Docker and Kubernetes for Developers

An API listens on 127.0.0.1:3000 inside its container. The container starts successfully with `docker run -p 8080:3000 api`, and an HTTP request made inside the container succeeds, but a request to localhost:8080 on the Docker host fails.

Which change directly addresses the demonstrated problem?

• AAdd `EXPOSE 8080` to the Dockerfile and rebuild.
• BChange the publication to `-p 3000:8080`.
• CConfigure the API to listen on 0.0.0.0:3000.
• DRun the container with a user-defined bridge network.

A developer builds an image successfully and starts it with `-p 8080:3000`. Docker reports that the container is running, but the acceptance criteria require a successful response on the published port and all supplied smoke tests to pass.

Which checks provide necessary acceptance evidence beyond the successful build and running state? Select all that apply.

• Call the expected HTTP endpoint through host port 8080 and check its response.
• Confirm that the Dockerfile declares `EXPOSE 3000` before accepting the service.
• Execute the complete supplied smoke suite against the running application.
• Verify that Docker marks the image's declared ports as published in its metadata.

A clean workstation has application source and a Dockerfile but no application image or running container. The acceptance script requires the response from a published-port check to succeed before it launches the smoke suite.

Order the steps to produce acceptance evidence for the newly built application.

A Node application image is 1 GB and includes its compiler toolchain, local node_modules directory, and Git history. Its Dockerfile copies the entire repository before installing dependencies, so changing one source file reruns dependency installation.

Which changes address the observed problems without relying on skipped application tests? Select all that apply.

• Install dependencies before copying frequently changed application source.
• Keep the toolchain and remove its files in a separate final RUN instruction.
• Exclude local node_modules and Git history from the build context.
• Copy required runtime artifacts into a separate runtime build stage.

A baseline image is 900 MB. Candidate A is 610 MB and passes every provided test; candidate B is 560 MB but fails the PDF export test because a runtime library was omitted.

Which acceptance decision is justified by the size and test requirements?

• AAccept A; it exceeds the required reduction and preserves tested behavior.
• BAccept B; removing an optional library is a valid size optimization.
• CReject both; a 30% reduction requires an image smaller than 600 MB.
• DReject both; A retains about 68% of the baseline rather than at most 30%.

A Dockerfile downloads a 400 MB compiler in one RUN instruction and deletes it in a later RUN instruction. The final filesystem no longer shows the compiler, but the distributed image remains large.

The deletion does not recover those distributed bytes because the compiler remains stored in earlier ___.

A Compose project defines services named `app` and `db` on its default network. PostgreSQL listens on container port 5432 and is published as `15432:5432`; the app's connection string currently uses localhost:15432.

Which database address should the app container normally use?

• Alocalhost:5432
• Bdb:15432
• Chost.docker.internal:5432
• Ddb:5432

A Compose database stores its data in a named volume, and the app uses `depends_on: [db]`. On cold starts the app sometimes exits before the database accepts connections; the team also needs evidence that records survive database-container recreation.

Which actions directly strengthen startup reliability or establish persistence evidence? Select all that apply.

• Add connection retries with bounded backoff to the application.
• Rely on the existing short-form depends_on to wait for SQL readiness.
• Insert a record, recreate the database container with its volume retained, and read it.
• Add a meaningful database healthcheck and use a service_healthy dependency.

A database uses a non-external named volume declared in compose.yaml. A developer proposes testing container recreation by running `docker compose down -v` followed by `docker compose up`.

Assertion: This procedure should preserve the existing database records because the storage uses a named volume. Reason: The `-v` option removes named volumes declared by the Compose project, except external volumes.

• ABoth A and R are true and R is the correct explanation of A
• BBoth A and R are true but R is NOT the correct explanation of A
• CA is true but R is false
• DA is false but R is true

An image runs as root, contains an API key copied into an earlier layer, and has a critical OS vulnerability with a patched package available. The API key has already been pushed to a shared registry.

Which actions address these findings rather than merely hiding them? Select all that apply.

• Rotate the exposed key and rebuild without embedding its replacement.
• Delete the key in a final RUN instruction and keep using its current value.
• Configure a non-root runtime user and grant only required filesystem access.
• Update the vulnerable component, rebuild, and confirm the finding is resolved.

Four hardening checks reveal a UID 10001 process unable to write uploads, a revoked credential still present in image history, a fixable critical library embedded in the application binary, and a scanner report generated before the latest rebuild.

Match each finding to the most directly relevant corrective action.

A developer switches to a minimal image and removes its package manager. The supplied scanner still reports a critical vulnerability in an installed TLS library and identifies a fixed version.

What is the strongest next step before declaring the image compliant?

