Exam Bundle

The incident timeline identifies the exact application artifact and Kubernetes rollout revision running when the fault occurred. That observed result would support another specific correction: Publish immutable versioned image references and retain release metadata linking a commit to its deployed digest. The other scenario concerns: A team creates a Deployment with an identical application tag for every release and cannot correlate an incident to code. The current Timberline Foods problem is: A release team stores database credentials in Helm values committed publicly so deployments can be copied across environments. The evidence required here is: No release repository or rendered public artifact reveals credentials, while authorized workloads still authenticate.

The deployment stage rejects malformed rendered manifests and passes when all required values are supplied. That observed result would support another specific correction: Validate the template rendering and configuration values before applying the resulting Kubernetes resources. The other scenario concerns: A release build fails because a Helm values file references a nonexistent key and the team deploys unrendered templates anyway. The current Timberline Foods problem is: A release team stores database credentials in Helm values committed publicly so deployments can be copied across environments. The evidence required here is: No release repository or rendered public artifact reveals credentials, while authorized workloads still authenticate.

A repository change follows review and audit controls while ordinary read access grants no direct cluster administrator privilege. That observed result would support another specific correction: Explain that GitOps uses version-controlled desired state with controlled reconciliation and separate authorization boundaries. The other scenario concerns: A platform team describes GitOps as granting every repository reader administrative kubectl access to the cluster. The current Timberline Foods problem is: A release team stores database credentials in Helm values committed publicly so deployments can be copied across environments. The evidence required here is: No release repository or rendered public artifact reveals credentials, while authorized workloads still authenticate.

Commit approved desired-state changes to the authoritative repository and let the GitOps reconciler apply them. That choice addresses a different foundational issue: A developer edits production Deployment resources from a laptop despite a GitOps controller continuously restoring the old manifest. The issue at Silvercrest University is instead: A release team stores database credentials in Helm values committed publicly so deployments can be copied across environments. It does not establish the required correction; the decisive verification would be: No release repository or rendered public artifact reveals credentials, while authorized workloads still authenticate.

Use the HPA's supported desired behavior and define min/max replicas rather than continually overriding controller intent. That choice addresses a different foundational issue: An engineer scales an application manually during every traffic spike while an approved HPA already controls its replica target. The issue at Silvercrest University is instead: A release team stores database credentials in Helm values committed publicly so deployments can be copied across environments. It does not establish the required correction; the decisive verification would be: No release repository or rendered public artifact reveals credentials, while authorized workloads still authenticate.

Include appropriate readiness and startup checks as part of a tested declarative release specification. That choice addresses a different foundational issue: An operator applies a new Deployment manifest but removes a container health check that guarded the previous release. The issue at Silvercrest University is instead: A release team stores database credentials in Helm values committed publicly so deployments can be copied across environments. It does not establish the required correction; the decisive verification would be: No release repository or rendered public artifact reveals credentials, while authorized workloads still authenticate.

The incident timeline identifies the exact application artifact and Kubernetes rollout revision running when the fault occurred. That observed result would support another specific correction: Publish immutable versioned image references and retain release metadata linking a commit to its deployed digest. The other scenario concerns: A team creates a Deployment with an identical application tag for every release and cannot correlate an incident to code. The current Silvercrest University problem is: A release team stores database credentials in Helm values committed publicly so deployments can be copied across environments. The evidence required here is: No release repository or rendered public artifact reveals credentials, while authorized workloads still authenticate.

A repository change follows review and audit controls while ordinary read access grants no direct cluster administrator privilege. That observed result would support another specific correction: Explain that GitOps uses version-controlled desired state with controlled reconciliation and separate authorization boundaries. The other scenario concerns: A platform team describes GitOps as granting every repository reader administrative kubectl access to the cluster. The current Silvercrest University problem is: A release team stores database credentials in Helm values committed publicly so deployments can be copied across environments. The evidence required here is: No release repository or rendered public artifact reveals credentials, while authorized workloads still authenticate.

