Our Blog & Insight

We delve into the world of DevOps, exploring the latest trends, regulations, and best practices that drive responsible cloud operations.

Subscribe to Newsletter
Blog illustration
AWS STS Session Internals for the AWS Security Specialty Exam (SCS-C03): AssumeRole vs GetSessionToken vs GetFederationToken, Session Duration Limits, Session Policies, Session Tags, Source Identity, Role Chaining, Regional Endpoints & Revoking Active Sessions AWS
7 min read

AWS STS Session Internals for the AWS Security Specialty Exam (SCS-C03): AssumeRole vs GetSessionToken vs GetFederationToken, Session Duration Limits, Session Policies, Session Tags, Source Identity, Role Chaining, Regional Endpoints & Revoking Active Sessions

A practitioner's guide to Skill 4.1.2 of the AWS Certified Security - Specialty exam: what a temporary session really consists of, the full STS API comparison (who can call, lifetimes, MFA and session-policy support, what the resulting credentials cannot do), DurationSeconds versus MaxSessionDuration, the one-hour role-chaining cap, how session policies intersect with identity and resource policies, session tag limits and transitive tags, sts:TagSession and sts:SetSourceIdentity, why source identity is immutable, MFA context keys and the BoolIfExists trap, the STS global endpoint changes and version 1 versus version 2 session tokens, AWSRevokeOlderSessions and aws:TokenIssueTime, denying a single session with aws:userid, centralized root access with AssumeRoot, a troubleshooting toolkit, scenario drills, common mistakes and an FAQ.
How the Kubernetes API Server Authenticates a Request for the CKS Exam: The Authenticator Chain, X.509 Certificates, Static & Bootstrap Tokens, ServiceAccount JWT Internals, Structured AuthenticationConfiguration & OIDC Claim Mapping, Webhook Token Authentication, Authenticating Proxies, Anonymous Endpoints, Impersonation Headers and kubectl auth whoami Kubernetes
7 min read

How the Kubernetes API Server Authenticates a Request for the CKS Exam: The Authenticator Chain, X.509 Certificates, Static & Bootstrap Tokens, ServiceAccount JWT Internals, Structured AuthenticationConfiguration & OIDC Claim Mapping, Webhook Token Authentication, Authenticating Proxies, Anonymous Endpoints, Impersonation Headers and kubectl auth whoami

A practitioner's guide to the authentication layer of kube-apiserver for the Certified Kubernetes Security Specialist (CKS) exam: how the authenticator chain short-circuits, what a Kubernetes identity actually contains, every reserved system: name, X.509 CN/O mapping and the no-revocation rule, the static token file, bootstrap token Secrets and groups, the ServiceAccount JWT issuer, keys, bound-object claims and discovery endpoints, every --oidc-* flag and its replacement in the structured AuthenticationConfiguration file (CEL claim validation, claim mappings, user validation, 64-authenticator limit, automatic reload), webhook TokenReview, the --requestheader-* authenticating-proxy flags and their CA warning, configuring anonymous access per endpoint, impersonation headers and constrained impersonation, client-go exec credential plugins, kubectl auth whoami, a failure-diagnosis table, a kubeadm lab, scenario drills, common mistakes and an FAQ.
DynamoDB Expressions Deep Dive for the AWS Developer Associate Exam (DVA-C02 & DVA-C03): Key Condition vs Filter vs Projection Expressions, Update Expressions (SET / REMOVE / ADD / DELETE), Condition Expressions & Functions, Expression Attribute Names & Values, ReturnValues, Transactions & Idempotency, and PartiQL AWS
7 min read

DynamoDB Expressions Deep Dive for the AWS Developer Associate Exam (DVA-C02 & DVA-C03): Key Condition vs Filter vs Projection Expressions, Update Expressions (SET / REMOVE / ADD / DELETE), Condition Expressions & Functions, Expression Attribute Names & Values, ReturnValues, Transactions & Idempotency, and PartiQL

A practitioner's guide to the DynamoDB expression language the Developer Associate exam actually tests: the five expression parameters and which API each belongs to, why # and : placeholders exist (reserved words, dots, hyphens, names starting with digits), the key condition rules (partition key equality, six sort key operators, begins_with only), why a filter expression never saves read capacity and why a page can come back empty with a LastEvaluatedKey, projection expressions and the Select parameter, the four update clauses with their evaluation-against-the-old-item rule, if_not_exists and list_append, the condition functions and operator precedence, ReturnValues and ReturnValuesOnConditionCheckFailure, the 300-operator and 4 KB limits, TransactWriteItems cancellation reasons and the 10-minute ClientRequestToken window, PartiQL full-table-scan traps, a 24-row scenario drill and an FAQ. Framed for both DVA-C02 (last day 30 November 2026) and DVA-C03 (from 1 December 2026).
How kubectl and Controllers Really Talk to the API Server for the CKA, CKAD & KCNA Exams: resourceVersion Semantics, List Pagination & continue Tokens, Watch Events & Bookmarks, 410 Gone and Relisting, Streaming Lists, Optimistic Concurrency & 409 Conflict, generation vs observedGeneration, Informers & the Reconcile Loop, and Reading the Raw Requests with -v Kubernetes
7 min read

How kubectl and Controllers Really Talk to the API Server for the CKA, CKAD & KCNA Exams: resourceVersion Semantics, List Pagination & continue Tokens, Watch Events & Bookmarks, 410 Gone and Relisting, Streaming Lists, Optimistic Concurrency & 409 Conflict, generation vs observedGeneration, Informers & the Reconcile Loop, and Reading the Raw Requests with -v

A practitioner's guide to the Kubernetes API mechanics underneath every kubectl command and every controller, for the KubeAstronaut exams: what uid, resourceVersion and generation each identify, the get/list semantics table (unset vs 0 vs a specific value, resourceVersionMatch Exact vs NotOlderThan, cache vs quorum read, consistent reads from cache in 1.37), limit/continue pagination with the 5-minute token expiry and 410 Gone, watch requests and ADDED/MODIFIED/DELETED/BOOKMARK/ERROR events, why 'too old resource version' means relist, bookmarks and allowWatchBookmarks, streaming lists with sendInitialEvents (WatchList beta on by default since 1.34), the 409 Conflict message and why kubectl edit hits it but kubectl apply rarely does, metadata.generation vs status.observedGeneration, how client-go informers turn list+watch into a reconcile loop, the kube-apiserver flags that shape all of it, a symptom-to-cause drill, a hands-on lab with kubectl get --raw and -v=8, and an FAQ.
Amazon EFS Deep Dive for the SAA-C03 Exam: Regional vs One Zone, Performance & Throughput Modes (Elastic, Provisioned, Bursting Credit Math), Storage Classes & Lifecycle Policies, Mount Targets, Access Points, IAM File System Policies, Encryption & Replication AWS
7 min read

Amazon EFS Deep Dive for the SAA-C03 Exam: Regional vs One Zone, Performance & Throughput Modes (Elastic, Provisioned, Bursting Credit Math), Storage Classes & Lifecycle Policies, Mount Targets, Access Points, IAM File System Policies, Encryption & Replication

A practitioner's guide to how Amazon EFS really works for the SAA-C03 exam: Regional vs One Zone file systems and what each actually guarantees, General Purpose vs Max I/O, the three throughput modes with the burst-credit arithmetic (50 KiBps per GiB baseline, 100 MiBps per TiB burst, the 2.1 TiB credit cap and the 24-hour switching lock), Standard vs Infrequent Access vs Archive with the 128 KiB and 90-day rules, the three lifecycle policies and the timer that drives them, mount targets and security groups, access points and the elasticfilesystem:ClientMount / ClientWrite / ClientRootAccess model, TLS via the mount helper, encryption at rest, replication with its 15-minute RPO and delete-to-fail-over semantics, quotas, a 24-row scenario drill and an FAQ.
How Azure Resource Manager Actually Deploys Things for the AZ-900 Exam: Resource Providers & Scopes, Control Plane vs Data Plane, the Portal, Cloud Shell, Azure CLI & Azure PowerShell Compared, ARM Templates vs Bicep, Incremental vs Complete Mode, What-If, Deployment Stacks and Azure Arc Azure
7 min read

How Azure Resource Manager Actually Deploys Things for the AZ-900 Exam: Resource Providers & Scopes, Control Plane vs Data Plane, the Portal, Cloud Shell, Azure CLI & Azure PowerShell Compared, ARM Templates vs Bicep, Incremental vs Complete Mode, What-If, Deployment Stacks and Azure Arc

A practitioner's guide to the AZ-900 skill group 'Describe features and tools for managing and deploying Azure resources' (skills measured as of July 20, 2026): how every portal click, az command and Bicep file becomes a request to Azure Resource Manager, what resource providers and resource types are, the four management scopes and inheritance, control plane vs data plane, what a resource group's location really means, the Azure portal vs Cloud Shell (20-minute idle timeout, 5 GB persisted home or ephemeral sessions) vs Azure CLI vs Azure PowerShell with side-by-side commands, infrastructure as code, ARM template anatomy, Bicep and how it transpiles to JSON, incremental vs complete deployment mode and the property-reset trap, what-if, template specs, deployment stacks as the Blueprints replacement, and Azure Arc with the Connected Machine agent. Includes a decision table, a 15-minute Cloud Shell lab, a 22-row scenario drill and an FAQ.
Route 53 Resolver & Hybrid DNS Internals for the SAP-C02 Exam: Inbound vs Outbound Endpoints, Forward / System / Delegate Rules, Rule Precedence, Autodefined Rules, Cross-Account Sharing with RAM, Route 53 Profiles, DNS Firewall, DNSSEC Signing & Validation, Query Logging and the Quotas That Become Distractors AWS
7 min read

Route 53 Resolver & Hybrid DNS Internals for the SAP-C02 Exam: Inbound vs Outbound Endpoints, Forward / System / Delegate Rules, Rule Precedence, Autodefined Rules, Cross-Account Sharing with RAM, Route 53 Profiles, DNS Firewall, DNSSEC Signing & Validation, Query Logging and the Quotas That Become Distractors

A practitioner's deep dive into Route 53 VPC Resolver for the AWS Certified Solutions Architect - Professional (SAP-C02) exam: how the VPC+2 resolver actually works, inbound and outbound endpoint internals (ENIs, 10,000 QPS per IP, connection tracking, Do53 vs DoH vs DoH-FIPS), forward, system and delegate rule types and the most-specific-match precedence, why a forwarding rule beats a private hosted zone, the autodefined rules created by enableDnsHostnames, sharing rules and private hosted zones across accounts with RAM and association authorizations, Route 53 Profiles, DNS Firewall actions and fail modes, DNSSEC signing with KMS-backed KSKs and per-VPC validation, query logging, pricing shape and the quotas the exam turns into distractors.
Terraform Backend Configuration Internals for the Terraform Associate (004) Exam: The backend Block Rules, Partial Configuration & -backend-config, What terraform init Stores in .terraform, -migrate-state vs -reconfigure vs -backend=false, S3 Native Locking with use_lockfile, How Every Backend Locks, Workspace Layouts, Credentials Precedence, terraform_remote_state and the cloud Block DevOps
7 min read

Terraform Backend Configuration Internals for the Terraform Associate (004) Exam: The backend Block Rules, Partial Configuration & -backend-config, What terraform init Stores in .terraform, -migrate-state vs -reconfigure vs -backend=false, S3 Native Locking with use_lockfile, How Every Backend Locks, Workspace Layouts, Credentials Precedence, terraform_remote_state and the cloud Block

