Exam Bundle

An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object. That observed result would support another specific correction: Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. The other scenario concerns: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The current Brookside Manufacturing problem is: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The evidence required here is: Only the intended application component can read the mounted secret in a controlled multi-container test.

A container inspection shows no broad host filesystem mount and the approved workload remains functional. That observed result would support another specific correction: Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. The other scenario concerns: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The current Brookside Manufacturing problem is: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The evidence required here is: Only the intended application component can read the mounted secret in a controlled multi-container test.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Brookside Manufacturing problem is: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The evidence required here is: Only the intended application component can read the mounted secret in a controlled multi-container test.

Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. That choice addresses a different foundational issue: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The issue at Silvercrest University is instead: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. It does not establish the required correction; the decisive verification would be: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Silvercrest University is instead: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. It does not establish the required correction; the decisive verification would be: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. That choice addresses a different foundational issue: A workload requires read-only source files but mounts its entire container root filesystem writable. The issue at Silvercrest University is instead: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. It does not establish the required correction; the decisive verification would be: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Silvercrest University problem is: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The evidence required here is: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Silvercrest University problem is: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The evidence required here is: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role. That observed result would support another specific correction: Separate Pod security standards at admission time from RBAC that governs API requests and object access. The other scenario concerns: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The current Silvercrest University problem is: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The evidence required here is: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Highland Education is instead: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. It does not establish the required correction; the decisive verification would be: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

Use provenance validation, image scanning, and approved registry controls before deploying workload artifacts. That choice addresses a different foundational issue: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The issue at Highland Education is instead: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. It does not establish the required correction; the decisive verification would be: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. That choice addresses a different foundational issue: A workload requires read-only source files but mounts its entire container root filesystem writable. The issue at Highland Education is instead: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. It does not establish the required correction; the decisive verification would be: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Highland Education problem is: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The evidence required here is: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object. That observed result would support another specific correction: Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. The other scenario concerns: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The current Highland Education problem is: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The evidence required here is: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Highland Education problem is: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The evidence required here is: Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable.

Distinguish readiness failure removing a Pod from Service endpoints from liveness-driven container restarts. That choice addresses a different foundational issue: An endpoint stops receiving traffic because its readiness probe fails, but a manager thinks Kubernetes deleted its container. The issue at Harborline Logistics is instead: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. It does not establish the required correction; the decisive verification would be: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

Inspect container logs, previous termination state, and exit codes to identify startup failure before touching networking. That choice addresses a different foundational issue: A Pod repeatedly changes to CrashLoopBackOff but the team assumes its Service DNS name must be wrong. The issue at Harborline Logistics is instead: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. It does not establish the required correction; the decisive verification would be: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

Inspect Deployment rollout conditions, updated replicas and readiness instead of relying on desired count alone. That choice addresses a different foundational issue: A rollout appears healthy because desired replicas equal the target while zero newly updated Pods are available. The issue at Harborline Logistics is instead: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. It does not establish the required correction; the decisive verification would be: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

The incident evidence distinguishes application errors from service discovery, endpoint and network path failures. That observed result would support another specific correction: Combine workload logs with Service and network telemetry appropriate to the failing layer. The other scenario concerns: An engineer assumes kubectl logs can display a Pod's entire cluster-wide network path and uses them instead of inspecting network components. The current Harborline Logistics problem is: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. The evidence required here is: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

The Service lists correct ready backends and traffic resumes while existing DNS resolution remains unchanged. That observed result would support another specific correction: Inspect Service selectors, EndpointSlices and Pod readiness before changing the DNS configuration. The other scenario concerns: A team assumes a Service outage is caused by CoreDNS even though the Service name resolves and no ready endpoints exist. The current Harborline Logistics problem is: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. The evidence required here is: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

The app completes startup and then passes regular health probes without repeated premature restarts. That observed result would support another specific correction: Use a startup probe or appropriately tuned probe timings to protect the initial bootstrap phase. The other scenario concerns: A slow-starting application is repeatedly killed by liveness checks before its initialization completes. The current Harborline Logistics problem is: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. The evidence required here is: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

Inspect node conditions, kubelet and runtime health, and capacity rather than treating a node fault as an app-only issue. That choice addresses a different foundational issue: A worker appears NotReady after a node-level runtime failure, but operators only restart the application Deployment. The issue at Maplewood Schools is instead: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. It does not establish the required correction; the decisive verification would be: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

Distinguish readiness failure removing a Pod from Service endpoints from liveness-driven container restarts. That choice addresses a different foundational issue: An endpoint stops receiving traffic because its readiness probe fails, but a manager thinks Kubernetes deleted its container. The issue at Maplewood Schools is instead: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. It does not establish the required correction; the decisive verification would be: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

