Cloud Native Applications and Containerization

1Z0-1084-26 · 99 questions

• A municipal developer packages the inspection API as a Docker artifact for later runs on laptops and in OCI. Which statement correctly distinguishes image from container?
• On a city developer workstation, which component actually creates the isolated process when someone runs a docker command?
• After building a waste-collection scheduling image on a laptop, other hosts and the cluster must run the same artifact. What role does a container registry play?
• A utilities team stores a Dockerfile next to their meter-reading service. What is that file’s correct role?
• Rebuilds of a city’s permit-intake image are slow because application source changes on every commit. How should Dockerfile instructions be ordered to protect the layer cache?
• When authoring the Dockerfile for a new public-records API, what does the FROM instruction establish?
• A Dockerfile for a zoning-map renderer installs packages with RUN. When do those RUN commands execute?
• The team needs to place known application source from the build context into a citizen-portal image without unpacking archives or fetching remote URLs. Which instruction is the professional default?
• Operators pass extra CLI arguments at docker run for a traffic-signal simulator image, but the container seems to ignore them. Which ENTRYPOINT/CMD relationship should they verify?
• A Dockerfile for a water-quality API sets WORKDIR, ENV, and EXPOSE. Which statement about those instructions is accurate?
• Many base images default to root. What should a professional Dockerfile for a parks reservation API do before the process starts?
• Builders pass a version string with --build-arg while assembling a court-calendar image. How do ARG and ENV differ for configuration?
• A Go service for flood-alert SMS is compiled in CI. Why would the Dockerfile use a second FROM stage?
• docker build for a 911-dispatch helper is unexpectedly large and slow. What should the team understand about the build context?
• Production for a voter-registration API must not silently drift to a different image tomorrow. How should the team think about tags versus digests?
• A developer prepares a local sidewalk-inspection tool image before any registry push. Which statement matches the build–tag–run lifecycle?
• A library-hours API container is running and healthy, but nothing on the host can reach it. EXPOSE 8080 is in the Dockerfile. What is the most likely gap?
• A city permit portal runs a container that writes uploaded PDFs under /tmp/uploads. After a redeploy the files are gone. What should the developer use so those uploads survive container replacement?
• The parks department wants the Docker Engine itself to mark a running recreation-API container unhealthy when its local probe fails. Which image-level feature provides that hook?
• A library catalog microservice currently ships on a full general-purpose OS base image with shells and package managers the runtime never uses. Why should the team switch to a slim or distroless runtime base?
• A transit-ticketing team packs a web API, a sidecar cron job, and a local database into one container so they can “share localhost.” What Docker design problem does that create?
• An on-call engineer patches a CVE inside a long-lived utilities-billing container with docker exec and apt-get. What is the Docker-native fix so the running instance matches what is in the registry?
• A municipal GIS team needs the Oracle-managed place to store, share, and retrieve container images with the ordinary Docker CLI. Which OCI service should they use?
• A developer on the water-meter telemetry service runs docker login against OCIR and keeps getting authentication failures after pasting an API signing key as the password. What should they use instead?
• A developer logs in to OCIR in Phoenix, then tries to push an image whose repository path is in Ashburn. The push fails. What is the most likely registry-auth mistake?
• When logging the Docker CLI into OCIR for a non-federated IAM user, what is the correct username shape?
• A federated user in a city tenancy has a valid auth token but docker login to OCIR still fails. The Profile menu shows an identity-provider path such as oracleidentitycloudservice. What username shape should they use?
• A public-works CI job must push a tagged image to OCIR. Which pieces belong in the fully qualified image path?
• A developer built city-permits-api:local on a laptop and needs that artifact in OCIR. What is the correct Docker sequence?
• A CI runner and later an OKE worker must retrieve the same permits-api artifact that was pushed to OCIR. How is that artifact identified on pull?
• Where should a developer read the tenancy namespace string that appears in OCIR image paths?
• Official OCIR documentation describes more than one valid registry hostname shape for the same regional service. Which statement is accurate?
• A planning-department repository in OCIR must be pullable only by callers with IAM permission or a logged-in Docker session. Which repository setting matches that requirement?
• A developer with rights only in a non-root compartment is ready to push the first tag of sanitation-routing. What should they do before the first docker push?
• OCIR shows repositories named project01/acme-web-app and project01/other-app. What do those names mean?
• Operators retagged :release in OCIR so it now points at yesterday’s build, and a cluster that pulls :release silently changed artifacts. How should a team pin a specific push?
