Which feature is typically NOT offered as a core capability by a Service Mesh?

Container image vulnerability scanning.

Automatic mTLS encryption between services.

Fine-grained traffic routing (e.g., canary deployments, A/B testing).

Distributed tracing and observability metrics for inter-service communication.

Resiliency features like retries and timeouts.

What is the primary function of a StorageClass in Kubernetes?

To define different "classes" or types of storage for dynamic provisioning.

To directly provide storage to a Pod.

To claim a specific PersistentVolume for use.

To backup and restore data from PersistentVolumes.

To limit the amount of storage a namespace can consume.

How does declarative configuration, a common feature in container orchestration, improve system reliability compared to imperative commands?

It describes the desired state, allowing the orchestrator to continuously reconcile.

It allows users to specify the exact sequence of operations for desired outcomes.

It requires less YAML or JSON to define resources.

It automatically selects the most performant hardware.

What is the significance of the dockershim component being removed from Kubernetes starting from v1.24?

Kubernetes now directly uses container runtimes that implement CRI, like containerd.

Kubernetes no longer supports Docker-formatted container images.

Developers must use a different command-line tool instead of docker build.

All existing Docker containers must be rebuilt using a new OCI tool.

Pods can no longer run multiple containers.

When a NetworkPolicy in Kubernetes selects a Pod, what does it primarily control?

The ingress and egress network traffic for that Pod at L3/L4.

The Pod's ability to access external services outside the cluster.

The amount of network bandwidth the Pod can consume.

The DNS resolution behavior for the Pod.

The encryption of data in transit for the Pod.

What is the primary mechanism for service discovery within a Kubernetes cluster for applications running in Pods?

Kubernetes DNS (e.g., CoreDNS) resolving Service names to ClusterIPs.

Manually configuring IP addresses in application code.

Using NodePort services and node IPs.

Broadcasting service availability via UDP multicast.

Relying on a Service Mesh sidecar proxy.

If a company wants to implement zero-trust security for inter-service communication within their Kubernetes cluster, what would a Service Mesh primarily contribute?

Providing automatic mutual TLS (mTLS) between all services in the mesh.

Encrypting persistent data at rest.

Enforcing strong authentication and authorization for kubectl users.

Scanning Pods for known vulnerabilities.

Managing firewall rules at the cluster's edge.

The Container Storage Interface (CSI) was developed to address what challenge in Kubernetes storage?

To enable third-party storage vendors to develop plugins without modifying core Kubernetes code.

To provide a standard for defining StorageClass parameters.

To improve the performance of hostPath volumes.

To automate the backup and restore of PersistentVolumes.

To define how containers should access configuration data.

Which of these is NOT a typical benefit of using a container orchestrator for managing applications?

Automatic conversion of monolithic applications to microservices.

Improved resource utilization through bin packing.

Simplified application code logic for handling infrastructure failures.

Abstracted underlying infrastructure differences.

Enhanced scalability and availability of applications.

What is a key characteristic of runc, often used by higher-level runtimes like containerd?

It's a low-level OCI runtime responsible for spawning and running containers.

It's a full-fledged container orchestrator.

It provides a command-line tool for building OCI-compliant images.

It's a CNI plugin for configuring Pod networking.

It's a distributed key-value store for container metadata.

What is the primary purpose of Secrets in Kubernetes, and how are they typically made available to Pods?

To store sensitive data (e.g., passwords, tokens); as environment variables or volume mounts.

To store arbitrary non-sensitive configuration; as environment variables or files.

To define network policies; applied directly by kubelet.

To store TLS certificates for Ingress; only used by Ingress controllers.

To store container image pull credentials; only used by kubelet.

An Ingress resource in Kubernetes provides what type of functionality?

Management of external HTTP/S access to services, with host/path based routing.

L4 TCP/UDP load balancing for internal services.

Network isolation between Pods within the same namespace.

Dynamic provisioning of persistent storage for web servers.

A CNI plugin implementation for advanced networking features.

In the context of a Service Mesh, what does "traffic splitting" commonly refer to?

Routing a percentage of traffic to different versions of a service (e.g., for canary).

Dividing network bandwidth equally among all services.

Encrypting only a portion of the traffic between services.

Splitting large data packets into smaller frames for transmission.

