| Find Files by Name, Size and AgeSearch a directory tree for files matching a name, a minimum size and a recent modification time.easyLinux10 XP | Linux | New | easy | 10 |
| Hard Links and Symbolic LinksCreate a symlink and a hard link to the same release file and see how they differ.easyLinux10 XP | Linux | New | easy | 10 |
| Restore One File from a Backup ArchivePull a single member out of a compressed tarball without unpacking the rest.easyLinux10 XP | Linux | New | easy | 10 |
| Create a Clean Backup ArchivePackage a project directory into a gzip tarball while excluding temporary files.easyLinux10 XP | Linux | New | easy | 10 |
| Set an Exact File ModeA key file is world-writable. Set its permission bits to an exact octal mode without touching ownership.easyLinux10 XP | Linux | New | easy | 10 |
| Fix "Permission denied" on Service DataA service account cannot write its own data directory. Find the real cause and fix it without loosening permissions.easyLinux10 XP | Linux | New | easy | 10 |
| Shared Team Directory with setgid and stickyBuild a team drop box where new files inherit the group and members can only delete their own files.mediumLinux20 XP | Linux | New | medium | 20 |
| Grant One Extra User Access with ACLsGive a single auditor read access to a report without changing its owner, group or mode bits.mediumLinux20 XP | Linux | New | medium | 20 |
| Create a User AccountAdd an account with a specific shell, home directory, primary group, secondary groups and a locked password.easyLinux10 XP | Linux | New | easy | 10 |
| Grant Exactly One Command via sudoLet an operator restart one service as root without a password and without handing over a root shell.mediumLinux20 XP | Linux | New | medium | 20 |
| Set Up SSH Key AuthenticationGenerate an ed25519 key pair and authorize it for another account with the permissions sshd insists on.mediumLinux20 XP | Linux | New | medium | 20 |
| Stop a Process That Ignores SIGTERMIdentify a rogue process among look-alikes, record its PID, and stop it even though it ignores a normal kill.easyLinux10 XP | Linux | New | easy | 10 |
| Who Is Listening on That Port?Go from an open TCP port to the process that owns it and the program it was started from.mediumLinux20 XP | Linux | New | medium | 20 |
| Extract Error Lines from a LogPull every uppercase ERROR line out of a mixed log without catching its lowercase look-alike.easyLinux10 XP | Linux | New | easy | 10 |
| Find Every Config That Uses a SettingSearch a whole configuration tree for files that still reference a deprecated hostname.easyLinux10 XP | Linux | New | easy | 10 |
| Edit a Config File in Place with sedRepoint one setting in a config file, keep a backup, and leave the commented-out twin untouched.easyLinux10 XP | Linux | New | easy | 10 |
| Summarize Sales Data with awkGroup CSV rows by a field, total a computed value per group, and format the output precisely.mediumLinux20 XP | Linux | New | medium | 20 |
| Schedule a Nightly Cron JobInstall a daily job in another user's crontab at an exact time.easyLinux10 XP | Linux | New | easy | 10 |
| Find What Is Filling the DiskTrack down the subdirectory consuming the most space, past a decoy full of tiny files.easyLinux10 XP | Linux | New | easy | 10 |
| Pin a Hostname with /etc/hostsMake a hostname resolve to a fixed IP address on this machine without touching DNS.easyLinux10 XP | Linux | New | easy | 10 |
| Growing a Logical VolumeThe XFS filesystem on /dev/vgdata/lvapp (mounted at /app) is full, and volume group vgdata has no free extents. A new empty disk /dev/vdc has been attached. WhimediumLinux5 XP | Linux | New | medium | 5 |
| Shrinking XFS vs ext4A colleague wants to give back 20 GiB from an over-sized logical volume so it can be used elsewhere. Which statement about shrinking the filesystem on it is cormediumLinux5 XP | Linux | New | medium | 5 |
| Robust fstab EntriesA data disk is mounted at /data via /dev/sdb1 /data xfs defaults 0 0 in /etc/fstab. After a reboot where the disk was missing, the server stopped in emergency mmediumLinux5 XP | Linux | New | medium | 5 |
| Activating Swap SpaceYou created partition /dev/vdb2 of type Linux swap and ran mkswap /dev/vdb2. free -h still shows 0B of swap. What is missing?easyLinux3 XP | Linux | New | easy | 3 |
| SELinux Modes and RebootsWhile troubleshooting, an admin runs setenforce 0. /etc/selinux/config contains SELINUX=enforcing. The server is then rebooted. What is the SELinux mode after teasyLinux3 XP | Linux | New | easy | 3 |
| Persistent SELinux File ContextsApache must serve files from a new directory /srv/site. It returns 403 until you run chcon -R -t httpdsyscontentt /srv/site. A week later, after another admin rhardLinux8 XP | Linux | New | hard | 8 |
| SELinux BooleansA PHP app under Apache cannot connect to a database on another host. ausearch -m AVC -ts recent shows httpdt being denied nameconnect. The file labels are corremediumLinux5 XP | Linux | New | medium | 5 |
| firewalld Runtime vs PermanentYou run firewall-cmd --permanent --zone=public --add-service=https. The command prints success, but clients still cannot reach port 443. Nginx is listening. WhaeasyLinux3 XP | Linux | New | easy | 3 |
| systemd Timers vs cronA backup must run daily at 02:00 on a VM that is often powered off overnight. If the run is missed, it should happen soon after the next boot. Which systemd timmediumLinux5 XP | Linux | New | medium | 5 |
| Booting into Rescue ModeAfter a bad change, a service hangs the boot. You have console access and the root password. How do you boot once into single-user rescue mode without changing mediumLinux5 XP | Linux | New | medium | 5 |
| Keeping Logs Across RebootsA server rebooted unexpectedly. journalctl --list-boots shows only the current boot, so the logs from before the crash are gone. journald.conf has the default SmediumLinux5 XP | Linux | New | medium | 5 |
| Filtering the JournalYou need only errors or worse from the SSH service in the last hour. Which command gives that?easyLinux3 XP | Linux | New | easy | 3 |
| Which Package Owns a FileOn a RHEL server you find /usr/bin/dig and want to know which installed package it came from. Which command answers that?easyLinux3 XP | Linux | New | easy | 3 |
| Persistent Static IP with nmcliYou set a server's address with ip addr add 10.0.5.20/24 dev ens3. It works, but after a reboot the address is gone. The connection profile is named ens3. How dmediumLinux5 XP | Linux | New | medium | 5 |
| Root Password RecoveryTo reset a forgotten root password on RHEL, you boot with rd.break, run mount -o remount,rw /sysroot, chroot /sysroot and passwd root. Why is the next step touchardLinux8 XP | Linux | New | hard | 8 |
