Troubleshoot Container Deployment, Registry, and Trusted CA Errors VCAP-VCF-VKS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A container application needs to connect to multiple external services, each using a certificate signed by a different private CA. The container image is built with a trust store that contains only one of the CA certificates. The application fails to connect to the service that uses the other CA. What is the best solution?

   • AUse a different container image for each service.
   • BReplace the existing CA certificate with the missing one.
   • CConfigure the application to skip TLS verification for the failing service.
   • DAdd all required CA certificates to the container image's trust store.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A container in a Kubernetes cluster fails to start because it cannot connect to an external service over TLS. The error log shows: x509: certificate signed by unknown authority. The external service uses a certificate issued by an internal corporate CA. Which configuration change is required?

   • ARestart the container with the --insecure flag.
   • BAdd the corporate CA certificate to the container image's trust store.
   • CConfigure the container runtime to skip TLS verification for all connections.
   • DSet the KUBECONFIG environment variable to point to the CA certificate.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company uses a private registry that requires client certificates for authentication. The registry is configured with a CA to validate client certificates. A developer is unable to push an image, and the registry logs show: client certificate authentication failed. The developer has a valid client certificate. What is the most likely cause?

   • AThe client certificate is not trusted by the registry's CA.
   • BThe developer is using the wrong username and password.
   • CThe registry's certificate is not trusted by the developer's machine.
   • DThe developer's client certificate is expired.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A container runtime reports 'x509: certificate signed by unknown authority'. What is the most likely fix?

   • AAdd the CA certificate to the trust store
   • BChange the registry credentials
   • CRestart the container runtime
   • DUse a different image tag
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A container deployment fails with an ImagePullBackOff error. The kubelet logs show: failed to pull image: rpc error: code = Unknown desc = failed to resolve reference: failed to do request: unexpected status code 404 Not Found. The image tag is correct and the registry is accessible. What is the most likely cause?

   • AThe image pull secret is incorrect.
   • BThe registry's certificate is not trusted.
   • CThe image does not exist in the registry.
   • DThe nodes do not have network access to the registry.
   Reveal Solution Discussion Select an answer first