✳ Practice range / Evidence and exceptions / 8 min

The record, not the logo

Riverstone requires phishing-resistant MFA for VPN admins. Four artifacts arrive. File the one that shows the control ran, then close a contractor exception that expires Friday.

YOUR CASE FILE

SYNTHETIC TABLETOP / GRC-019
Riverstone Logistics (fiction). No live directory.

Control: phishing-resistant MFA on the VPN-Admin group.
Priya Shah owns the risk. Devon operates the directory.
Maya files the March 2026 record.

Four artifacts are in the packet. One shows the control ran.

Exception: contractor account casey.nguyen
  has no phishing-resistant factor.
Scope on the card: VPN-Admin sign-in, Oakland jump host only.
Owner on the card: Priya Shah.
Expiry: Friday 27 March 2026.
Today in this exercise is that Friday.
No renewal is written.

You cannot change a real directory.

Download the synthetic case ↓

SIMULATEDIdentity-provider marketing site

Vendor logo on the public homepage

Page: Public marketing homepage
Image: Product logoScreenshot
Words on the page: MFA availableAdvertisement
Riverstone accounts: None listedNot an export

Annotation: a logo shows that a product is offered. It does not show a factor on a Riverstone account.

SIMULATEDPolicy PDF

The rule that says MFA is required

Document: Riverstone access policy (synthetic)
Sentence: MFA required for VPN administratorsIntent
Named owner: Priya Shah
March export: Not attached

Annotation: a policy is the rule people are supposed to follow. It is not the record that they did.

SIMULATEDIdentity-provider enrollment report

VPN-Admin group, March 2026

Group: VPN-Admin
Month: March 2026
Generated: 24 March 2026, 18:10 UTCProvenance
Columns: Account, factor type, enrolled yes or no
Named gap: casey.nguyen, no phishing-resistant factorOn the page

Annotation: this export lists the group for the named month. Read the columns, including the account that is missing a factor.

SIMULATEDChat

A line in #dock-ops

Channel: #dock-ops (synthetic)
From: Devon
Text: everyone is enrolledHearsay
Time: 24 March 2026, 18:22 UTC
Attachment: None

Annotation: a chat line is what someone said. It does not list accounts or factor types.

Name the artifact that shows the control ran, and the close you would sign.
Question	Your note
Which artifact is the March record?
Why are the logo, the PDF, and the chat not enough?
How does the Friday exception close?

Your answers stay in this browser. This exercise uses fictional data and makes no changes to any system.

Step 1 of 2

Priya asks which artifact shows that phishing-resistant MFA ran for VPN-Admin in March 2026. What should Maya file?

CASE REFLECTION

Keep the reasoning.

first decisions matched the scenario’s best-supported answer.

The enrollment report is the evidence that the control ran. A logo, a policy PDF, and a chat line are not. When Friday comes, re-enroll, remove the role, or renew with an owner, a scope, and a new expiry.

One defensible packet for March 2026. Silence is not a renewal.
Item	What Maya keeps
Evidence	The 24 March 2026 enrollment report for VPN-Admin: account, factor type, and generation time. casey.nguyen is listed with no phishing-resistant factor.
Not evidence	The vendor logo, the policy PDF that says MFA is required, and Devon’s chat line that everyone is enrolled.
Close	Re-enroll casey.nguyen, remove that account from VPN-Admin, or renew in writing with Priya Shah as owner, jump-host scope, and a new expiry. Friday passing with no note does not renew the exception.

Another case ↗