A company's security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster. Can this be used to schedule containers to meet the security policy requirements? Solution: node taints
Correct Answer: B
Question 7
Are these conditions sufficient for Kubernetes to dynamically provision a persistentVolume, assuming there are no limitations on the amount and type of available external storage? Solution: A persistentVolumeClaim is created that specifies a pre-defined storageClass.
Correct Answer: A
= The conditions are sufficient for Kubernetes to dynamically provision a persistentVolume, because a storageClass defines the provisioner and parameters for creating a volume on-demand. A persistentVolumeClaim that specifies a storageClass triggers the dynamic provisioning process, and Kubernetes will automatically create and bind a persistentVolume that matches the request. This eliminates the need for manual intervention by cluster administrators to provision storage volumes. Reference: Dynamic Volume Provisioning | Kubernetes Persistent volumes and dynamic provisioning | Google Kubernetes Engine ... Dynamic Provisioning and Storage Classes in Kubernetes
Question 8
A company's security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster. Can this be used to schedule containers to meet the security policy requirements? Solution: label contraints
Correct Answer: A
Label constraints can be used to schedule containers to meet the security policy requirements. Label constraints allow you to specify which nodes a service can run on based on the labels assigned to the nodes1. For example, you can label the nodes that are intended for development with env=dev and the nodes that are intended for production with env=prod. Then, you can use the --constraint flag when creating a service to restrict it to run only on nodes with a certain label value. For example, docker service create --name dev-app --constraint 'node.labels.env == dev' ... will create a service that runs only on development nodes2. Similarly, docker service create --name prod-app --constraint 'node.labels.env == prod' ... will create a service that runsonly on production nodes3. This way, you can ensure that development and production containers are running on separate nodes in a given Swarm cluster. Reference: Add labels to swarm nodes Using placement constraints with Docker Swarm Multiple label placement constraints in docker swarm
Question 9
Which networking drivers allow you to enable multi-host network connectivity between containers?
Correct Answer: D
The networking drivers that allow you to enable multi-host network connectivity between containers are bridge, macvlan, ipvlan, and overlay. These drivers create networks that can span multiple Docker hosts, and therefore enable containers on different hosts to communicate with each other. The other drivers, such as host, user-defined, and none, create networks that are either isolated or limited to a single host. Here is a brief overview of each driver and how it supports multi-host networking: *bridge: The bridge driver creates a network that connects containers on the same host using a Linux bridge. However, it can also be used to create a network that connects containers across multiple hosts using an external key-value store, such as Consul, Etcd, or ZooKeeper. This feature is deprecated and not recommended, as it requires manual configuration and has some limitations. The preferred driver for multi-host networking is overlay1. *macvlan: The macvlan driver creates a network that assigns a MAC address to each container, making it appear as a physical device on the network. This allows the containers to communicate with other devices on the same network, regardless of the host they are running on. The macvlan driver can also use 802.1q trunking to create sub-interfaces and isolate traffic between different networks2. *ipvlan: The ipvlan driver creates a network that assigns an IP address to each container, making it appear as a logical device on the network. This allows the containers to communicate with other devices on the same network, regardless of the host they are running on. The ipvlan driver can also use different modes, such as l2, l3, or l3s, to control the routing and isolation of traffic between different networks3. *overlay: The overlay driver creates a network that connects multiple Docker daemons together using VXLAN tunnels. This allows the containers to communicate across different hosts, even if they are on different networks. The overlay driver also supports encryption, load balancing, and service discovery. The overlay driver is the default and recommended driver for multi-host networking, especially for Swarm services4. References: *Use bridge networks *Use macvlan networks *Use ipvlan networks *Use overlay networks
Question 10
Is this a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used? Solution: user
Correct Answer: A
Explanation The user namespace is a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. The user namespace allows the host system to map its own uid and gid to some different uid and gid for containers' processes. This improves the security of Docker by isolating the user and group ID number spaces, so that a process's user and group ID can be different inside and outside of a user namespace1. To enable the user namespace, the daemon must start with --userns-remap flag with a parameter that specifies base uid/gid2. All containers are run with the same mapping range according to /etc/subuid and /etc/subgid3. References: * Isolate containers with a user namespace * Using User Namespaces on Docker * Docker 1.10 Security Features, Part 3: User Namespace