| Password Aging with chageNew user maria must change her password at first login, and from then on every 90 days. Which commands do this?easyLinux3 XP | Linux | New | easy | 3 |
| Loading Kernel ModulesYou need to load the vfiopci kernel module, which depends on other modules that are not loaded yet. Which command handles the dependencies for you?easyLinux3 XP | Linux | New | easy | 3 |
| autofs Indirect MapsYou configured autofs for NFS. /etc/auto.master.d/shares.autofs contains /shares /etc/auto.shares, and /etc/auto.shares contains data -rw,sync nfs1:/export/datahardLinux8 XP | Linux | New | hard | 8 |
| Rootless Podman at BootUser app runs a rootless Podman container as a systemd user service (a Quadlet .container file in ~/.config/containers/systemd/, enabled for default.target). IthardLinux8 XP | Linux | New | hard | 8 |
| Process Priority with niceA regular user starts a long compression job with nice -n 10 xz big.tar, then tries to speed it up with renice -n 0 -p <pid>. The command fails with Permission easyLinux3 XP | Linux | New | easy | 3 |
| Reading rwxr-x---ls -l shows -rwxr-x--- for a script. What is its octal mode?easyLinux3 XP | Linux | New | easy | 3 |
| SIGTERM vs SIGKILLWhat is the key difference between kill PID and kill -9 PID?easyLinux3 XP | Linux | New | easy | 3 |
| Redirecting ErrorsWhich command writes both standard output and standard error of build.sh to build.log?easyLinux3 XP | Linux | New | easy | 3 |
| Disk "Full" but df Shows Free SpaceWriting a new file fails with "No space left on device", yet df -h shows 40% free space on that filesystem. What should you check next?hardLinux8 XP | Linux | New | hard | 8 |
| enable vs startWhat is the difference between systemctl start nginx and systemctl enable nginx?easyLinux3 XP | Linux | New | easy | 3 |
| Absolute vs Relative PathsYou are in /var/log. Which path refers to the file /var/www/index.html?easyLinux3 XP | Linux | New | easy | 3 |
| sudo and Redirectionsudo echo "net.ipv4.ipforward=1" > /etc/sysctl.d/99-fw.conf fails with "Permission denied". Why?mediumLinux5 XP | Linux | New | medium | 5 |
| Reading the Load Averageuptime on a 4-CPU server shows load average: 3.80, 3.95, 4.10. What does this mean?mediumLinux5 XP | Linux | New | medium | 5 |
| A Script with Arguments and Exit CodesWrite a small Bash script that validates its arguments, prints usage to stderr and returns the right exit codes.easyShell10 XP | Shell | New | easy | 10 |
| Count Matching Files RecursivelyWrite a script that counts matching files in any directory tree, handling odd file names and bad input.easyShell10 XP | Shell | New | easy | 10 |
| Rename Many Files SafelyBulk-rename file extensions with a loop that survives spaces and leaves everything else alone.easyShell10 XP | Shell | New | easy | 10 |
| Put Your Own Tools on the PATHMake a personal tools directory part of PATH for every future shell, and make the tool executable.easyShell10 XP | Shell | New | easy | 10 |
| Search and Replace Across Many FilesUpgrade every http:// endpoint to https:// in all config files of a tree, and only in config files.easyShell10 XP | Shell | New | easy | 10 |
| Top Talkers in an Access LogBuild a pipeline that finds the busiest client IPs in a web server log and formats the report exactly.mediumShell20 XP | Shell | New | medium | 20 |
| Query JSON from the Command Line with jqFilter a JSON inventory of services and extract exactly the fields you need.mediumShell20 XP | Shell | New | medium | 20 |
| Write a Reusable Backup ScriptCreate a script that archives a directory into a dated tarball, with input validation and a clear exit status.mediumShell20 XP | Shell | New | medium | 20 |
| Retry Flaky Commands with BackoffWrite a retry wrapper that re-runs any command until it succeeds, preserving arguments and exit codes.hardShell40 XP | Shell | New | hard | 40 |
| Single vs Double QuotesGiven name=world, what does echo '$name' "$name" print?easyShell3 XP | Shell | New | easy | 3 |
| Exit Status and &&What does mkdir /data/new && cd /data/new || echo "failed" do if mkdir fails?easyShell3 XP | Shell | New | easy | 3 |
| set -euo pipefailWhat does set -o pipefail change in a Bash script?mediumShell5 XP | Shell | New | medium | 5 |
| Command SubstitutionWhich line stores today's date (as YYYY-MM-DD) in the variable today?easyShell3 XP | Shell | New | easy | 3 |
| Filenames with Spaces in PipelinesYou need to delete all .tmp files under a directory; some names contain spaces and newlines. Which command is safe?hardShell8 XP | Shell | New | hard | 8 |
| Your First Repository and CommitTurn a project folder into a Git repository, set a per-repo identity and make a clean first commit.easyGit10 XP | Git | New | easy | 10 |
| Work on a Feature BranchCreate a branch from main, commit on it, and keep main untouched.easyGit10 XP | Git | New | easy | 10 |
| Resolve a Merge ConflictMerge a feature branch into main, resolve a conflicting line correctly and keep both sides' other changes.mediumGit20 XP | Git | New | medium | 20 |
| Undo a Bad Commit Without Rewriting HistoryA shared branch contains a commit that broke production. Undo just that commit safely.mediumGit20 XP | Git | New | medium | 20 |
| Fix the Last Commit MessageCorrect a typo in the most recent, not-yet-pushed commit without creating a new commit.easyGit10 XP | Git | New | easy | 10 |
| Stop Tracking Build Output and LogsIgnore generated files with .gitignore and remove already-tracked ones from the index while keeping them on disk.easyGit10 XP | Git | New | easy | 10 |
| Backport One Fix with cherry-pickCopy a single bug-fix commit from a release branch onto main without merging anything else.mediumGit20 XP | Git | New | medium | 20 |
| Find the Commit That Introduced a BugSearch a long history to find exactly which commit added a dangerous setting.hardGit40 XP | Git | New | hard | 40 |
| Bring Back a Deleted FileRecover a file that was deleted several commits ago and commit it again.easyGit10 XP | Git | New | easy | 10 |
| Squash WIP Commits Before ReviewCombine several messy work-in-progress commits on a feature branch into one clean commit.hardGit40 XP | Git | New | hard | 40 |
| Tag a Release on the Right CommitCreate an annotated release tag on a specific older commit, not on HEAD.easyGit10 XP | Git | New | easy | 10 |
| Pause Your Work for an Urgent HotfixShelve uncommitted changes, commit a hotfix cleanly, then get your work-in-progress back.mediumGit20 XP | Git | New | medium | 20 |
| Forks, Branches and ClonesYou want to fix a bug in an open-source project on GitHub. You have no write access to its repository. What is the usual way to contribute?easyGit3 XP | Git | New | easy | 3 |
