CKA Container Fundamentals 4

Question 1

Which Kubernetes resource defines the minimum and maximum CPU/memory a container can use?

Accepted Answer

Pod's resources.requests and resources.limits fields

Answer

Each container in a Pod spec has a resources field with requests (scheduling guarantee) and limits (hard cap) for CPU and memory.

Question 2

What is the difference between a container image tag and a digest?

Accepted Answer

Tags are mutable pointers that can be reassigned; digests are immutable content-addressable hashes

Answer

An image tag like 'latest' can be reassigned to a new image, while a digest (sha256:...) uniquely and immutably identifies a specific image manifest.

Question 3

What Linux capability is required for a container to bind to a port below 1024?

Accepted Answer

CAP_NET_BIND_SERVICE

Answer

CAP_NET_BIND_SERVICE allows a process to bind to privileged ports (below 1024) without running as root, and must be added explicitly for containers needing this ability.

Question 4

In Kubernetes, what is an init container and when does it run?

Accepted Answer

A container that runs to completion before app containers start, used for setup tasks

Answer

Init containers run sequentially to completion before any app containers start, making them ideal for setup tasks like downloading configs or waiting for dependencies.

Question 5

What does the securityContext.runAsNonRoot: true field enforce in a Kubernetes Pod?

Accepted Answer

Kubernetes will reject or fail the container if it attempts to run as UID 0

Answer

runAsNonRoot: true causes the kubelet to validate that the container's process does not run as UID 0 and will fail to start the container if it does.

(CKA) Certified Kubernetes Associate Practice Test

(CKA) Certified Kubernetes Associate Practice Test

CKA Container Fundamentals 4