Blocking traffic from specific IP address ranges.

What is a key security implication of running containers as a non-root user?

It reduces the potential impact if the container process is compromised.

It prevents containers from accessing network resources.

It allows containers to bypass RBAC checks for API access.

It disables the container runtime's ability to pull images from private registries.

It encrypts all data written by the container to its filesystem.

What is the typical interaction flow when kubelet needs to start a Pod using a CRI-compliant runtime?

kubelet sends a request to the CRI gRPC server implemented by the runtime.

kubelet directly calls runc to create the container.

kubelet updates etcd, and the runtime reads the changes.

kubelet instructs kube-proxy to prepare the network for the runtime.

kubelet uses kubectl commands to tell the runtime what to do.

In Kubernetes, what is the purpose of an EndpointSlice object in relation to a Service?

To efficiently track and provide the IP addresses and ports of Pods backing a Service.

To define the external IP address for a LoadBalancer Service.

To store the DNS configuration for a Service.

To enforce network policies for traffic destined to a Service.

To manage TLS termination for a Service.

Which component of a Service Mesh architecture is typically injected as a sidecar container into application Pods?

The data plane proxy (e.g., Envoy, Linkerd2-proxy).

The control plane's central policy manager.

The certificate authority for issuing mTLS certificates.

The metrics collection and aggregation server.

The UI dashboard for visualizing mesh topology.

A StatefulSet requires stable, unique network identifiers for its Pods. How is this typically achieved in Kubernetes?

Through a headless Service that creates DNS records for each Pod.

By manually assigning static IP addresses to each Pod.

Using hostNetwork: true for all Pods in the StatefulSet.

By relying on CNI plugins to assign predictable IPs from a predefined range.

By using NetworkPolicy to restrict Pod IPs.

When using dynamic provisioning for Kubernetes storage, what happens if a PersistentVolumeClaim requests a StorageClass that does not exist?

The PVC remains in a Pending state indefinitely or until the class is created.

Kubernetes automatically creates a default StorageClass and uses it.

The Pod attempting to use the PVC will fail to start with a network error.

The PVC will use any available PersistentVolume regardless of its StorageClass.

The request defaults to using hostPath storage on the assigned node.

What is the primary benefit of using orchestration for rolling updates compared to manual, script-based updates?

Automated health checks, progressive rollout, and easier rollback capabilities.

Faster individual container restart times.

Guaranteed zero cost for update operations.

Elimination of the need for container image registries.

In-place binary patching of running application code.

What is a key difference between containerd and Docker Engine in the context of Kubernetes (post-dockershim removal)?

Docker Engine includes build tools and a CLI; containerd is a core runtime.

containerd cannot run Docker-formatted images; Docker Engine can.

containerd is not OCI compliant; Docker Engine is.

Docker Engine implements CRI directly; containerd requires a shim.

containerd is only for Linux; Docker Engine is cross-platform.

How does Role-Based Access Control (RBAC) in Kubernetes contribute to the principle of least privilege?

By allowing administrators to grant users/ServiceAccounts only necessary permissions.

By encrypting all API communication by default.

By ensuring all Pods run with minimal resource requests and limits.

By automatically rotating credentials for ServiceAccounts.

By restricting network access between namespaces.

What is the concept of a "control plane" in a Service Mesh architecture?

The central components that manage and configure the data plane proxies.

The set of sidecar proxies running alongside application containers.

The application code responsible for handling business logic.

The underlying Kubernetes cluster nodes.

The network infrastructure connecting the cluster to the internet.

If a PersistentVolume is reclaimed using the Delete reclaim policy, what happens to the underlying storage when the associated PersistentVolumeClaim is deleted?

The data on the underlying storage medium is deleted.

The storage is archived and can be restored later.

The PersistentVolume object is deleted, but the data on the storage medium remains.

The PersistentVolume becomes available for another PersistentVolumeClaim.

The storage is automatically resized to its minimum capacity.

A PodSecurityContext can be used to define security settings that apply to:

All containers within a Pod, and potentially the Pod's volumes.

All Pods within a specific Namespace.

A specific container within a Pod.

Only the network policies associated with a Pod.

The ServiceAccount used by the Pod.

What is a key benefit of using the Container Runtime Interface (CRI) from Kubernetes' perspective?

