Explanation

The correct answer is " Service Mesh. " A service mesh is a configurable, low-latency infrastructure layer that controls the interaction between a network of microservices. It provides functionalities such as service discovery, load balancing, traffic management, security, and observability for microservices-based applications. It is designed to improve communication and manage the complex interactions between services within a distributed system. Service mesh frameworks like Istio and Linkerd are commonly used to implement service mesh architecture.

Explanation

To mandate image verification when deploying container images to Oracle Cloud Infrastructure (OCI) Container Engine for Kubernetes (OKE) clusters, you should enable image verification policies separately for each OKE cluster. This is enforced at the cluster level. Enabling image verification policies at the cluster level ensures that all container images deployed to the OKE cluster are automatically verified against the specified master encryption key (MEK). This helps maintain the security and integrity of the deployed microservices by ensuring that only signed and trusted container images are used. Enabling image verification policies at the cluster level allows for consistent and centralized enforcement of the verification process across all nodes and node pools within the cluster. It provides a standardized approach to image verification for the entire cluster, simplifying management and ensuring compliance with the organization ' s mandate. Enabling image verification policies separately for each node pool or at the pod level would introduce complexity and potential inconsistencies in the verification process. Therefore, enforcing image verification at the cluster level is the recommended approach.

An Ingress Controller is a Kubernetes resource that provides advanced routing and load balancing for your applications running on a Kubernetes cluster 1 .  An Ingress Controller allows you to define rules that specify how to route traffic to different services in your cluster based on the host name or path of the incoming request 1 .  By deploying an Ingress Controller and using it to expose multiple application endpoints, you can achieve the following benefits 1 :

Cost-effectiveness: You only need to create one load balancer instance per cluster, instead of one per service, which reduces the cost of exposing your applications.

Simplicity: You only need to manage one set of routing rules for all your services, instead of configuring each service separately, which simplifies the application deployment and maintenance.

Flexibility: You can use different types of Ingress Controllers, such as NGINX or Traefik, that offer various features and customization options for your routing needs.

Explanation

The correct answer is: " Create a self-signed certificate and its corresponding key. Create a Kubernetes secret using the certificate and the key. Then add these annotations to the Kubernetes service: annotations: service.beta.kubernetes.io/oci-load-balancer-ssl-ports: ' 443 ' service.beta.kubernetes.io/oci-load-balancer-tls-secret: ssl certificate-secret. " To create a secure SSL termination for your microservices-based application running in an OCI Container Engine for Kubernetes (OKE) cluster, you can follow these steps: Create a self-signed certificate and its corresponding key: Generate a self-signed SSL certificate and its private key using a tool like OpenSSL. Create a Kubernetes secret: Create a Kubernetes secret using the certificate and key obtained in the previous step. This secret will securely store the certificate and key within the Kubernetes cluster. Add annotations to the Kubernetes service: Modify the Kubernetes service that exposes your application and add the following annotations to enable SSL termination: annotations: service.beta.kubernetes.io/oci-load-balancer-ssl-ports: ' 443 ' (specify the SSL port as 443) annotations: service.beta.kubernetes.io/oci-load-balancer-tls-secret: ssl certificate-secret (specify the name of the Kubernetes secret containing the certificate and key) By following these steps, you can create a secure SSL termination for your application using a self-signed certificate and Kubernetes secret. The annotations added to the Kubernetes service ensure that the SSL port is configured correctly and the TLS secret is utilized for SSL termination when traffic reaches the load balancer. The other options provided are not the most suitable approaches for achieving secure SSL termination in an OCI Container Engine for Kubernetes (OKE) cluster: Adding annotations related to the OCI load balancer SSL secret key is not the correct approach for SSL termination in this scenario. Using Let ' s Encrypt to generate a self-signed certificate and configuring it on the OCI Load Balancer is not necessary when you can create and manage the SSL certificate within the Kubernetes cluster using a Kubernetes secret.

Explanation

The two components that are part of the Cloud Native Computing Foundation (CNCF) container runtime are: containerd: containerd is an open-source container runtime that provides a runtime environment for containers, including managing container images, executing containers, and handling container lifecycle events. It is designed to be lightweight and extensible, providing the necessary functionality to run containers efficiently. runc: runc is a lightweight container runtime that serves as a reference implementation of the Open Container Initiative (OCI) runtime specification. It is responsible for launching and managing containers based on OCI specifications, including handling container isolation, namespaces, cgroups, and other low-level container operations. These two components, containerd and runc, are widely used in the container ecosystem and are part of the CNCF ' s efforts to promote and develop open-source technologies for cloud-native computing.

