Exam Bundle

A system diagram distinguishes a container runtime sharing the host kernel from a VM running a separate guest operating system. That observed result would support another specific correction: Explain that containers isolate processes using host operating-system kernel mechanisms while virtual machines typically run guest kernels. The other scenario concerns: A trainee claims a container is a fully separate hardware virtual machine with its own guest kernel. The current Brookside Manufacturing problem is: An operator expects deleting a local developer image cache to remove deployed images from every Kubernetes worker. The evidence required here is: The registry retains the release artifact and running nodes continue using their pulled image after a local cache cleanup.

The container starts successfully in a restricted network where external dependency repositories are unreachable. That observed result would support another specific correction: Package predictable application runtime dependencies into the approved image and make startup independent of arbitrary downloads. The other scenario concerns: A project fetches dependencies during startup because its image contains only a minimal launcher and fails when the repository is offline. The current Brookside Manufacturing problem is: An operator expects deleting a local developer image cache to remove deployed images from every Kubernetes worker. The evidence required here is: The registry retains the release artifact and running nodes continue using their pulled image after a local cache cleanup.

The application retrieves its persisted data after the original Pod is removed and a replacement starts. That observed result would support another specific correction: Use a suitable mounted persistent storage volume or external durable data service for data that must survive container replacement. The other scenario concerns: An application writes important customer data only inside its container writable layer and loses the data after Pod recreation. The current Brookside Manufacturing problem is: An operator expects deleting a local developer image cache to remove deployed images from every Kubernetes worker. The evidence required here is: The registry retains the release artifact and running nodes continue using their pulled image after a local cache cleanup.

Bake required dependencies into a versioned image and treat production containers as replaceable instances. That choice addresses a different foundational issue: An app build installs packages at container startup and each new replica unpredictably differs from the previous one. The issue at Juniper Media is instead: An operator expects deleting a local developer image cache to remove deployed images from every Kubernetes worker. It does not establish the required correction; the decisive verification would be: The registry retains the release artifact and running nodes continue using their pulled image after a local cache cleanup.

Package predictable application runtime dependencies into the approved image and make startup independent of arbitrary downloads. That choice addresses a different foundational issue: A project fetches dependencies during startup because its image contains only a minimal launcher and fails when the repository is offline. The issue at Juniper Media is instead: An operator expects deleting a local developer image cache to remove deployed images from every Kubernetes worker. It does not establish the required correction; the decisive verification would be: The registry retains the release artifact and running nodes continue using their pulled image after a local cache cleanup.

Apply approved registry policy, provenance or signature verification, and vulnerability assessment during image delivery. That choice addresses a different foundational issue: A team uses the image name alone to decide whether a container is trustworthy and ignores unverified registries and tags. The issue at Juniper Media is instead: An operator expects deleting a local developer image cache to remove deployed images from every Kubernetes worker. It does not establish the required correction; the decisive verification would be: The registry retains the release artifact and running nodes continue using their pulled image after a local cache cleanup.

Every newly created Pod identifies the intended digest and no replica silently pulls a different build. That observed result would support another specific correction: Pin the image to a specific digest or controlled immutable release tag and verify its provenance. The other scenario concerns: A deployment relies on the mutable latest tag and different nodes start different application builds during a rollout. The current Juniper Media problem is: An operator expects deleting a local developer image cache to remove deployed images from every Kubernetes worker. The evidence required here is: The registry retains the release artifact and running nodes continue using their pulled image after a local cache cleanup.

Only artifacts from approved sources with validated provenance are admitted to the production environment. That observed result would support another specific correction: Apply approved registry policy, provenance or signature verification, and vulnerability assessment during image delivery. The other scenario concerns: A team uses the image name alone to decide whether a container is trustworthy and ignores unverified registries and tags. The current Juniper Media problem is: An operator expects deleting a local developer image cache to remove deployed images from every Kubernetes worker. The evidence required here is: The registry retains the release artifact and running nodes continue using their pulled image after a local cache cleanup.

Inspecting the built image and layer metadata reveals no usable credentials, while authorized Pods obtain runtime secrets. That observed result would support another specific correction: Provide secrets at runtime through secured mechanisms rather than embedding them in image instructions or layers. The other scenario concerns: A build author places database passwords in a Dockerfile environment instruction that is retained in image layers. The current Juniper Media problem is: An operator expects deleting a local developer image cache to remove deployed images from every Kubernetes worker. The evidence required here is: The registry retains the release artifact and running nodes continue using their pulled image after a local cache cleanup.