A practitioner's guide to Objective 6 of the HashiCorp Terraform Associate (004) exam, 'Terraform state management': the exact rules of the backend block (one per configuration, no variables, no cloud block alongside it), partial configuration through -backend-config files and key=value pairs, the backend state Terraform writes under .terraform and how init detects a changed backend, when to use -migrate-state, -reconfigure, -force-copy and -backend=false, the S3 backend's use_lockfile native locking and the deprecated DynamoDB table, how local, azurerm, gcs, http, pg, kubernetes, consul and oci backends implement locking, workspace key layouts per backend, credential sourcing and why secrets must not live in the block, -lock, -lock-timeout and force-unlock, terraform_remote_state's security trade-off, and the cloud block versus the remote backend.
EC2 Image Builder Internals for the DOP-C02 Exam: Pipelines, Recipes & Semantic Versioning, AWSTOE Components & Action Modules, Build/Test/Distribution Workflows, Cross-Account Distribution, Launch Template & SSM Parameter Outputs, Inspector Scans, Lifecycle Policies and Auto-Disable AWS
7 min read

EC2 Image Builder Internals for the DOP-C02 Exam: Pipelines, Recipes & Semantic Versioning, AWSTOE Components & Action Modules, Build/Test/Distribution Workflows, Cross-Account Distribution, Launch Template & SSM Parameter Outputs, Inspector Scans, Lifecycle Policies and Auto-Disable

A practitioner's guide to EC2 Image Builder for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam: how the six resource types fit together, semantic versioning and the x wildcard rules that make dependency-triggered builds work, image vs container recipes and their limits, AWSTOE component documents (build/validate/test phases, chaining, onFailure, action modules such as UpdateOS and Reboot), infrastructure configuration and the instance profile policies, build/test/distribution workflows with WaitForAction gates, distribution configurations (target accounts, launch permissions, KMS copies, launch template versions, SSM parameter output, Fast Launch, VM export), the cross-account role, Inspector test-instance vs on-demand AMI scans with scan result conditions, lifecycle policies (deprecate/disable/delete), auto-disable policies, EventBridge events and the post-build clean-up script, with a scenario drill and FAQ.
How a Kubernetes Deployment Rollout Actually Works for the CKAD Exam: ReplicaSets & the pod-template-hash, maxSurge/maxUnavailable Rounding Math, minReadySeconds & Availability, progressDeadlineSeconds & Deployment Conditions, Revision Annotations, Proportional Scaling, Rollback Internals and Paused Deployments Kubernetes
7 min read

How a Kubernetes Deployment Rollout Actually Works for the CKAD Exam: ReplicaSets & the pod-template-hash, maxSurge/maxUnavailable Rounding Math, minReadySeconds & Availability, progressDeadlineSeconds & Deployment Conditions, Revision Annotations, Proportional Scaling, Rollback Internals and Paused Deployments

A practitioner's guide to the Deployment controller for the Certified Kubernetes Application Developer (CKAD) exam: how a Deployment owns ReplicaSets through the pod-template-hash label and collisionCount, what does and does not create a revision, how maxSurge (rounds up) and maxUnavailable (rounds down) turn into exact Pod counts with worked examples, why a Ready Pod is not yet Available under minReadySeconds, the Progressing/Available/ReplicaFailure conditions and their reasons, how progressDeadlineSeconds surfaces a stuck rollout without rolling back, proportional scaling during a rollout, the deployment.kubernetes.io/revision and revision-history annotations, what kubectl rollout undo really changes, revisionHistoryLimit, Recreate semantics, label selector immutability, ReplicaSet adoption and scale-down ordering, plus how to read status fields quickly in the exam.
Deploying & Operating in the AWS Cloud for the Cloud Practitioner (CLF-C02) Exam: Console vs CLI vs SDKs vs Infrastructure as Code, CloudFormation & the CDK, Deployment Models, Connectivity Options, and the Management & Governance Toolbox (Systems Manager, Organizations, Control Tower, Service Catalog, Launch Wizard, License Manager & the Developer Tools) AWS
7 min read

Deploying & Operating in the AWS Cloud for the Cloud Practitioner (CLF-C02) Exam: Console vs CLI vs SDKs vs Infrastructure as Code, CloudFormation & the CDK, Deployment Models, Connectivity Options, and the Management & Governance Toolbox (Systems Manager, Organizations, Control Tower, Service Catalog, Launch Wizard, License Manager & the Developer Tools)

A practitioner's guide to CLF-C02 Task Statement 3.1 and the Management & Governance and Developer Tools service categories — how to choose between the AWS Management Console, the AWS CLI and CloudShell, the SDKs and infrastructure as code, what CloudFormation stacks, change sets, drift detection, StackSets and the CDK actually do, one-time operations versus repeatable processes, cloud vs hybrid vs on-premises deployment models and the AWS services that make hybrid work, the connectivity options the exam names, every in-scope management and governance service (Systems Manager, Organizations with SCPs, RCPs and declarative policies, Control Tower, Service Catalog, Launch Wizard, License Manager, Resource Groups & Tag Editor, Compute Optimizer, the Well-Architected Tool, the Health Dashboard), the current status of Cloud9, CodeCommit and CodeStar, and a scenario-to-answer table for exam day.
Reading Pod Status for the KCNA Exam: Pod Phases vs the kubectl STATUS Column, Container States, Pod Conditions & Readiness Gates, restartPolicy & the CrashLoopBackOff Timer, Container Restart Rules, Pod Termination and Pod Garbage Collection Kubernetes
7 min read

Reading Pod Status for the KCNA Exam: Pod Phases vs the kubectl STATUS Column, Container States, Pod Conditions & Readiness Gates, restartPolicy & the CrashLoopBackOff Timer, Container Restart Rules, Pod Termination and Pod Garbage Collection

A practitioner's KCNA guide to what a Pod's status actually tells you — the five Pod phases and why Terminating and CrashLoopBackOff are not among them, how kubectl derives the STATUS column from container states, the Waiting/Running/Terminated container states and exit codes, every Pod condition (PodScheduled, PodReadyToStartContainers, Initialized, ContainersReady, Ready, DisruptionTarget, PodResizePending) plus readiness gates, how restartPolicy and the 10 s → 5 min backoff produce CrashLoopBackOff, the new container-level restart rules, how probes move a Pod between states, the exact termination sequence from kubectl delete to SIGKILL, and when the Pod garbage collector removes finished Pods — with the questions the KCNA actually asks.
Kubelet Configuration Internals for the CKA Exam: KubeletConfiguration vs Flags, the --config-dir Drop-in Directory, kubeadm's kubelet-config ConfigMap & kubeadm-flags.env, Cgroup Drivers & cgroup v2, Swap, Image Pull & GC Settings, Log Rotation, CrashLoopBackOff Tuning and the /configz Endpoint Kubernetes
7 min read

Kubelet Configuration Internals for the CKA Exam: KubeletConfiguration vs Flags, the --config-dir Drop-in Directory, kubeadm's kubelet-config ConfigMap & kubeadm-flags.env, Cgroup Drivers & cgroup v2, Swap, Image Pull & GC Settings, Log Rotation, CrashLoopBackOff Tuning and the /configz Endpoint

A practitioner's CKA guide to how the kubelet is actually configured on a kubeadm node — the systemd unit chain and the four environment variables behind ExecStart, the exact precedence between the config file, drop-in files and flags, how the --config-dir drop-in directory merges scalars, lists and maps, the kubelet-config ConfigMap and the kubeadm upgrade node phase kubelet-config loop, instance-specific settings through kubeadm-flags.env, patches and kubeletExtraArgs, why cgroup drivers must match the runtime and how KubeletCgroupDriverFromCRI changed that, cgroup v2 and failCgroupV1, failSwapOn and LimitedSwap, the defaults that matter (evictionHard, image GC, serializeImagePulls, containerLogMaxSize, maxPods, podPidsLimit, crashLoopBackOff), reading the live configuration from /configz, and a symptom-to-fix table for a kubelet that will not start.
Kubernetes Storage Security for the KCSA Exam: hostPath Risks, subPath Escapes, CSI Driver Privileges, Mount Propagation, PV Reclaim Policies, Secret Volumes & the Pod Security Standards Volume Allowlist Kubernetes
7 min read

Kubernetes Storage Security for the KCSA Exam: hostPath Risks, subPath Escapes, CSI Driver Privileges, Mount Propagation, PV Reclaim Policies, Secret Volumes & the Pod Security Standards Volume Allowlist

A practitioner's KCSA guide to the Storage item in the Cluster Component Security domain — what a hostPath mount really exposes (kubelet credentials, the runtime socket, every Pod's Secrets on the node), why read-only is the only safe hostPath, the subPath symlink CVEs, why CSI node plugins run privileged with Bidirectional mount propagation, the CSIDriver fields that hand drivers Pod identity and service account tokens, inline CSI ephemeral volumes, cluster-scoped PersistentVolumes and cross-namespace data leakage, Retain vs Delete and HonorPVReclaimPolicy, Secret volumes on tmpfs, the Secrets Store CSI Driver, and how every control maps to the Baseline and Restricted Pod Security Standards.
Secure Administrative Access to EC2 for the AWS Security Specialty Exam (SCS-C03): Session Manager vs EC2 Instance Connect vs EC2 Instance Connect Endpoint vs Bastion Hosts, IAM Condition Keys, Session Logging, Port Forwarding & the EC2 Serial Console AWS
7 min read

Secure Administrative Access to EC2 for the AWS Security Specialty Exam (SCS-C03): Session Manager vs EC2 Instance Connect vs EC2 Instance Connect Endpoint vs Bastion Hosts, IAM Condition Keys, Session Logging, Port Forwarding & the EC2 Serial Console

A practitioner's guide to Skill 3.2.5 of the AWS Certified Security - Specialty exam: how Systems Manager Session Manager works without inbound ports (agent, ssmmessages, session documents, ssm-user, Run As, KMS session encryption, idle and maximum timeouts, S3/CloudWatch logging and the SSH/port-forwarding logging gap), how EC2 Instance Connect pushes a 60-second key through instance metadata and what ec2:osuser and the managed prefix list control, how EC2 Instance Connect Endpoint acts as an identity-aware TCP proxy with remotePort/privateIpAddress/maxTunnelDuration conditions and client IP preservation, when a bastion host is still the right answer, where the EC2 Serial Console fits, plus a decision table, scenario drills, common mistakes and an FAQ.
Pod securityContext Internals for the CKS Exam: Linux Capability Sets, Runtime Default Capabilities, Why Added Capabilities Vanish for Non-Root Users, allowPrivilegeEscalation & no_new_privs, privileged Containers, fsGroup, fsGroupChangePolicy, supplementalGroupsPolicy, Sysctls, procMount & How Every Field Maps to Pod Security Standards Kubernetes
7 min read

Pod securityContext Internals for the CKS Exam: Linux Capability Sets, Runtime Default Capabilities, Why Added Capabilities Vanish for Non-Root Users, allowPrivilegeEscalation & no_new_privs, privileged Containers, fsGroup, fsGroupChangePolicy, supplementalGroupsPolicy, Sysctls, procMount & How Every Field Maps to Pod Security Standards

A hands-on CKS guide to what the Pod securityContext actually does at the kernel and runtime level: the five Linux capability sets and the execve transformation rules, the 14-capability containerd default versus the 9-capability CRI-O default, how to decode CapEff from /proc/1/status, why capabilities.add has no effect for a non-root user under runc and what to do instead, what allowPrivilegeEscalation: false really blocks via no_new_privs, everything a privileged container switches off, runAsUser/runAsGroup/runAsNonRoot semantics, fsGroup with fsGroupChangePolicy and the Strict supplementalGroupsPolicy, safe versus unsafe sysctls and allowedUnsafeSysctls, procMount Unmasked, pod-level versus container-level precedence, a field-by-field Baseline/Restricted mapping, a verification cheat sheet, scenario drills, common mistakes and an FAQ.
AWS X-Ray Internals for the DVA-C02 Exam: The Trace Header & Trace IDs, Segments vs Subsegments, Sampling Rules (Reservoir + Rate), Annotations vs Metadata, Filter Expressions & Groups, Lambda Active vs PassThrough Tracing, API Gateway & SQS Trace Linking, the Daemon vs ADOT, and CloudWatch Transaction Search AWS
7 min read

