Free · no sign-up · no time limit
Ready-made multiple-choice practice quizzes, hand-checked. Take any free quiz online — every answer comes with an explanation, and every quiz page has a full answer key to revise from.
Loading quizzes
Free · no sign-up · no time limit
Ready-made multiple-choice practice quizzes, hand-checked. Take any free quiz online — every answer comes with an explanation, and every quiz page has a full answer key to revise from.
IT
Deepen your technical knowledge of Linux namespaces, cgroups, Kubernetes control plane internals, CNI, and CRI. Answer each question to see whether you got it right, with an explanation every time.
A free 16-question multiple-choice practice test on IT. Each question has one correct answer and a short explanation, and the full answer key below the player doubles as a study sheet. No account, no time limit — take it as often as you like.
This is a free, 16-question multiple-choice quiz. Answer each question to see whether you got it right, with an explanation for every answer. There is no sign-up and no time limit — take it as many times as you like, and use the answer key above to revise before or after.
Correct answer: BNamespaces
Linux namespaces (PID, mount, network, IPC, UTS, user) isolate what a process can see, while cgroups limit how many resources (CPU, memory, I/O) it can consume.
Correct answer: Bcgroups v2 provides a unified hierarchy, resolving resource controller conflicts and supporting rootless containers cleanly
cgroups v2 unifies resource management under a single hierarchy, eliminating cross-controller deadlocks, improving memory-pressure metrics, and supporting rootless cgroups.
Correct answer: BIt defines a gRPC interface allowing the kubelet to interact with different container runtimes (like containerd or CRI-O)
The CRI is a gRPC specification enabling the kubelet to manage container lifecycles against various container runtimes (containerd, CRI-O) without modifying Kubernetes core code.
Correct answer: Cetcd
etcd is a strongly consistent, distributed key-value store that acts as the single source of truth for all Kubernetes cluster state and specifications.
Correct answer: BThe Linux Out-Of-Memory (OOM) killer terminates a process within the container (OOMKilled, exit code 137)
When memory usage breaches the cgroup limit, the Linux kernel triggers the OOM killer on that container, terminating the offending process and setting the Pod state to OOMKilled.
Correct answer: AIt merges multiple read-only lower directories with a single read-write upper directory into a unified view
OverlayFS uses stacked read-only layers (lowerdir) from the container image and presents a single writable layer (upperdir) on top using copy-on-write mechanics.
Correct answer: BMaintaining network rules on nodes (via iptables or IPVS) to route Service clusterIP traffic to backend Pods
kube-proxy watches the API server for Service and Endpoints objects and configures iptables, IPVS, or eBPF rules on the host to route service traffic to Pod IPs.
Correct answer: BTo initialize and hold the shared network and IPC namespaces for all containers in the Pod
The Pause container starts first to set up the network, IPC, and UTS namespaces; all other containers in the Pod join these shared namespaces, allowing them to communicate over localhost.
Correct answer: BIt inspects and potentially modifies an object payload before schema validation and storage in etcd
Mutating admission webhooks run before validating webhooks and etcd persistence, allowing admission controllers (like Istio sidecar injectors) to mutate resource definitions dynamically.
Correct answer: BIt provides binary plugins called by the runtime to allocate IP addresses and wire network interfaces into Pod namespaces
When a Pod sandbox is created, the container runtime invokes the configured CNI plugin (e.g., Calico, Cilium) to set up virtual Ethernet interfaces, configure routing, and assign an IP.
Correct answer: BNodePort exposes a high static port on every cluster node; Ingress acts as an intelligent Layer 7 reverse proxy routing to Services
NodePort exposes a Service across a dedicated high-range port (30000-32767) on all node IPs (Layer 4), whereas an Ingress controller provides Layer 7 reverse-proxying, SSL termination, and path routing.
Correct answer: BThe minimum number or percentage of Pod replicas that must remain available during voluntary disruptions (like node drains)
A PDB limits the number of concurrently disrupted Pods during planned cluster administrative maintenance (like node upgrades and kubectl drain), preventing accidental application downtime.
Correct answer: BExtended Berkeley Packet Filter (eBPF)
Cilium leverages eBPF inside the Linux kernel to attach programs directly to network sockets and interfaces, routing packets efficiently without traversing complex iptables rule chains.
Correct answer: ATaints repel Pods from nodes unless the Pod possesses a matching toleration; affinities attract Pods to nodes
Taints are applied to nodes to repel Pods that do not explicitly tolerate the taint, whereas Node Affinity rules attract Pods to nodes matching specified label conditions.
Correct answer: BExisting Pods continue executing normally, but newly created Pods remain in a 'Pending' state
The scheduler is only involved in assigning unbound Pods to nodes; if it fails, existing running Pods continue unaffected, but newly requested Pods remain unscheduled in 'Pending'.
Correct answer: BIt ensures that if an attacker escapes the container, they only have unprivileged user access on the host
Rootless containers map the container's root user (UID 0) to a non-privileged UID on the host via user namespaces, preventing container escape exploits from gaining full host root privileges.