• ASuppress the finding because the container cannot install additional packages.
• BRebuild with the patched library, rerun tests, and scan the release digest.
• CAccept the finding because a minimal base image has a smaller attack surface.
• DDisable the library's command-line tools while retaining the same library.

A Deployment has three Ready Pods labeled `app: catalog`. A ClusterIP Service selects `app: shop`; an in-cluster test client resolves the Service name but cannot reach the application.

Which change addresses the demonstrated routing defect?

• ASet the Service selector to `app: catalog`.
• BRestart the Pods so the Service rediscovers their endpoints.
• CChange the Service type from ClusterIP to NodePort.
• DSet the Service port equal to the application's containerPort.

An API must run three replicas, listen inside each Pod on 8080, and be reachable through a Service on port 80. Its Pods carry the label `app: inventory`, and their readiness check can fail while the process remains running.

Match each intended outcome to the manifest setting or evidence that directly establishes it.

kubectl apply succeeds for a Deployment and Service. The acceptance criteria require three ready replicas and a successful HTTP response from a test client running in the same namespace.

Which observations directly support those acceptance criteria? Select all that apply.

• The API server returned created or configured for both manifests.
• The Deployment reports three ready replicas from the intended workload.
• The Service has an allocated ClusterIP address.
• The test client receives the expected response through the Service.

A Deployment reads a feature flag from a ConfigMap environment variable and a password from a Secret environment variable. A teammate proposes committing the Secret manifest because its data field contains base64 rather than plain text.

Which conclusions are justified? Select all that apply.

• The encoded password remains sensitive and should not be committed in that form.
• Changing either API object does not update these variables in existing processes.
• Secret environment variables are encrypted inside the application's process memory.
• Consumption checks should prove use without printing the password into CI logs.

A ConfigMap-backed environment variable was changed, but an existing Deployment's containers still report the previous value. The Pod template has not changed, and the team wants kubectl to replace the Pods without changing the replica count.

The kubectl operation `kubectl ___ deployment/catalog` initiates this replacement.

A team injects a database password through a Secret reference rather than embedding it in a Deployment manifest. A developer claims that this choice automatically makes storing the base64 Secret manifest in Git safe.

Assertion: Using a Secret reference keeps the literal password out of the Deployment manifest. Reason: Kubernetes Secret data encoded with base64 is encrypted and therefore safe to commit.

• ABoth A and R are true and R is the correct explanation of A
• BBoth A and R are true but R is NOT the correct explanation of A
• CA is true but R is false
• DA is false but R is true

An API needs 90 seconds to initialize, sometimes loses a required dependency after startup, and can deadlock while its process stays alive. The team also wants existing in-flight requests to finish when a Pod is terminated.

Match each condition to the mechanism that most directly addresses it.

A controlled test makes a Pod's readiness endpoint fail while its liveness endpoint continues succeeding. The Pod stays Running, its restart count remains unchanged, and after endpoint propagation it receives no new requests through a normal Service.

How should the team interpret this result?

• ALiveness is ineffective because an unready container should always restart.
• BReadiness has not taken effect because the Pod's phase is still Running.
• CReadiness has triggered a restart that is waiting for the liveness threshold.
• DReadiness is working; traffic eligibility and container restart are separate.

An application takes up to two minutes to initialize. It has a startup probe with an adequate budget plus separate readiness and liveness probes.

Assertion: Liveness failures cannot restart the container while its startup probe is still pending within its allowed budget. Reason: When configured, a startup probe must succeed before Kubernetes begins liveness and readiness probing.

• ABoth A and R are true and R is the correct explanation of A
• BBoth A and R are true but R is NOT the correct explanation of A
• CA is true but R is false
• DA is false but R is true

A database Pod mounts a bound PVC at /mnt/data, but the database configuration writes its files to /var/lib/database. After deleting and recreating only the Pod, the test records are gone even though the original PVC still exists.

Which correction most directly addresses the observed loss?

• AChange the volume's reclaim policy from Delete to Retain.
• BMount the PVC at the actual data directory or configure the database to use it.
• CReplace the PVC with an emptyDir mounted at /var/lib/database.
• DSet the container's workingDir to /mnt/data so database writes use the volume.

A single-replica database uses a PVC mounted at its configured data directory. The team must demonstrate persistence across Pod replacement without accidentally testing deletion of the storage itself.

Which steps or conclusions are appropriate? Select all that apply.

• Record a test row, delete only the Pod, and read that row from its replacement.
• Delete the PVC as well, since a bound volume always survives claim deletion.
• Confirm that the replacement uses the same claim and the intended data directory.
• Treat a Bound PVC as sufficient evidence that the application stored its records there.

A database writes to /var/lib/postgresql/data, but a PVC is attached at /backup and receives no database writes. The developer wants to correct the container's volumeMount entry rather than change the database's data directory.

