849 B
Audit impact and containment order
The learner completed the substantive reasoning in Lesson 32. They distinguished a rejected RBAC attempt from a successful RoleBinding creation by checking responseStatus.code, identified the authenticated ServiceAccount principal, traced Secret access and Pod exec, and ordered containment as RBAC revocation, workload isolation, then credential rotation.
Evidence
The incident note correctly identifies system:serviceaccount:checkout:release-bot, RoleBinding checkout/release-bot-secret-reader, Secret checkout/payment-gateway, and the exec target checkout/checkout-api-6d8f.
Remaining evidence gap
The answer does not include the exact structured JSON filter command requested by the lesson. Continue requiring commands or output when a task asks for reproducible investigation evidence.