Apply an ingress policy selecting the database Pods with the minimum permitted client sources and ports. That choice addresses a different foundational issue: A security team intends to limit inbound access to a database but writes only an egress NetworkPolicy for its namespace. The issue at Highland Education is instead: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. It does not establish the required correction; the decisive verification would be: The client continues to connect after the selected Pod is recreated with a different address.

Use a Service DNS name or the correct cross-Pod network address instead of the client's loopback interface. That choice addresses a different foundational issue: A developer uses localhost to contact a database Pod running separately from the client Pod. The issue at Highland Education is instead: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. It does not establish the required correction; the decisive verification would be: The client continues to connect after the selected Pod is recreated with a different address.

Explain the Kubernetes Pod networking model in which reachable Pod addresses connect across nodes through the cluster network. That choice addresses a different foundational issue: A cluster design assumes every Pod communicates through NAT using a unique host port and can never contact other Pod IPs directly. The issue at Highland Education is instead: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. It does not establish the required correction; the decisive verification would be: The client continues to connect after the selected Pod is recreated with a different address.

The service's EndpointSlices contain only the desired backend addresses and client traffic flows again. That observed result would support another specific correction: Restore a valid Service selector or explicitly manage EndpointSlices when a selectorless Service is intentional. The other scenario concerns: A team removes all Service selectors expecting the cluster to automatically discover arbitrary backend Pods anyway. The current Highland Education problem is: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. The evidence required here is: The client continues to connect after the selected Pod is recreated with a different address.

The client resolves and reaches the Service in the target namespace without relying on an ambiguous short name. That observed result would support another specific correction: Use the appropriate namespace-qualified Service DNS name or configure the intended discovery context. The other scenario concerns: An application in one namespace queries a short Service name that exists only in a different namespace and gets a lookup failure. The current Highland Education problem is: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. The evidence required here is: The client continues to connect after the selected Pod is recreated with a different address.

The DNS response provides records for the relevant endpoints rather than one normal Service virtual IP. That observed result would support another specific correction: Explain that a headless Service omits the virtual ClusterIP and exposes endpoint-oriented DNS discovery behavior. The other scenario concerns: A cluster operator expects a headless Service to allocate a stable virtual ClusterIP and load-balance traffic across all endpoints. The current Highland Education problem is: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. The evidence required here is: The client continues to connect after the selected Pod is recreated with a different address.

Explain that a headless Service omits the virtual ClusterIP and exposes endpoint-oriented DNS discovery behavior. That choice addresses a different foundational issue: A cluster operator expects a headless Service to allocate a stable virtual ClusterIP and load-balance traffic across all endpoints. The issue at Eastshore Energy is instead: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. It does not establish the required correction; the decisive verification would be: The client continues to connect after the selected Pod is recreated with a different address.

Differentiate NodePort access on node addresses from a LoadBalancer Service that requests provider integration where available. That choice addresses a different foundational issue: A developer believes NodePort automatically allocates a dedicated public load balancer in the cloud provider account. The issue at Eastshore Energy is instead: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. It does not establish the required correction; the decisive verification would be: The client continues to connect after the selected Pod is recreated with a different address.

Use localhost for communication between containers that share a Pod network namespace. That choice addresses a different foundational issue: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. The issue at Eastshore Energy is instead: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. It does not establish the required correction; the decisive verification would be: The client continues to connect after the selected Pod is recreated with a different address.

A controlled blocked-flow test proves the policy is enforced by the configured network plugin. That observed result would support another specific correction: Verify that the installed network implementation enforces NetworkPolicy before relying on default-deny rules. The other scenario concerns: A platform team configures a NetworkPolicy but assumes it automatically denies traffic in a cluster without a policy-aware CNI plugin. The current Eastshore Energy problem is: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. The evidence required here is: The client continues to connect after the selected Pod is recreated with a different address.

The service's EndpointSlices contain only the desired backend addresses and client traffic flows again. That observed result would support another specific correction: Restore a valid Service selector or explicitly manage EndpointSlices when a selectorless Service is intentional. The other scenario concerns: A team removes all Service selectors expecting the cluster to automatically discover arbitrary backend Pods anyway. The current Eastshore Energy problem is: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. The evidence required here is: The client continues to connect after the selected Pod is recreated with a different address.

The application reaches the database through an appropriate Service while localhost remains limited to its own Pod. That observed result would support another specific correction: Use a Service DNS name or the correct cross-Pod network address instead of the client's loopback interface. The other scenario concerns: A developer uses localhost to contact a database Pod running separately from the client Pod. The current Eastshore Energy problem is: A Kubernetes beginner expects Pod IP addresses to remain stable across rescheduling and hard-codes one into a client configuration. The evidence required here is: The client continues to connect after the selected Pod is recreated with a different address.