| Public, Private and Internal ReposA company on GitHub Enterprise wants a shared tooling repository that every employee in the enterprise can read, without adding them one by one, but that must neasyGit3 XP | Git | New | easy | 3 |
| Issues vs Discussions vs ProjectsMaintainers of a popular library are overwhelmed by "how do I...?" questions and loose feature ideas opened as issues. They want a separate community space for easyGit3 XP | Git | New | easy | 3 |
| Linking Issues with ClosesA pull request into main (the default branch) has this description:easyGit3 XP | Git | New | easy | 3 |
| Merge, Squash or RebaseA team's pull requests contain many small commits like "wip" and "fix typo". They want main to have a linear history with exactly one commit per pull request. WmediumGit5 XP | Git | New | medium | 5 |
| Enforcing CODEOWNERS ReviewsThe repository has .github/CODEOWNERS containing /infra/ @acme/platform-team. The platform team is requested as a reviewer on PRs that touch infra/, but PRs aremediumGit5 XP | Git | New | medium | 5 |
| Branch Protection and RulesetsAn organization has 40 repositories. On main and every release/ branch in all of them, it wants to require a pull request with one approval and block force pushhardGit8 XP | Git | New | hard | 8 |
| A Required Check That Never Reportsmain requires the status check test. After someone edited the CI workflow, every new PR shows test as "Expected — Waiting for status to be reported" and cannot hardGit8 XP | Git | New | hard | 8 |
| Workflow Anatomy and Fork PRsyamlmediumGit5 XP | Git | New | medium | 5 |
| Dependabot Alerts and UpdatesA team wants GitHub to open pull requests every week that bump their npm dependencies to the latest versions, even when no vulnerability is involved. What shoulmediumGit5 XP | Git | New | medium | 5 |
| Working Tree, Index and RepositoryYou edited app.py and ran git add app.py. Then you edited app.py again. What will git commit (without -a) record?easyGit3 XP | Git | New | easy | 3 |
| fetch vs pullWhat is the difference between git fetch and git pull?easyGit3 XP | Git | New | easy | 3 |
| Detached HEADAfter git checkout 3f9c2ab Git says you are in "detached HEAD" state. What does that mean?mediumGit5 XP | Git | New | medium | 5 |
| Merge vs RebaseWhich statement about git rebase main (run on a feature branch) is correct?mediumGit5 XP | Git | New | medium | 5 |
| Recovering "Lost" CommitsYou ran git reset --hard HEAD~3 by mistake and the three commits disappeared from git log. How can you get them back?hardGit8 XP | Git | New | hard | 8 |
| .gitignore and Tracked FilesYou add config.local.json to .gitignore, but Git still shows changes to that file. Why?easyGit3 XP | Git | New | easy | 3 |
| Images vs ContainersWhich statement best describes the relationship between a Docker image and a container?easyDocker3 XP | Docker | New | easy | 3 |
| Build Cache OrderingA Node.js Dockerfile looks like this and rebuilds all dependencies on every code change:mediumDocker5 XP | Docker | New | medium | 5 |
| CMD vs ENTRYPOINTAn image has ENTRYPOINT ["curl"] and CMD ["--help"]. What runs when you execute docker run myimage https://example.com?mediumDocker5 XP | Docker | New | medium | 5 |
| Where Should Database Data Live?You run PostgreSQL in a container. You want the data to survive docker rm and container upgrades. What should you use?easyDocker3 XP | Docker | New | easy | 3 |
| Publishing PortsA container's web server listens on port 8080. Which command makes it reachable at http://localhost:3000 on the host?easyDocker3 XP | Docker | New | easy | 3 |
| Multi-stage BuildsWhat is the main benefit of a multi-stage Dockerfile for a compiled Go service?mediumDocker5 XP | Docker | New | medium | 5 |
| Container-to-Container DNSTwo containers, api and db, should talk to each other. Which setup lets api reach the database at hostname db?mediumDocker5 XP | Docker | New | medium | 5 |
| Running as Non-rootWhy is it recommended to add a USER instruction (a non-root user) to production Dockerfiles?mediumDocker5 XP | Docker | New | medium | 5 |
| The Problem with :latestWhat is the main risk of deploying images referenced as myapp:latest?easyDocker3 XP | Docker | New | easy | 3 |
| HEALTHCHECKA container is "Up" but the app inside is deadlocked and returns nothing. Which Dockerfile instruction lets Docker detect this?mediumDocker5 XP | Docker | New | medium | 5 |
| Compose Startup OrderIn Docker Compose, the api service has dependson: [db]. On startup the API still crashes with "connection refused" to the database. Why?mediumDocker5 XP | Docker | New | medium | 5 |
| .dockerignoreWhat does a .dockerignore file do?easyDocker3 XP | Docker | New | easy | 3 |
| Fix a Deployment Stuck Pulling Its ImageA rollout is stuck with Pods in ImagePullBackOff. Find the broken image reference and get every replica running.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Deploy and Expose an AppCreate a Deployment with exact labels and ports, then put a ClusterIP Service in front of every replica.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Fix a Service With No EndpointsA Service routes to nothing because its selector misses the Pods. Point it at exactly the right replicas without catching the canary.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Roll Back to a Named RevisionA Deployment has several recorded rollouts. Use its history to return to one specific earlier revision, not just the previous one.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Fix Pods Stuck in PendingA Deployment asks for more CPU than any node has. Find out why its Pods never start and right-size the requests.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Inject a ConfigMap and a Secret as Env VarsCreate a ConfigMap and a Secret, then wire them into a Deployment's containers as environment variables.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Autoscale a Deployment on CPUSet up a HorizontalPodAutoscaler for a Deployment, and give its containers the CPU request that utilization targets depend on.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Add Readiness and Liveness ProbesGive a Deployment the health checks it is missing, so Kubernetes stops sending traffic to Pods that are not ready and restarts hung ones.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Add an Init Container and a SidecarPrepare a shared volume before the app starts and ship its logs with a sidecar that reads the same volume.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Bind a Claim to a Static VolumeCreate a hostPath PersistentVolume, a claim that binds to exactly that volume, and a Pod that mounts it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Run an Agent on Every NodeCreate a DaemonSet for a node agent that must also run on the control plane, without touching the node's taint.