Honest status surfaces: logs, metrics, events, and runtime audit
Practice self-check. Answers stay in this page so you can grade yourself. This is not a scored exam.
Twelve scenario items on AWS monitoring, event response and troubleshooting plus Kubernetes troubleshooting and runtime security. Companion lab: Hedronite uistatus (a UI status contract that never paints healthy after a terminal failure).
Lab download.Starter is the tree you edit. Worked answer is a separate file; open it after the starter passes. Rust 1.85 or newer. One online cargo vendor vendor. The zip has no vendored crates. Offline build after that command was checked for this lab on Rust 1.99. All lab requirements.
A web service's request count and latency metrics follow strong daily and weekly patterns. Any single static alarm threshold either fires every night or misses daytime spikes, and the team's status banner must not stay green during a real anomaly. Which approach fires only when the metric falls outside its expected pattern?
Answer: C. CloudWatch anomaly detection trains a model on the metric's past data, accounts for hourly, daily and weekly patterns, and an alarm built on it fires when the metric leaves the expected band. A single static threshold, including one at the weekly average, cannot follow a cyclical pattern; a dashboard widget has no alarm action; and detailed monitoring only raises resolution to 1 minute without adding any alarm logic. Source: Using CloudWatch anomaly detection (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Anomaly_Detection.html)
A Pod's container is in CrashLoopBackOff. Running kubectl logs against the current container shows only startup lines because it restarted moments ago. The engineer needs the output written by the instance that crashed. Which command provides it?
Answer: A. The --previous flag prints the logs for the previous instance of the container in the Pod, if one exists. --follow only streams the current instance, while Events and kubectl describe report lifecycle information such as restarts and exit codes and never contain the container's stdout. Source: kubectl logs (https://kubernetes.io/docs/reference/kubectl/generated/kubectl_logs/)
Q3 · CKS runtime security, audit policy level
Security wants an audit record of every read or change to Secrets, including who acted, when, which resource and which verb. The audit log must not contain Secret payloads in request or response bodies. Which audit policy rule meets both requirements?
Answer: D. The Metadata level logs request metadata such as user, timestamp, resource and verb but does not log the request or response body. RequestResponse logs both bodies and Request logs the request body, so Secret payloads would be written, while None does not log matching events at all. Source: Auditing (https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/)
Q4 · DOP-C02 event management (5.1), AWS Health events
The team wants to be notified and to start an automated runbook whenever AWS Health reports a scheduled change or issue affecting their EC2 instances. The solution must be event-driven and must not poll any API. What should they build?
Answer: B. AWS Health publishes events to Amazon EventBridge with source aws.health, and a rule can route matching events to targets such as an SNS topic or a Lambda function. S3 Event Notifications and log metric filters only see bucket activity and application log text, and a periodic AWS Config rule evaluates resource configuration instead of receiving AWS Health events. Source: Monitoring events in AWS Health with Amazon EventBridge (https://docs.aws.amazon.com/health/latest/ug/cloudwatch-events-health.html); AWS Health events Amazon EventBridge schema, source aws.health (https://docs.aws.amazon.com/health/latest/ug/aws-health-events-eventbridge-schema.html)
Q5 · CKA troubleshooting, Service with no endpoints
A Service named status-api returns connection failures to clients. Its backing Pods are Running and Ready, yet kubectl get endpointslices -l kubernetes.io/service-name=status-api shows <none> in the ENDPOINTS column. Which first troubleshooting step addresses the most likely cause?
Answer: B. The Debug Services guide says that if the ENDPOINTS column is <none>, check that the Service spec.selector actually selects the metadata.labels values on the Pods. Restarting kube-proxy, adding replicas and recreating CoreDNS Pods do not change which Pods the selector matches, so the endpoint list would stay empty. Source: Debug Services (https://kubernetes.io/docs/tasks/debug/debug-application/debug-service/)
Q6 · DOP-C02 log and metric collection (4.1), CloudWatch agent
The team needs memory utilization and disk usage metrics from EC2 instances, plus the application log files delivered to CloudWatch Logs. The default EC2 metrics do not include memory. What should they do?