AWS X-Ray Internals for the DVA-C02 Exam: The Trace Header & Trace IDs, Segments vs Subsegments, Sampling Rules (Reservoir + Rate), Annotations vs Metadata, Filter Expressions & Groups, Lambda Active vs PassThrough Tracing, API Gateway & SQS Trace Linking, the Daemon vs ADOT, and CloudWatch Transaction Search

A practitioner's deep dive into how AWS X-Ray actually works, at the depth the DVA-C02 Troubleshooting and Optimization domain tests: the X-Amzn-Trace-Id header (Root, Parent, Sampled) and the 1-epoch-random trace ID format, segment documents (64 KB, in_progress, inferred segments, namespace aws vs remote, error/throttle/fault), parent-based sampling with the default 1 request/second reservoir plus 5% rate and how centrally managed sampling rules, priorities and quotas work, the 50-indexed-annotations limit and why metadata is not searchable, filter expression syntax and groups, how the SDK → UDP 2000 → daemon → PutTraceSegments path works on EC2, ECS and Elastic Beanstalk, the 25 February 2026 maintenance-mode notice for the X-Ray SDKs and daemon and the move to OpenTelemetry (ADOT and the CloudWatch agent), Lambda's Active vs PassThrough modes and fixed sampling, the AWS::Lambda vs AWS::Lambda::Function segments, API Gateway REST-only tracing, SQS → Lambda trace linking, the quotas that appear in questions, and CloudWatch Transaction Search.
How kube-scheduler Actually Picks a Node for the CKA & KCNA Exams: The Scheduling Framework, Filter & Score Plugins, NodeResourcesFit Scoring Strategies, percentageOfNodesToScore, Scheduling Gates & Running a Second Scheduler Kubernetes
7 min read

How kube-scheduler Actually Picks a Node for the CKA & KCNA Exams: The Scheduling Framework, Filter & Score Plugins, NodeResourcesFit Scoring Strategies, percentageOfNodesToScore, Scheduling Gates & Running a Second Scheduler

A practitioner's walkthrough of the engine underneath every Pending Pod: the scheduling queue (active, backoff and unschedulable queues, PrioritySort, queueing hints), the scheduling cycle vs binding cycle, every extension point from PreEnqueue to PostBind, which default plugin produces each fragment of the '0/3 nodes are available' message, how Score plugins and weights combine, the LeastAllocated vs MostAllocated vs RequestedToCapacityRatio scoring strategies with a worked example, percentageOfNodesToScore and the 100-node floor, KubeSchedulerConfiguration profiles and plugin args, scheduling gates, bypassing the scheduler with nodeName and static Pods, and the classic CKA task of running a second scheduler and proving which one placed a Pod.
Amazon EBS Snapshots Deep Dive for the SAA-C03 Exam: Incremental Storage, Lazy Loading & Fast Snapshot Restore, Snapshots Archive, Recycle Bin, Snapshot Lock, Copy & Encryption Rules, Sharing, Data Lifecycle Manager & EBS Direct APIs AWS
7 min read

Amazon EBS Snapshots Deep Dive for the SAA-C03 Exam: Incremental Storage, Lazy Loading & Fast Snapshot Restore, Snapshots Archive, Recycle Bin, Snapshot Lock, Copy & Encryption Rules, Sharing, Data Lifecycle Manager & EBS Direct APIs

A practitioner's guide to how Amazon EBS snapshots really work for the SAA-C03 exam: the incremental block model and what deletion actually removes, lazy loading on restore and the three ways to fix it (manual initialization, Provisioned Rate for Volume Initialization 100–300 MiB/s, Fast Snapshot Restore with its credit-bucket math and 5-per-Region quota), the Snapshots Archive tier (75% cheaper, full snapshots, 90-day minimum, up to 72-hour restore), Recycle Bin retention rules, snapshot lock governance vs compliance mode, when a copy is full vs incremental, encryption outcomes, cross-account sharing constraints, block public access, time-based copies, Data Lifecycle Manager policies, and the EBS direct APIs.
Moving Data Into Azure for the AZ-900 Exam: Azure Migrate, Azure Data Box, AzCopy, Azure Storage Explorer & Azure File Sync Explained Azure
7 min read

Moving Data Into Azure for the AZ-900 Exam: Azure Migrate, Azure Data Box, AzCopy, Azure Storage Explorer & Azure File Sync Explained

A practitioner's guide to two AZ-900 skills-outline bullets most candidates skim: 'Identify options for moving files, including AzCopy, Azure Storage Explorer, and Azure File Sync' and 'Describe migration options, including Azure Migrate and Azure Data Box'. Learn what each tool is for, how the Data Box family (Data Box Disk, Data Box, next-gen 120 TB and 525 TB) differs, what Azure Migrate's discover-assess-migrate flow does, how File Sync cloud tiering works, where Azure Import/Export and Azure Storage Mover fit, and a decision table for the scenario questions the exam asks.
AWS Direct Connect Internals for the SAP-C02 Exam: VIF Types & Quotas, Direct Connect Gateway Association Rules, Allowed Prefixes, BGP Communities & Route Preference, LAGs, Resiliency Models, SiteLink, MACsec & Private IP VPN AWS
7 min read

AWS Direct Connect Internals for the SAP-C02 Exam: VIF Types & Quotas, Direct Connect Gateway Association Rules, Allowed Prefixes, BGP Communities & Route Preference, LAGs, Resiliency Models, SiteLink, MACsec & Private IP VPN

A practitioner's deep dive into AWS Direct Connect for the AWS Certified Solutions Architect - Professional (SAP-C02) exam: dedicated vs hosted connections and their quotas, private, public and transit virtual interfaces, Direct Connect gateway association rules and allowed-prefix semantics for VGWs vs Transit Gateways, inbound prefix controls, BGP route evaluation order and the 7224 local-preference and scope communities, LAG rules, the Resiliency Toolkit models and failover test, jumbo frames, SiteLink, MACsec and Private IP VPN over Direct Connect.
How Terraform Installs Providers for the Terraform Associate (004) Exam: The CLI Config File, Implied & Explicit Installation Methods, Filesystem & Network Mirrors, the Plugin Cache, dev_overrides, h1 vs zh Lock-File Hashes & terraform providers lock/mirror DevOps
7 min read

How Terraform Installs Providers for the Terraform Associate (004) Exam: The CLI Config File, Implied & Explicit Installation Methods, Filesystem & Network Mirrors, the Plugin Cache, dev_overrides, h1 vs zh Lock-File Hashes & terraform providers lock/mirror

A practitioner's guide to objective 2a of the Terraform Associate (004) exam, 'Install and version Terraform providers': what terraform init really does, where the CLI configuration file lives (.terraformrc, terraform.rc, TF_CLI_CONFIG_FILE), the implied filesystem mirrors, the provider_installation block with direct, filesystem_mirror, network_mirror and dev_overrides, include/exclude patterns, packed vs unpacked mirror layouts, the provider network mirror protocol, the plugin cache and its lock-file rule, zh: vs h1: hashes and trust on first use, cross-platform lock files with terraform providers lock -platform, terraform providers mirror for air-gapped installs, and init -upgrade, -lockfile=readonly and -plugin-dir.
AWS CodePipeline V2 for the DOP-C02 Exam: Pipeline Types, Execution Modes (SUPERSEDED vs QUEUED vs PARALLEL), Git Triggers & Filters, Pipeline-Level Variables, Stage Conditions & Rules, Automatic Retry, Stage Rollback & the Commands Action AWS
7 min read

AWS CodePipeline V2 for the DOP-C02 Exam: Pipeline Types, Execution Modes (SUPERSEDED vs QUEUED vs PARALLEL), Git Triggers & Filters, Pipeline-Level Variables, Stage Conditions & Rules, Automatic Retry, Stage Rollback & the Commands Action

A practitioner's guide to the V2 pipeline type in AWS CodePipeline for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam: V1 vs V2 features and pricing, how SUPERSEDED, QUEUED and PARALLEL execution modes lock stages and handle waiting executions, Git push and pull-request triggers with branch, tag and file-path filters, pipeline-level variables and source revision overrides, beforeEntry/onSuccess/onFailure stage conditions with CloudWatchAlarm, LambdaInvoke, DeploymentWindow, VariableCheck, CodeBuild and Commands rules, automatic retry, stage rollback, and the Commands action that runs shell commands without a CodeBuild project.
kubectl patch for the CKAD Exam: Strategic Merge vs JSON Merge vs JSON Patch, Merge Keys, $patch Directives, --subresource & When to Use set, edit or apply Instead Kubernetes
7 min read

kubectl patch for the CKAD Exam: Strategic Merge vs JSON Merge vs JSON Patch, Merge Keys, $patch Directives, --subresource & When to Use set, edit or apply Instead

A practitioner's guide to kubectl patch for the Certified Kubernetes Application Developer (CKAD) exam: how the three patch types (strategic merge, JSON merge patch RFC 7386, JSON Patch RFC 6902) treat lists, nulls and custom resources, which Pod fields merge by key and which get replaced wholesale, the $patch, $deleteFromPrimitiveList, $setElementOrder and $retainKeys directives, --patch-file, --dry-run and --subresource scale/status/resize, and a decision table for patch vs set vs edit vs apply vs replace, with exam-day one-liners.
AWS AI & Machine Learning Services for the Cloud Practitioner (CLF-C02): SageMaker AI, Rekognition, Textract, Comprehend, Translate, Transcribe, Polly, Lex, Kendra & Amazon Q AWS
7 min read

AWS AI & Machine Learning Services for the Cloud Practitioner (CLF-C02): SageMaker AI, Rekognition, Textract, Comprehend, Translate, Transcribe, Polly, Lex, Kendra & Amazon Q

A practitioner's guide to Task Statement 3.7 on the AWS Certified Cloud Practitioner (CLF-C02) exam — the nine machine learning services on the official in-scope list and the one that was quietly dropped — with the one-line recognition cue for each, the three-layer mental model (pre-trained AI services, the SageMaker AI platform, generative AI assistants), the confusable pairs the exam uses as distractors, and the other AWS services that use machine learning under the hood.
Extending the Kubernetes API for the KCNA Exam: Custom Resources, CRDs, Controllers, the Operator Pattern, Aggregated APIs & Admission Policies Kubernetes
7 min read

Extending the Kubernetes API for the KCNA Exam: Custom Resources, CRDs, Controllers, the Operator Pattern, Aggregated APIs & Admission Policies

A practitioner's guide to how Kubernetes is extended for the KCNA exam — what a CustomResourceDefinition actually creates, what a custom resource gets for free from the API server, why a CRD on its own does nothing until a controller reconciles it, how the Operator pattern packages operational knowledge, when API aggregation beats a CRD, how admission webhooks and the newer CEL-based admission policies fit in, and which CNCF projects you already use that are nothing more than CRDs plus controllers.
Inside Amazon Bedrock Knowledge Bases for the AIF-C01 Exam: Parsing, Chunking Strategies, Vector Stores, Metadata Filtering, Hybrid Search, Reranking & Managed vs Customer-Managed RAG AWS
7 min read

Inside Amazon Bedrock Knowledge Bases for the AIF-C01 Exam: Parsing, Chunking Strategies, Vector Stores, Metadata Filtering, Hybrid Search, Reranking & Managed vs Customer-Managed RAG

