts update their ARP caches and start sending gateway-bound traffic to the attacker, who forwards it. What makes this attack possible?

What does this Go program print?

What is the resolved type of `x` below?

What does this code log to the console?

A container sets securityContext.readOnlyRootFilesystem: true, as shown. Its process needs to write temporary files to /tmp. What is the effect of this setting, and what must you add for the writes to succeed?

This C function is compiled with GCC's -fstack-protector-strong, and an attacker overflows buf via the unchecked strcpy. How does the inserted stack canary defend against the classic 'overwrite the saved return address' exploit?

What does this Go program print?

Using the `Record` utility type below, what is the resolved type of `Config`?

What does this code log?

You run `kubectl rollout restart deployment/web`. The Deployment's image and configuration are otherwise unchanged. What does this command do?

This Node.js endpoint fetches any URL the client supplies and returns the body. An attacker submits `http://169.254.169.254/latest/meta-data/iam/security-credentials/web-role`. On AWS, why is this SSRF target especially dangerous, and what mitigates it?

What does this Go program print?

With `x` typed as `unknown`, which single operation does the compiler allow without any narrowing?

What does this code log?

A Deployment sets spec.revisionHistoryLimit: 2 (shown below). After many rolling updates, what does this field control?

An attacker has a list of thousands of valid usernames for a company SSO portal. Rather than trying many passwords against one account, they try a single common password such as "Spring2026!" against every username, wait a few hours, then try a second common password against all of them. What is this technique, and why does it slip past typical lockout defenses?

What does this Go program print?

What is the resolved type of `Greeting` below?