Treat Service configuration as network discovery and traffic exposure, and use controllers and scheduling mechanisms for replicas. That choice addresses a different foundational issue: A team assumes a Service type changes Pod placement and autoscaling rather than influencing how clients access a workload. The issue at Maplewood Schools is instead: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. It does not establish the required correction; the decisive verification would be: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

Check selector labels and readiness conditions so the Service advertises only eligible endpoints. That choice addresses a different foundational issue: A Service has the correct selector but no healthy endpoints because the matching Pods are not ready. The issue at Maplewood Schools is instead: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. It does not establish the required correction; the decisive verification would be: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

Align the Service targetPort with the actual container listener and its named port where applicable. That choice addresses a different foundational issue: An engineer claims the Kubernetes Service is broken because DNS works but a backend application listens on a different port. The issue at Maplewood Schools is instead: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. It does not establish the required correction; the decisive verification would be: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

The DNS response provides records for the relevant endpoints rather than one normal Service virtual IP. That observed result would support another specific correction: Explain that a headless Service omits the virtual ClusterIP and exposes endpoint-oriented DNS discovery behavior. The other scenario concerns: A cluster operator expects a headless Service to allocate a stable virtual ClusterIP and load-balance traffic across all endpoints. The current Maplewood Schools problem is: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. The evidence required here is: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

The provider assigns or exposes the intended frontend and authorized external requests reach ready backend Pods. That observed result would support another specific correction: Use a LoadBalancer Service in a compatible environment and confirm the external address and access policy. The other scenario concerns: A cloud deployment requires a provider-managed external frontend but the service manifest still uses ClusterIP. The current Maplewood Schools problem is: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. The evidence required here is: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

Ready Pods appear in the endpoint set and client connections recover without routing to unready replicas. That observed result would support another specific correction: Check selector labels and readiness conditions so the Service advertises only eligible endpoints. The other scenario concerns: A Service has the correct selector but no healthy endpoints because the matching Pods are not ready. The current Maplewood Schools problem is: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. The evidence required here is: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

Install or select an appropriate Ingress controller and configure its routing rules with required policies. That choice addresses a different foundational issue: A developer creates an Ingress object and assumes it processes HTTP traffic even though the cluster has no Ingress controller. The issue at Brookside Manufacturing is instead: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. It does not establish the required correction; the decisive verification would be: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

Differentiate NodePort access on node addresses from a LoadBalancer Service that requests provider integration where available. That choice addresses a different foundational issue: A developer believes NodePort automatically allocates a dedicated public load balancer in the cloud provider account. The issue at Brookside Manufacturing is instead: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. It does not establish the required correction; the decisive verification would be: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

Check selector labels and readiness conditions so the Service advertises only eligible endpoints. That choice addresses a different foundational issue: A Service has the correct selector but no healthy endpoints because the matching Pods are not ready. The issue at Brookside Manufacturing is instead: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. It does not establish the required correction; the decisive verification would be: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

A Pod on one worker contacts a permitted Pod IP on another worker without inventing a host-port mapping for every workload. That observed result would support another specific correction: Explain the Kubernetes Pod networking model in which reachable Pod addresses connect across nodes through the cluster network. The other scenario concerns: A cluster design assumes every Pod communicates through NAT using a unique host port and can never contact other Pod IPs directly. The current Brookside Manufacturing problem is: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. The evidence required here is: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

The client resolves and reaches the Service in the target namespace without relying on an ambiguous short name. That observed result would support another specific correction: Use the appropriate namespace-qualified Service DNS name or configure the intended discovery context. The other scenario concerns: An application in one namespace queries a short Service name that exists only in a different namespace and gets a lookup failure. The current Brookside Manufacturing problem is: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. The evidence required here is: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.

In-cluster clients reach the ClusterIP while external access uses a deliberately configured entry point. That observed result would support another specific correction: Explain that ClusterIP provides cluster-internal reachability and select an explicitly authorized external exposure mechanism. The other scenario concerns: An operator creates a ClusterIP Service and expects a browser on the public internet to connect to it directly. The current Brookside Manufacturing problem is: Two containers in the same Pod use each other's Pod IP as though they live on separate network namespaces. The evidence required here is: The sidecar successfully reaches the application's loopback listener without using a separate inter-Pod route.