It allows Kubernetes to be independent of specific container runtime implementations.

It simplifies the container image building process for developers.

It provides a built-in metrics collection system for containers.

It enables running virtual machines alongside containers within the same Pod.

It standardizes the format for container log messages.

What is the main difference between iptables and IPVS modes for kube-proxy?

iptables uses linked lists for rules; IPVS uses hash tables, often better for scale.

iptables mode is newer and supports more advanced features.

IPVS is designed for smaller clusters; iptables for larger ones.

IPVS mode does not require kube-proxy to run on worker nodes.

iptables mode can only handle HTTP traffic; IPVS handles all TCP/UDP.

When would you typically choose a Service Mesh over just using Kubernetes NetworkPolicies for securing inter-Pod communication?

When you require application-layer (L7) traffic management, mTLS, and observability.

When you need basic L3/L4 firewalling based on Pod labels.

When you need to expose services externally using an Ingress controller.

When you want to restrict a Pod's access to host resources.

When the primary concern is node-to-node encryption.

How does a VolumeSnapshot object in Kubernetes relate to a PersistentVolumeClaim?

It's a request to create a point-in-time copy of the data in a PVC.

It defines the maximum size a PVC can grow to.

It's a type of PVC that uses ephemeral local storage.

It specifies the encryption key to be used for a PVC.

It provides a template for creating multiple identical PVCs.

Which Kubernetes security mechanism would you use to prevent containers in a Pod from running as the root user or gaining new privileges?

SecurityContext (e.g., runAsNonRoot: true, allowPrivilegeEscalation: false)

Secret storing user credentials.

LimitRange defining CPU limits.

What is the primary advantage of a "headless" Service in Kubernetes?

It allows direct Pod IP discovery via DNS, often used with StatefulSets.

It provides a stable ClusterIP for load balancing.

It automatically creates an external load balancer for the Service.

It encrypts all traffic to the Pods it selects.

It exposes Pods on every node using a fixed NodePort.

In a Service Mesh, what is the typical role of the "data plane"?

To actually handle and proxy network traffic between services (e.g., using sidecars).

To define global policies and configurations for service communication.

To collect telemetry data and send it to a centralized monitoring system.

To provide a user interface for managing and visualizing the mesh.

To manage the lifecycle of service instances (deploy, scale, heal).

What does the accessModes field (e.g., ReadWriteOnce, ReadOnlyMany, ReadWriteMany) on a PersistentVolume signify?

How the volume can be mounted by nodes and Pods.

The speed of the underlying storage (e.g., SSD vs. HDD).

The encryption status of the volume.

The backup policy for the volume.

The geographical region where the storage is located.

What differentiates a PodSecurityPolicy (deprecated) or its successor (Pod Security Admission) from a NetworkPolicy?

PodSecurityPolicy defines what a Pod can do (e.g., host access, privileges); NetworkPolicy defines network connectivity.

PodSecurityPolicy controls network access; NetworkPolicy controls Pod privileges.

Both control the same aspects but at different scopes (namespace vs. cluster).

NetworkPolicy is implemented by CNI; PodSecurityPolicy by the runtime.

PodSecurityPolicy is for ingress; NetworkPolicy is for egress.

How does Kubernetes DNS enable service discovery for a Service named my-svc in namespace my-ns from another Pod in the same namespace?

The Pod queries for my-svc.my-ns.svc.cluster.local.

The Pod queries for the ClusterIP of my-svc directly.

kube-proxy injects the IP of my-svc into the Pod's /etc/hosts.

Pods cannot discover services in the same namespace via DNS.

What is the primary purpose of the volumeMode field (e.g., Filesystem, Block) in a PersistentVolume and PersistentVolumeClaim?

To determine if the volume should be presented as a mounted filesystem or a raw block device.

To specify whether the volume should be encrypted.

To indicate if the volume supports snapshots.

To define the accessModes allowed for the volume.

To set the default permissions for files created on the volume.

If a container image specifies a USER instruction, but the Pod's SecurityContext also defines runAsUser, which value typically takes precedence?

The runAsUser from the Pod's SecurityContext.

The USER instruction in the Dockerfile.

Neither; the container will run as root by default.

The values are merged, leading to an error.

