Final Mastery Quiz

This is the capstone quiz for the DevOps Learning Labs. It covers all tracks: Docker, Kubernetes, Helm, multi-region, sidecars, GitOps with Flux, observability, security, and troubleshooting. It is designed to be challenging — expect scenario-based questions, multi-select answers, and fill-in-the-blank facts from the labs.

---

Docker & Containerization

#

In a multi-stage Dockerfile, which of the following are true?

The final image only contains layers copied from the last stage.

All build tools used in earlier stages remain in the final image unless you run apk del.

It can significantly reduce the final image size.

It requires the scratch base image to work.

Submit

Multi-stage builds let you compile or install in one stage and copy only the artifacts into a smaller runtime stage.

#

What is the primary purpose of docker build --cache-from?

To force a fresh build without reusing layers

To use an existing image as a source for layer cache

To tag the image with a cache label

To compress the final image

#

A container that was running as PID 1 is stopped and its writable layer is discarded. This is an example of a container being .

Submit

---

Kubernetes Core & Workloads

#

Which Kubernetes controllers are best matched to these use cases?

A logging agent that must run on every node: DaemonSet

A replicated, stateless API: DaemonSet

A single-instance, ordered database: StatefulSet

A horizontally scalable, stateless web app: Deployment

Submit

StatefulSet provides stable network identity and persistent storage; DaemonSet runs one pod per node; Deployment is for stateless, interchangeable pods.

#

What happens during a rolling update when maxSurge: 1 and maxUnavailable: 0?

Kubernetes replaces all old pods at once

A new pod is created before an old pod is removed, keeping full capacity

At least one pod is always unavailable to speed up the update

The update is rejected because the two settings conflict

#

Fill in the missing field: the smallest schedulable unit in Kubernetes is a .

Submit

#

A pod is stuck in Pending for 5 minutes. Which commands help you diagnose why?

kubectl describe pod <name>

kubectl get events

helm rollback <release>

docker logs <container-id>

Submit

describe and events show scheduler and resource issues; helm rollback is for already-deployed releases; docker logs is not for Kubernetes pods.

---

Kubernetes Networking & Storage

#

Which Service types expose the application outside the cluster?

ClusterIP

NodePort

LoadBalancer

Headless Service with clusterIP: None

Submit

ClusterIP and headless services are internal-only.

#

Which objects are required for a Pod to use durable storage in Kubernetes?

PersistentVolume (PV)

PersistentVolumeClaim (PVC)

EmptyDir volume

ConfigMap

Submit

The PVC requests storage; the PV is the actual storage resource. EmptyDir is ephemeral.

#

In the FQDN my-svc.my-ns.svc.cluster.local, what is the first label my-svc?

The namespace

The service name

The cluster domain

The pod name

---

Helm

#

Which command is idempotent for installing or upgrading a Helm release?

helm install myapp ./chart

helm upgrade --install myapp ./chart

helm rollback myapp

helm lint myapp

#

In Helm, the file that defines default configuration values is .

Submit

#

Which statements about Helm chart dependencies are true?

Dependencies can be declared in Chart.yaml.

Dependencies must be copied into templates/.

helm dependency update downloads and packages sub-charts.

Helm cannot resolve dependencies from remote repositories.

Submit

---

Multi-Region & Advanced Patterns

#

You are running two Minikube clusters for east and west. How do you switch between them with kubectl?

kubectl use-context east

kubectl config use-context east

minikube switch east

kubectl set cluster east

#

A sidecar container in the same pod always shares which namespaces with the app container by default?

Network namespace

IPC and storage volumes (when configured)

Its own PID namespace

Its own UTS namespace

Submit

Containers in a pod share the network namespace by default; volumes and IPC are shared when declared.

#

What is a key trade-off of a multi-region Kubernetes deployment compared to a single-region one?

Higher complexity and cost for better availability and reduced latency

Simpler networking because cross-region latency is lower

No need for data replication because each region is independent

Single control plane is mandatory

---

GitOps & Flux

#

In a pull-based GitOps model such as Flux, which of these are true?

The cluster watches Git for desired state.

Manual kubectl changes can be detected and reverted.

A Jenkins pipeline must run helm upgrade after every push.

Git commit history provides an audit trail.

Submit

#

Which Flux controllers are matched to these responsibilities?

Fetches from Git: Source Controller

Reconciles Helm charts: Helm Controller

Builds container images: Kustomize Controller

Applies Kustomize overlays: Kustomize Controller

Submit

Flux does not build images; it only deploys them.

#

To roll back a Flux-managed HelmRelease to a previous state, the cleanest action is the offending commit.

Submit

#

What is the function of interval: 5m inside a HelmRelease?

How long the pod has to start before Kubernetes kills it

How often Flux re-reconciles the Helm release

The Helm chart version retention period

The maximum time a job is allowed to run

---

Observability

#

The three pillars of observability are , , and .

Submit

#

Which tool in the open-source observability stack is responsible for each task below?

Collect and store numeric time-series: Prometheus

Visualize dashboards: Grafana

Aggregate logs: Loki

Define NetworkPolicies: Grafana

Submit

#

A 99.9% SLO for a service means the error budget is roughly percent over the budget window.

Submit

---

Security & Operations

#

Which of these improve Kubernetes secret security from dev to production?

Using ConfigMap for all credentials

Enabling encryption at rest for etcd

Using Sealed Secrets or an external Vault

Storing secrets in plain YAML in a public Git repo

Submit

#

A NetworkPolicy that denies all ingress and egress until explicitly allowed is the foundation of a network model.

Submit

---

Troubleshooting & Scenarios

#

A pod is in CrashLoopBackOff. Which checks are in the correct order?

Scale to zero and back to one, then delete the node

Read pod logs → inspect kubectl describe events → verify image, config, and resources

Immediately rebuild the Docker image without checking logs

Delete the Deployment and recreate with a new name

#

Your API latency suddenly jumps from 50 ms to 2 s after a Helm chart update. What should you investigate first?

The new image tag, resource requests/limits, and readiness probe changes

The Git repository commit messages

The Grafana dashboard theme

The number of labels on each pod

#

A Helm release is failing with HelmRelease not ready in Flux. Which commands give the most useful next clues?

flux logs --level=error

kubectl describe helmrelease <name>

docker system prune -a

minikube delete

Submit

---

Wrap-up

Well done! Once you finish all questions above, the quiz plugin will show your score and save your progress. Review any missed questions by revisiting the relevant theory modules and labs.

Quiz Progress

• Answered: 0 / 0 (0%)
• Correct: 0 / 0 (0%) Reset