Answer: C. The CloudWatch agent collects in-guest system metrics such as memory and disk usage and also ships log files to CloudWatch Logs. Detailed monitoring only changes the frequency of the default hypervisor-level metrics, Flow Logs capture network traffic metadata, and CloudTrail data events record API activity on resources rather than guest metrics or files. Source: Collect metrics, logs, and traces using the CloudWatch agent (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html)
Q7 · CKS runtime security, immutable containers
After an incident in which an attacker dropped a binary into a running container, the team wants the container's root filesystem to be immutable at runtime. The application must still write scratch data to a mounted volume. Which configuration meets this?
Answer: A.securityContext.readOnlyRootFilesystem: true mounts the container's root filesystem read-only, and a writable volume such as emptyDir still provides scratch space. Running privileged, allowing privilege escalation and running as UID 0 each grant more capability to the process and none of them makes the root filesystem read-only. Source: Configure a Security Context for a Pod or Container (https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
A distributed application on AWS shows rising error rates. The team cannot tell which downstream service call is failing or adding latency, and they need request-level visibility rather than account activity history. What should they do?
Answer: D. AWS X-Ray collects traces of requests as they travel through the application and builds a trace map that shows each downstream node with its errors and latency. CloudTrail management events record control-plane API calls, AWS Config tracks resource configuration changes, and Trusted Advisor gives best-practice checks, so none of them show per-request downstream calls. Source: What is AWS X-Ray? (https://docs.aws.amazon.com/xray/latest/devguide/aws-xray.html)
Q9 · CKA troubleshooting, resource usage metrics
On a new cluster, kubectl top pods fails with an error that the Metrics API is not available. No metrics add-on has been installed. The team needs per-Pod CPU and memory usage. What should they do?
Answer: A. Metrics Server collects resource metrics from kubelets and exposes them through the metrics.k8s.io API that kubectl top reads. Audit logs record API requests, CoreDNS only handles name resolution, and container logs with timestamps contain no CPU or memory usage figures. Source: Resource metrics pipeline (https://kubernetes.io/docs/tasks/debug/debug-cluster/resource-metrics-pipeline/)
An EC2 instance occasionally becomes impaired because of problems with the underlying host hardware. The team wants it recovered on new hardware automatically, with no human action, keeping its instance ID and private IP address. Which solution meets this?
Answer: C. A CloudWatch alarm on the system status check metric StatusCheckFailed_System can run the EC2 recover action, which migrates the instance to new hardware and keeps its instance ID and private IP address. CPU utilization does not reflect host hardware failure and a stop action does not recover the instance, a nightly reboot stays on the same impaired host, and detailed monitoring only changes metric frequency. Source: Add recover actions to Amazon CloudWatch alarms (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/UsingAlarmActions.html)
Q11 · CKS runtime security, audit log backend
A kubeadm cluster has an audit policy file written to the control plane node, but no audit events appear on disk. The team wants the log backend writing to a local file. Which component must receive the --audit-policy-file and --audit-log-path flags?
Answer: D. Auditing is performed by the kube-apiserver, which is started with --audit-policy-file to load the policy and --audit-log-path to enable the log backend. The kubelet, kube-proxy and etcd do not process API requests through the audit pipeline, so these flags have no effect there. Source: Auditing (https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/)
An S3 bucket or security group occasionally drifts into a noncompliant state after manual changes. The team wants the noncompliant resource corrected automatically, without a person running a fix. Which solution meets this?
Answer: B. AWS Config rules can be paired with automatic remediation actions that run an AWS Systems Manager Automation document to correct noncompliant resources. CloudTrail only records API activity and cannot reverse changes, while Trusted Advisor reports and Inspector assessments only report findings that a person must then fix. Source: Remediating noncompliant resources with AWS Config rules (https://docs.aws.amazon.com/config/latest/developerguide/remediation.html)