EMT Practice Test

1. Question Content...

---

Question1: A server is running low on disk space. What command can be used to check the disk usage of images, containers, and volumes for Docker engine?

Question2: The output of which command can be used to find the architecture and operating system an image is
compatible with?

Question3: You created a new service named 'http' and discover it is not registering as healthy. Will this command enable you to view the list of historical tasks for this service?
Solution: 'docker service inspect http'

Question4: Which flag for a service would allow a container to consume more than 2 GB of memory only when there is no memory contention but would also prevent a container from consuming more than 4GB of memory, in any case?

Question5: Does this command display all the pods in the cluster that are labeled as 'env: development'?
Solution: 'kubectl get pods -I env=development'

Question6: You want to provide a configuration file to a container at runtime. Does this set of Kubernetes tools and steps accomplish this?
Solution: Mount the configuration file directly into the appropriate pod and container using the .spec.containers.configMounts key.

Question7: Which of the following is supported by control groups?

Question8: Are these conditions sufficient for Kubernetes to dynamically provision a persistentVolume, assuming there are no limitations on the amount and type of available external storage?
Solution: A default provisioner is specified, and subsequently a persistentVolumeClaim is created.

Question9: Which command interactively monitors all container activity in the Docker engine?

Question10: Which one of the following commands will result in the volume being removed automatically once the container has exited?

Question11: Will this command ensure that overlay traffic between service tasks is encrypted?
Solution: docker service create --network --secure

Question12: A persistentVolumeClaim (PVC) is created with the specification storageClass: "", and size requirements that cannot be satisfied by any existing persistentVolume.
Is this an action Kubernetes takes in this situation?
Solution: The PVC remains unbound until a persistentVolume that matches all requirements of the PVC becomes available.

Question13: A docker service 'web' is running with a scale factor of 1 (replicas = 1).
Bob intends to use the command 'docker service update --replicas=3 web'.
Alice intends to use the command 'docker service scale web=3'.
How do the outcomes oft these two commands differ?

Question14: Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory?
Solution: seccomp

Question15: Is this a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used?
Solution: mnt

Question16: What is one way of directly transferring a Docker Image from one Docker host in another?

Question17: Is this a function of UCP?
Solution: scans images to detect any security vulnerability

Question18: You configure a local Docker engine to enforce content trust by setting the environment variable
DOCKER_CONTENT_TRUST=1.
If myorg/myimage: 1.0 is unsigned, does Docker block this command?
Solution: docker service create myorg/myimage:1.0

Question19: The Kubernetes yaml shown below describes a networkPolicy.

Will the networkPolicy BLOCK this traffic?
Solution: a request issued from a pod lacking the tier: api label, to a pod bearing the tier: backend label

Question20: What service mode is used to deploy a single task of a service to each node?

Question21: Can this set of commands identify the published port(s) for a container?
Solution: docker container inspect', 'docker port'

Question22: From a DevOps process standpoint, it is best practice to keep changes to an application in version control.
Which of the following will allow changes to a docker Image to be stored in a version control system?

Question23: You have created a Docker bridge network on a host with three containers attached, how do you make this containers accessible outside of the host?

Question24: You want to mount external storage to a particular filesystem path in a container in a Kubernetes pod. What is the correct set of objects to use for this?

Question25: Will this command list all nodes in a swarm cluster from the command line?
Solution: 'docker swarm nodes'

Question26: Will this command mount the host's '/data' directory to the ubuntu container in read-only mode?
Solution: 'docker run --volume /data:/mydata:ro ubuntu'

Question27: Is this a supported user authentication method for Universal Control Plane?
Solution: PAM

Question28: Which of the following is true about using the '-P' option when creating a new container?

Question29: Which of the following is NOT backed up when performing a Docker Trusted backup operation?

Question30: Which of the following commands will create a swarm service which only listens on port 53 using the UDP protocol?

Question31: You are troubleshooting a Kubernetes deployment called api, and want to see the events table for this object. Does this command display it?
Solution: kubectl logs deployment api

Question32: You set up an automatic pruning policy on a DTR repository to prune all images using Apache licenses. What effect does this have on images in this repository?

Question33: Which of the following commands starts a Redis container and configures it to always restart unless it is
explicitly stopped or Docker is restarted?

