Troubleshoot Container Deployment, Registry, and Trusted CA Errors VCAP-VCF-VKS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A container deployment is stuck in a CrashLoopBackOff state. The logs show: exec: "sh": executable file not found in $PATH. The container image was built on a Windows machine and pushed to a Linux-based registry. What is the most likely cause?

   • AThe container runtime does not have permission to execute the entrypoint.
   • BThe container image was built for the wrong operating system architecture.
   • CThe registry is not accessible from the nodes.
   • DThe image pull secret is missing.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A developer reports that a new container deployment fails with an ImagePullBackOff status. The cluster uses a private registry that was recently configured with a self-signed certificate. The kubelet logs show an x509: certificate signed by unknown authority error. Which action should you take to resolve the issue?

   • AConfigure the registry to use HTTP instead of HTTPS to bypass certificate validation.
   • BAdd the registry's CA certificate to the trusted CA bundle on each node and configure the container runtime to use it.
   • CRestart the kubelet on all nodes to refresh the certificate store.
   • DCreate a Kubernetes secret with the registry credentials and reference it in the deployment.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Kubernetes cluster is configured to pull images from a private registry that uses token-based authentication. The token expires every 12 hours. The deployment fails with an unauthorized error after the token expires. What is the best practice to handle this?

   • AConfigure the registry to issue long-lived tokens.
   • BDisable authentication on the registry.
   • CUse a Kubernetes image pull secret with the token and update it before expiration.
   • DUse a service account with an attached image pull secret that is automatically refreshed by an external controller.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A container application needs to connect to an external service over TLS. The external service uses a certificate signed by a public CA, but the container's trust store only contains a private CA certificate. The connection fails with an x509: certificate signed by unknown authority error. What is the best solution?

   • AAdd the public CA certificate to the container image's trust store.
   • BReplace the private CA certificate with the public CA certificate in the trust store.
   • CConfigure the application to skip TLS verification.
   • DUse the external service's IP address instead of its hostname.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevOps engineer is unable to push a container image to a private registry from a build server. The registry is accessible from the build server, and the engineer can log in successfully using docker login. However, the push fails with a denied: requested access to the resource is denied error. What is the most likely cause?

   • AThe build server's IP address is not allowlisted in the registry's firewall rules.
   • BThe user account used for the push does not have write permissions to the target repository.
   • CThe registry's certificate is not trusted by the build server.
   • DThe image tag does not include the registry hostname.
   Reveal Solution Discussion Select an answer first