Cloud-Native, Kubernetes & Container Internals

Answer key & explanations

Every question in this quiz, with the correct answer marked and an explanation of why it is right. Use it to revise before or after taking the quiz above.

1. 1.Which Linux kernel feature provides process isolation for containers (e.g., restricting what a process can see)?

   • AControl Groups (cgroups)
   • BNamespaces✓ Correct
   • CeBPF filters
   • DSwap memory partitions

   Correct answer: Namespaces

   Linux namespaces (PID, mount, network, IPC, UTS, user) isolate what a process can see, while cgroups limit how many resources (CPU, memory, I/O) it can consume.

2. 2.What is the difference between cgroups v1 and cgroups v2 in Linux container runtimes?

   • Acgroups v2 eliminates the concept of memory limits entirely
   • Bcgroups v2 provides a unified hierarchy, resolving resource controller conflicts and supporting rootless containers cleanly✓ Correct
   • Ccgroups v1 was implemented in user space, while v2 runs in the kernel
   • Dcgroups v2 is restricted to ARM64 server architectures

   Correct answer: cgroups v2 provides a unified hierarchy, resolving resource controller conflicts and supporting rootless containers cleanly

   cgroups v2 unifies resource management under a single hierarchy, eliminating cross-controller deadlocks, improving memory-pressure metrics, and supporting rootless cgroups.

3. 3.What role does the Container Runtime Interface (CRI) play in Kubernetes?

   • AIt standardizes network communication between distinct Pods
   • BIt defines a gRPC interface allowing the kubelet to interact with different container runtimes (like containerd or CRI-O)✓ Correct
   • CIt exposes Kubernetes REST endpoints to external developers
   • DIt manages persistent volume allocations across cloud providers

   Correct answer: It defines a gRPC interface allowing the kubelet to interact with different container runtimes (like containerd or CRI-O)

   The CRI is a gRPC specification enabling the kubelet to manage container lifecycles against various container runtimes (containerd, CRI-O) without modifying Kubernetes core code.

4. 4.In Kubernetes, which component is the sole stateful storage backend of the control plane?

   • Akube-scheduler
   • Bkube-controller-manager
   • Cetcd✓ Correct
   • Dkube-apiserver

   Correct answer: etcd

   etcd is a strongly consistent, distributed key-value store that acts as the single source of truth for all Kubernetes cluster state and specifications.

5. 5.What happens when a Pod's memory consumption exceeds its configured 'limits.memory' setting in Kubernetes?

   • AThe kernel throttles the Pod's CPU allocations down to zero
   • BThe Linux Out-Of-Memory (OOM) killer terminates a process within the container (OOMKilled, exit code 137)✓ Correct
   • CThe kubelet migrates the Pod live to an idle cluster node
   • DThe Pod automatically allocates swap memory from the host machine

   Correct answer: The Linux Out-Of-Memory (OOM) killer terminates a process within the container (OOMKilled, exit code 137)

   When memory usage breaches the cgroup limit, the Linux kernel triggers the OOM killer on that container, terminating the offending process and setting the Pod state to OOMKilled.

6. 6.How does an OverlayFS filesystem work inside standard container image layers?

   • AIt merges multiple read-only lower directories with a single read-write upper directory into a unified view✓ Correct
   • BIt writes all changes directly into the host machine's root partition without abstraction
   • CIt compresses container images into tarballs prior to running them
   • DIt loads container images completely into the host kernel's RAM

   Correct answer: It merges multiple read-only lower directories with a single read-write upper directory into a unified view

   OverlayFS uses stacked read-only layers (lowerdir) from the container image and presents a single writable layer (upperdir) on top using copy-on-write mechanics.

7. 7.What is the primary responsibility of kube-proxy in a Kubernetes node?

   • AManaging container volume attachments
   • BMaintaining network rules on nodes (via iptables or IPVS) to route Service clusterIP traffic to backend Pods✓ Correct
   • CScheduling pending Pods onto nodes with adequate resources
   • DVerifying TLS client certificates for incoming apiserver requests

   Correct answer: Maintaining network rules on nodes (via iptables or IPVS) to route Service clusterIP traffic to backend Pods

   kube-proxy watches the API server for Service and Endpoints objects and configures iptables, IPVS, or eBPF rules on the host to route service traffic to Pod IPs.

8. 8.What is the function of the Pause container inside every Kubernetes Pod?

   • ATo suspend the Pod during peak CPU load
   • BTo initialize and hold the shared network and IPC namespaces for all containers in the Pod✓ Correct
   • CTo collect log output and push it to fluentd
   • DTo check container image signatures against an external notary

   Correct answer: To initialize and hold the shared network and IPC namespaces for all containers in the Pod

   The Pause container starts first to set up the network, IPC, and UTS namespaces; all other containers in the Pod join these shared namespaces, allowing them to communicate over localhost.

9. 9.What does a Kubernetes Mutating Admission Webhook accomplish during an API request lifecycle?

   • AIt evaluates whether the user's token possesses valid cluster admin roles
   • BIt inspects and potentially modifies an object payload before schema validation and storage in etcd✓ Correct
   • CIt encrypts the payload at rest inside the etcd storage volume
   • DIt formats the terminal output of kubectl commands

   Correct answer: It inspects and potentially modifies an object payload before schema validation and storage in etcd

   Mutating admission webhooks run before validating webhooks and etcd persistence, allowing admission controllers (like Istio sidecar injectors) to mutate resource definitions dynamically.