An AIF-C01 deep dive into how Amazon Bedrock Knowledge Bases actually implements RAG — the ingestion pipeline (data sources, default vs Bedrock Data Automation vs foundation-model parsing, fixed-size / default / semantic / hierarchical / no chunking, custom transformation Lambdas), embeddings models and dimensions, every supported vector store (OpenSearch Serverless and managed clusters, Aurora PostgreSQL pgvector, Neptune Analytics GraphRAG, S3 Vectors, Pinecone, Redis, MongoDB Atlas), the Retrieve vs RetrieveAndGenerate APIs, numberOfResults, hybrid vs semantic search, metadata filtering and implicit filters, reranking, query decomposition, structured-data (NL2SQL) and multimodal knowledge bases, and the new Bedrock Managed Knowledge Base — with the exam scenarios each detail unlocks.
Node Allocatable & the Kubelet Resource Managers for the CKA Exam: kube-reserved, system-reserved, Eviction Thresholds, enforceNodeAllocatable, CPU Manager Static Policy, Memory Manager & Topology Manager Kubernetes
7 min read

Node Allocatable & the Kubelet Resource Managers for the CKA Exam: kube-reserved, system-reserved, Eviction Thresholds, enforceNodeAllocatable, CPU Manager Static Policy, Memory Manager & Topology Manager

A hands-on CKA guide to why a node's Allocatable is smaller than its Capacity and what the kubelet does with the difference — the Allocatable formula (Capacity − kubeReserved − systemReserved − evictionHard), configuring kubeReserved/systemReserved/reservedSystemCPUs in KubeletConfiguration, what enforceNodeAllocatable (pods, kube-reserved, system-reserved and the -compressible variants) actually enforces through cgroups, the worked 16-CPU/32Gi example, reading Capacity vs Allocatable vs Allocated resources in kubectl describe node, then the CPU Manager static policy (exclusive CPUs for Guaranteed integer-CPU Pods, the shared pool, cpu_manager_state, full-pcpus-only and strict-cpu-reservation), the Memory Manager Static policy and reservedMemory formula, and the Topology Manager scopes/policies including the TopologyAffinityError Terminated Pods that the scheduler never retries.
Pod-to-Pod Encryption with Cilium for the CKS Exam: WireGuard vs IPsec Transparent Encryption, Node Encryption, Key Rotation, Strict Mode & Verifying Traffic Is Actually Encrypted Kubernetes
7 min read

Pod-to-Pod Encryption with Cilium for the CKS Exam: WireGuard vs IPsec Transparent Encryption, Node Encryption, Key Rotation, Strict Mode & Verifying Traffic Is Actually Encrypted

A hands-on CKS guide to the 'Implement Pod-to-Pod encryption (Cilium, Istio)' objective — how Cilium's transparent encryption differs from NetworkPolicy and from service-mesh mTLS, enabling WireGuard (cilium_wg0, UDP 51871, per-node keys in the CiliumNode annotation) and IPsec (the cilium-ipsec-keys Secret, SPI 1–15 key rotation), what is and is not encrypted (same-node traffic, node-to-node, control-plane opt-out, the unencrypted first-packet window), egress and ingress strict mode, the ztunnel and mutual-authentication betas, and the tcpdump and cilium-dbg checks that prove encryption is on.
The Kubernetes Authorization Chain for the KCSA Exam: Authorization Modes, Node & Webhook Authorizers, SubjectAccessReview, AuthorizationConfiguration & CEL matchConditions Kubernetes
7 min read

The Kubernetes Authorization Chain for the KCSA Exam: Authorization Modes, Node & Webhook Authorizers, SubjectAccessReview, AuthorizationConfiguration & CEL matchConditions

A practitioner's KCSA guide to everything around RBAC in the Kubernetes authorization layer — how the API server runs a chain of authorizers and why order matters, Allow/Deny/NoOpinion verdicts, the Node authorizer and NodeRestriction, ABAC, the Webhook authorizer and its SubjectAccessReview contract, response caching TTLs, the structured AuthorizationConfiguration file (GA in v1.32) with failurePolicy and CEL matchConditions, the SelfSubjectAccessReview family behind kubectl auth can-i, how the kubelet delegates its own authorization, and aggregated ClusterRoles.
Amazon Security Lake vs CloudTrail Lake for the SCS-C02 Exam: OCSF Normalization, Native Sources, Subscribers, Rollup Regions, Event Data Stores & Choosing the Right Query Layer AWS
7 min read

Amazon Security Lake vs CloudTrail Lake for the SCS-C02 Exam: OCSF Normalization, Native Sources, Subscribers, Rollup Regions, Event Data Stores & Choosing the Right Query Layer

A practitioner's guide to the two managed security data lakes on the AWS Certified Security - Specialty exam. How Amazon Security Lake collects CloudTrail, VPC Flow Logs, Route 53 Resolver, EKS audit, WAF and Security Hub data without you configuring the sources, normalizes it to OCSF Parquet in your own S3 buckets, and exposes it through data-access and query-access subscribers, rollup Regions and Lake Formation. How CloudTrail Lake event data stores differ: retention pricing tiers, Config items, Audit Manager evidence, network activity events, S3 imports, Lake Formation federation and dashboards. Plus a decision table against trail-plus-Athena and CloudWatch Logs, worked exam scenarios and an FAQ.
What Happens When a Kubernetes Node Dies for the CKA Exam: Node Leases, NotReady Timing, Taint-Based Eviction, Graceful & Non-Graceful Node Shutdown Kubernetes
7 min read

What Happens When a Kubernetes Node Dies for the CKA Exam: Node Leases, NotReady Timing, Taint-Based Eviction, Graceful & Non-Graceful Node Shutdown

A practitioner's walkthrough of the node failure lifecycle the CKA and KubeAstronaut exams test: how the kubelet heartbeats through Lease objects and node status, how the node lifecycle controller turns a missed heartbeat into Ready=Unknown after node-monitor-grace-period, the not-ready and unreachable NoExecute taints and the 300-second default tolerationSeconds, zone-aware eviction rate limiting, why Deployments recover but StatefulSet Pods stay Terminating, the kubelet's Graceful Node Shutdown with shutdownGracePeriod and shutdownGracePeriodCriticalPods, and the out-of-service taint for non-graceful shutdown. With a minute-by-minute timeline, debugging commands and an FAQ.
Amazon FSx Deep Dive for the SAA-C03 Exam: FSx for Windows File Server vs Lustre vs NetApp ONTAP vs OpenZFS, Deployment Types, Tiering & S3 Integration AWS
7 min read

Amazon FSx Deep Dive for the SAA-C03 Exam: FSx for Windows File Server vs Lustre vs NetApp ONTAP vs OpenZFS, Deployment Types, Tiering & S3 Integration

A practitioner's guide to the four Amazon FSx file systems for the AWS Certified Solutions Architect - Associate (SAA-C03) exam. Protocols and clients for each member, Windows File Server Single-AZ vs Multi-AZ and SSD vs HDD, Lustre scratch vs persistent deployment types and S3 data repository associations, NetApp ONTAP multi-protocol access, SSD and capacity-pool tiering policies and SnapMirror, OpenZFS snapshots and clones, the decision table, scenario keywords and the limits that show up in exam questions.
AWS Lambda Beyond the Handler for the DVA-C02 Exam: Function URLs, Response Streaming, Destinations, Extensions, Custom Runtimes, Container Images, Code Signing & Recursive Loop Detection AWS
7 min read

AWS Lambda Beyond the Handler for the DVA-C02 Exam: Function URLs, Response Streaming, Destinations, Extensions, Custom Runtimes, Container Images, Code Signing & Recursive Loop Detection

A practitioner's deep dive into the Lambda features the DVA-C02 exam tests beyond versions and concurrency. Function URLs (AWS_IAM vs NONE, CORS, throttling, when to use API Gateway instead), response streaming and its 200 MB limit, asynchronous destinations vs dead-letter queues, external and internal extensions and the execution-environment lifecycle, custom runtimes on provided.al2023 and the Runtime API, container-image functions, code signing with AWS Signer, recursive loop detection, and the quotas that show up in questions.
Azure Monitoring Tools for the AZ-900 Exam: Azure Monitor, Log Analytics, Application Insights, Alerts, Azure Advisor & Service Health Explained Azure
7 min read

Azure Monitoring Tools for the AZ-900 Exam: Azure Monitor, Log Analytics, Application Insights, Alerts, Azure Advisor & Service Health Explained

A practitioner's guide to the AZ-900 'Describe monitoring tools in Azure' objective: how Azure Monitor collects metrics, logs and traces, the difference between the Log Analytics tool and a Log Analytics workspace, what Application Insights adds with OpenTelemetry, how alert rules, action groups and alert states work, Azure Advisor's five recommendation categories, and how Azure status, Service Health and Resource Health divide the question 'is it Azure or is it me?', with a decision table and worked exam scenarios.
Terraform Ephemeral Values for the Terraform Associate (004) Exam: Ephemeral Resources, Ephemeral Variables & Outputs, Write-Only Arguments and Keeping Secrets Out of State HashiCorp
7 min read

Terraform Ephemeral Values for the Terraform Associate (004) Exam: Ephemeral Resources, Ephemeral Variables & Outputs, Write-Only Arguments and Keeping Secrets Out of State

A practitioner's guide to the newest objective 4h topic on the HashiCorp Terraform Associate (004) exam: why sensitive = true never kept secrets out of state, how ephemeral resources (Terraform 1.10) open, renew and close without touching state or plan files, the seven ephemeral contexts, ephemeral input variables and child-module outputs, write-only arguments and their _wo_version companions (Terraform 1.11), terraform.applying, ephemeralasnull, the Vault and AWS Secrets Manager patterns, and the exam traps that separate sensitive from ephemeral.
AWS CodeArtifact for the DOP-C02 Exam: Domains, Upstream Repositories, External Connections, Package Origin Controls & Package Groups AWS
7 min read

AWS CodeArtifact for the DOP-C02 Exam: Domains, Upstream Repositories, External Connections, Package Origin Controls & Package Groups

A practitioner's guide to AWS CodeArtifact for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam: how domains, repositories, upstream chains and external connections fit together, where fetched packages are retained, the 12-hour authorization token model, package origin controls and package groups that stop dependency substitution attacks, cross-account domain policies, and how to wire CodeArtifact into CodeBuild and CodePipeline.
AWS Transit Gateway Internals for the SAP-C02 Exam: Route Evaluation Order, Appliance Mode, Connect Attachments, Multicast, Network Function Attachments & Flow Logs AWS
7 min read

AWS Transit Gateway Internals for the SAP-C02 Exam: Route Evaluation Order, Appliance Mode, Connect Attachments, Multicast, Network Function Attachments & Flow Logs

A practitioner's deep dive into the Transit Gateway mechanics the AWS Certified Solutions Architect - Professional (SAP-C02) exam tests beyond hub-and-spoke: association vs propagation, the exact route evaluation and attachment priority order, blackhole and prefix-list routes, why appliance mode exists and when it drops traffic, Connect attachments with GRE and BGP, multicast domains, the new Network Firewall network function attachment, MTU and bandwidth quotas, and Transit Gateway Flow Logs for debugging.
AWS Technical Resources & Engagement Options for the Cloud Practitioner (CLF-C02) Exam: AWS Marketplace, Partner Network, Professional Services, Managed Services, re:Post & Prescriptive Guidance AWS
7 min read

AWS Technical Resources & Engagement Options for the Cloud Practitioner (CLF-C02) Exam: AWS Marketplace, Partner Network, Professional Services, Managed Services, re:Post & Prescriptive Guidance

A practitioner's CLF-C02 guide to the 'who helps you' part of the exam — what AWS Marketplace, the AWS Partner Network (paths and tiers), AWS Professional Services, AWS Managed Services, AWS Solutions Architects, AWS re:Post, Prescriptive Guidance and the Solutions Library each do, how they differ from Support plans, how to pick the right one in a scenario question, and the 2026 change that retired AWS IQ in favour of Marketplace Professional Services.
In-Place Pod Resize for the CKAD Exam: The resize Subresource, resizePolicy, QoS Constraints & PodResizePending / PodResizeInProgress Conditions Kubernetes
7 min read

