Free 300-910 sample questions

Correct answer: Implementing a multi-stage build.

A multi-stage build is the ideal solution. It allows you to use one stage with a full JDK and Maven to compile the application and build the JAR file, and a second, final stage that starts from a minimal JRE base image and copies only the compiled application artifact. This ensures no build tools or intermediate files are present in the final image, directly addressing both security and size requirements.

Correct answer: Deploying a central HashiCorp Vault cluster and using the Vault Agent Injector to dynamically provide secrets to pods in both EKS and AKS.

HashiCorp Vault is a dedicated secrets management tool designed to be cloud-agnostic. By deploying a central Vault cluster, you create a single source of truth for secrets. The Vault Agent Injector can be deployed to both Kubernetes clusters, allowing pods to authenticate using their Kubernetes Service Account and receive secrets dynamically via a sidecar container. This approach is highly secure, centralized, and avoids vendor lock-in, making it the best choice for a multi-cloud scenario.

Correct answers: Integrate a container vulnerability scanner (e.g., Snyk, Trivy) into the pipeline to scan images for known CVEs before they are pushed to the registry.; Enforce a policy where only the CI/CD service principal has write access to the production container registry.

Correct answer: False

This statement is false. While 'golden image' can refer to a VM template in a traditional infrastructure context, in the context of containerized application deployment for Kubernetes, it refers to a standardized, pre-configured base container image. This base image would be stored in a container registry (like Docker Hub or ECR) and would include common dependencies, security configurations, and monitoring agents required by the organization.

Correct answer: terraform plan

The `terraform plan` command is used specifically to create an execution plan. It compares the desired state defined in the Terraform configuration files with the actual state of the remote infrastructure and outputs the set of changes that will be made. This 'dry run' capability is essential for pre-check validation in a CI/CD pipeline, allowing for review and approval before any changes are applied with `terraform apply`.

Correct answer: Service

A Kubernetes Service provides a stable network abstraction layer for a set of pods. It creates a single, stable IP address and DNS name (e.g., my-service.default.svc.cluster.local) that other applications within the cluster can use to access the pods managed by the Deployment. The Service automatically handles load balancing across the pods, even as they are created or destroyed. An Ingress is for external access, a Pod is the workload itself, and a ConfigMap is for configuration data.

Correct answer: To verify that the application's circuit breakers, timeouts, and fallback mechanisms function correctly under degraded network conditions.

The primary goal of chaos engineering is to build confidence in the system's ability to withstand turbulent conditions in production. By injecting latency, the team is proactively testing whether the application's built-in resilience patterns (like timeouts, retries, and circuit breakers) behave as expected. This helps uncover hidden weaknesses before they cause a real-world outage.

Correct answer: Static Application Security Testing (SAST)

Static Application Security Testing (SAST) analyzes an application's source code, bytecode, or binary code for security vulnerabilities without executing the program. Because it works directly on the code, it can be integrated very early in the SDLC, such as upon a code commit or pull request, to find issues like SQL injection or buffer overflows before the application is even built. DAST requires a running application, IAST combines both, and penetration testing is typically a later-stage manual or automated process.

Correct answer: Jenkins

Jenkins is renowned for its massive plugin ecosystem, which allows for extensive customization and integration with virtually any tool. It is an open-source, self-hosted solution, which satisfies the security compliance requirement. Its long history has resulted in a very large and active community, providing ample support and resources. While Drone is also self-hosted, its plugin ecosystem is smaller. Travis CI is primarily a cloud-based SaaS offering.

Correct answer: A transitive dependency (a dependency of a dependency) requires a version of `urllib3` that conflicts with the explicitly defined version constraint.

This is a classic transitive dependency conflict. The `requests` library itself depends on `urllib3`. If version 2.25.1 of `requests` requires a version of `urllib3` that is outside the ` =1.25.4` range, `pip` will be unable to find a compatible set of packages, leading to a resolution error. This highlights the complexity of managing dependencies in modern applications.