Free 300-910 sample questions

Correct answers: Integrate a container vulnerability scanner (e.g., Snyk, Trivy) into the pipeline to scan images for known CVEs before they are pushed to the registry.; Enforce a policy where only the CI/CD service principal has write access to the production container registry.

Correct answer: False

This statement is false. While 'golden image' can refer to a VM template in a traditional infrastructure context, in the context of containerized application deployment for Kubernetes, it refers to a standardized, pre-configured base container image. This base image would be stored in a container registry (like Docker Hub or ECR) and would include common dependencies, security configurations, and monitoring agents required by the organization.

Correct answer: terraform plan

The `terraform plan` command is used specifically to create an execution plan. It compares the desired state defined in the Terraform configuration files with the actual state of the remote infrastructure and outputs the set of changes that will be made. This 'dry run' capability is essential for pre-check validation in a CI/CD pipeline, allowing for review and approval before any changes are applied with `terraform apply`.

Correct answer: Service

A Kubernetes Service provides a stable network abstraction layer for a set of pods. It creates a single, stable IP address and DNS name (e.g., my-service.default.svc.cluster.local) that other applications within the cluster can use to access the pods managed by the Deployment. The Service automatically handles load balancing across the pods, even as they are created or destroyed. An Ingress is for external access, a Pod is the workload itself, and a ConfigMap is for configuration data.

Correct answer: To verify that the application's circuit breakers, timeouts, and fallback mechanisms function correctly under degraded network conditions.

The primary goal of chaos engineering is to build confidence in the system's ability to withstand turbulent conditions in production. By injecting latency, the team is proactively testing whether the application's built-in resilience patterns (like timeouts, retries, and circuit breakers) behave as expected. This helps uncover hidden weaknesses before they cause a real-world outage.

Correct answer: Static Application Security Testing (SAST)

Static Application Security Testing (SAST) analyzes an application's source code, bytecode, or binary code for security vulnerabilities without executing the program. Because it works directly on the code, it can be integrated very early in the SDLC, such as upon a code commit or pull request, to find issues like SQL injection or buffer overflows before the application is even built. DAST requires a running application, IAST combines both, and penetration testing is typically a later-stage manual or automated process.

Correct answer: Jenkins

Jenkins is renowned for its massive plugin ecosystem, which allows for extensive customization and integration with virtually any tool. It is an open-source, self-hosted solution, which satisfies the security compliance requirement. Its long history has resulted in a very large and active community, providing ample support and resources. While Drone is also self-hosted, its plugin ecosystem is smaller. Travis CI is primarily a cloud-based SaaS offering.

Correct answer: A transitive dependency (a dependency of a dependency) requires a version of `urllib3` that conflicts with the explicitly defined version constraint.

This is a classic transitive dependency conflict. The `requests` library itself depends on `urllib3`. If version 2.25.1 of `requests` requires a version of `urllib3` that is outside the ` =1.25.4` range, `pip` will be unable to find a compatible set of packages, leading to a resolution error. This highlights the complexity of managing dependencies in modern applications.

Correct answer: present

In Ansible, the `state: present` parameter is used to ensure that a resource (like a VLAN, user, or package) exists. If the VLAN is not configured, Ansible will create it. If the VLAN already exists as defined, Ansible will report 'ok' and make no changes. This is the core of idempotency. The opposite is `state: absent`, which ensures the resource does not exist.

Correct answer: A Service Mesh (e.g., Istio or Linkerd)

A service mesh is a dedicated infrastructure layer for managing service-to-service communication. It provides features like mutual TLS (mTLS) for security, advanced traffic management (e.g., circuit breaking, retries) for performance and resilience, and detailed telemetry (metrics, logs, traces) for observability. While an API Gateway handles north-south (ingress) traffic, a service mesh is specifically designed to manage east-west traffic between microservices, making it the ideal choice for this scenario.