In-Place Pod Resize for the CKAD Exam: The resize Subresource, resizePolicy, QoS Constraints & PodResizePending / PodResizeInProgress Conditions

A hands-on CKAD guide to in-place Pod vertical scaling (GA in Kubernetes 1.35) — how to change a running Pod's CPU and memory through the resize subresource without recreating it, what resizePolicy NotRequired vs RestartContainer really does, why the QoS class can never change, how to read PodResizePending (Infeasible vs Deferred) and PodResizeInProgress, and the limits around memory decreases, init containers, static CPU manager policies and Windows nodes.
How Kubernetes Services Actually Route Traffic for the CKA Exam: kube-proxy Modes (iptables, IPVS, nftables), EndpointSlices, Traffic Policies & Session Affinity Kubernetes
7 min read

How Kubernetes Services Actually Route Traffic for the CKA Exam: kube-proxy Modes (iptables, IPVS, nftables), EndpointSlices, Traffic Policies & Session Affinity

A hands-on CKA guide to what happens after a packet hits a ClusterIP — how kube-proxy programs iptables, IPVS or nftables rules from EndpointSlices, what externalTrafficPolicy and internalTrafficPolicy really change, how trafficDistribution PreferSameZone and PreferSameNode work, when sessionAffinity ClientIP is the right answer, and how to debug a Service that has endpoints but still drops traffic.
Kubernetes Community & Governance for the KCNA Exam: SIGs, Working Groups, KEPs, Feature Stages, the Release Cycle, Version Skew & CNCF Structure Kubernetes
7 min read

Kubernetes Community & Governance for the KCNA Exam: SIGs, Working Groups, KEPs, Feature Stages, the Release Cycle, Version Skew & CNCF Structure

A practitioner's guide to the Cloud Native Community and Collaboration topics on the KCNA exam — how the Kubernetes project is organised (Steering Committee, SIGs, Working Groups, committees, the contributor ladder), how a feature travels from KEP to alpha, beta and GA, how the three-releases-a-year cycle and 14-month support window work, what the version skew and API deprecation policies guarantee, and how the CNCF, its TOC, TAGs and conformance program fit around it.
Amazon Bedrock Inference Options for the AIF-C01 Exam: Cross-Region Inference, Inference Profiles, Prompt Caching, Intelligent Prompt Routing, Service Tiers & Model Distillation AWS
7 min read

Amazon Bedrock Inference Options for the AIF-C01 Exam: Cross-Region Inference, Inference Profiles, Prompt Caching, Intelligent Prompt Routing, Service Tiers & Model Distillation

A practitioner's guide to the Amazon Bedrock inference features behind the AIF-C01 'cost tradeoffs' and 'regional coverage' objectives — geographic vs global cross-Region inference profiles, application inference profiles for cost tracking, Provisioned Throughput model units, batch inference, the Reserved/Priority/Standard/Flex service tiers, implicit and explicit prompt caching, intelligent prompt routing, latency-optimized inference, model distillation and Custom Model Import — with the scenario cues that map each one to the right answer.
Kubernetes User Namespaces for the CKS Exam: hostUsers: false, idmap Mounts, Kubelet ID Ranges, Pod Security Admission & procMount Kubernetes
7 min read

Kubernetes User Namespaces for the CKS Exam: hostUsers: false, idmap Mounts, Kubelet ID Ranges, Pod Security Admission & procMount

A hands-on CKS guide to Linux user namespaces in Kubernetes — what hostUsers: false actually changes, how the kubelet maps container root to an unprivileged host UID, the kernel, filesystem and runtime prerequisites, /etc/subuid and idsPerPod sizing, how Pod Security Admission relaxes runAsNonRoot and procMount for user-namespaced pods, the hostNetwork/hostPID/NFS limitations, and how to verify the mapping on exam day.
Denial of Service in Kubernetes for the KCSA Exam: Resource Exhaustion, PID & Ephemeral-Storage Limits, Node-Pressure Eviction & API Priority and Fairness Kubernetes
7 min read

Denial of Service in Kubernetes for the KCSA Exam: Resource Exhaustion, PID & Ephemeral-Storage Limits, Node-Pressure Eviction & API Priority and Fairness

A practitioner's KCSA guide to the Denial of Service bullet of the Kubernetes Threat Model domain — how a single Pod, tenant, or client can exhaust CPU, memory, PIDs, disk, etcd, the API server, and the cluster network, and the layered controls that stop it: requests and limits, LimitRange and ResourceQuota, kubelet PID limits and node-pressure eviction, API Priority and Fairness (FlowSchema and PriorityLevelConfiguration), event rate limiting, etcd quotas, conntrack sizing, and network-level protection.
Pod Topology Spread Constraints Deep Dive for the CNCF Exams (CKA & CKAD): maxSkew Math, minDomains, matchLabelKeys & Scheduler Defaults Kubernetes
7 min read

Pod Topology Spread Constraints Deep Dive for the CNCF Exams (CKA & CKAD): maxSkew Math, minDomains, matchLabelKeys & Scheduler Defaults

A practitioner's guide to Kubernetes topologySpreadConstraints for the KubeAstronaut path — how the scheduler actually computes skew, what minDomains, matchLabelKeys, nodeAffinityPolicy and nodeTaintsPolicy change, the cluster-level default constraints every cluster already has, the scale-down and ghost-pod traps, and how to debug a Pod stuck Pending on a spread constraint during the CKA or CKAD exam.
AWS Lambda Event Source Mappings for the DVA-C02 Exam: Batching Windows, Partial Batch Responses, Stream Error Handling, Filtering & Concurrency Controls AWS
7 min read

AWS Lambda Event Source Mappings for the DVA-C02 Exam: Batching Windows, Partial Batch Responses, Stream Error Handling, Filtering & Concurrency Controls

A developer's guide to Lambda event source mappings for the AWS Certified Developer - Associate (DVA-C02) exam. Learn how Lambda polls SQS, Kinesis and DynamoDB Streams on your behalf, what batch size and batching window really control, how ReportBatchItemFailures stops successful records from being reprocessed, how bisect-on-error, maximum retry attempts, maximum record age and on-failure destinations unblock a poisoned shard, how event filtering drops records before invocation, and how parallelization factor and maximum concurrency govern scale.
EC2 Instance Metadata Service (IMDSv2) for the SCS-C02 Exam: SSRF Defense, Hop Limits, Enforcement at Scale & Credential Exfiltration Detection AWS
7 min read

EC2 Instance Metadata Service (IMDSv2) for the SCS-C02 Exam: SSRF Defense, Hop Limits, Enforcement at Scale & Credential Exfiltration Detection

A practitioner's guide to the EC2 Instance Metadata Service for the AWS Certified Security - Specialty (SCS-C02) exam. Learn why IMDSv1 enables SSRF credential theft, how the IMDSv2 session token and hop limit stop it, how to enforce IMDSv2 with instance metadata options, account defaults, launch templates, AMI attributes and IAM condition keys, how to find stragglers with the MetadataNoToken metric, and how GuardDuty and SCPs detect and contain stolen instance credentials.
IPv6 in Amazon VPC for the SAA-C03 Exam: Dual-Stack VPCs, IPv6-Only Subnets, Egress-Only Internet Gateways, DNS64 & NAT64 AWS
7 min read

IPv6 in Amazon VPC for the SAA-C03 Exam: Dual-Stack VPCs, IPv6-Only Subnets, Egress-Only Internet Gateways, DNS64 & NAT64

A practitioner's guide to IPv6 networking in Amazon VPC for the AWS Certified Solutions Architect - Associate (SAA-C03) exam. Learn how dual-stack and IPv6-only subnets work, why IPv6 addresses are public by default and never NATed, when to use an egress-only internet gateway instead of a NAT gateway, how DNS64 and NAT64 let IPv6-only workloads reach IPv4 services, the /56 and /64 CIDR rules, BYOIP and IPAM pools, security group and NACL changes, and the exam decision cues that separate IPv6 scenarios from their IPv4 twins.
Terraform moved & removed Blocks for the Terraform Associate (004) Exam: Renaming Resources, Restructuring Modules & Forgetting Resources Without State Surgery HashiCorp
7 min read

Terraform moved & removed Blocks for the Terraform Associate (004) Exam: Renaming Resources, Restructuring Modules & Forgetting Resources Without State Surgery

A practitioner's guide to Terraform's declarative refactoring blocks for the HashiCorp Terraform Associate (004) exam. Learn how moved blocks rename resources, enable count or for_each, and relocate resources into modules without a destroy, how removed blocks drop a resource from state with or without destroying it, what the plan output looks like, how chained and historical moved blocks work, the restrictions the exam likes to test, and when terraform state mv or terraform state rm is still the right tool.
Microsoft Defender for Cloud for the AZ-900 Exam: CSPM, Secure Score, Defender Plans & Regulatory Compliance Explained Azure
7 min read

Microsoft Defender for Cloud for the AZ-900 Exam: CSPM, Secure Score, Defender Plans & Regulatory Compliance Explained

A practitioner's guide to Microsoft Defender for Cloud for the AZ-900 exam: what a CNAPP is, the free Foundational CSPM tier versus the paid Defender CSPM plan, how secure score is calculated from the Microsoft cloud security benchmark, workload protection plans (Servers, Storage, Containers, SQL, Key Vault), the regulatory compliance dashboard, multicloud and Azure Arc coverage, and how Defender for Cloud differs from Azure Policy, Microsoft Sentinel, Entra ID and Azure Firewall.
AWS Elastic Disaster Recovery & Application Recovery Controller for the SAP-C02 Exam: Continuous Replication, Zonal Shift, Routing Controls & Region Switch AWS
7 min read

AWS Elastic Disaster Recovery & Application Recovery Controller for the SAP-C02 Exam: Continuous Replication, Zonal Shift, Routing Controls & Region Switch

A practitioner's guide to the two AWS services that implement disaster recovery for the AWS Certified Solutions Architect - Professional (SAP-C02) exam: AWS Elastic Disaster Recovery (DRS) with its replication agent, staging area subnet, point-in-time snapshots, drills, recovery launch and failback, and Amazon Application Recovery Controller (ARC) with zonal shift, zonal autoshift, routing controls, safety rules and Region switch. Includes pricing shape, exam decision cues and how they differ from AWS Backup, Route 53 health checks and Resilience Hub.
AWS Business Apps, End-User Computing, Frontend & IoT Services for the Cloud Practitioner (CLF-C02): Connect, SES, WorkSpaces, AppStream 2.0, Amplify, AppSync & IoT Core AWS
7 min read

AWS Business Apps, End-User Computing, Frontend & IoT Services for the Cloud Practitioner (CLF-C02): Connect, SES, WorkSpaces, AppStream 2.0, Amplify, AppSync & IoT Core

A practitioner's guide to the 'other in-scope service categories' on the AWS Certified Cloud Practitioner (CLF-C02) exam — Amazon Connect and Amazon SES for business applications, Amazon WorkSpaces, AppStream 2.0 and WorkSpaces Secure Browser for end-user computing, AWS Amplify and AWS AppSync for frontend web and mobile, and AWS IoT Core and IoT Greengrass for connected devices — with the one-line recognition cues and confusable pairs the exam tests.
AWS Fault Injection Service & Resilience Hub for the DOP-C02 Exam: Chaos Engineering, Stop Conditions & RTO/RPO Validation AWS
7 min read

AWS Fault Injection Service & Resilience Hub for the DOP-C02 Exam: Chaos Engineering, Stop Conditions & RTO/RPO Validation

A practitioner's guide to proving resilience on AWS for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam: AWS Fault Injection Service experiment templates, actions, targets and selection modes, CloudWatch alarm stop conditions, SSM-based fault documents, and the scenario library — plus AWS Resilience Hub resiliency policies, RTO/RPO assessments, the resiliency score, drift detection, and how to wire both into a CI/CD pipeline.
Kubernetes Finalizers, Owner References & Garbage Collection for the CKA Exam: Fixing Resources Stuck in Terminating Kubernetes
7 min read