Inspect Deployment rollout history and ReplicaSet revisions before choosing a supported rollback target. That choice addresses a different foundational issue: A failed release is rolled back but a developer cannot tell whether older ReplicaSets were retained for revision history. The issue at Maplewood Schools is instead: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. It does not establish the required correction; the decisive verification would be: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

The corrected process starts successfully and the restart count stops growing under the representative workload. That observed result would support another specific correction: Inspect container logs, previous termination state, and exit codes to identify startup failure before touching networking. The other scenario concerns: A Pod repeatedly changes to CrashLoopBackOff but the team assumes its Service DNS name must be wrong. The current Maplewood Schools problem is: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. The evidence required here is: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

The deployment completes with the intended updated Pods available and no progressive rollout failure condition. That observed result would support another specific correction: Inspect Deployment rollout conditions, updated replicas and readiness instead of relying on desired count alone. The other scenario concerns: A rollout appears healthy because desired replicas equal the target while zero newly updated Pods are available. The current Maplewood Schools problem is: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. The evidence required here is: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

The Service lists correct ready backends and traffic resumes while existing DNS resolution remains unchanged. That observed result would support another specific correction: Inspect Service selectors, EndpointSlices and Pod readiness before changing the DNS configuration. The other scenario concerns: A team assumes a Service outage is caused by CoreDNS even though the Service name resolves and no ready endpoints exist. The current Maplewood Schools problem is: An operator sees a Pending Pod and restarts unrelated applications without checking the scheduler's events. The evidence required here is: The diagnostic conclusion identifies the actual Pending reason and the specific approved fix resolves it.

Inspect Deployment rollout history and ReplicaSet revisions before choosing a supported rollback target. That choice addresses a different foundational issue: A failed release is rolled back but a developer cannot tell whether older ReplicaSets were retained for revision history. The issue at Timberline Foods is instead: A Pod repeatedly changes to CrashLoopBackOff but the team assumes its Service DNS name must be wrong. It does not establish the required correction; the decisive verification would be: The corrected process starts successfully and the restart count stops growing under the representative workload.

Inspect image name, digest, registry access and pull credentials to resolve image download failures. That choice addresses a different foundational issue: An app shows ImagePullBackOff after release and its team increases memory limits instead of checking image retrieval. The issue at Timberline Foods is instead: A Pod repeatedly changes to CrashLoopBackOff but the team assumes its Service DNS name must be wrong. It does not establish the required correction; the decisive verification would be: The corrected process starts successfully and the restart count stops growing under the representative workload.

Distinguish readiness failure removing a Pod from Service endpoints from liveness-driven container restarts. That choice addresses a different foundational issue: An endpoint stops receiving traffic because its readiness probe fails, but a manager thinks Kubernetes deleted its container. The issue at Timberline Foods is instead: A Pod repeatedly changes to CrashLoopBackOff but the team assumes its Service DNS name must be wrong. It does not establish the required correction; the decisive verification would be: The corrected process starts successfully and the restart count stops growing under the representative workload.

The incident evidence distinguishes application errors from service discovery, endpoint and network path failures. That observed result would support another specific correction: Combine workload logs with Service and network telemetry appropriate to the failing layer. The other scenario concerns: An engineer assumes kubectl logs can display a Pod's entire cluster-wide network path and uses them instead of inspecting network components. The current Timberline Foods problem is: A Pod repeatedly changes to CrashLoopBackOff but the team assumes its Service DNS name must be wrong. The evidence required here is: The corrected process starts successfully and the restart count stops growing under the representative workload.

The node successfully pulls the intended image and the Pod progresses beyond image-pull errors. That observed result would support another specific correction: Inspect image name, digest, registry access and pull credentials to resolve image download failures. The other scenario concerns: An app shows ImagePullBackOff after release and its team increases memory limits instead of checking image retrieval. The current Timberline Foods problem is: A Pod repeatedly changes to CrashLoopBackOff but the team assumes its Service DNS name must be wrong. The evidence required here is: The corrected process starts successfully and the restart count stops growing under the representative workload.

The incident report includes the prior failing process's evidence and a corrected restart no longer reproduces the error. That observed result would support another specific correction: Retrieve the previous container's logs and inspect termination details before resetting the Pod. The other scenario concerns: A support engineer examines only current container logs after a crash and misses the error emitted by the previous instance. The current Timberline Foods problem is: A Pod repeatedly changes to CrashLoopBackOff but the team assumes its Service DNS name must be wrong. The evidence required here is: The corrected process starts successfully and the restart count stops growing under the representative workload.