Practice → investigate → explain
Make every missed question lead to a useful lab.
These original study exercises connect exam concepts to observable behavior. The linked GitHub projects provide implementation material; they are not endorsements of Certbie or evidence that a practice set matches a live exam.
Sources checked September 20, 2026 · AI-assisted editorial review · Exercises have not been independently execution-tested by Certbie.
A repeatable 45-minute study session
- Spend five minutes answering a small set of questions without notes. Mark guesses.
- Spend ten minutes checking the weakest concept against current official documentation.
- Spend twenty minutes predicting, running, and observing one small lab change.
- Spend ten minutes explaining the result and writing a new scenario that changes one assumption.
Use your exam's current objective list to track coverage. These four exercises cover selected concepts, not an entire certification syllabus.
PROJECT 1
Kubernetes: diagnose a Service with no usable backends
Advanced infrastructure reference; use a disposable local cluster for this smaller exercise.
A Deployment is healthy, but its Service is not sending traffic to the Pods. Compare the Service selector with Pod labels, inspect EndpointSlices, and verify target ports before changing anything.
Check your reasoning: If the Service selector matches no Pods, would restarting a healthy container fix the routing relationship?
No. A restart does not correct a selector mismatch. Match the intended labels, then confirm that endpoints are populated and a client can reach the application. A populated endpoint list alone does not prove every network path works.
Read the official explanationWhat to put in your study notebook
Save the initial manifest, observed endpoints, corrected manifest, and client check. Explain one alternative cause, such as a wrong targetPort.
Open Kubernetes the Hard Way on GitHub →PROJECT 2
Azure: separate identity permissions from network access
Intermediate; some labs require an Azure subscription and incur charges.
Choose a storage or virtual networking exercise that matches a weak objective. Draw the user, resource, role assignment scope, and relevant network boundary before following the lab.
Check your reasoning: A user can manage a storage account. Does that alone establish that they can read its blob contents?
No. Management-plane permissions and blob data access are separate considerations. Verify the authentication method, data role, scope, and network access instead of assuming that management access proves data access.
Read the official explanationWhat to put in your study notebook
Record the intended access, role scope, observed result, and reason for the permission choice. Remove lab resources and avoid publishing tokens or account keys.
Open Microsoft Azure Administrator labs on GitHub →PROJECT 3
AWS: explain retries before deploying an event workflow
Intermediate; reading is free, deployed services may be billable.
Select one queue-to-function pattern. Sketch its message path and examine what happens when processing fails after an external side effect has already completed.
Check your reasoning: Can a consumer assume that a standard SQS message will be delivered exactly once?
No. Standard queues provide at-least-once delivery. Design processing to tolerate duplicates; choose an appropriate idempotency approach and examine retry and dead-letter behavior for the selected integration.
Read the official explanationWhat to put in your study notebook
Write down a duplicate-message example and how your consumer avoids repeating the side effect. Record the permissions and cleanup instructions before deployment.
Open AWS Serverless Patterns on GitHub →PROJECT 4
Security: write a finding someone else can verify
Beginner to intermediate; run in an isolated local lab, never as a public production service.
Follow the project's local setup and select one documented beginner challenge. Record the preconditions, observed application behavior, and the boundary the application failed to enforce.
Check your reasoning: Is hiding an administrative button in the browser enough to enforce authorization?
No. The server must check authorization on the protected operation. A user interface can guide users, but it does not replace access checks. Describe how a server-side rule would be tested for both allowed and denied users.
Read the official explanationWhat to put in your study notebook
Produce a short report with reproduction steps, impact, recommended fix, and a retest plan. Keep activity inside systems you own or are authorized to test.
Open OWASP Juice Shop on GitHub →Keep an evidence log, not just a score
For each weak objective, record your prediction, what actually happened, the source that resolves the difference, and when you will retest it. A useful retest changes the environment or scenario so that you must apply the principle again.
Download the study worksheetRead each repository's license before reusing its code. These exercises link to the projects and do not reproduce their question banks or imply vendor affiliation.