Kubernetes Finalizers, Owner References & Garbage Collection for the CKA Exam: Fixing Resources Stuck in Terminating

A hands-on CKA guide to how Kubernetes deletes things — deletionTimestamp, finalizers, owner references, and background, foreground and orphan cascading deletion — plus a troubleshooting playbook for PVCs, PVs, namespaces, custom resources and Pods stuck in Terminating, with the commands to diagnose the real cause before you ever touch a finalizer.
Static Analysis for the CKS Exam: Scanning Kubernetes Manifests with Kubesec & KubeLinter Kubernetes
7 min read

Static Analysis for the CKS Exam: Scanning Kubernetes Manifests with Kubesec & KubeLinter

A hands-on CKS guide to static analysis of Kubernetes workloads with Kubesec and KubeLinter — how each tool works, how to read Kubesec's score and critical/advise findings, KubeLinter's default checks, configuration and ignore annotations, a full scan-fix-rescan worked example, a Dockerfile review checklist, and how static analysis fits with image scanning and admission control.
AWS Step Functions for the DVA-C02 Exam: Workflow Types, ASL, I/O Processing, Error Handling & Integration Patterns AWS
7 min read

AWS Step Functions for the DVA-C02 Exam: Workflow Types, ASL, I/O Processing, Error Handling & Integration Patterns

A developer-level deep dive into AWS Step Functions for the AWS Certified Developer - Associate (DVA-C02) exam. Standard vs Express execution semantics, the Amazon States Language state types, the input/output processing pipeline, Retry and Catch error handling, the three service integration patterns (Request Response, .sync, .waitForTaskToken), Map vs Distributed Map, and the SAM, X-Ray, and TestState developer tooling.
AWS KMS Custom Key Stores for the SCS-C02 Exam: CloudHSM Key Stores, External Key Stores (XKS) & Key Material Origin AWS
7 min read

AWS KMS Custom Key Stores for the SCS-C02 Exam: CloudHSM Key Stores, External Key Stores (XKS) & Key Material Origin

A practitioner's guide to AWS KMS custom key stores for the AWS Certified Security - Specialty (SCS-C02) exam. Learn the four key material origin options, how AWS CloudHSM key stores and external key stores (XKS) split the KMS control plane from your own HSM data plane, the CloudHSM cluster prerequisites, the XKS proxy and its connectivity, and the single-tenant control (not the FIPS level) that actually decides when you leave the default KMS key store.
S3 Multi-Region Access Points for the SAA-C03 Exam: Global Endpoints, Failover Controls & Active-Active Storage AWS
7 min read

S3 Multi-Region Access Points for the SAA-C03 Exam: Global Endpoints, Failover Controls & Active-Active Storage

A practitioner's guide to Amazon S3 Multi-Region Access Points (MRAP) for the AWS Certified Solutions Architect - Associate (SAA-C03) exam. Learn how the global endpoint routes requests over the AWS global network, why replication is configured separately with CRR, how active-active and active-passive failover controls work, the SigV4A signing requirement, the limits that show up in scenarios, and how to choose MRAP over Transfer Acceleration, CloudFront, or Route 53.
Terraform check Blocks for the Terraform Associate (004) Exam: Continuous Validation, Assertions & Scoped Data Sources HashiCorp
7 min read

Terraform check Blocks for the Terraform Associate (004) Exam: Continuous Validation, Assertions & Scoped Data Sources

A practitioner's guide to Terraform check blocks for the HashiCorp Terraform Associate (004) exam. Learn how check blocks fit objective 4g 'validate configuration using custom conditions', how assertions emit warnings instead of blocking apply, how scoped data sources enable post-apply health checks, and exactly how checks differ from variable validation and preconditions/postconditions.
Amazon EventBridge Pipes, Scheduler & Advanced Routing for the DOP-C02 Exam: Beyond Rules and Targets AWS
7 min read

Amazon EventBridge Pipes, Scheduler & Advanced Routing for the DOP-C02 Exam: Beyond Rules and Targets

A practitioner's guide to the advanced Amazon EventBridge features the AWS Certified DevOps Engineer - Professional (DOP-C02) exam expects you to reach for: EventBridge Pipes for point-to-point integration with filtering and enrichment, input transformers, API destinations for third-party calls, target retry policies and dead-letter queues, archive and replay for reprocessing, and EventBridge Scheduler for serverless scheduled tasks. Learn when each one beats a hand-written Lambda.
Amazon VPC Lattice for the SAP-C02 Exam: Application Networking, Service Networks & Auth Policies AWS
7 min read

Amazon VPC Lattice for the SAP-C02 Exam: Application Networking, Service Networks & Auth Policies

A practitioner's guide to Amazon VPC Lattice for the AWS Certified Solutions Architect - Professional (SAP-C02) exam. Learn how Lattice connects, secures, and monitors service-to-service communication across VPCs and accounts at the application layer, how service networks, services, listeners, and target groups fit together, how IAM auth policies work, how it handles overlapping CIDRs, and when to choose Lattice over VPC peering, Transit Gateway, or PrivateLink.
Securing Generative AI Prompts for the AIF-C01 Exam: Prompt Injection, Jailbreaking, Poisoning & Layered Defenses AWS
7 min read

Securing Generative AI Prompts for the AIF-C01 Exam: Prompt Injection, Jailbreaking, Poisoning & Layered Defenses

A practitioner's guide to prompt-engineering security risks for the AWS Certified AI Practitioner (AIF-C01) exam. Learn the attack taxonomy the blueprint tests — prompt injection (direct and indirect), jailbreaking, prompt leaking/exposure, hijacking, and data poisoning — plus the layered defenses that stop them, where Amazon Bedrock Guardrails fits, and the exam cues that map each attack to the right term.
AWS Nitro Enclaves for the SCS-C02 Exam: Isolated Compute, Attestation & KMS Condition Keys AWS
7 min read

AWS Nitro Enclaves for the SCS-C02 Exam: Isolated Compute, Attestation & KMS Condition Keys

A practitioner's guide to AWS Nitro Enclaves for the AWS Certified Security - Specialty (SCS-C02) exam. Learn how enclaves isolate sensitive data processing from the parent instance and its admins, how cryptographic attestation and PCR measurements work, how kms:RecipientAttestation condition keys gate KMS Decrypt/GenerateDataKey, the nitro-cli and EIF workflow, ACM for Nitro Enclaves, and how to tell Enclaves apart from CloudHSM, Dedicated Hosts, and KMS on the exam.
AWS Lambda SnapStart for the DVA-C02 Exam: Faster Cold Starts, the Snapshot Lifecycle, Runtime Support & When to Use It AWS
7 min read

AWS Lambda SnapStart for the DVA-C02 Exam: Faster Cold Starts, the Snapshot Lifecycle, Runtime Support & When to Use It

A practitioner's deep dive into AWS Lambda SnapStart for the DVA-C02 exam. How the snapshot-on-publish, restore-on-invoke lifecycle works, current runtime support (Java, Python, .NET), pricing differences, the uniqueness and state hazards you must fix with runtime hooks, how to enable it via CLI and SAM, reading Restore Duration in the logs, and how SnapStart compares to provisioned concurrency.
Azure Networking for the AZ-900 Exam: Virtual Networks, Subnets, Peering, Azure DNS, VPN Gateway, ExpressRoute & Private Endpoints Azure
7 min read

Azure Networking for the AZ-900 Exam: Virtual Networks, Subnets, Peering, Azure DNS, VPN Gateway, ExpressRoute & Private Endpoints

A practitioner's guide to the networking half of the AZ-900 'compute and networking services' objective. Covers Azure virtual networks and subnets, VNet peering, Azure DNS, VPN Gateway vs ExpressRoute for hybrid connectivity, and public vs private endpoints — scoped exactly to the current skills measured, with decision tables for the pairs the exam loves to confuse.
EC2 Auto Scaling Internals for the SAA-C03 Exam: Launch Templates, Health Checks, Termination Policies, Mixed Instances & Instance Refresh AWS
7 min read

EC2 Auto Scaling Internals for the SAA-C03 Exam: Launch Templates, Health Checks, Termination Policies, Mixed Instances & Instance Refresh

A practitioner's deep dive into how an EC2 Auto Scaling group actually works for the AWS Solutions Architect Associate (SAA-C03) exam. Covers launch templates vs launch configurations, EC2 vs ELB health checks and the grace period, termination policies and instance scale-in protection, mixed instances with On-Demand/Spot allocation strategies, and instance refresh for rolling fleet updates — the configuration and operational details behind the resilience concepts.
Azure Core Architectural Components for the AZ-900 Exam: Regions, Availability Zones, Resource Groups, Subscriptions & Management Groups Azure
7 min read

Azure Core Architectural Components for the AZ-900 Exam: Regions, Availability Zones, Resource Groups, Subscriptions & Management Groups

A practitioner's guide to the AZ-900 'core architectural components' objective — the foundation of the exam's largest domain, Azure architecture and services (35–40%). Covers the physical hierarchy (datacenters, regions, region pairs, sovereign regions and availability zones) and the logical hierarchy (resources, resource groups, subscriptions and management groups), how governance inherits down that tree, and the scenario cues that map each question to the right scope.
AWS Analytics Services for the Cloud Practitioner (CLF-C02): Athena, Glue, Kinesis, Redshift, EMR & QuickSight AWS
7 min read

AWS Analytics Services for the Cloud Practitioner (CLF-C02): Athena, Glue, Kinesis, Redshift, EMR & QuickSight

A practitioner's guide to the AWS analytics services on the CLF-C02 exam — Amazon Kinesis for streaming ingestion, S3 as the data lake, AWS Glue for serverless ETL and the Data Catalog, Amazon Athena for serverless SQL, Amazon Redshift for data warehousing, Amazon EMR for big-data processing, and Amazon QuickSight for BI dashboards — organized as one end-to-end data pipeline with the service-recognition cues the exam actually tests.
Azure Management & Governance for the AZ-900 Exam: Cost Management, Azure Policy, Resource Locks, ARM & Azure Monitor Azure
7 min read

Azure Management & Governance for the AZ-900 Exam: Cost Management, Azure Policy, Resource Locks, ARM & Azure Monitor

A practitioner's guide to the AZ-900 'Describe Azure management and governance' domain — the largest scored slice of the exam. Covers cost management (the Pricing Calculator, TCO Calculator, Microsoft Cost Management and tags), governance and compliance (Azure Policy, resource locks and Microsoft Purview), the management and deployment surfaces (portal, Cloud Shell, Azure CLI, Azure PowerShell, Azure Arc, IaC and ARM templates) and the monitoring stack (Azure Monitor, Log Analytics, Application Insights, Azure Advisor and Azure Service Health), with the scenario cues that map each question to the right tool.
Cloud Concepts for the AZ-900 Exam: IaaS vs PaaS vs SaaS, Public/Private/Hybrid Cloud, the Shared Responsibility Model & CapEx vs OpEx Azure
7 min read

Cloud Concepts for the AZ-900 Exam: IaaS vs PaaS vs SaaS, Public/Private/Hybrid Cloud, the Shared Responsibility Model & CapEx vs OpEx

A practitioner's guide to the AZ-900 'Describe cloud concepts' domain — the shared responsibility model explained with a who-manages-what table, IaaS vs PaaS vs SaaS with Azure examples, public/private/hybrid deployment models, consumption-based pricing and CapEx vs OpEx, plus the cloud benefits the exam name-drops (high availability, scalability, elasticity, disaster recovery) and the scenario cues that map each question to the right answer.
Image Signing & Verification for the CKS Exam: Cosign, Sigstore & Enforcing Signed Images at Admission Kubernetes
7 min read

Image Signing & Verification for the CKS Exam: Cosign, Sigstore & Enforcing Signed Images at Admission