The deployment stage rejects malformed rendered manifests and passes when all required values are supplied. That observed result would support another specific correction: Validate the template rendering and configuration values before applying the resulting Kubernetes resources. The other scenario concerns: A release build fails because a Helm values file references a nonexistent key and the team deploys unrendered templates anyway. The current Silvercrest University problem is: A release team stores database credentials in Helm values committed publicly so deployments can be copied across environments. The evidence required here is: No release repository or rendered public artifact reveals credentials, while authorized workloads still authenticate.

Use a supported canary or progressive delivery strategy with measured traffic and explicit rollback criteria. That choice addresses a different foundational issue: A rollout requires gradual exposure to a risky new version but the team switches all production requests instantly. The issue at Meadowbrook Finance is instead: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. It does not establish the required correction; the decisive verification would be: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

Publish immutable versioned image references and retain release metadata linking a commit to its deployed digest. That choice addresses a different foundational issue: A team creates a Deployment with an identical application tag for every release and cannot correlate an incident to code. The issue at Meadowbrook Finance is instead: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. It does not establish the required correction; the decisive verification would be: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

Use declarative environment overlays or configuration values under version control with a reproducible promotion process. That choice addresses a different foundational issue: An application is configured in three environments through manual edits that leave different values undocumented. The issue at Meadowbrook Finance is instead: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. It does not establish the required correction; the decisive verification would be: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

The green version passes health and acceptance tests before clients are directed to it, with a working rollback path. That observed result would support another specific correction: Run and validate a separate green version before atomically switching the intended traffic selection. The other scenario concerns: An application requires blue-green deployment but the team updates the shared Service selector before testing the green environment. The current Meadowbrook Finance problem is: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. The evidence required here is: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

The HPA displays valid current metrics and adjusts replicas after an authorized load change. That observed result would support another specific correction: Supply supported resource or custom metrics with appropriate requests and a working metrics adapter for autoscaling. The other scenario concerns: A team tries to use an HPA without any usable metrics source and assumes it will infer load from container image size. The current Meadowbrook Finance problem is: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. The evidence required here is: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

The pipeline rejects a failing commit before publishing or deploying an unverified application image. That observed result would support another specific correction: Establish automated build and test validation in CI, with a separate approved continuous delivery or deployment stage. The other scenario concerns: A release team pushes untested images directly into production and calls the sequence continuous integration. The current Meadowbrook Finance problem is: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. The evidence required here is: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

Use a supported canary or progressive delivery strategy with measured traffic and explicit rollback criteria. That choice addresses a different foundational issue: A rollout requires gradual exposure to a risky new version but the team switches all production requests instantly. The issue at Harborline Logistics is instead: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. It does not establish the required correction; the decisive verification would be: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

Validate the template rendering and configuration values before applying the resulting Kubernetes resources. That choice addresses a different foundational issue: A release build fails because a Helm values file references a nonexistent key and the team deploys unrendered templates anyway. The issue at Harborline Logistics is instead: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. It does not establish the required correction; the decisive verification would be: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

Describe Helm as a packaging and release tool that renders and manages Kubernetes resource definitions. That choice addresses a different foundational issue: A team believes Helm charts run containers by themselves and expects an installed chart to replace Kubernetes controllers. The issue at Harborline Logistics is instead: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. It does not establish the required correction; the decisive verification would be: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

Dev, staging and production show their intended parameter differences without untracked live drift. That observed result would support another specific correction: Use declarative environment overlays or configuration values under version control with a reproducible promotion process. The other scenario concerns: An application is configured in three environments through manual edits that leave different values undocumented. The current Harborline Logistics problem is: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. The evidence required here is: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

The incident timeline identifies the exact application artifact and Kubernetes rollout revision running when the fault occurred. That observed result would support another specific correction: Publish immutable versioned image references and retain release metadata linking a commit to its deployed digest. The other scenario concerns: A team creates a Deployment with an identical application tag for every release and cannot correlate an incident to code. The current Harborline Logistics problem is: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. The evidence required here is: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

The HPA displays valid current metrics and adjusts replicas after an authorized load change. That observed result would support another specific correction: Supply supported resource or custom metrics with appropriate requests and a working metrics adapter for autoscaling. The other scenario concerns: A team tries to use an HPA without any usable metrics source and assumes it will infer load from container image size. The current Harborline Logistics problem is: A delivery team deletes older ReplicaSets after every rollout and later discovers there is no supported revision to undo. The evidence required here is: A simulated failed rollout restores a known good revision and its exact image digest is still retrievable.