Explanation

The correct options are: A configured OCI API signing key pair: The API signing key pair is used for authentication and authorization to access OCI resources, including the OKE cluster. The private key should be configured on your local machine to authenticate API requests. An SSH key pair with the public key added to the cluster worker nodes: This is required for secure SSH access to the worker nodes in the OKE cluster. You need to generate an SSH key pair and add the public key to the cluster ' s worker node pool during cluster creation or update. Therefore, the correct options are having a configured OCI API signing key pair and an SSH key pair with the public key added to the cluster worker nodes.

Explanation

The two correct differences between continuous delivery and continuous deployment in the DevOps lifecycle are: Continuous delivery is a process that initiates deployment manually, while continuous deployment is based on automating the deployment process. In continuous delivery, the software is ready for deployment, but the decision to deploy is made manually by a human. On the other hand, continuous deployment automates the deployment process, and once the software passes all the necessary tests and quality checks, it is automatically deployed without human intervention. Continuous delivery utilizes automatic deployment to a development environment, while continuous deployment involves automatic deployment to a production environment. In continuous delivery, the software is automatically deployed to a development or staging environment for further testing and validation. However, the actual deployment to the production environment is performed manually. In continuous deployment, the software is automatically deployed to the production environment, eliminating the need for manual intervention in the deployment process. These differences highlight the level of automation and human involvement in the deployment process between continuous delivery and continuous deployment approaches in the DevOps lifecycle.

Idle-timeout is the parameter that is used to configure the time period during which an idle function will remain in memory before Oracle Functions removes its container image from memory 2 .  The idle-timeout parameter is specified in seconds and can be set when creating or updating a function 2 .  The default value for idle-timeout is 30 seconds and the maximum value is 900 seconds (15 minutes) 2 .  If a function has the --provisioned-concurrency option enabled, the idle-timeout parameter is ignored and the function instances are always kept in memory 3 . Verified References:  Creating Functions ,  Provisioned Concurrency

Explanation

The correct answer is: " Resiliency is about recovering from failures without downtime or data loss. " Service resiliency, in the context of cloud-native applications, is the ability of a service or system to recover from failures and continue functioning without downtime or data loss. It involves designing and implementing mechanisms to handle failures, such as network outages, hardware failures, or software errors, in a way that minimizes the impact on the overall system. The goal of resiliency is to ensure that the application or service can continue to operate and provide a certain level of functionality, even in the face of failures. This typically involves techniques such as redundancy, fault tolerance, and graceful degradation. By implementing resiliency measures, a cloud-native application can recover and adapt to failures, maintain availability, and preserve data integrity. The other statements are not accurate regarding service resiliency: Resiliency is not about not bringing a service to a functioning state after a failure. Instead, it is about recovering from failures and ensuring continued functionality. Resiliency is not about avoiding failures entirely. While it is desirable to prevent failures, resiliency focuses on the ability to handle and recover from failures when they do occur. Resiliency testing is not limited to a test environment. It is important to test and validate the resiliency measures in both test environments and production environments to ensure the application can effectively handle failures in real-world scenarios.

Explanation

Oracle Cloud Infrastructure (OCI) API Gateway supports various backend-types to handle incoming requests and route them to the appropriate backend service. However, " ORACLE_STREAMS_BACKEND " is not a valid backend-type in OCI API Gateway. " STOCK_RESPONSE_BACKEND " is a valid backend-type that allows you to configure static responses directly in the API Gateway without routing requests to any specific backend service. This can be useful for handling simple requests or returning predefined responses. " HTTP BACKEND " is another valid backend-type that enables routing requests to an HTTP backend service. " ORACLE_FUNCTIONS_BACKEND " is a valid backend-type that allows you to route requests to Oracle Functions, which are serverless functions that can be used to execute specific logic or operations. However, " ORACLE_STREAMS_BACKEND " is not a valid backend-type in OCI API Gateway. The API Gateway does not have native support for Oracle Streams as a backend service. Oracle Streams is a feature of Oracle Database that provides a publish-subscribe mechanism for data replication and distribution within an Oracle Database environment. It is not directly integrated as a backend service in OCI API Gateway.