A hands-on CKS guide to container image signing and verification with Cosign and Sigstore — why signing proves provenance where scanning proves contents, key-based and keyless signing, the Fulcio and Rekor roles, verifying signatures and attestations, and enforcing a signed-images-only policy at admission with Kyverno verifyImages and the sigstore policy-controller, plus the exam scenarios and mistakes to watch for.
AWS AppConfig for the DOP-C02 Exam: Safe Dynamic Configuration, Deployment Strategies, Validators & Automatic Rollback AWS
7 min read

AWS AppConfig for the DOP-C02 Exam: Safe Dynamic Configuration, Deployment Strategies, Validators & Automatic Rollback

Changing a running application's behavior shouldn't require a full code deployment — or a risky config edit with no safety net. A DevOps-scale guide to AWS AppConfig for the DOP-C02 exam: the application/environment/profile hierarchy, freeform vs feature-flag profiles, deployment strategies with bake time, JSON Schema and Lambda validators, and CloudWatch-alarm automatic rollback.
Debugging Terraform with TF_LOG for the Terraform Associate Exam: Log Levels, crash.log, Provider Logs & Reading Common Errors DevOps
7 min read

Debugging Terraform with TF_LOG for the Terraform Associate Exam: Log Levels, crash.log, Provider Logs & Reading Common Errors

When plan and apply aren't enough, you reach for logs. A practitioner's guide to debugging Terraform — the TF_LOG log levels, splitting core and provider logs with TF_LOG_CORE and TF_LOG_PROVIDER, persisting output with TF_LOG_PATH, what crash.log contains, and how to read the errors the Terraform Associate (003/004) exam keeps asking about.
EC2 Placement Groups & Instance Tenancy for the SAA-C03 Exam: Cluster, Spread & Partition Placement, Dedicated Hosts vs Dedicated Instances AWS
7 min read

EC2 Placement Groups & Instance Tenancy for the SAA-C03 Exam: Cluster, Spread & Partition Placement, Dedicated Hosts vs Dedicated Instances

A practitioner's deep dive into EC2 placement and tenancy for the AWS Solutions Architect Associate (SAA-C03): cluster, spread, and partition placement groups with their limits and use cases, plus shared vs dedicated tenancy and Dedicated Hosts vs Dedicated Instances — with decision tables and the exact exam cues that map each scenario to the right choice.
Azure Identity, Access & Security for the AZ-900 Exam: Microsoft Entra ID, Authentication, MFA, SSO, Conditional Access & Azure RBAC Azure
7 min read

Azure Identity, Access & Security for the AZ-900 Exam: Microsoft Entra ID, Authentication, MFA, SSO, Conditional Access & Azure RBAC

A practitioner's guide to Azure identity and access for AZ-900: authentication vs authorization, Microsoft Entra ID and how it differs from on-premises Active Directory, MFA and passwordless sign-in, single sign-on, Conditional Access, Azure RBAC scope and roles, and the Zero Trust and defence-in-depth models — with decision tables and the exam cues that map each scenario to the right concept.
IAM Access Analyzer for the SCS-C02 Exam: External Access, Unused Access, Policy Validation & Custom Policy Checks AWS
7 min read

IAM Access Analyzer for the SCS-C02 Exam: External Access, Unused Access, Policy Validation & Custom Policy Checks

A practitioner's guide to IAM Access Analyzer for the AWS Certified Security - Specialty (SCS-C02) exam. Learn how the zone of trust surfaces external access findings, how unused access analyzers cut down over-permissioned roles, how policy validation and custom policy checks (CheckNoNewAccess, CheckAccessNotGranted) guard your pipelines, and how policy generation builds least-privilege policies from CloudTrail.
Structuring Terraform Across Multiple States for the Terraform Associate Exam: Root Modules, terraform_remote_state & Sharing Data Between Configurations DevOps
7 min read

Structuring Terraform Across Multiple States for the Terraform Associate Exam: Root Modules, terraform_remote_state & Sharing Data Between Configurations

One giant state file is slow, risky, and a collaboration bottleneck. Learn how to split Terraform into multiple states, why a root module maps to exactly one state, the three ways to share data between configurations (terraform_remote_state, data sources, and SSM), and the apply-ordering and blast-radius trade-offs — for the HashiCorp Terraform Associate (003/004) exam.
Infrastructure as Code Concepts for the Terraform Associate Exam: Declarative vs Imperative, Idempotency & the Benefits of IaC HashiCorp
7 min read

Infrastructure as Code Concepts for the Terraform Associate Exam: Declarative vs Imperative, Idempotency & the Benefits of IaC

A foundational guide to the Infrastructure as Code concepts the Terraform Associate (004) exam tests first: what IaC is and the problems it solves, declarative vs imperative styles, idempotency and desired state, mutable vs immutable infrastructure, provisioning vs configuration management, and why version control changes everything.
AWS Support Plans & Trusted Advisor for the Cloud Practitioner (CLF-C02): How to Choose Basic, Developer, Business, Enterprise On-Ramp & Enterprise AWS
7 min read

AWS Support Plans & Trusted Advisor for the Cloud Practitioner (CLF-C02): How to Choose Basic, Developer, Business, Enterprise On-Ramp & Enterprise

A practitioner's guide to picking the right AWS Support plan for the CLF-C02 exam. Response-time SLAs compared, who gets a TAM and Concierge, how Trusted Advisor and AWS Health fit, the scenario keywords that decide the answer, and the 2026 change retiring Developer, Business & Enterprise On-Ramp you should know about.
kubectl apply vs create vs replace: Managing Kubernetes Objects for the CNCF Exams (Imperative, Declarative & Server-Side Apply) Kubernetes
7 min read

kubectl apply vs create vs replace: Managing Kubernetes Objects for the CNCF Exams (Imperative, Declarative & Server-Side Apply)

A practitioner's guide to the three ways kubectl manages Kubernetes objects — imperative commands, imperative object config, and declarative apply. How apply's three-way merge works, when create fails, why replace --force recreates a resource, server-side apply and field managers, and which mode to reach for on the CKA, CKAD, CKS and KCNA.
Choosing Foundation Models & Tuning Inference Parameters on Amazon Bedrock for the AWS AI Practitioner (AIF-C01): Temperature, Top-P, Top-K, Context Windows, Cost & Latency AWS
7 min read

Choosing Foundation Models & Tuning Inference Parameters on Amazon Bedrock for the AWS AI Practitioner (AIF-C01): Temperature, Top-P, Top-K, Context Windows, Cost & Latency

A practitioner's guide to the Amazon Bedrock model-selection and inference-configuration topics the AIF-C01 exam tests — how to pick a foundation model by capability, modality, context window, cost, and latency, and how temperature, top-p, top-k, max tokens, and stop sequences shape a model's output. With comparison tables, examples, and the keyword traps that reveal the right answer.
Taints, Tolerations, Node Affinity & Pod Affinity for the CNCF Exams: Controlling Pod Placement (CKA, CKAD, KCNA) Kubernetes
7 min read

Taints, Tolerations, Node Affinity & Pod Affinity for the CNCF Exams: Controlling Pod Placement (CKA, CKAD, KCNA)

A hands-on guide to advanced Kubernetes scheduling for the KubeAstronaut path — how taints and tolerations repel Pods from nodes, how nodeSelector and node affinity attract them, how pod affinity and anti-affinity co-locate or spread workloads, and how topology spread constraints balance them across zones. With YAML, kubectl commands, and the keyword traps that decide exam questions.
AWS Certificate Manager & Private CA for the SCS-C02 Exam: Certificate Lifecycle, Validation, Renewal & TLS Termination AWS
7 min read

AWS Certificate Manager & Private CA for the SCS-C02 Exam: Certificate Lifecycle, Validation, Renewal & TLS Termination

A practitioner's guide to certificate management for the AWS Certified Security - Specialty (SCS-C02) exam — how AWS Certificate Manager provisions and auto-renews public certificates, where TLS terminates on ALB, CloudFront, and API Gateway, why ACM certs cannot be exported, when to reach for AWS Private CA, and the certificate-lifecycle traps the exam loves to set.
API Deprecations & Managing API Versions for the CKAD Exam: apiVersion, kubectl convert & the Deprecation Policy Kubernetes
7 min read

API Deprecations & Managing API Versions for the CKAD Exam: apiVersion, kubectl convert & the Deprecation Policy

A practitioner's guide to Kubernetes API versioning and deprecations for the CKAD exam — how alpha/beta/stable versions work, the deprecation policy that governs them, how to find the right apiVersion for any object with kubectl api-resources and explain, how to migrate manifests off removed APIs with kubectl convert, and the exact commands that stop 'no matches for kind' errors from costing you points on exam day.
Hybrid & Edge Architectures for the SAP-C02 Exam: Outposts, Local Zones, Wavelength, Snow Family & Hybrid DNS AWS
7 min read

Hybrid & Edge Architectures for the SAP-C02 Exam: Outposts, Local Zones, Wavelength, Snow Family & Hybrid DNS

A practitioner's guide to AWS hybrid and edge architectures for the SAP-C02 Solutions Architect Professional exam — when to reach for Outposts vs Local Zones vs Wavelength, how the Snow Family moves data and runs compute at the edge, how hybrid DNS resolution works with Route 53 Resolver endpoints, and the latency, residency, and connectivity trade-offs the exam expects you to reason about.
AWS Lambda for the Developer Associate (DVA-C02): Versions, Aliases, Concurrency, Layers & the Execution Environment AWS
7 min read

AWS Lambda for the Developer Associate (DVA-C02): Versions, Aliases, Concurrency, Layers & the Execution Environment

A deep, practitioner-focused guide to AWS Lambda for the DVA-C02 exam — how the execution environment lifecycle drives cold starts, publishing immutable versions, routing traffic with aliases and weighted canaries, reserved vs provisioned concurrency, Lambda layers, environment variables and encryption, /tmp ephemeral storage, and event source mappings. Includes CLI commands, tables, and exam gotchas.
AWS Systems Manager Operations for the DevOps Engineer Professional (DOP-C02): Session Manager, Run Command, Patch Manager, Fleet Manager, OpsCenter & Incident Manager AWS
7 min read

AWS Systems Manager Operations for the DevOps Engineer Professional (DOP-C02): Session Manager, Run Command, Patch Manager, Fleet Manager, OpsCenter & Incident Manager

A practitioner's deep dive into the operational side of AWS Systems Manager for the DOP-C02 exam: agentless Session Manager access, Run Command at fleet scale, Patch Manager and patch baselines, Maintenance Windows, Fleet Manager, Inventory and Compliance, plus OpsCenter, Change Manager, and Incident Manager for operations management — with CLI examples and the trade-offs the exam tests.
Terraform Meta-Arguments, Lifecycle & Provisioners for the Terraform Associate Exam: depends_on, lifecycle, provisioners & null_resource HashiCorp
7 min read

Terraform Meta-Arguments, Lifecycle & Provisioners for the Terraform Associate Exam: depends_on, lifecycle, provisioners & null_resource

A practitioner's guide to Terraform's resource meta-arguments and escape hatches for the Terraform Associate (003/004) exam: explicit depends_on, the lifecycle block (create_before_destroy, prevent_destroy, ignore_changes, replace_triggered_by), custom conditions, provisioners (local-exec, remote-exec, file), connection blocks, and null_resource / terraform_data — with commands, real examples, and the trade-offs the exam tests.
Pod Security Standards & Pod Security Admission for the KCSA Exam: Privileged, Baseline, Restricted & Namespace Enforcement Kubernetes
7 min read

Pod Security Standards & Pod Security Admission for the KCSA Exam: Privileged, Baseline, Restricted & Namespace Enforcement

