Troubleshoot Container Deployment, Registry, and Trusted CA Errors VCAP-VCF-VKS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Kubernetes cluster is unable to pull an image from a private registry. The registry is reachable, and the credentials are correct. The kubelet logs show: failed to resolve reference: failed to do request: unexpected status code 401 Unauthorized. What is the most likely cause?

   • AThe image tag is incorrect.
   • BThe nodes do not have internet access.
   • CThe image pull secret is not associated with the service account used by the pod.
   • DThe registry's certificate is not trusted by the nodes.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A container deployment fails with an error: failed to pull image: rpc error: code = Unknown desc = failed to resolve reference: failed to do request: x509: certificate relies on legacy Common Name field. The registry uses a certificate that is valid but relies on the Common Name for hostname verification. What is the best solution?

   • AUse the registry's IP address instead of the hostname in the image reference.
   • BAdd the registry's certificate to the node's trusted CA bundle.
   • CConfigure the container runtime to allow legacy Common Name verification.
   • DUpdate the registry's certificate to include the hostname in the Subject Alternative Name (SAN) field.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A Kubernetes cluster is configured to pull images from a private registry that uses a self-signed certificate. The CA certificate has been added to the nodes' trust store and the container runtime is configured to use it. However, a deployment fails with an x509 error. The registry is accessed via a hostname that resolves to a different IP address than the one in the certificate's SAN. What is the most likely cause?

   • AThe registry's IP address has changed.
   • BThe nodes do not have DNS resolution for the registry hostname.
   • CThe CA certificate is not trusted by the container runtime.
   • DThe certificate's SAN does not include the hostname used to access the registry.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A container image pull from a private registry fails with a timeout error. The registry is configured with a custom CA certificate that has been added to the nodes' trust store. The registry is accessible from the nodes via curl. What is the most likely cause?

   • AThe nodes do not have DNS resolution for the registry hostname.
   • BThe container runtime is not configured to use the custom CA certificate.
   • CThe image pull secret is incorrect.
   • DThe registry is overloaded and cannot handle the request.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A user receives an 'unauthorized' error when attempting to push an image to a private registry. What is the most likely cause?

   • AThe registry's certificate is untrusted
   • BThe user's credentials lack push permissions
   • CThe registry is not reachable from the network
   • DThe image tag is invalid
   Reveal Solution Discussion Select an answer first