Containers and Orchestration Questions and Answers

Answer: A

Termination waits for readiness so that capacity is never lost during the update. A readiness probe that always passes defeats the protection entirely. Capacity is preserved throughout. Old pods wait for the new to be ready.

Answer: B

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason gives the dependency. A rolling update advances only as new pods report ready, so the readiness probe is what stops a broken version from replacing a working one. A probe that returns success unconditionally - a bare TCP check on a port the framework opens before it can serve, for instance - lets the rollout proceed through every replica and take the service down.

Answer: C

A privileged container has essentially the access of the host and undoes the isolation entirely. The other three are three of the standard hardening measures. Privilege undoes the isolation. Hardening is layered rather than single.

Answer: D

Root in the container maps to a privileged context that makes an escape considerably more damaging. Running as an unprivileged user, or using user namespaces, is standard practice. Namespaces are not a security boundary alone.

Answer: A

Images are pushed to it and pulled from it by the nodes that run them. Access control and vulnerability scanning at the registry are part of a supply chain security posture. Nodes pull from it. The registry is part of the supply chain.

Answer: B

Correct answer: 1 and 2 only

Statements 1 and 2 are sound practice: scanning catches known vulnerabilities before deployment, and pinning to an immutable digest guarantees that the same bytes are deployed every time. Statement 3 is the misconception the second addresses - a tag is a mutable pointer, and latest in particular is whatever was pushed most recently, so the same manifest can yield different images on different days.

Answer: C

Both are true and the reason gives the risk, and reproducibility of a deployment depends entirely on the reference identifying one image and only one. Tags may be repointed. Reproducibility requires an exact reference.

Answer: D

Resource requests, node selectors, taints and affinity rules all enter the filtering stage. Scoring then prefers among the feasible nodes on spread and utilisation. Filtering comes before scoring. Requests and constraints both enter the first stage.

Answer: A

Correct answer: True

The scheduler places pods according to their declared requests, so a pod requesting nothing appears to fit anywhere. It will be scheduled onto a node with little real capacity left, and then contends with its neighbours for CPU and memory - and under memory pressure a pod with no request is the first candidate for eviction. Requests are how the scheduler is told what the workload actually needs.