A practitioner's guide to Pod Security Standards (PSS) and Pod Security Admission (PSA) for the KCSA exam. Learn the three policy profiles — privileged, baseline, restricted — the three modes (enforce, audit, warn), how namespace labels wire it all together, what replaced PodSecurityPolicy, and the exact controls each profile blocks.
Container Runtimes & the Container Ecosystem for the KCNA Exam: OCI, CRI, containerd, runc & Why Kubernetes Removed Dockershim Kubernetes
7 min read

Container Runtimes & the Container Ecosystem for the KCNA Exam: OCI, CRI, containerd, runc & Why Kubernetes Removed Dockershim

A practitioner's deep dive into container runtimes for the Kubernetes and Cloud Native Associate (KCNA) exam. Understand OCI standards, the Container Runtime Interface (CRI), high-level vs low-level runtimes, containerd, CRI-O, runc, and the real story behind Kubernetes deprecating Dockershim — with the exam cues that make runtime questions easy.
Amazon GuardDuty Deep Dive for the AWS Security Specialty (SCS-C02): Data Sources, Finding Types, Protection Plans & Automated Response AWS
7 min read

Amazon GuardDuty Deep Dive for the AWS Security Specialty (SCS-C02): Data Sources, Finding Types, Protection Plans & Automated Response

A practitioner's deep dive into Amazon GuardDuty for the AWS Certified Security Specialty (SCS-C02) exam. How GuardDuty consumes data sources, the anatomy of a finding, every protection plan (S3, EKS, Malware, RDS, Lambda, Runtime Monitoring), suppression and trusted IP lists, delegated administration across an organization, and EventBridge-driven automated response.
Labels, Selectors & Annotations for the CKAD Exam: matchLabels, Set-Based Selectors, Field Selectors & kubectl -l Kubernetes
7 min read

Labels, Selectors & Annotations for the CKAD Exam: matchLabels, Set-Based Selectors, Field Selectors & kubectl -l

A practitioner's guide to Kubernetes labels, selectors, and annotations for the CKAD exam — equality vs set-based selectors, how Services and Deployments find Pods with matchLabels and matchExpressions, the difference between labels and annotations, field selectors, the recommended label set, and the kubectl -l speed techniques that save you real minutes on exam day.
Identity Federation & Centralized Access for the SAP-C02 Exam: IAM Identity Center, SAML/OIDC, Cross-Account Roles & AWS Organizations AWS
7 min read

Identity Federation & Centralized Access for the SAP-C02 Exam: IAM Identity Center, SAML/OIDC, Cross-Account Roles & AWS Organizations

A practitioner's guide to designing centralized identity and access for the AWS Solutions Architect Professional (SAP-C02) exam — IAM Identity Center with permission sets, SAML 2.0 and OIDC federation, cross-account IAM roles with sts:AssumeRole and external IDs, workforce vs workload identity, AD integration, and the scenario patterns the exam tests under 'organizational complexity'.
Service Account Token Security for the CKS Exam: Bound Tokens, TokenRequest, Automount & Stopping Token Theft Kubernetes
7 min read

Service Account Token Security for the CKS Exam: Bound Tokens, TokenRequest, Automount & Stopping Token Theft

A practitioner's guide to hardening Kubernetes ServiceAccount tokens for the CKS exam — how bound tokens replaced legacy non-expiring Secrets in 1.24+, minting short-lived tokens with the TokenRequest API and kubectl create token, disabling token automount, auditing over-permissioned ServiceAccounts, and stopping the token-theft attack that turns one compromised pod into cluster-wide access.
Importing Existing Infrastructure into Terraform for the Terraform Associate Exam: terraform import, import Blocks, Drift Detection & moved Blocks HashiCorp
7 min read

Importing Existing Infrastructure into Terraform for the Terraform Associate Exam: terraform import, import Blocks, Drift Detection & moved Blocks

A practitioner's guide to bringing existing resources under Terraform management for the Terraform Associate (003/004) exam. Learn the terraform import command, declarative import blocks, refactoring with moved blocks, detecting configuration drift with -refresh-only, and how state ties it all together — with commands and real examples.
AWS Compute Services for the Cloud Practitioner (CLF-C02): EC2, Lambda, Containers, Elastic Beanstalk & Lightsail AWS
7 min read

AWS Compute Services for the Cloud Practitioner (CLF-C02): EC2, Lambda, Containers, Elastic Beanstalk & Lightsail

A practitioner's guide to AWS compute for the Cloud Practitioner (CLF-C02) exam. Understand EC2 and its purchasing options, Auto Scaling and load balancing, AWS Lambda and serverless, containers on ECS/EKS/Fargate, and platform services like Elastic Beanstalk and Lightsail — plus the decision framework that makes 'which compute service?' questions easy.
Kubernetes Services & Networking for the KCNA Exam: ClusterIP, NodePort, LoadBalancer, Ingress & DNS Kubernetes
7 min read

Kubernetes Services & Networking for the KCNA Exam: ClusterIP, NodePort, LoadBalancer, Ingress & DNS

A practitioner's guide to Kubernetes networking for the KCNA exam. Learn the Kubernetes networking model, why Services exist, the four Service types (ClusterIP, NodePort, LoadBalancer, ExternalName), how Ingress does Layer 7 routing, cluster DNS with CoreDNS, the CNI, and NetworkPolicy — with YAML examples and the exam signals that make networking questions easy.
Amazon SageMaker for the AWS AI Practitioner (AIF-C01): Studio, Canvas, JumpStart, Data Wrangler, Clarify & Model Monitor AWS
7 min read

Amazon SageMaker for the AWS AI Practitioner (AIF-C01): Studio, Canvas, JumpStart, Data Wrangler, Clarify & Model Monitor

A practitioner's tour of Amazon SageMaker for the AWS Certified AI Practitioner (AIF-C01) exam. Learn what SageMaker is, how its tools map onto the ML lifecycle — Ground Truth, Data Wrangler, Feature Store, Autopilot, JumpStart, Clarify, Model Monitor — and the exam cues that tell you when to reach for SageMaker versus Bedrock or an AI service.
Amazon S3 Security for the AWS Security Specialty (SCS-C02): Bucket Policies, Block Public Access, Encryption & Cross-Account Access AWS
7 min read

Amazon S3 Security for the AWS Security Specialty (SCS-C02): Bucket Policies, Block Public Access, Encryption & Cross-Account Access

A practitioner's deep dive into securing Amazon S3 for the AWS SCS-C02 exam. Learn how S3 authorization is evaluated, Block Public Access, bucket policies vs. IAM vs. ACLs, SSE-S3/SSE-KMS/DSSE encryption, VPC endpoint restrictions, access points, presigned URLs, and how to detect exposure — with policy JSON, CLI examples, and exam-style scenarios.
Amazon API Gateway for the AWS Developer Associate (DVA-C02): REST vs HTTP APIs, Integrations, Authorizers, Throttling & Stages AWS
7 min read

Amazon API Gateway for the AWS Developer Associate (DVA-C02): REST vs HTTP APIs, Integrations, Authorizers, Throttling & Stages

A developer-focused deep dive into Amazon API Gateway for the DVA-C02 exam: choosing between REST, HTTP, and WebSocket APIs, Lambda proxy vs custom integrations, IAM/Cognito/Lambda authorizers, throttling and usage plans, caching and CORS, stages and canary deployments, and the CloudWatch metrics that explain 4XX/5XX errors — with code, CLI, and the scenario clues the exam rewards.
CRDs & the Operator Pattern for the CKAD Exam: Extending Kubernetes with Custom Resources Kubernetes
7 min read

CRDs & the Operator Pattern for the CKAD Exam: Extending Kubernetes with Custom Resources

A practitioner's guide to Custom Resource Definitions and Operators for the CKAD exam — how to discover CRDs on an unfamiliar cluster with kubectl api-resources and kubectl explain, read and create custom resource instances, understand the controller reconcile loop behind Operators, and move fast on the exam's extend-Kubernetes objective, with manifests, commands, and a discovery workflow.
Multi-Account & Cross-Region CI/CD for the AWS DevOps Engineer Professional (DOP-C02): Cross-Account CodePipeline, StackSets & Deployment Governance AWS
7 min read

Multi-Account & Cross-Region CI/CD for the AWS DevOps Engineer Professional (DOP-C02): Cross-Account CodePipeline, StackSets & Deployment Governance

A practitioner's guide to multi-account and cross-region delivery for the DOP-C02 exam: why teams split into AWS accounts, cross-account CodePipeline with the required customer-managed KMS key, CloudFormation StackSets (self-managed vs service-managed), cross-region actions and artifact buckets, approval gates, and org-wide guardrails — with IAM policies and CLI examples.
Kubernetes Secrets Management & Encryption at Rest for the CKS Exam: etcd Encryption, KMS Providers, RBAC & External Secrets Kubernetes
7 min read

Kubernetes Secrets Management & Encryption at Rest for the CKS Exam: etcd Encryption, KMS Providers, RBAC & External Secrets

A hands-on CKS guide to protecting Kubernetes Secrets: why Secrets are only base64-encoded by default, how to configure EncryptionConfiguration with aescbc/aesgcm, envelope encryption with a KMS provider, re-encrypting existing secrets, locking down access with RBAC, and where External Secrets and Vault fit — with copy-paste YAML and kubectl.
HCP Terraform (Terraform Cloud) for the Terraform Associate Exam: Remote State, Remote Runs, Workflows, Private Registry & Sentinel DevOps
7 min read

HCP Terraform (Terraform Cloud) for the Terraform Associate Exam: Remote State, Remote Runs, Workflows, Private Registry & Sentinel

A practitioner's guide to HCP Terraform — formerly Terraform Cloud — for the HashiCorp Terraform Associate (003) exam. Understand the remote backend and managed state, where remote runs execute, the VCS/CLI/API workflows, HCP workspaces vs CLI workspaces, variable sets, the private module registry, and Sentinel policy as code, with config you can copy.
Kubernetes Scheduling & Resource Management for the KCNA Exam: Requests, Limits, QoS Classes, Affinity, Taints & Tolerations Kubernetes
7 min read

Kubernetes Scheduling & Resource Management for the KCNA Exam: Requests, Limits, QoS Classes, Affinity, Taints & Tolerations

A practitioner's guide to Kubernetes scheduling and resource management for the KCNA exam. Understand how the scheduler places Pods, how requests and limits work, QoS classes and eviction order, nodeSelector, node and pod affinity, taints and tolerations, and DaemonSets — with manifests, kubectl commands, and the exam traps that trip candidates up.
Configuration Management & Infrastructure as Code for the AWS DevOps Engineer Professional (DOP-C02): CloudFormation, CDK, Systems Manager & Elastic Beanstalk AWS
7 min read

Configuration Management & Infrastructure as Code for the AWS DevOps Engineer Professional (DOP-C02): CloudFormation, CDK, Systems Manager & Elastic Beanstalk

Master Domain 2 of the AWS DOP-C02 exam — Configuration Management and Infrastructure as Code (~17%). A practitioner's guide to CloudFormation stacks, change sets, StackSets and drift detection, the AWS CDK and SAM, Systems Manager (Parameter Store, State Manager, Automation, Patch Manager), Elastic Beanstalk deployment policies, and golden AMIs — with the trade-offs and CLI details the exam expects.
The Kubernetes Object Model & kubectl for the KCNA Exam: Manifests, the Declarative API, Labels & Namespaces Kubernetes
7 min read

The Kubernetes Object Model & kubectl for the KCNA Exam: Manifests, the Declarative API, Labels & Namespaces

A practitioner's guide to the Kubernetes object model for the KCNA exam. Understand the declarative API and reconciliation loop, the anatomy of a manifest (apiVersion, kind, metadata, spec, status), API groups and versions, kubectl verbs, labels and selectors, annotations, and namespaces — the concepts the Kubernetes Fundamentals domain rewards most.

Limited Time Offer: Get 80% off all Mock Exam Bundles | Sale ends in 7 days. Start learning today.

Claim Now