Read previous container logs, state and exit codes to identify startup and crash diagnostics. That choice addresses a different foundational issue: A Kubernetes app crashes before emitting normal logs and a trainee assumes there is no way to inspect its last termination. The issue at Alpine Healthcare is instead: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. It does not establish the required correction; the decisive verification would be: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

Use supported logs, process metadata, or approved ephemeral debugging methods rather than requiring a shell inside production images. That choice addresses a different foundational issue: An engineer runs a debugging shell inside an immutable distroless container and assumes the application is broken because no shell exists. The issue at Alpine Healthcare is instead: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. It does not establish the required correction; the decisive verification would be: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

Inspect waiting container reasons, image pull status and application startup logs before modifying network exposure. That choice addresses a different foundational issue: A developer tries to debug a crash by changing Service type even though the Pod never starts its container. The issue at Alpine Healthcare is instead: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. It does not establish the required correction; the decisive verification would be: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

The deployed release returns an expected response and related Pods report Ready, not merely Running. That observed result would support another specific correction: Combine workload status with a legitimate end-to-end probe through the application Service or entry point. The other scenario concerns: A team tests application health only through kubectl get and never checks whether the process is actually serving responses. The current Alpine Healthcare problem is: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. The evidence required here is: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

The app remains Running while the fixed endpoint or port mapping restores Service-level client access. That observed result would support another specific correction: Check Service port mapping, ready endpoints, and permitted network paths separately from the container's health. The other scenario concerns: An app works within one Pod but fails through its Service and a trainee concludes the process must have crashed. The current Alpine Healthcare problem is: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. The evidence required here is: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

The incident can be diagnosed without rebuilding the production image solely to add an interactive shell. That observed result would support another specific correction: Use supported logs, process metadata, or approved ephemeral debugging methods rather than requiring a shell inside production images. The other scenario concerns: An engineer runs a debugging shell inside an immutable distroless container and assumes the application is broken because no shell exists. The current Alpine Healthcare problem is: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. The evidence required here is: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

Capture timestamped logs, events and relevant manifests before transient state is lost, then verify the suspected cause. That choice addresses a different foundational issue: A staging issue disappears after a Pod restart but the team closes it without preserving the logs and resource conditions. The issue at Timberline Foods is instead: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. It does not establish the required correction; the decisive verification would be: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

Use supported logs, process metadata, or approved ephemeral debugging methods rather than requiring a shell inside production images. That choice addresses a different foundational issue: An engineer runs a debugging shell inside an immutable distroless container and assumes the application is broken because no shell exists. The issue at Timberline Foods is instead: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. It does not establish the required correction; the decisive verification would be: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

Check Service port mapping, ready endpoints, and permitted network paths separately from the container's health. That choice addresses a different foundational issue: An app works within one Pod but fails through its Service and a trainee concludes the process must have crashed. The issue at Timberline Foods is instead: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. It does not establish the required correction; the decisive verification would be: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

The deployed release returns an expected response and related Pods report Ready, not merely Running. That observed result would support another specific correction: Combine workload status with a legitimate end-to-end probe through the application Service or entry point. The other scenario concerns: A team tests application health only through kubectl get and never checks whether the process is actually serving responses. The current Timberline Foods problem is: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. The evidence required here is: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

The Service resolves to the intended new ready Pods and user requests reach the correct release. That observed result would support another specific correction: Compare Deployment Pod labels against Service selectors and the resulting EndpointSlices. The other scenario concerns: A release's Pods start but users receive errors because the Service selector still points to the previous version label. The current Timberline Foods problem is: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. The evidence required here is: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.

An ordinary support identity can read relevant logs but cannot start arbitrary privileged sessions in production Pods. That observed result would support another specific correction: Prefer least-privilege read-only inspection and use controlled temporary debug access only when authorized. The other scenario concerns: A developer uses kubectl exec with unrestricted permissions in a protected production namespace for routine debugging. The current Timberline Foods problem is: A new release fails readiness but developers only read the old version's logs and conclude the application is healthy. The evidence required here is: The diagnostic evidence pinpoints the failing revision and confirms the corrected replacement Pods become ready.