The kubelet decides based on node configuration.

One of the challenges in early container adoption was managing many containers across many hosts. What core capability did orchestrators bring to solve this directly?

Automated cluster-wide scheduling and resource management.

Standardization of container image formats.

Tools for building smaller container images.

Secure private container image registries.

set 3 Quiz

1.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

What is a primary motivation for adopting container orchestration beyond simply running containers with a runtime like containerd?

To achieve higher density of containers on a single host.

To automate deployment, scaling, healing, and networking of distributed applications.

To simplify the process of building container images from source code.

To provide a standardized container image format for portability.

To enforce strict kernel isolation between containers.

Answer explanation

While runtimes manage container lifecycle on a single host, orchestration automates complex tasks across a cluster of hosts, such as declarative deployments, auto-scaling based on load, self-healing of failed instances, service discovery, and load balancing.

2.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

The Container Runtime Interface (CRI) in Kubernetes serves what key purpose?

To define the standard for container image formats.

To provide an API for kubelet to interact with different container runtimes.

To manage network plugin configurations (CNI).

To enforce security policies for container execution.

To schedule containers onto nodes.

Answer explanation

CRI is a plugin interface enabling kubelet to use various container runtimes (like containerd, CRI-O) without recompiling Kubernetes. It standardizes communication for operations like starting/stopping Pods and containers.

3.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

In Kubernetes RBAC, what is the difference between a Role and a ClusterRole?

Role grants permissions to users, ClusterRole to ServiceAccounts.

Role is for read-only access, ClusterRole for write access.

Role is namespaced, ClusterRole is cluster-wide.

Role defines permissions, ClusterRole binds permissions to subjects.

Role is for built-in components, ClusterRole for custom resources.

Answer explanation

Role objects define permissions within a specific namespace, while ClusterRole objects define permissions that apply cluster-wide (e.g., to access nodes, persistent volumes, or resources across all namespaces).

4.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

Which Kubernetes networking component is responsible for ensuring that traffic sent to a Service's IP address is correctly routed to one of its backing Pods?

CNI plugin

kube-dns / CoreDNS

kube-proxy

Ingress controller

The API server's endpoint controller.

Answer explanation

kube-proxy runs on each node and maintains network rules (e.g., using iptables, IPVS) that implement Kubernetes Services. It watches the API server for Service and EndpointSlice changes and updates these rules accordingly.

5.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

What fundamental problem does a Service Mesh aim to solve for microservices that is not inherently addressed by basic Kubernetes Services?

Providing stable IP addresses for Pods.

Exposing services to external traffic via HTTP/S routing.

Adding advanced observability, security (mTLS), and traffic control between services.

Managing persistent storage for stateful applications.

Automating the build and deployment of container images.

Answer explanation

While Kubernetes Services provide basic L4 load balancing and service discovery, a Service Mesh (like Istio, Linkerd) adds a dedicated infrastructure layer for L7 concerns like fine-grained traffic management (canary, retries), mutual TLS (mTLS) between services, and detailed telemetry (metrics, traces).

6.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

What is the role of a PersistentVolumeClaim (PVC) in Kubernetes storage?

It defines a specific type of storage backend (e.g., SSD, HDD).

It represents a piece of provisioned storage available in the cluster.

It is a request for storage by a user/Pod, consuming a PersistentVolume.

It directly attaches a node's local disk to a Pod.

It manages the lifecycle of storage snapshots.

Answer explanation

A PVC is a request for storage by a user. It consumes an existing PersistentVolume (PV) or can dynamically provision one if a StorageClass is configured. Pods then mount the PVC as a volume.

7.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

How does container orchestration typically facilitate "self-healing" for applications?

By automatically applying security patches to container images.

By using AI to predict and prevent application failures.

By monitoring application health and automatically restarting or replacing failed instances.

By providing detailed debugging tools for developers to fix application bugs faster.

By load balancing traffic away from nodes with high CPU usage.

Answer explanation

Orchestrators monitor the health of application instances (e.g., Pods). If an instance fails a health check or crashes, the orchestrator can automatically restart it or replace it with a new instance to maintain the desired state and availability.

8.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

Which of these is a direct responsibility of an OCI-compliant container runtime like containerd?

