Troubleshoot Container Deployment, Registry, and Trusted CA Errors VCAP-VCF-VKS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A container application fails to start because it cannot verify the TLS certificate of an internal service. The internal service uses a certificate signed by a private CA. The CA certificate has been added to the container image's trust store, but the error persists. What is the most likely cause?

   • AThe internal service is not reachable from the container.
   • BThe CA certificate is not in the correct format (e.g., PEM vs DER).
   • CThe container runtime is not using the image's trust store.
   • DThe internal service's certificate is expired.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company uses a private registry with a self-signed certificate. The registry is accessible from the nodes, and the CA certificate has been added to the nodes' trust store. However, container pulls still fail with an x509 error. The registry is accessed via a load balancer that terminates TLS and forwards traffic to the registry over HTTP. What is the most likely cause?

   • AThe registry's self-signed certificate is not trusted by the load balancer.
   • BThe load balancer's certificate is not trusted by the nodes.
   • CThe nodes are not configured to use the load balancer's DNS name.
   • DThe registry is not configured to support HTTPS.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A container application fails to connect to an internal service over TLS. The internal service uses a certificate signed by a private CA. The CA certificate has been added to the container image's trust store, but the error persists. The application is a Java application. What is the most likely cause?

   • AThe internal service's certificate is expired.
   • BThe container runtime is not using the image's trust store.
   • CThe Java application uses its own trust store (cacerts) and does not use the OS trust store.
   • DThe CA certificate is not in PEM format.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A container fails to pull an image because the registry's certificate is not trusted. What is the most likely cause?

   • AThe registry is not reachable
   • BThe registry's credentials are invalid
   • CThe image tag is incorrect
   • DThe registry's certificate is signed by an unknown CA
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A container deployment is stuck in a pending state. Which of the following is a common cause?

   • AThe node has insufficient memory to schedule the pod
   • BThe container runtime is misconfigured
   • CThe container image is missing from the local cache
   • DThe registry is unreachable
   Reveal Solution Discussion Select an answer first