Reconcile the longest documented evidence custody prefix

A hands-on CS0-004 lab. You produce the real artefact and 8 automated checks verify it behaves the way the exam expects.

Try this lab All CS0-004 practice

Certification: CS0-004
Format: SQL query
Difficulty: hard
Estimated time: 40 min
Automated checks: 8

The brief

Repair custody.sql. Return exactly evidence_id,case_id,verified_holder,verified_steps,chain_state, one row for EVERY unique collected artifact. Initial holder/time/digest are trusted supplied collection facts. expected_steps is 0..4. Exact imported duplicates collapse. Only handoff steps 1..expected_steps for that artifact are considered. Starting at step 1, each step needs exactly ONE distinct complete receipt row, including transfer_id; conflicting rows or different receipts at one step remain ambiguous. Stop at the FIRST defective step, in this precedence: no receipt -> UNACCOUNTED; multiple distinct receipt rows -> AMBIGUOUS_HANDOFF; acknowledged!=1 -> MISSING_ACK; digest not equal collection_digest -> INTEGRITY_MISMATCH; from_holder not equal the prior verified holder OR observed earlier than prior verified time -> CUSTODY_GAP; to_holder absent from custodians for THIS case -> UNAUTHORIZED_DESTINATION. Otherwise accept that step, update verified holder/time and continue. Times may be equal; they cannot decrease. Custodian imports may repeat and must not multiply results. All receipt strings/digests are supplied non-NULL normalized values. Return verified_steps as accepted prefix length, verified_holder as its last supported holder (initial holder for zero accepted steps), and the earliest defect status. Never skip an invalid or missing step to accept later transfers. If all expected steps are accepted, including zero, chain_state is DOCUMENTED_CHAIN. A recursive prefix walk or equivalent ordered first-defect/window strategy is valid. The reported holder remains last documented, not guaranteed actual possession. Preserve case identity and unfamiliar artifacts; save, run tests and repair unresolved custody without Reset.

What the checks verify

Your work is graded on 8 independent properties, not on matching one reference answer.

One bounded read-only custody query executes against immutable evidence.
Artifact/case identity, last supported holder, verified prefix length and unresolved state are explicit.
Every supplied artifact remains represented, including a collection with zero expected transfers.
Custodian/time continuity and missing receipt steps bound the accepted prefix.
Actual acknowledged metadata and matching collection digest precede verified custody acceptance.
Each destination is delegated for the actual case without import multiplication.
Exact copies collapse while distinct competing receipts stop an ambiguous step.
Unfamiliar case, holder and artifact identities retain their actual documented or unresolved status.

Where this sits in the CS0-004 blueprint

Domain: Incident Response and Management
Objective: Incident Response Techniques
Skill: Evidence, Containment and Verification

Part of CS0-004 preparation

CS0-004

CompTIA Cybersecurity Analyst (CySA+)

All CS0-004 practice All labs

Labs are written by ExamNova to teach the decisions the exam tests. They are not reproductions of vendor lab content.