• A fleet team ships both linux/amd64 and linux/arm64 builds of a civic mobile-backend image and also stores Helm charts. Why can OCIR hold all of those artifacts?
• After pushing a verified build of inspections-api to OCIR, the team must cryptographically bind that particular push to a key they manage. What is the documented OCIR signing approach?
• A teammate can pull from a private OCIR repository used by the 311 mobile API but cannot push new tags. What best explains that at developer depth?
• OKE worker nodes for a records-management workload run in a private subnet and must pull images from OCIR in the same region without public IPs. Which VCN attachment pattern do official OCIR docs call out for that pull path?
• A single Docker Engine on one host can docker run the city’s FAQ API. Why is that still not container orchestration?
• Operators declare three healthy replicas of a licensing API image. What posture distinguishes an orchestrator from a human start/stop runbook?
• A city permitting office runs permit-review workers as containers across a pool of hosts. When a reviewer container must start, which orchestration responsibility decides which worker has enough CPU and memory and binds the container there?
• A municipal parking citation API declares three replicas on OKE. One replica’s process exits unexpectedly. What does orchestration self-healing do so the declared count stays true?
• Weekend campground reservation spikes overload the city’s checkout microservice on OKE. How should the team scale capacity using orchestration’s primary scale knob?
• A library catalog frontend must call the search backend on OKE, but search Pod IPs change whenever replicas restart. What orchestration concern gives callers a stable name that tracks currently healthy replicas?
• Public-works inspectors need a new image of the field-notes API with no Saturday outage. Which orchestration role updates replicas so clients keep working under the same service name?
• A parks department team deploys containers on OKE. Which split correctly describes how orchestration separates decision-making from execution?
• A county IT board asks which industry orchestrator this OCI developer path standardizes on, and which OCI service delivers that API without the city running control-plane VMs. What is the correct pairing?
• A water-utility team wants OKE to keep twenty meter-reading API replicas running. Which approach actually uses the orchestration contract?
• A building-permit API Pod has started its process but is still loading reference data and cannot answer HTTP yet. How should orchestration’s service layer treat that replica?
• One OKE cluster hosts both the clerk portal and the inspector mobile API for a city. What orchestration constructs slice the cluster so a Service or controller affects only the intended replica set?
• A transit app team needs scheduling, desired replica state, horizontal scale, and stable service discovery on OKE. Which product family correctly covers those needs for this exam item?
• A clerk is debugging a single container locally, and a separate short-lived event handler will run as an Oracle Function. When does a multi-node orchestrated cluster earn its keep?
• A municipal development team wants a CNCF-conformant Kubernetes API on OCI without operating control-plane VMs. Which OCI service provides that?
• Inspectors’ dispatch workloads run on an OKE cluster. How should developers manage those workloads day to day?
• A sanitation routing image sits in OCIR and must run on OKE. What is the atomic scheduled unit that actually runs that image (alone or with tightly coupled sidecars)?
• A 24×7 municipal payments microservice must keep a declared replica count and roll out image changes safely on OKE. Which Kubernetes object should the team kubectl apply as the everyday service controller?
• During a rollout of the city’s code-enforcement API, which statement best describes the ReplicaSet relative to the Deployment authors use day to day?
• After applying a Service for the tax-assessor API, kubectl reports no endpoints even though Pods are running. What binding mechanism should the team verify first?
• Inside an OKE cluster, the clerk portal must call the checkout service. Which Service type provides a stable in-cluster virtual IP that forwards to ready Pods and is not itself a public internet front door?
• A partner system outside the OKE cluster must reach a Service via a port on worker nodes. Which Service type publishes that node port, and how should teams treat it as a public front door on OKE?
• Residents must reach a public recreation-registration API on OKE through an OCI load balancer. Which developer-facing Kubernetes object asks OKE to provision and wire that balancer to the selected Pods?
• A city exposes permits.example.gov and inspections.example.gov with different URL paths and does not want a separate LoadBalancer Service for each hostname. Which Kubernetes object declares host and path HTTP routing typically in front of ClusterIP Services?
• On OKE, which documented ingress controller reads Ingress resources and programs an OCI flexible load balancer, adding Pods as backends on VCN-native clusters or nodes (with NodePort Services) on flannel clusters?
• A parks reservation API needs different feature flags and log levels in test versus production on OKE. Where should those non-secret settings live so retargeting an environment does not require rebuilding the OCIR image?
• The utility billing API on OKE needs a database password and an OCIR pull credential at runtime. Where should those credentials live relative to ConfigMaps and the container image?
