Alerting on under-replicated Deployments
WHAT IT TESTS: Prometheus alerting pipeline. OUTLINE: write an alerting rule comparing kube_state_metrics available vs desired replicas with for: 5m, Prometheus evaluates and fires to Alertmanager, which dedupes/routes/notifies.
PromQL for top 5 CPU-consuming pods
WHAT IT TESTS: PromQL on counters. OUTLINE: apply rate() to the counter over 15m, sum by pod to combine containers, then wrap in topk(5); rate handles counter resets.
EFK centralized logging architecture
WHAT IT TESTS: End-to-end log pipeline design. OUTLINE: Fluentd runs as a DaemonSet collecting node container logs, parses and forwards to Elasticsearch for indexed storage, and Kibana queries and visualizes them.
Auto-discovering app pods for Prometheus scraping
WHAT IT TESTS: Kubernetes service discovery in Prometheus. OUTLINE: use kubernetes_sd_configs with role pod, relabel on pod annotations like prometheus.io/scrape to filter, and set path and port; with the Operator use a PodMonitor or ServiceMonitor.
kube-state-metrics versus node-exporter
WHAT IT TESTS: Distinguishing object-state from host metrics. OUTLINE: kube-state-metrics exposes API object state (deployment replicas, pod phase, restarts) from the control plane, while node-exporter exposes OS-level hardware metrics (CPU, memory, disk) per…
Viewing pod logs and durable log collection
WHAT IT TESTS: Logging basics and durability. OUTLINE: kubectl logs (with -c, --previous, -f) reads container stdout/stderr; because that storage is ephemeral, run a node-level logging agent as a DaemonSet shipping logs to a central store.
Multi-tenant isolation with a monitoring exception
WHAT IT TESTS: Layered NetworkPolicy design. OUTLINE: apply default-deny ingress per tenant namespace, allow same-namespace traffic, then add an ingress rule permitting the monitoring namespace via namespaceSelector on the metrics port.
Binding a ClusterRole with a RoleBinding
WHAT IT TESTS: Reusing a ClusterRole at namespace scope. OUTLINE: a RoleBinding referencing a ClusterRole grants those rules only within the binding's namespace; reuse built-in roles like view per-team without duplicating definitions.
Root and NET_ADMIN under Pod Security Standards
WHAT IT TESTS: securityContext plus admission policy. OUTLINE: set runAsUser 0 and capabilities add NET_ADMIN in the container securityContext; this is rejected by Restricted and Baseline, so the namespace must use the Privileged profile.
Write a frontend-to-backend NetworkPolicy
WHAT IT TESTS: Authoring a correct ingress NetworkPolicy. OUTLINE: set podSelector to app=backend, policyTypes Ingress, one ingress rule with from podSelector app=frontend and ports TCP 8080; the implicit deny handles the rest.
Namespace-scoped RBAC for a ServiceAccount
WHAT IT TESTS: Designing least-privilege namespaced access. OUTLINE: create a Role in production granting create on deployments (apps group) and services (core group), then a RoleBinding tying that Role to the ServiceAccount.
Troubleshooting an RBAC forbidden error
WHAT IT TESTS: Practical RBAC debugging. OUTLINE: use kubectl auth can-i with --as impersonation to check the verb, inspect RoleBindings and ClusterRoleBindings, and read the role rules.
First NetworkPolicy flips a pod to default-deny
WHAT IT TESTS: NetworkPolicy default behavior. OUTLINE: once any policy selects a pod for a direction, that direction becomes default-deny and only explicitly allowed traffic passes; unselected pods stay open.
Role versus ClusterRole in RBAC
WHAT IT TESTS: RBAC scope basics. OUTLINE: Role is namespaced, ClusterRole is cluster-wide and covers cluster-scoped resources, and you grant either via a RoleBinding (namespaced) or ClusterRoleBinding (cluster-wide) to a subject.
Topology spread constraints versus pod anti-affinity
WHAT IT TESTS: Proportional spread versus binary repulsion. OUTLINE: spread constraints balance pod counts per domain bounded by maxSkew, anti-affinity is all-or-nothing co-location avoidance, and maxSkew caps the difference between fullest and emptiest…
tolerationSeconds and graceful eviction on NoExecute
WHAT IT TESTS: NoExecute eviction timing. OUTLINE: tolerationSeconds is how long a tolerating pod may stay after the taint applies; once it elapses eviction starts, then terminationGracePeriodSeconds governs the SIGTERM-to-SIGKILL window.
Pinning exclusive CPU cores to a pod
WHAT IT TESTS: Achieving CPU pinning. OUTLINE: set kubelet CPU Manager policy to static, make the pod Guaranteed QoS with integer CPU limits equal to requests, so it gets exclusive dedicated cores.
Taints and tolerations versus node affinity
WHAT IT TESTS: Knowing repulsion versus attraction. OUTLINE: taints repel pods from nodes (reserve hardware), affinity attracts pods to nodes, and you combine both so only tolerating pods land AND only those pods seek the node.
Spreading replicas across availability zones
WHAT IT TESTS: Designing zone-resilient placement. OUTLINE: use topologySpreadConstraints on topology.kubernetes.io/zone with a small maxSkew, choose DoNotSchedule or ScheduleAnyway, and confirm nodes carry zone labels.
Required vs preferred node affinity rules
WHAT IT TESTS: Understanding hard vs soft scheduling constraints. OUTLINE: required is a mandatory filter, preferred is a weighted preference, and IgnoredDuringExecution means rules apply only at scheduling time.