Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. With 3 racks, how should 3 control-plane nodes be placed?

   1. AAll in rack 1
   2. BOne per rack, so losing any single rack still leaves 2 of 3 etcd members (quorum)
   3. CTwo in rack 1, one in rack 2
   4. DIt doesn't matter
   Show answer

   B. Quorum survives only if no failure domain holds a majority of members.

   From lesson 05 · Control plane & node topology

2. Q2. Why is a 5-member etcd not automatically better than 3?

   1. AIt can't form quorum
   2. BIt tolerates two failures, but every write must reach 3 members (more latency), and it needs more machines; with fewer than 5 failure domains, the extra members may add little
   3. Cetcd supports only 3
   4. D5 is slower to read
   Show answer

   B. Choose members based on failure domains and required tolerance, not 'more is better'.

   From lesson 05 · Control plane & node topology

3. Q3. What makes an ADR useful a year later?

   1. ALength
   2. BIt records the context and constraints at the time, the decision, its consequences and the alternatives rejected, so future engineers understand why, and can revisit it when the context changes
   3. CDiagrams only
   4. DSignatures
   Show answer

   B. Decisions without context get re-argued forever, or blindly kept after the reasons have gone.

   From lesson 05 · Control plane & node topology

4. Q4. Why must pod and service CIDRs be unique across ParcelPath's clusters and not overlap corporate ranges?

   1. AFor aesthetics
   2. BOverlaps break routing when clusters talk to each other (failover, multi-cluster services, service mesh) or to corporate systems via native routing, VPN or peering; changing CIDRs later means rebuilding clusters
   3. CKubernetes rejects duplicates across clusters
   4. DDNS requires it
   Show answer

   B. Pod and service CIDRs are effectively permanent for a cluster's life. Plan them once, globally.

   From lesson 06 · Cluster networking

5. Q5. A cluster uses pod CIDR 10.64.0.0/16 with a /24 per node. What's the node limit from IPAM?

   1. A110
   2. B256
   3. C65,536
   4. D16
   Show answer

   B. A /16 contains 256 /24 blocks, one per node.

   From lesson 06 · Cluster networking

6. Q6. What does native routing (BGP) give over an overlay?

   1. ANothing
   2. BNo encapsulation overhead and pod IPs routable from the data-centre network (useful for performance, troubleshooting and some integrations), at the cost of coordination with the network team
   3. CAutomatic encryption
   4. DMore IPs
   Show answer

   B. Overlay is simpler to adopt; native routing integrates pods into the DC network.

   From lesson 06 · Cluster networking

7. Q7. What's the difference between L4 and L7 load balancing?

   1. ANone
   2. BL4 forwards TCP/UDP connections by IP and port; L7 understands HTTP (hosts, paths, headers) and can terminate TLS, route, retry and rate-limit
   3. CL7 is always faster
   4. DL4 only works in clouds
   Show answer

   B. Designs usually combine them: L4 gives stable IPs to the L7 ingress tier.

   From lesson 07 · Load balancing & ingress

8. Q8. Why might ParcelPath terminate TLS at the ingress and re-encrypt to backends?

   1. AIt's required by Kubernetes
   2. BIngress can route and apply L7 policy with certificates managed in-cluster, while re-encryption (or mesh mTLS) keeps traffic encrypted inside the data centre for security/compliance
   3. CTo save CPU
   4. DBrowsers need it
   Show answer

   B. It's a balance of L7 features, certificate management and in-DC encryption requirements; record it as an ADR.

   From lesson 07 · Load balancing & ingress

9. Q9. What does externalTrafficPolicy: Local change?

   1. ANothing
   2. BTraffic is only delivered to endpoints on the receiving node (no extra hop), preserving the client source IP; the LB must only send to nodes that have ready endpoints
   3. CIt disables load balancing
   4. DIt enables TLS
   Show answer

   B. Needed when apps or policies depend on the real client IP; health checks keep traffic away from nodes without endpoints.

   From lesson 07 · Load balancing & ingress

10. Q10. What does a WAF add in front of the ingress?

    1. AMore bandwidth
    2. BInspection of HTTP requests against rules (injection, known exploits, bots, custom rules) so attacks are blocked before they reach applications
    3. CDNS resolution
    4. DTLS certificates only
    Show answer

    B. Combine with DDoS protection (volumetric attacks) and rate limiting (abuse), which a WAF alone doesn't fully cover.

    From lesson 08 · Customer-facing edge

11. Q11. When is a separate cluster per tenant justified over namespaces?

    1. AAlways
    2. BWhen tenants need strong isolation (untrusted code, strict compliance, different Kubernetes versions or cluster-wide resources like CRDs), and the operational cost is acceptable
    3. CNever
    4. DOnly for dev
    Show answer

    B. Namespaces share the kernel and control plane; virtual clusters add control-plane isolation; separate clusters isolate almost everything, at the highest cost.

    From lesson 08 · Customer-facing edge

12. Q12. Which set of controls is the minimum for namespace-per-team isolation?

    1. ALabels only
    2. BRBAC scoped to the namespace, default-deny NetworkPolicies, ResourceQuotas/LimitRanges, and Pod Security (restricted) enforcement
    3. CA separate Git repo
    4. DDifferent node names
    Show answer

    B. Each layer blocks a different path: API access, network, resources and privilege escalation.

    From lesson 08 · Customer-facing edge

13. Q13. Why is local NVMe with database-level replication often preferred for databases on Kubernetes?

    1. AIt's cheaper only
    2. BDatabases like PostgreSQL and Kafka already replicate themselves; local disks give the lowest latency, and adding storage-level replication underneath doubles work and latency
    3. CKubernetes can't use network storage
    4. DIt needs no backups
    Show answer

    B. Let the application replicate; use operators to handle failover. Storage-level replication fits apps that can't replicate themselves.

    From lesson 09 · Storage & the stateful tier

14. Q14. Orders need RPO 5 minutes across two data centres 300 km apart. Synchronous or asynchronous?

    1. ASynchronous, always
    2. BAsynchronous replication with monitored lag well under 5 minutes (plus PITR backups); synchronous over that distance adds significant latency to every write
    3. CNo replication
    4. DOnly backups once a day
    Show answer

    B. Synchronous replication fits metro distances with low RTT; for longer distances, async with lag alerts meets a minutes-level RPO.

    From lesson 09 · Storage & the stateful tier

15. Q15. Why are backups needed even with replication?

    1. AThey aren't
    2. BReplication copies mistakes and corruption instantly (a bad migration, a deleted table); point-in-time backups let you go back
    3. CFor compliance only
    4. DReplication is too slow
    Show answer

    B. Replication protects against hardware loss; backups protect against logical errors and ransomware.

    From lesson 09 · Storage & the stateful tier