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Run a StatefulSet Behind a Headless ServiceGive each replica of a clustered datastore a stable name and DNS identity with a StatefulSet and a headless Service.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Schedule a CronJob and Run It NowCreate a CronJob with a precise schedule and history settings, then trigger a one-off Job from it that completes.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Route a Host and Two PathsPublish a frontend and its API under one host name with an Ingress that sends each path to the right Service and port.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Run a Workload on a Dedicated NodeA node is reserved with a taint. Get one Deployment onto that node, and only that node, while everything else stays off it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Give a ServiceAccount Read-Only AccessCreate a ServiceAccount that can watch Pods and Deployments in one namespace and nothing more.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Build a Cluster-Wide Read-Only RoleGive an auditor read access to nodes, volumes and Pods across the cluster, without Secrets and without any write access.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| Lock Down Database TrafficWrite a NetworkPolicy so only the API tier can reach the database, without cutting off anything else.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Zero-Trust Networking with Default DenyBlock all traffic in and out of a namespace, then allow exactly the flows the app needs, DNS included.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| Choose the Least Permissive NetworkPolicyFour candidate policies are on disk. Apply the one that allows exactly the required traffic and nothing more.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Add a Quota Without Breaking WorkloadsCap a namespace with a ResourceQuota and give it LimitRange defaults so a Deployment without resources keeps running.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Route Traffic with the Gateway APIAttach an HTTPRoute to a shared Gateway and send /api and the rest of the site to different Services.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Migrate an Ingress to the Gateway APIReplace an Ingress with a Gateway that terminates TLS and an HTTPRoute that routes the same way.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| Enforce the Restricted Pod Security StandardTurn on restricted Pod Security enforcement for a namespace and harden a multi-container Deployment so it still runs.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| Install a Helm Chart with Custom ValuesAdd your team's chart repository and install a pinned chart version with your own settings.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Roll Back a Broken Helm UpgradeThe latest Helm upgrade broke a release. Find the last good revision in its history and roll back to it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Upgrade a Helm Release Without Losing Its SettingsMove a release to the newest chart version in the repository while keeping every custom value.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Build a Production Overlay with KustomizeReuse shared manifests without touching them, with an overlay that changes the namespace, replicas, image and labels.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Install the Newest Chart VersionYour Helm client doesn't list the chart versions published this morning. Install the newest one anyway.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Remove Releases of a Deprecated ChartFind every release that still runs a deprecated chart version, in any namespace, and uninstall only those.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Unstick a Helm ReleaseEvery Helm upgrade fails with "another operation is in progress". Recover the release and finish the upgrade the team asked for.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| Render a Chart Without Its CRDsGenerate a controller's manifests from its Helm chart with the CRDs left out, save them, and apply them with kubectl.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Write Your First Helm ChartPackage a team's settings as a small Helm chart whose ConfigMap comes from values, then install it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Fix a Chart That Won't InstallA colleague's chart fails to install. Find what is wrong with it, fix the chart, and install it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Install an Umbrella ChartAn umbrella chart depends on a chart from the team repository and won't install yet. Fetch its dependency and install it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Package a Chart into a RepositoryPackage a chart at the version the release team asked for and publish it in a chart repository folder with an index.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Sign a Certificate for a New UserTurn a new admin's key and certificate request into a signed client certificate through the Kubernetes API, then give them read access.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| A Role for Rolling Out AppsLet a CI ServiceAccount create and update workloads in one namespace, but never delete them or read Secrets.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Keep a Volume's Data When Its Claim GoesProtect a volume from deletion, then move its data to a new claim name without losing it.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| Let One Namespace InA namespace denies all incoming traffic. Write one NetworkPolicy that lets only the monitoring namespace's scraper reach the API's metrics port.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Serve an App over HTTPS with IngressStore the provided certificate as a TLS Secret and publish the app over HTTPS on its host name with an Ingress.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Pending on Purpose, Pending by MistakeA batch workload must run on the node reserved for it, but its Pods never get placed. Fix the workload, not the nodes.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Add a Log Sidecar to a Running AppAn app writes its log to a file nobody can read. Add a sidecar that streams the file to the container log, sharing a volume.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Run a Batch Job in ParallelCreate a Job that runs a fixed number of completions, a few at a time, with a retry limit and a deadline.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| A Deployment That Creates No PodsA Deployment sits at zero Pods and there are no Pending Pods to describe. Find what blocks it and fix the Deployment.