Select Two (Multi-Select) Questions

Containers are used exclusively

Why wrong: Immutable infrastructure can be implemented with VMs as well; containers are not a requirement.

Infrastructure is version-controlled and tested

Why wrong: While good practice, version control is not unique to immutable infrastructure.

Configuration updates are applied directly to running servers

Why wrong: This describes mutable infrastructure where changes are made in-place.

affinity: nodeAntiAffinity

Why wrong: Anti-affinity prevents scheduling on nodes, does not assign.

tolerations

Why wrong: Tolerations allow scheduling on tainted nodes but do not assign to a specific node.

podSelector

Why wrong: PodSelector is used for network policies or pod affinity, not node assignment.

ConfigMaps are automatically encrypted at rest

Why wrong: Incorrect. ConfigMaps are not automatically encrypted at rest; encryption must be configured separately, typically via etcd encryption.

ConfigMaps can hold binary data

Why wrong: Incorrect. ConfigMaps are designed for plaintext data; binary data should use Secrets or other mechanisms.

ConfigMaps are used to store sensitive configuration data

Why wrong: Incorrect. While ConfigMaps are indeed used for non-sensitive configuration data, this statement, though true, is not one of the two key operational characteristics being asked about in this question.

Monolithic architecture

Why wrong: Cloud-native favors microservices over monoliths.

Manual scaling

Why wrong: Cloud-native emphasizes automated scaling.

Long-lived virtual machines

Why wrong: Cloud-native prefers ephemeral containers over VMs.

Kyverno

Why wrong: Kyverno is a CNCF incubating project.

Knative

Why wrong: Knative is an incubating CNCF project.

ArgoCD

Why wrong: ArgoCD is a CNCF incubating project, not graduated.

Docker is an OCI runtime specification

Why wrong: Docker is a platform that uses OCI-compliant runtimes like containerd, but it is not itself a runtime spec.

OCI is governed by the Cloud Native Computing Foundation (CNCF)

Why wrong: OCI is a separate project under the Linux Foundation, not CNCF.

Container images include a full operating system kernel

Why wrong: Images share the host kernel.

Container images are immutable once built

Why wrong: Tags can be overwritten; images can be replaced.

Container images can only be built on Linux

Why wrong: Images can be built on Windows and macOS too.

Auto-scaling of pods based on CPU

Why wrong: Auto-scaling is not a service mesh feature; it's provided by HPA.

Service discovery

Why wrong: While service mesh can integrate with service discovery, it is not a primary feature; Kubernetes DNS already provides discovery.

Automatic database scaling

Why wrong: Service mesh does not manage databases.

Container image building

Why wrong: Image building is outside the scope of service mesh.

Load balancing of external requests

Why wrong: External load balancing is typically handled by an ingress or load balancer.

Grafana

Why wrong: Grafana is for visualization of metrics and logs.

Fluentd

Why wrong: Fluentd is for log collection.

Prometheus

Why wrong: Prometheus is for metrics.

They should include an error budget

Why wrong: Error budget is derived from SLO, but not a consideration when defining SLO; it's a consequence.

They should minimize infrastructure cost

Why wrong: Cost is not a primary factor in defining SLOs.

Loki

Why wrong: Loki is a log storage system, not an aggregator.

Prometheus

Why wrong: Prometheus is for metrics.

Jaeger

Why wrong: Jaeger is for tracing.

runc

Why wrong: runc is a low-level OCI runtime, not a CRI implementation.

rkt

Why wrong: rkt is discontinued and not CRI-compliant.

Use a single centralized logging solution to aggregate logs from all components.

Why wrong: Single point of failure; prefer highly available solutions.

Store all debug logs for a minimum of 90 days for compliance.

Why wrong: Debug logs are verbose; store selectively.

Disable leader election for monitoring components to reduce complexity.

Why wrong: Leader election prevents duplicate metrics in HA setups.

OCI is governed solely by Docker Inc.

Why wrong: OCI is a Linux Foundation project with multiple members.

OCI only applies to Linux containers

Why wrong: OCI standards are OS-agnostic.

Hardcoding credentials in the image

Why wrong: Credentials should be injected at runtime or using secrets management.

Running containers as root user

Why wrong: Running as root increases security risks; containers should run with least privilege.

Automatic scaling of pods based on CPU usage

Why wrong: Scaling is handled by HorizontalPodAutoscaler, not Helm.

Native integration with service mesh for traffic splitting

Why wrong: Service mesh integration is not a Helm feature.

Built-in support for canary deployments

Why wrong: Helm does not have built-in canary deployment; that requires additional tools like Argo Rollouts.

Jenkins

Why wrong: Jenkins is a CI/CD tool, not specifically GitOps.

Helm

Why wrong: Helm is a package manager for Kubernetes that deploys applications as pre-configured charts, but it lacks the continuous reconciliation loop that defines GitOps: Helm applies a chart once and does not automatically detect or correct drift between the cluster state and the desired state declared in Git. It is tempting because Helm charts are widely used to define Kubernetes resources, and teams often assume that storing a chart in a Git repository alone constitutes GitOps, whereas a true GitOps tool like Argo CD or Flux continuously synchronises the cluster with the repository.

Terraform

Why wrong: Terraform is an IaC tool, not specifically GitOps (though it can be used in a GitOps workflow).

Replaces the need for a CI/CD pipeline

Why wrong: Progressive delivery is part of the CD pipeline, not a replacement.

Eliminates the need for monitoring and alerting

Why wrong: Monitoring is still essential to detect issues during rollout.

Guarantees zero downtime

Why wrong: While canary releases can reduce downtime, they do not guarantee zero downtime.