The Triage Playbook — diagnose a CDP challenge fast

Every CDP challenge drops you into a live environment with something already broken — a pipeline stage, a scanner config, a policy — and the clock is running from the moment you open it. The candidates who lose time aren't the ones who don't know the tools; they're the ones who trust a scan's output at face value and start "fixing" the wrong thing. A scan that reports zero findings looks identical to a clean codebase and to a scan that never actually pointed at your code. A DAST run that only covers the login page looks identical to an app with almost nothing to attack. A policy that blocks everything, including plans that are actually fine, looks identical to a strict security posture working as intended. This page exists to tell those apart fast: one diagnostic order to run before you form any opinion, and a symptom index that takes whatever's in front of you and tells you where the real problem almost always lives.

The universal triage order

☺ Like you're 10: Before you guess what's wrong, always check the same five things first, in the same order. Guessing before you've looked is how six-hour windows disappear.

The single biggest time sink in a live-environment challenge is forming a hypothesis before reading the tool's own report of what it did. You see a clean scan, you decide the code must be fine, you move to the next challenge, and the scan never actually reached the file you were graded on. So: don't theorize. Run the sequence. It takes under two minutes and, more often than not, the tool has already told you the answer in its own output — you just have to read past the summary line.

The five steps, in order

Steps 1–3 apply to every scanner in the CDP toolchain, static or dynamic. Step 4 only matters for anything that talks to a live target — a running app, a cloud account, a cluster. Only at step 5 do you get to have an opinion about what's actually broken.

# The two-minute opener. Run this shape on every scan, every time.
semgrep --config=auto --verbose .                          # 1. rule count + files scanned, printed up front
checkov -d . --compact --quiet 2>&1 | head -20              # 1. "Passed checks / Failed checks / Skipped" line
trivy image --debug registry.acme.io/app:1.4 2>&1 | tail -30 # 1+3. DB freshness, target resolved, rules applied
opa eval --data policy/ --input plan.json --explain=full \
  'data.main.deny' | head -40                                # 1+3. rule evaluation trace, not just pass/fail
trufflehog git file://. --since-commit main --only-verified  # 2. confirm --since-commit isn't hiding old history
zap-baseline.py -t "$URL" -I 2>&1 | grep -i "routes\|spider"  # 1+4. route count is the tell for a missing session

# Confirming the target itself, before trusting any of the above:
git rev-parse --abbrev-ref HEAD && git log -1 --oneline       # right branch, right commit?
docker inspect --format '{{.Id}}' app:1.4                     # is this the image you just built, or a cached one?
aws sts get-caller-identity                                    # which identity is actually running this scan?

Symptom index

☺ Like you're 10: Find the words that match your screen in the left column. The middle column tells you what to test first. The right column says which page has the full story.

Once the five-step opener has produced evidence, this is the lookup — organized the way the CDP's own challenges are organized, from source code outward to the cloud account. Scan the left column for what you're actually staring at, test the middle column first, and follow the link for the full treatment.

When you're stuck

☺ Like you're 10: If you've been stuck a while, stop and check the boring things — are you even scanning the room you think you're in?

Every experienced practitioner has lost real minutes to a problem that didn't exist. These checks cost fifteen seconds and resolve a surprising share of "impossible" failures — and inside a 6-hour challenge window with a 24-hour report clock waiting behind it, fifteen seconds spent here is cheap insurance against losing twenty minutes later.

# 1. Am I actually looking at what the task described?
pwd && git remote -v && git branch --show-current

# 2. Does the config file I think is loaded actually exist, at that path?
ls -la .semgrep.yml .checkov.yaml .gitleaks.toml 2>&1

# 3. Is the thing I'm scanning even reachable — target up, credentials valid?
curl -sI "$URL" | head -1
aws sts get-caller-identity 2>&1 || echo "no valid AWS session"

1. Re-read the task wording, verbatim. Candidates solve the problem they remember rather than the one on screen — scanning staging when the task named prod, or gating on a severity the task never asked for. The wording usually names the exact repo, branch, image, or URL you're meant to use.
2. Confirm you're not still holding the previous challenge's context. A live environment carries state between tasks the same way a multi-cluster exam does — the previous challenge's target, token, or working directory is a common source of a scan that "should" work and doesn't.
3. Time-box hard. Past five to seven minutes with no visible progress on one challenge, note where you are and move to the next one — five challenges in a 6-hour window rewards banked partial progress across all of them over a perfect solve on just one. See the CDP exam guide for how the two clocks actually work.

Practice the triage under real pressure

☺ Like you're 10: Reading the table once is not the same as finding the bug with a clock running. These drills are the clock.

The symptom index is a lookup table, not a substitute for having actually chased each of these down once. These timed drills put you in front of the real failure shape, not a description of it:

That's the whole page: five steps that take under two minutes, a table that turns whatever's on your screen into a lead, and the reminder underneath both of them that a quiet scanner is a symptom, not a result. Pair it with the CDP exam guide for how the two exam-day clocks actually run, the CDP study plan for the week-by-week route to exam-ready, Know It Cold and the command & tool reference for the from-memory drills this page assumes, and the capstone lab track for hands-on reps across the whole toolchain this index covers. Then close all of them and go find something to deliberately break.