Question34: Does this command display all the pods in the cluster that are labeled as 'env: development'?
Solution: 'kubectl get pods --all-namespaces -I env=development'

Question35: Is this the purpose of Docker Content Trust?
Solution: Verify and encrypt Docker registry TLS.

Question36: An application image runs in multiple environments, with each environment using different certificates and ports.
Is this a way to provision configuration to containers at runtime?
Solution: Provision a Docker config object for each environment.

Question37: What is the docker command to setup a swarm?

Question38: Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory?
Solution: cgroups

Question39: When using the Docker client to push an image to a registry, what environment variable is used to instruct the client to perform signing of the image?

Question40: Will this command ensure that overlay traffic between service tasks is encrypted?
Solution: docker network create -d overlay -o encrypted=true <network-name>

Question41: You have deployed a service to swarm. Which command uses the Docker CLI to set the number of tasks of the services to 5? (choose 2)

Question42: Which 'docker run' flag lifts cgroup limitations?

Question43: Will this action upgrade Docker Engine CE to Docker Engine EE?
Solution: Manually download the 'docker-ee' package

Question44: A company's security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster.
Can this be used to schedule containers to meet the security policy requirements?
Solution: resource reservation

Question45: Which of the following constitutes a production-ready devicemapper configuration for the Docker engine?

Question46: Will this configuration achieve fault tolerance for managers in a swarm?
Solution: only two managers, one active and one passive.

Question47: Your organization has a centralized logging solution, such as Splunk.
Will this configure a Docker container to export container logs to the logging solution?
Solution: docker logs <container-id>

Question48: You created a new service named 'http' and discover it is not registering as healthy. Will this command enable you to view the list of historical tasks for this service?
Solution: 'docker inspect http'

Question49: In the context of a swarm mode cluster, does this describe a node?
Solution: an instance of the Docker engine participating in the swarm

Question50: One of several containers in a pod is marked as unhealthy after failing its livenessProbe many times. Is this the action taken by the orchestrator to fix the unhealthy container?
Solution: The controller managing the pod is autoscaled back to delete the unhealthy pod and alleviate load.

Question51: One of several containers in a pod is marked as unhealthy after failing its livenessProbe many times. Is this the action taken by the orchestrator to fix the unhealthy container?
Solution: Kubernetes automatically triggers a user-defined script to attempt to fix the unhealthy container.

Question52: Is this a function of UCP?
Solution: enforces the deployment of signed images to the cluster

Question53: You are pulling images from a Docker Trusted Registry installation configured to use self-signed certificates, and this error appears:
'x509: certificate signed by unknown authority'.
You already downloaded the Docker Trusted Registry certificate authority certificate from https://dtr.example.com/ca.
How do you trust it? (Select two.)

Question54: You configure a local Docker engine to enforce content trust by setting the environment variable
DOCKER_CONTENT_TRUST=1.
If myorg/myimage: 1.0 is unsigned, does Docker block this command?
Solution: docker image import <tarball> myorg/myimage:1.0

Question55: Which of the following commands is used to display system-wide Docker configuration on a host?

Question56: Will this sequence of steps completely delete an image from disk in the Docker Trusted Registry?
Solution: Delete the image and run garbage collection on the Docker Trusted Registry.

Question57: You are troubleshooting a Kubernetes deployment called api, and want to see the events table for this object. Does this command display it?
Solution: kubectl describe deployment api

Question58: Will this sequence of steps completely delete an image from disk in the Docker Trusted Registry?
Solution: Delete the image and delete the image repository from Docker Trusted Registry

Question59: You are troubleshooting a Kubernetes deployment called api, and want to see the events table for this object. Does this command display it?
Solution: kubectl events deployment api

Question60: Which set of commands can identify the publishd port(s) for a container? (Choose 1.)

Question61: A Kubernetes node is allocated a /26 CIDR block (64 unique IPs) for its address space.
If every pod on this node has exactly two containers in it, how many pods can this address space support on this node?

Question62: The Kubernetes yaml shown below describes a clusterIP service.

Is this a correct statement about how this service routes requests?
Solution: Traffic sent to the IP of this service on port 8080 will be routed to port 80 in a random pod with the label aPP: nginx.

Question63: A users attempts to set the system time from inside a Docker container are unsuccessful. Could this be blocking this operation?
Solution: Linux capabilities