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| A Claim Stuck in PendingAn app waits on a PersistentVolumeClaim that never binds. Bind it to the volume prepared for it and get the app running.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Names Stopped ResolvingAfter a default-deny egress policy went in, the app can't look up any Service by name. Let DNS through, and only DNS.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| The Policy That Lets Nothing InA NetworkPolicy should let the frontend reach the backend, yet every request times out. Find the mistake in the policy and fix it without opening anything else.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Unreachable from OutsideAn external health checker polls the app on a fixed port of every node and gets nothing. Find what is wrong with the Service and fix it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| The Ingress Returns 404 and 503The shop's Ingress serves nothing it should. Find what doesn't match between the Ingress, its class and the Services, and fix it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| The Route That Never AttachedAn HTTPRoute was applied without errors, but the Gateway ignores it. Find why it isn't attached or can't reach its backend, and fix it.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| Stuck in PendingA new release never starts; its Pods sit in Pending. Read the scheduler's events, find the cause and fix it the right way.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| A Service for a Database Outside the ClusterApps reach a legacy database through a Service with no selector, and connections hang. Fix its hand-made EndpointSlice so the Service points at the database.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Only This App Can't Resolve ServicesEvery app in the namespace resolves Service names except one. The cluster DNS is fine; the problem is in the app's own Pod settings.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Bring Existing Objects Under HelmThe app was deployed by hand from the chart's output, and helm install now refuses to touch it. Make Helm adopt the running objects, without downtime.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| An Upgrade Stuck in Its HookA Helm upgrade failed because its pre-upgrade hook timed out. Find the hook that never finished, then complete the upgrade the team wanted.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Someone Edited a Helm Release by HandQuick kubectl fixes changed a Helm-managed app behind Helm's back. Put the objects back to what the release defines, using Helm, without uninstalling.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Values the Chart RejectsThe chart validates its values against a JSON Schema, and your team's values file fails it. Fix the values file, not the chart, and install the release.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Patch a Chart Without Forking ItA vendor chart has no values for the scheduling rule your platform requires. Install it with a Kustomize post-renderer that adds it, so the change stays part of the release.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| Values That Never Reach the SubchartAn umbrella chart installs two copies of a subchart, but your settings land nowhere and the admin copy shouldn't be installed at all. Fix the umbrella's values and install it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Helm Upgraded the Operator, Not Its CRDAfter upgrading an operator's chart, its new custom resource field is silently dropped. Helm doesn't upgrade CRDs from a chart's crds/ folder. Do it yourself and create the resource.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| A ServiceAccount With Just Enough AccessAn app runs with the namespace's default ServiceAccount and an auto-mounted token. Give it its own account that can read one ConfigMap and nothing else, and keep the token off every other Pod.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Make a Container ImmutableAn attacker who gets into this container could rewrite its files and escalate. Make its root filesystem read-only, run it unprivileged, and keep the app working.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Keep Pods Away From the Metadata ServicePods can reach the cloud's instance metadata endpoint and steal the node's credentials. Block it for every Pod in the namespace, without cutting off anything else.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Only Images From the Company RegistryWrite a ValidatingAdmissionPolicy that rejects Pods with images from anywhere but the company registry, in the namespaces that opt in.hardKubernetes40 XP | Kubernetes | New | hard | 40 |
| Secrets as Files, Not Environment VariablesAn app reads its database password from an environment variable, where it leaks into crash dumps and debug output. Move it to a read-only file only the app's user can read.easyKubernetes10 XP | Kubernetes | New | easy | 10 |
| Who Can Read the Production Secrets?Audit RBAC across the cluster to find the ServiceAccount that can read Secrets in the payments namespace without needing to, record it, and revoke exactly that access.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| Pass the Security LinterThe deployment pipeline now runs kube-linter with a security profile, and your team's manifest fails it. Fix the manifest until the linter is clean, then deploy it.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| A Short-Lived Token for One AudienceAn app needs a token only to log in to Vault. Replace the auto-mounted all-purpose token with a projected one, bound to Vault's audience and valid for one hour.mediumKubernetes20 XP | Kubernetes | New | medium | 20 |
| What Is a Pod?Which statement about a Kubernetes Pod is correct?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| Restoring an etcd SnapshotOn a kubeadm cluster you took a backup with etcdctl snapshot save /opt/snap.db. After an accidental deletion you run etcdutl snapshot restore /opt/snap.db --dathardKubernetes8 XP | Kubernetes | New | hard | 8 |
| Deployments and ReplicaSetsYou change the container image of a Deployment. What does Kubernetes do by default?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| kubeadm Upgrade OrderYou are upgrading a kubeadm cluster by one minor version. Which order is correct for the first control-plane node?mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Service TypesWhich Service type gives Pods a stable cluster-internal virtual IP and DNS name, and is the default?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| Pods That Come BackYou run kubectl delete pod metrics-node01 and it reappears within seconds with the same name. It has no ownerReferences and its name ends with the node name. HoeasyKubernetes3 XP | Kubernetes | New | easy | 3 |
