Containers and Orchestration Questions and Answers

Q: Consider the following statements about container image provenance.1. Images should be scanned for known vulnerabilities before use.2. Pinning to a digest rather than a mutable tag improves reproducibility.3. A tag such as latest guarantees a specific image version.

Correct answer: 1 and 2 onlyStatements 1 and 2 are sound practice: scanning catches known vulnerabilities before deployment, and pinning to an immutable digest guarantees that the same bytes are deployed every time. Statement 3 is the misconception the second addresses - a tag is a mutable pointer, and latest in particular is whatever was pushed most recently, so the same manifest can yield different images on different days.

Q: State whether the following is true or false.A pod without resource requests may be scheduled onto a node that cannot actually run it well.

Correct answer: TrueThe scheduler places pods according to their declared requests, so a pod requesting nothing appears to fit anywhere. It will be scheduled onto a node with little real capacity left, and then contends with its neighbours for CPU and memory - and under memory pressure a pod with no request is the first candidate for eviction. Requests are how the scheduler is told what the workload actually needs.

21.

Arrange the stages of a rolling update in order.
1. new pods pass their readiness probes
2. the desired image in the Deployment is changed
3. old pods are terminated
4. the controller creates pods with the new image

A.2 - 4 - 1 - 3
B.3 - 1 - 4 - 2
C.4 - 2 - 1 - 3
D.2 - 1 - 4 - 3

Answer: A

Termination waits for readiness so that capacity is never lost during the update. A readiness probe that always passes defeats the protection entirely. Capacity is preserved throughout. Old pods wait for the new to be ready.

Discuss in Forum

22.

Assertion (A): A rolling update depends on the readiness probe being meaningful.
Reason (R): Old pods are removed only once new ones report ready, so a probe that always passes removes the protection.

A.A is false but R is true
B.Both A and R are true, and R is the correct explanation of A
C.Both A and R are true, but R is not the correct explanation of A
D.A is true but R is false

Answer: B

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason gives the dependency. A rolling update advances only as new pods report ready, so the readiness probe is what stops a broken version from replacing a working one. A probe that returns success unconditionally - a bare TCP check on a port the framework opens before it can serve, for instance - lets the rollout proceed through every replica and take the service down.

Discuss in Forum

23.

Three of the following are container security measures. Which is the odd one out?

A.scanning images for known vulnerabilities
B.dropping unnecessary Linux capabilities
C.running the container with full host privileges
D.running the process as a non-root user account

Answer: C

A privileged container has essentially the access of the host and undoes the isolation entirely. The other three are three of the standard hardening measures. Privilege undoes the isolation. Hardening is layered rather than single.

Discuss in Forum

24.

State whether the following is true or false.
Running a container as root inside the container is entirely safe because of namespace isolation.

A.True only at large scales
B.False only at small scales
C.True
D.False

Answer: D

Root in the container maps to a privileged context that makes an escape considerably more damaging. Running as an unprivileged user, or using user namespaces, is standard practice. Namespaces are not a security boundary alone.

Discuss in Forum

25.

A container registry stores

A.images and their layers
B.the running containers themselves
C.the state of the orchestrator
D.the log output of the workloads

Answer: A

Images are pushed to it and pulled from it by the nodes that run them. Access control and vulnerability scanning at the registry are part of a supply chain security posture. Nodes pull from it. The registry is part of the supply chain.

Discuss in Forum

26.

Consider the following statements about container image provenance.
1. Images should be scanned for known vulnerabilities before use.
2. Pinning to a digest rather than a mutable tag improves reproducibility.
3. A tag such as latest guarantees a specific image version.

A.All of them
B.1 and 2 only
C.3 only
D.1 only

Answer: B

Correct answer: 1 and 2 only

Statements 1 and 2 are sound practice: scanning catches known vulnerabilities before deployment, and pinning to an immutable digest guarantees that the same bytes are deployed every time. Statement 3 is the misconception the second addresses - a tag is a mutable pointer, and latest in particular is whatever was pushed most recently, so the same manifest can yield different images on different days.

Discuss in Forum

27.

Assertion (A): Deployments should pin images by digest rather than by a mutable tag.
Reason (R): A tag can be repointed at a different image without any change to the configuration.

A.A is true but R is false
B.A is false but R is true
C.Both A and R are true, and R is the correct explanation of A
D.Both A and R are true, but R is not the correct explanation of A

Answer: C

Both are true and the reason gives the risk, and reproducibility of a deployment depends entirely on the reference identifying one image and only one. Tags may be repointed. Reproducibility requires an exact reference.

Discuss in Forum

28.

The Kubernetes scheduler places a pod on a node by

A.choosing the first node alphabetically
B.choosing at random with no constraints
C.always using the least loaded node available
D.filtering nodes and scoring what remains

Answer: D

Resource requests, node selectors, taints and affinity rules all enter the filtering stage. Scoring then prefers among the feasible nodes on spread and utilisation. Filtering comes before scoring. Requests and constraints both enter the first stage.

Discuss in Forum

29.

State whether the following is true or false.
A pod without resource requests may be scheduled onto a node that cannot actually run it well.

A.True
B.False
C.True only at large scales
D.False only at small scales

Answer: A

Correct answer: True

The scheduler places pods according to their declared requests, so a pod requesting nothing appears to fit anywhere. It will be scheduled onto a node with little real capacity left, and then contends with its neighbours for CPU and memory - and under memory pressure a pod with no request is the first candidate for eviction. Requests are how the scheduler is told what the workload actually needs.

Discuss in Forum

Loading…

Topics

Other Subjects

Tags: Containers and Orchestration Questions and Answers || Containers and Orchestration MCQ Questions and Answers || Containers and Orchestration GK Questions and Answers || Containers and Orchestration GK MCQ Questions || Containers and Orchestration Multiple Choice Questions and Answers || Containers and Orchestration GK || GK on Containers and Orchestration || Cloud Computing Questions and Answers || Cloud Computing MCQ Questions and Answers || Cloud Computing GK Questions and Answers || GK on Cloud Computing

Containers and Orchestration Questions and Answers

Topics

Other Subjects

About Us

Stay informed about all important Dates & Notifications