mosiur/CKS-Lessons
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Completed upto lesson 35

Browse Source
This commit is contained in:
Mosiur Rahman
2026-08-26 19:37:55 +06:00
parent 639e69484c
commit eaef1c17a7
20 changed files with 1586 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
learning-records/0006-audit-impact-and-containment-order.md Normal file
View File

@@ -0,0 +1,11 @@
# Audit impact and containment order
The learner completed the substantive reasoning in Lesson 32. They distinguished a rejected RBAC attempt from a successful RoleBinding creation by checking `responseStatus.code`, identified the authenticated ServiceAccount principal, traced Secret access and Pod exec, and ordered containment as RBAC revocation, workload isolation, then credential rotation.
## Evidence
The incident note correctly identifies `system:serviceaccount:checkout:release-bot`, RoleBinding `checkout/release-bot-secret-reader`, Secret `checkout/payment-gateway`, and the exec target `checkout/checkout-api-6d8f`.
## Remaining evidence gap
The answer does not include the exact structured JSON filter command requested by the lesson. Continue requiring commands or output when a task asks for reproducible investigation evidence.