The store stopped answering: a pause, a loss, and the mess left behind Start this lab

Why this matters

Most storage incidents are not a disk dying; they are a device that has stopped answering, a backup that did not clean up after itself, and a store that is fuller than anyone believes. Each has a different correct response, and the expensive mistakes come from treating one as another.

Concepts

Objectives graded

• Read the baseline score and the storage figures before changing anything.
• Separate a device that has paused on every path from one the array has declared permanently gone, and say which this is.
• Read the consolidation refusal and fix the thing it names rather than retrying the button.
• Clear the delta files a failed backup left behind, then reclaim the space the guests already released.
• Stop promising more thin space than the store can deliver.
• Restore the quiet device once the fabric is repaired and prove the score moved.

MITRE ATT&CK coverage

Storage that stops answering looks identical whether a switch port failed or somebody detached a LUN on purpose, and delta files left behind by a backup are where a copy of a whole machine quietly sits. Telling a fault from an action is the skill.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A reversible action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The platform was worked in the console rather than described from the ticket.

  investigation · weight 15

• The platform was measured before it was touched.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The failing device was identified rather than guessed from which guests complained.

  investigation · weight 10 · T1046 Network Service Discovery (Discovery)

• The symptom was recorded as a measured figure.

  investigation · weight 10 · T1046 Network Service Discovery (Discovery)

• The refusal was read instead of retried, and the real blocker named.

  investigation · weight 10 · T1078 Valid Accounts (Defense Evasion)

• Space was reclaimed and the amount recorded, not merely assumed.

  configuration · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The repair was carried through and the improvement measured.

  configuration · weight 15 · T1078 Valid Accounts (Defense Evasion)

Common mistakes

• Removing a device that had only paused, turning a short outage into a rebuild.
• Retrying consolidation instead of reading why it refuses.
• Reclaiming space and calling it capacity planning while still promising more than the store has.
• Fixing the symptom on one store and not checking the others behind the same fabric.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.