The volumeMount field that must be changed to /var/lib/postgresql/data is ___.

Each application Pod requests 200m CPU, has a 1000m CPU limit, and currently consumes 150m. An HPA targets 60% average CPU utilization, and its metrics are available.

Which interpretations are correct for this CPU utilization target? Select all that apply.

• The measured utilization is 15%, because the CPU limit is the denominator.
• The measured utilization is 75%, relative to the CPU request.
• Sustained measurements can recommend scale-out even below the CPU limit.
• Changing CPU requests can change scaling behavior without changing actual CPU use.

During a load test, engineers observe CPU throttling near a container's CPU limit, OOMKilled restarts near its memory limit, Pending replicas with Insufficient cpu events, and delayed scale-in after traffic drops despite low CPU measurements.

Match each observation to its most directly relevant interpretation.

An HPA uses averageUtilization for CPU, and each Pod contains one application container. Metrics are available and CPU limits are set, but the controller reports that CPU utilization cannot be calculated because a required resource setting is missing.

The missing denominator for this utilization calculation is the container's ___.

A stateless API Deployment retains revision history and uses readiness probes. The team is planning a rollback exercise and a separate continuous-request test during its next rolling update.

Assertion: A rollout undo can restore the previous retained Deployment Pod template. Reason: Readiness probes help keep unready replacement Pods out of normal Service traffic during a rollout.

• ABoth A and R are true and R is the correct explanation of A
• BBoth A and R are true but R is NOT the correct explanation of A
• CA is true but R is false
• DA is false but R is true

A three-replica HTTP API must undergo a rolling update with no failed requests under the supplied workload. The cluster has spare capacity, and the application supports readiness reporting and graceful shutdown.

Which measures directly support the goal or establish that it was achieved? Select all that apply.

• Use maxUnavailable: 0 and a positive maxSurge with meaningful readiness checks.
• Treat successful rollout status as proof that every client request succeeded.
• Allow in-flight requests to drain within an adequate termination grace period.
• Run the supplied continuous workload and record its failures across the update.

A completed update to v2 failed application acceptance, and revision 4 is the recorded v1 target. The exercise requires validating the rollback target before issuing the rollback, then waiting for completion before running restored-version acceptance checks.

Order the rollback procedure.

Four diagnostic observations are available: image-pull events report manifest unknown, startup logs reject an invalid DATABASE_URL, a Service has no EndpointSlice addresses and mismatched selectors, and a reachable Pod listens on 8080 while its Service targets 9090.

Match each observation to the root cause best supported by the evidence.

An application Pod repeatedly enters CrashLoopBackOff. Its current logs contain only the beginning of a new startup, while the last terminated container exited with code 1 after a configuration change.

Which next action most directly retrieves evidence about the previous failed application execution?

• ARun kubectl describe pod to retrieve the terminated application's error output.
• BRun kubectl get events to retrieve the application's last logged exception.
• CRun kubectl logs for the application container with --previous.
• DRun kubectl logs with --since=1h to include earlier container instances.

A Pod remains in ImagePullBackOff, and events report registry authentication failure. A valid registry credential Secret already exists in the Pod's namespace, but neither the Pod nor its ServiceAccount references it.

To attach that registry credential directly in the Pod specification, add its Secret name under ___.

A pipeline tests commit A, builds an image, pushes it as latest, applies a Deployment that still references latest, and immediately reports success. Another build can overwrite latest before the test namespace pulls the image.

Which changes close the artifact-identity or verification gaps? Select all that apply.

• Resolve the published image digest and deploy that exact digest.
• Use imagePullPolicy: Always as the complete immutability guarantee.
• Wait for rollout readiness and then run application smoke tests in the test environment.
• Record the mapping from tested commit to image digest and deployment.

CI deploys a new digest to namespace test-a. The next step runs `kubectl rollout status deployment/api` without a namespace; its current context points to default, where an older api Deployment is healthy.

Which correction makes the readiness gate verify the intended deployment?

• AAdd a longer timeout to the existing rollout status command.
• BRun rollout status with --namespace=test-a and fail the job if it does not complete.
• CReplace rollout status with a successful kubectl apply exit-code check.
• DSet metadata.namespace to test-a in the manifest and leave the gate command unchanged.

A CI deployment uses an exact image digest and reaches three Ready replicas. Its smoke-test command then exits nonzero, but the shell step ends with `|| true`, leaving the workflow green.

Which changes or conclusions are justified? Select all that apply.

• Treat Ready replicas as sufficient evidence and remove the smoke-test stage.
• Propagate the smoke-test failure so this run cannot satisfy the deployment gate.
• Use `set -e` before the existing command so the trailing `|| true` cannot mask failure.
• Keep readiness and smoke tests because they establish different aspects of success.