Scheduling containers across a cluster of machines.

Managing the lifecycle of containers on a single host (create, start, stop, delete).

Defining the desired state of application deployments.

Providing inter-service authentication using mTLS.

Allocating persistent storage volumes from cloud providers.

Answer explanation

Container runtimes like containerd are responsible for managing the complete container lifecycle on a single node, including pulling images, creating, starting, stopping, and deleting containers as instructed by a higher-level component like the kubelet.

9.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

What is the primary purpose of a ServiceAccount in Kubernetes security?

To provide an identity for human users to log into the cluster.

To define permissions for accessing Kubernetes API resources.

To provide a distinct identity for processes running inside Pods to interact with the API.

To securely store API tokens and certificates for external services.

To encrypt network traffic between Pods.

Answer explanation

ServiceAccounts are meant for processes within Pods, giving them an identity that can be authenticated by the API server and authorized via RBAC to perform specific actions. Human users typically use regular user accounts or external identity providers.

10.

MULTIPLE CHOICE QUESTION

1 min • 1 pt

What role does the Container Network Interface (CNI) play in Kubernetes networking?

It defines the API for how kube-proxy implements Services.

It provides a specification for writing plugins to configure network interfaces for Pods.

It manages DNS resolution for Services and Pods within the cluster.

It enforces network policies to restrict traffic flow between Pods.

It provides a secure tunnel for control plane communication.

Answer explanation

CNI is a specification and a set of libraries for writing plugins to configure network interfaces in Linux containers. In Kubernetes, CNI plugins are responsible for connecting Pods to the cluster network and assigning IP addresses.

set 3

50 questions

What is a primary motivation for adopting container orchestration beyond simply running containers with a runtime like containerd?

While runtimes manage container lifecycle on a single host, orchestration automates complex tasks across a cluster of hosts, such as declarative deployments, auto-scaling based on load, self-healing of failed instances, service discovery, and load balancing.

The Container Runtime Interface (CRI) in Kubernetes serves what key purpose?

CRI is a plugin interface enabling kubelet to use various container runtimes (like containerd, CRI-O) without recompiling Kubernetes. It standardizes communication for operations like starting/stopping Pods and containers.

In Kubernetes RBAC, what is the difference between a Role and a ClusterRole?

Role objects define permissions within a specific namespace, while ClusterRole objects define permissions that apply cluster-wide (e.g., to access nodes, persistent volumes, or resources across all namespaces).

Which Kubernetes networking component is responsible for ensuring that traffic sent to a Service's IP address is correctly routed to one of its backing Pods?

kube-proxy runs on each node and maintains network rules (e.g., using iptables, IPVS) that implement Kubernetes Services. It watches the API server for Service and EndpointSlice changes and updates these rules accordingly.

What fundamental problem does a Service Mesh aim to solve for microservices that is not inherently addressed by basic Kubernetes Services?

What is the role of a PersistentVolumeClaim (PVC) in Kubernetes storage?

A PVC is a request for storage by a user. It consumes an existing PersistentVolume (PV) or can dynamically provision one if a StorageClass is configured. Pods then mount the PVC as a volume.

How does container orchestration typically facilitate "self-healing" for applications?

Orchestrators monitor the health of application instances (e.g., Pods). If an instance fails a health check or crashes, the orchestrator can automatically restart it or replace it with a new instance to maintain the desired state and availability.

Which of these is a direct responsibility of an OCI-compliant container runtime like containerd?

Container runtimes like containerd are responsible for managing the complete container lifecycle on a single node, including pulling images, creating, starting, stopping, and deleting containers as instructed by a higher-level component like the kubelet.

What is the primary purpose of a ServiceAccount in Kubernetes security?

ServiceAccounts are meant for processes within Pods, giving them an identity that can be authenticated by the API server and authorized via RBAC to perform specific actions. Human users typically use regular user accounts or external identity providers.

What role does the Container Network Interface (CNI) play in Kubernetes networking?

CNI is a specification and a set of libraries for writing plugins to configure network interfaces in Linux containers. In Kubernetes, CNI plugins are responsible for connecting Pods to the cluster network and assigning IP addresses.

Create a free account and access millions of resources

Similar Resources on Wayground

Popular Resources on Wayground

Discover more resources for Computers