10. 10.How does the Container Network Interface (CNI) integrate with Kubernetes?

    • AIt runs as a daemon inside etcd to monitor DNS queries
    • BIt provides binary plugins called by the runtime to allocate IP addresses and wire network interfaces into Pod namespaces✓ Correct
    • CIt configures physical network switches across data centers using BGP
    • DIt translates IPv6 packets to IPv4 across public cloud gateways

    Correct answer: It provides binary plugins called by the runtime to allocate IP addresses and wire network interfaces into Pod namespaces

    When a Pod sandbox is created, the container runtime invokes the configured CNI plugin (e.g., Calico, Cilium) to set up virtual Ethernet interfaces, configure routing, and assign an IP.

11. 11.What is the difference between an Ingress controller and a NodePort service in Kubernetes?

    • ANodePort operates at Layer 7 with path-based routing; Ingress is strictly Layer 4
    • BNodePort exposes a high static port on every cluster node; Ingress acts as an intelligent Layer 7 reverse proxy routing to Services✓ Correct
    • CNodePort requires a cloud load balancer; Ingress does not
    • DNodePort can only expose pods running on the master node

    Correct answer: NodePort exposes a high static port on every cluster node; Ingress acts as an intelligent Layer 7 reverse proxy routing to Services

    NodePort exposes a Service across a dedicated high-range port (30000-32767) on all node IPs (Layer 4), whereas an Ingress controller provides Layer 7 reverse-proxying, SSL termination, and path routing.

12. 12.What does a PodDisruptionBudget (PDB) enforce in a Kubernetes cluster?

    • AThe maximum financial cloud billing cost allowed for a deployment
    • BThe minimum number or percentage of Pod replicas that must remain available during voluntary disruptions (like node drains)✓ Correct
    • CThe maximum CPU usage permitted across all worker nodes
    • DThe duration a node will wait before evicting pods when it becomes unreachable

    Correct answer: The minimum number or percentage of Pod replicas that must remain available during voluntary disruptions (like node drains)

    A PDB limits the number of concurrently disrupted Pods during planned cluster administrative maintenance (like node upgrades and kubectl drain), preventing accidental application downtime.

13. 13.What mechanism does Cilium use to bypass iptables overhead for high-performance Kubernetes networking?

    • ARaw UDP packet wrapping
    • BExtended Berkeley Packet Filter (eBPF)✓ Correct
    • CHardware-accelerated InfiniBand switches
    • DKernel-bypass DPDK drivers

    Correct answer: Extended Berkeley Packet Filter (eBPF)

    Cilium leverages eBPF inside the Linux kernel to attach programs directly to network sockets and interfaces, routing packets efficiently without traversing complex iptables rule chains.

14. 14.In Kubernetes scheduling, what distinguishes a 'Taint' from an 'Affinity'?

    • ATaints repel Pods from nodes unless the Pod possesses a matching toleration; affinities attract Pods to nodes✓ Correct
    • BTaints are applied to Pods; affinities are applied to namespaces
    • CTaints dictate storage mounts; affinities dictate network bandwidth
    • DTaints can only be applied to master control-plane nodes

    Correct answer: Taints repel Pods from nodes unless the Pod possesses a matching toleration; affinities attract Pods to nodes

    Taints are applied to nodes to repel Pods that do not explicitly tolerate the taint, whereas Node Affinity rules attract Pods to nodes matching specified label conditions.

15. 15.What happens if the kube-scheduler crashes in a production Kubernetes cluster?

    • AAll currently running Pods immediately shut down
    • BExisting Pods continue executing normally, but newly created Pods remain in a 'Pending' state✓ Correct
    • CThe cluster loses all persistent volume attachments
    • Detcd deletes the cluster configuration after a five-minute timeout

    Correct answer: Existing Pods continue executing normally, but newly created Pods remain in a 'Pending' state

    The scheduler is only involved in assigning unbound Pods to nodes; if it fails, existing running Pods continue unaffected, but newly requested Pods remain unscheduled in 'Pending'.

16. 16.Why is rootless container execution recommended in modern container security?

    • AIt increases container networking speeds by bypassing TCP handshakes
    • BIt ensures that if an attacker escapes the container, they only have unprivileged user access on the host✓ Correct
    • CIt allows containers to run without compiling Linux kernel drivers
    • DIt removes the need to use Dockerfiles to build container images

    Correct answer: It ensures that if an attacker escapes the container, they only have unprivileged user access on the host

    Rootless containers map the container's root user (UID 0) to a non-privileged UID on the host via user namespaces, preventing container escape exploits from gaining full host root privileges.

More free quizzes

• ITDistributed Systems: Consensus & Fault ToleranceDeep dive into distributed systems engineering, covering consensus protocols (Raft/Paxos), the CAP theorem, and vector clocks.16 questions
• ITLLM Engineering: Fine-Tuning, Alignment & ServingTest your knowledge of transformer architectures, PEFT techniques (LoRA), RLHF, vLLM, and production deployment strategies.16 questions
• ITApplied AI: Systems, Embeddings & RAGAssess your understanding of practical machine learning architectures, embedding spaces, and Retrieval-Augmented Generation systems.16 questions