| A Service with No Endpointskubectl get endpointslices -l kubernetes.io/service-name=web shows no endpoints, although Pods of the web app are Running and Ready. What is the most likely caumediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Node Stuck NotReadykubectl get nodes shows node02 as NotReady after a maintenance window. Everything else is healthy. What is the most useful first step?mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| ConfigMaps vs SecretsWhat is true about a Kubernetes Secret by default?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| StorageClass Reclaim PolicyA developer deleted a PVC that was dynamically provisioned by the fast-ssd StorageClass. The PV and the cloud disk behind it were deleted too. How do you stop tmediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Liveness vs ReadinessA Pod's readiness probe starts failing while its liveness probe keeps succeeding. What happens?mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Gateway API RolesThe platform team runs a shared Gateway in the infra namespace. Your team wants /orders on that Gateway to reach your orders Service. Which resource do you creaeasyKubernetes3 XP | Kubernetes | New | easy | 3 |
| Requests and LimitsA container has resources.requests.memory: 256Mi and resources.limits.memory: 512Mi. Which statement is correct?mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Sorting with kubectlYou need to find the Pod in namespace prod whose first container has restarted the most. Which command works?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| NamespacesWhich of these resources is cluster-scoped (not namespaced)?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| Overlapping CronJob RunsA CronJob runs a backup every 5 minutes. Sometimes a run takes 8 minutes, and two overlapping runs corrupt the archive. You want the new run to be skipped whilemediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Role vs ClusterRoleA ServiceAccount in namespace ci must list Pods only in namespace staging. Which combination is correct?mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Native Sidecar ContainersA Job's Pod needs a log-shipper that must be running before the main container starts and must not stop the Job from completing when the main container exits. HmediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| PersistentVolumeClaimsA PVC stays in Pending. The cluster has a default StorageClass with volumeBindingMode: WaitForFirstConsumer. What is the most likely explanation?mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Rolling Back a Helm Releasehelm upgrade shop ./chart -f prod-values.yaml broke the app. helm history shop shows the last good release is revision 3. What is the cleanest way back?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| When to Use a DaemonSetYou need exactly one log-collector Pod on every node, including nodes added later. Which controller fits best?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| Kustomize Overlaysbase/ holds a Deployment and a Service. Production needs 5 replicas and the image tag 2.4.1, without copying the base manifests. What is the Kustomize way?mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| CrashLoopBackOffA Pod is in CrashLoopBackOff. Which command most directly shows why the previous container instance exited?mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Canary Releases with LabelsService shop selects app: shop. You want roughly 10% of traffic to go to version 2 using only core Kubernetes objects. Which setup works?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| Taints and TolerationsA node has the taint gpu=true:NoSchedule. A Pod has a matching toleration but no node selector or affinity. Which is true?hardKubernetes8 XP | Kubernetes | New | hard | 8 |
| runAsNonRoot FailuresAfter you add runAsNonRoot: true to a Pod, its container stays in CreateContainerConfigError with "container has runAsNonRoot and image will run as root". What mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| NetworkPolicy DefaultsA namespace has no NetworkPolicies. You then add one policy that selects Pods app=db and allows ingress only from Pods app=api. Which statement is correct (withhardKubernetes8 XP | Kubernetes | New | hard | 8 |
| ResourceQuota Needs DefaultsAn admin added a ResourceQuota on requests.cpu and limits.cpu to namespace team-a. Now a Deployment there has 0 Pods and kubectl get pods shows nothing. kubectlhardKubernetes8 XP | Kubernetes | New | hard | 8 |
| ConfigMap Updates and subPathA container mounts key config.yaml from ConfigMap app-cfg with mountPath: /etc/app/config.yaml and subPath: config.yaml. You edit the ConfigMap. Ten minutes lathardKubernetes8 XP | Kubernetes | New | hard | 8 |
| Pod Security Restricted LevelNamespace payments has the label pod-security.kubernetes.io/enforce: restricted. A Pod is rejected with: seccompProfile (pod or container "api" must set securitmediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Encrypting Existing SecretsYou add an EncryptionConfiguration with an aescbc provider first and identity last, and start kube-apiserver with --encryption-provider-config. New Secrets appehardKubernetes8 XP | Kubernetes | New | hard | 8 |
| Audit Policy Rule OrderYour audit policy has these rules in order: (1) level: RequestResponse for all resources, (2) level: Metadata for secrets. Secret values are showing up in the amediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Pinning Images by DigestCI scans registry.example.com/api:1.8 with Trivy and it passes. Later someone pushes a different image under the same tag. How do you make sure Pods run exactlyeasyKubernetes3 XP | Kubernetes | New | easy | 3 |
| Disabling Token AutomountA web frontend never calls the Kubernetes API. The security review requires that no ServiceAccount token is present anywhere in its container filesystem. What deasyKubernetes3 XP | Kubernetes | New | easy | 3 |
| ValidatingAdmissionPolicy BindingYou create a ValidatingAdmissionPolicy with the CEL expression has(object.metadata.labels.team) that matches Deployments. kubectl apply succeeds, but DeploymenthardKubernetes8 XP | Kubernetes | New | hard | 8 |