• A city permit portal on OKE needs database credentials that operators may rotate overnight without rewriting the Pod template. How should those Secrets be injected?
• County library catalog Pods on OKE stay ImagePullBackOff after the Deployment points at a private OCIR repository. What is the most likely missing piece?
• Transit fare API owners change the OCIR image tag on an OKE Deployment and want riders to keep hitting ready Pods during the cutover. Which strategy should they keep?
• A small water-meter telemetry node pool is nearly full. During a Deployment roll, many new Pods sit Pending while capacity is exhausted. Which RollingUpdate knob most directly oversubscribed the pool?
• After a bad OCIR tag hit the parks reservation Deployment, operators need the previous working Pods back quickly. Why does kubectl rollout undo succeed here?
• Clinic appointment Pods report Running but callers still see intermittent 502s during boot while dependencies warm up. Which probe should gate Service membership?
• A zoning-map microservice listens on its port but deadlocks and stops handling requests. Extra replicas alone do not clear the stuck processes. Which probe should restart the unhealthy containers?
• A property-tax batch importer on OKE needs several minutes to load reference data on first boot, and liveness keeps killing it mid-load. What should the team add?
• 311 ticket workers on OKE must land on nodes with enough free capacity, yet noisy neighbors must not consume unbounded CPU. How should the Pod spec express that?
• Recycling-schedule API traffic spikes at evening set-out times. Operators want more Pods automatically when CPU rises. Which object changes the Deployment replica count?
• HPA raised court-docket replicas, but new Pods stay Pending because managed-node CPU is saturated. What capacity action addresses the shortage?
• Checkout-stage and checkout-prod for the city storefront share one OKE cluster. What Kubernetes unit keeps their Services, ConfigMaps, and Secrets from clobbering each other?
• Public-works crews want one versioned bundle for the work-order Deployment, Service, Ingress, and ConfigMap on OKE. Which packaging approach fits that need?
• Stage and production for the city grants portal should share one Helm chart but differ in image tag, replica count, and Service type. Where should those differences live?
• Emergency-alert microservices already push images to OCIR. Where should the matching Helm chart artifact live, and how is it applied to OKE?
• Building-inspection APIs need worker VMs the team can shape and patch themselves on OKE. Which node type matches that responsibility model?
• A seasonal parks ticket burst should scale Pods with HPA without patching worker instances or babysitting pool capacity. Which OKE node type fits?
• A municipal GIS renderer needs GPU shapes that managed and virtual pools do not offer. Which enhanced-cluster node option joins custom Compute instances to OKE?
• The city platform team wants virtual nodes, workload identity, and node cycling on their OKE cluster. Which cluster type unlocks those developer features?
• Permit-API Pods must be reachable as native addresses from a peered VCN that already routes the application subnet. Which OKE network type gives pods routable VCN IPs?
• A records-search team wants the simpler overlay model where pod IPs stay inside the cluster rather than as native VCN addresses. Which network type should they pick?
• Operators want serverless virtual node pools for a summer camp registration API and also selected flannel as the cluster network type. What does official OKE behavior imply?
• The city runs a general managed pool for web APIs and a separate GPU self-managed pool for model inference on one OKE cluster. What unit holds shape, image, subnet, and Kubernetes version for each capacity group?
• Virtual-node Pods for the health-clinic API must read secrets from OCI Vault without relying on a worker-instance principal. Which enhanced-cluster approach maps a Kubernetes service account to IAM for those calls?
• The cluster must refuse to run unsigned or wrongly signed images from OCIR for the tax-assessor workloads. Where is that enforcement configured?
• A city permitting microservice on OKE must keep uploaded PDF attachments across Pod restarts. Which Kubernetes object should the developer declare so the Pod receives durable storage provisioned by the cluster?
• Before the main container of a municipal records API starts on OKE, the team must run a one-shot schema migration against the database. Which Pod construct should they use?
• Developers on a county OKE cluster want kubectl logs and later platform collectors to see application messages from a containerized service. Where should the process write those messages?
• A transit-authority microservice on OKE must call the Kubernetes API (and later OCI APIs via workload identity) under a least-privilege identity. Which Pod-level object supplies that identity?
• A city finance team needs a report that runs once each night, finishes, and then stops. Which OKE workload object fits that pattern?
• An OKE cluster for a municipal GIS team was created with a private Kubernetes API endpoint only. What does that imply for how developers run kubectl?
• Before OKE terminates or recycles a managed worker so Pods can move safely, what sequence does the platform use?