| Runtime Threat DetectionAn attacker exploits a web app and spawns /bin/sh from inside the running process; no one runs kubectl exec. Which control is designed to detect this as it happmediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Control Plane ResponsibilitiesYou create a Deployment. The API server stores it, but no ReplicaSet is ever created. Which component is most likely not working?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| What Makes It GitOpsWhich setup best matches the GitOps model?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| Picking the Right SignalA checkout request passes through six microservices and sometimes takes 4 seconds. Which telemetry signal shows which hop is spending the time?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| HPA, VPA and Cluster AutoscalerDuring a traffic spike, the HorizontalPodAutoscaler scales api from 4 to 20 replicas, but 6 new Pods stay Pending with 0/5 nodes are available: Insufficient cpumediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Charts, Releases and RevisionsYou run helm install api internal/webapp -n shop, then helm upgrade api internal/webapp -n shop --set replicaCount=3. Which statement is true?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| Which Value Wins?The chart's values.yaml sets replicaCount: 1. You run helm install web ./chart -f prod.yaml -f extra.yaml --set replicaCount=4. prod.yaml sets replicaCount: 2 amediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Upgrades That Forget SettingsA release was installed with --set config.logLevel=debug. Later someone runs helm upgrade web internal/webapp --set replicaCount=3, and the log level silently gmediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Upgrades That Undo ThemselvesYou want an upgrade to roll back automatically if the new Pods never become ready within 5 minutes. Which command does that?mediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Seeing the YAML Before You InstallYou want the manifests a chart would create, saved to a file, without contacting the cluster or creating a release. Which command fits?easyKubernetes3 XP | Kubernetes | New | easy | 3 |
| How Helm Treats CRDsA chart ships its CustomResourceDefinitions in the crds/ folder. Which statement about them is true?hardKubernetes8 XP | Kubernetes | New | hard | 8 |
| Where Subcharts Come FromChart.yaml lists a dependency on redis 19.x from a repository URL. helm install app . fails with "found in Chart.yaml, but missing in charts/ directory". What fmediumKubernetes5 XP | Kubernetes | New | medium | 5 |
| Another Operation Is in Progresshelm upgrade api ./chart fails with "another operation (install/upgrade/rollback) is in progress". helm history api shows the last revision as pending-upgrade fhardKubernetes8 XP | Kubernetes | New | hard | 8 |
| The Shared Responsibility ModelUnder the cloud shared responsibility model, which task is the customer's responsibility when running an application on a virtual machine (for example EC2)?easyCloud3 XP | Cloud | New | easy | 3 |
| Choosing an EC2 Pricing ModelA web fleet runs 24/7 at a predictable baseline and will keep running for at least three years. The team expects to move to newer instance families and may shifeasyCloud3 XP | Cloud | New | easy | 3 |
| Least Privilege with IAMAn application on a virtual machine needs to read objects from one storage bucket. What is the recommended way to give it access?easyCloud3 XP | Cloud | New | easy | 3 |
| Well-Architected PillarsDuring a Well-Architected review, the team discusses deploying across multiple Availability Zones, testing recovery procedures, and having the system automaticaeasyCloud3 XP | Cloud | New | easy | 3 |
| Regions and Availability ZonesWhat is the main reason to spread application servers across multiple Availability Zones in one region?easyCloud3 XP | Cloud | New | easy | 3 |
| CloudTrail vs CloudWatch vs ConfigA bucket policy was removed last Tuesday and the security team asks: which IAM principal made the DeleteBucketPolicy call, from which IP address, and when? WhicmediumCloud5 XP | Cloud | New | medium | 5 |
| Choosing a Storage ClassYou store compliance logs that must be kept for 7 years and are almost never read. Retrieval can take hours. Which object storage class is the most cost-effectimediumCloud5 XP | Cloud | New | medium | 5 |
| Picking a Managed DatabaseA shopping-cart service stores items by cartId, needs consistent single-digit millisecond reads and writes, has no joins, and must handle large, unpredictable tmediumCloud5 XP | Cloud | New | medium | 5 |
| Security Groups Are StatefulA security group allows inbound TCP 443 from anywhere and has no outbound rules that match the client. Will responses to HTTPS requests reach the clients?mediumCloud5 XP | Cloud | New | medium | 5 |
| CloudFront and Edge LocationsStatic images and JavaScript are served from an S3 bucket in us-east-1. Users in Asia and Europe complain that pages load slowly. What is the most direct improveasyCloud3 XP | Cloud | New | easy | 3 |
| Public vs Private SubnetsDatabase servers in a private subnet need to download OS updates from the internet but must not be reachable from it. What is the standard setup?mediumCloud5 XP | Cloud | New | medium | 5 |
| Route 53 Routing PoliciesAn application runs in eu-west-1 and ap-southeast-1. Users should be sent to whichever Region gives them the lowest latency, and if one Region becomes unhealthyhardCloud8 XP | Cloud | New | hard | 8 |
| Auto Scaling SignalsYour web tier is CPU-bound and traffic doubles every evening. Which approach keeps latency stable at the lowest cost?mediumCloud5 XP | Cloud | New | medium | 5 |
| Encryption at Rest with KMSCompliance requires that EBS volumes and S3 objects are encrypted at rest, that the security team controls who can use the key, and that every use of the key ismediumCloud5 XP | Cloud | New | medium | 5 |
| Avoiding Surprise BillsWhat is the first safeguard you should set up on a new personal cloud account?easyCloud3 XP | Cloud | New | easy | 3 |
| Organizations and SCPsA member account sits in an OU with a service control policy that denies all actions outside eu-central-1 and eu-west-1. An IAM user in that account has the AdmhardCloud8 XP | Cloud | New | hard | 8 |
| When Serverless Functions FitWhich workload is the best fit for a serverless function service (like AWS Lambda)?mediumCloud5 XP | Cloud | New | medium | 5 |
| Protecting the Root UserYou have just created a new AWS account. What should you do with the root user?easyCloud3 XP | Cloud | New | easy | 3 |
| Public BucketsA static website's images must be publicly readable, but the rest of the bucket must stay private. What is the safest approach?easyCloud3 XP | Cloud | New | easy | 3 |
| What Basic Support IncludesA startup is on the free Basic support plan. Which of these do they get without upgrading?easyCloud3 XP | Cloud | New | easy | 3 |
| Migration StrategiesA team moves its self-managed MySQL server from an on-premises VM to Amazon RDS for MySQL. The application code does not change; only the connection string is umediumCloud5 XP | Cloud | New | medium | 5 |
| Cost Explorer, Budgets, Trusted AdvisorFinance wants to understand why last quarter's bill grew, broken down by service and by the team cost allocation tag, with a monthly trend chart. Which tool fitmediumCloud5 XP | Cloud | New | medium | 5 |
| SQS vs SNS Fan-OutEvery OrderPlaced event must be processed by three independent services (billing, shipping, analytics). Each service must receive every event, process at its owhardCloud8 XP | Cloud | New | hard | 8 |
| EBS vs EFS vs S3Several Linux EC2 instances in different Availability Zones must mount the same POSIX file system at the same time to share uploaded files. Which storage serviceasyCloud3 XP | Cloud | New | easy | 3 |
| Roles vs Users for AccessA partner's auditing tool runs in their own AWS account and needs read-only access to resources in yours. What is the recommended setup?mediumCloud5 XP | Cloud | New | medium | 5 |
| Shield vs WAF vs GuardDutyA web app behind an Application Load Balancer is receiving requests with SQL injection payloads in the query string. You want to block these requests before themediumCloud5 XP | Cloud | New | medium | 5 |
| How Big Is a /24?How many IPv4 addresses does the block 10.0.1.0/24 contain?easyNetworking3 XP | Networking | New | easy | 3 |
| Overlapping NetworksWhich pair of networks overlaps?mediumNetworking5 XP | Networking | New | medium | 5 |
| DNS Record TypesWhich DNS record makes www.example.com an alias for another hostname (for example a load balancer's DNS name)?easyNetworking3 XP | Networking | New | easy | 3 |
| TCP vs UDPWhy does DNS traditionally use UDP for normal queries?easyNetworking3 XP | Networking | New | easy | 3 |
| HTTP Status CodesA load balancer returns 502 Bad Gateway. What does that usually indicate?easyNetworking3 XP | Networking | New | easy | 3 |
| What TLS Certificates ProveWhen your browser validates a server's TLS certificate, what is it mainly verifying?mediumNetworking5 XP | Networking | New | medium | 5 |
| Well-known PortsWhich mapping of service to default TCP port is correct?easyNetworking3 XP | Networking | New | easy | 3 |
| 127.0.0.1 vs 0.0.0.0An app inside a container listens on 127.0.0.1:8080. The container is started with -p 8080:8080, but requests from the host fail. Why?mediumNetworking5 XP | Networking | New | medium | 5 |
| CI vs CDWhich statement best describes Continuous Integration?easyCI/CD3 XP | CI/CD | New | easy | 3 |
| Secrets in PipelinesWhere should a deployment token used by a CI workflow be stored?easyCI/CD3 XP | CI/CD | New | easy | 3 |
| Workflow TriggersIn a GitHub Actions workflow, which on: block runs the workflow for pushes to main and for pull requests targeting main?easyCI/CD3 XP | CI/CD | New | easy | 3 |
| Job DependenciesBy default, how do multiple jobs in one GitHub Actions workflow run, and how do you make deploy wait for test?mediumCI/CD5 XP | CI/CD | New | medium | 5 |
| Faster Pipelines with CachingYour pipeline spends 4 minutes downloading the same dependencies on every run. What is the usual fix?mediumCI/CD5 XP | CI/CD | New | medium | 5 |
| Blue-Green vs CanaryWhich description matches a canary release?mediumCI/CD5 XP | CI/CD | New | medium | 5 |
| Why Infrastructure as Code?What is the main benefit of managing infrastructure with code (e.g. Terraform) instead of clicking in a web console?easyTerraform3 XP | Terraform | New | easy | 3 |
| Provider Versions and the Lock FileThe configuration declares version = "~> 5.40" for the hashicorp/aws provider. The committed .terraform.lock.hcl records 5.42.0. Version 5.60.0 has since been rmediumTerraform5 XP | Terraform | New | medium | 5 |
| plan vs applyWhat does terraform plan do?easyTerraform3 XP | Terraform | New | easy | 3 |
| Using Module OutputsThe root module calls a child module with module "network" { source = "./modules/network" }. Inside it, the VPC is awsvpc.main. How does the root module get theeasyTerraform3 XP | Terraform | New | easy | 3 |
| What Is the State File For?Why does Terraform keep a state file?mediumTerraform5 XP | Terraform | New | medium | 5 |
| Reading Data with Data SourcesInstead of hard-coding an AMI ID, you want Terraform to look up the latest Amazon Linux AMI at plan time and use its ID for an instance. What do you write?easyTerraform3 XP | Terraform | New | easy | 3 |
| Remote State and LockingTwo engineers run terraform apply on the same stack at the same time. What prevents them from corrupting the state?mediumTerraform5 XP | Terraform | New | medium | 5 |
| fmt and validate in CIA CI job must fail if any .tf file in the repo is not in canonical style, without modifying the files. Which command fits?easyTerraform3 XP | Terraform | New | easy | 3 |
| Variables and OutputsIn a reusable Terraform module, how do callers pass values in, and how does the module expose values out?easyTerraform3 XP | Terraform | New | easy | 3 |
| Implicit vs Explicit DependenciesAn EC2 instance's user data script downloads a file from S3 at boot. The permission comes from an awsiamrolepolicy that nothing in the instance block referenceseasyTerraform3 XP | Terraform | New | easy | 3 |
| Configuration DriftSomeone changed a firewall rule manually in the console. What happens on the next terraform plan?mediumTerraform5 XP | Terraform | New | medium | 5 |
| count vs for_eachhclmediumTerraform5 XP | Terraform | New | medium | 5 |
| Lifecycle Meta-ArgumentsChanging an argument on a load balancer's TLS certificate forces replacement. By default Terraform destroys the old certificate first, causing an outage while leasyTerraform3 XP | Terraform | New | easy | 3 |
| Importing Existing ResourcesAn S3 bucket acme-logs-prod was created by hand in the console. You want Terraform to manage it without recreating it, and you would like Terraform to draft themediumTerraform5 XP | Terraform | New | medium | 5 |
| Renaming with moved BlocksYou rename resource "awsinstance" "web" to resource "awsinstance" "app" for clarity. terraform plan now wants to destroy awsinstance.web and create awsinstance.hardTerraform8 XP | Terraform | New | hard | 8 |
| Forcing Replacement with -replaceThe configuration is unchanged, but the VM behind awsinstance.web is in a broken state and you want Terraform to destroy and recreate just that instance. Which mediumTerraform5 XP | Terraform | New | medium | 5 |
| Workspaces vs Separate ConfigurationsA team uses CLI workspaces dev and prod in the same backend and the same configuration. Security now requires that prod state and prod credentials be completelymediumTerraform5 XP | Terraform | New | medium | 5 |
| Sensitive Values and StateA database password is passed in through variable "dbpassword" { sensitive = true } and used as the password argument of an awsdbinstance. Which statement is trhardTerraform8 XP | Terraform | New | hard | 8 |