6.7 Knowledge Check - Containers and AI Platform

1.

A team migrating a public-facing web tier onto a Managed Kubernetes public cluster declares a Service of type LoadBalancer and assumes it now has a highly available, source-IP-preserving external load balancer equivalent to the Managed Network Load Balancer used elsewhere in the estate. The architect pushes back. Why is this assumption wrong, and what is the correct way to front the workload?

A A LoadBalancer Service is not a managed external load balancer; IONOS reserves a static public IP and assigns it as a secondary IP to a single worker node that acts as the ingress node, so production ingress should be a separately provisioned load balancer plus an in-cluster ingress controller. B A LoadBalancer Service is a fully managed L4 load balancer, but it only becomes highly available once at least three nodes are in the pool, so the fix is simply to scale the node pool to three. C The Service type works as expected; the only correction needed is to set externalTrafficPolicy: Cluster so that traffic is balanced across every node automatically. D The cluster manifest auto-provisions a Managed Network Load Balancer behind the scenes, so the team should remove the explicit Service and let the controller create it.

2.

A cost-conscious team running batch jobs on a Managed Kubernetes cluster wants the node pool to drop to zero nodes overnight when no jobs run, and they also want the cluster's control-plane events to flow into the centralized Logging Service alongside their application logs. The architect explains that both expectations collide with platform boundaries. Which statement correctly describes those boundaries?

A Node pools can scale to zero, and control-plane events are delivered to the Logging Service by default once the cluster is created. B Node pools can scale to zero only on private clusters, while control-plane events reach the Logging Service only on public clusters. C Cluster autoscaling has a floor of one warm node and cannot scale to zero, and control-plane events do not reach the Logging Service, so the team must design around an always-on node and source control-plane visibility another way. D Node pools can scale to zero if vulnerability scanning is disabled first, and control-plane events reach the Logging Service once audit logging to S3 is enabled.

3.

An architect is designing a private Managed Kubernetes cluster for a regulated workload and lists the prerequisites. The build is for a private cluster whose data plane must be isolated, whose API server must remain reachable only by the operations team, and whose nodes must communicate across a second VDC. Which set of decisions is correct?

A Private clusters isolate the API endpoint itself, so no allowlist is needed; egress and cross-VDC traffic work without any additional network resources. B Provision a NAT Gateway and Cross-Connect after the cluster is running, and rely on a security group bound to the cluster object to restrict the API server. C Choose the node-pool type loosely since it can be switched later, and protect the API by placing the control plane in a US region for redundancy. D A private cluster isolates the data plane but not the API endpoint, so protect the API with an IP allowlist; provision the NAT Gateway for egress and the Cross-Connect for cross-VDC node traffic first; keep the control plane in-region for sovereignty and fix the node-pool type up front because it is immutable after creation.

4.

A platform team wants to govern access to its Container Registry the way it governs its cloud accounts, by defining roles such as read-only developer, pipeline-pusher, and admin, and binding human users and groups to those roles. They also want an anonymous public-pull tier for open-source images. The architect explains the registry does not work that way. What is the correct governance model?

A The registry supports RBAC roles bound to users and groups, but a public-pull tier must be enabled separately per repository. B Governance is handled by disabling tokens when a pipeline stage is retired, and a public-pull tier is available for images flagged as open source. C The registry inherits the cloud account's IAM roles automatically, so the existing role bindings apply without further configuration. D The registry has no RBAC; access is token-only, so governance comes from token discipline (one narrowly scoped token per pipeline stage with an expiry, rotated regularly, and deleted rather than disabled), and there is no public-pull tier.

5.

An enterprise wants to add generative AI to a regulated, in-country application and must keep all processing in Germany, avoid running and patching GPU infrastructure, and integrate using its existing OpenAI client libraries. It also needs retrieval over a private corpus. Which approach fits the platform's enterprise default and its current direction?

A Self-host an open-source model on a GPU node pool from day one for control, and store the retrieval corpus in the managed vector-store feature of the AI platform. B Use managed inference on the AI Model Hub through its OpenAI-compatible API with per-token pricing and stateless, in-country processing, and build retrieval yourself using hub embeddings, vectors in Managed PostgreSQL, and the corpus in Object Storage. C Use managed inference but route requests to a US region for capacity, accepting that statelessness compensates for the data leaving the country. D Self-host the model and replicate the managed vector store across regions so retrieval survives a regional outage.

6.

A customer deploys an open-source model on the AI Model Hub and asks how EU AI Act responsibilities are allocated, including the case where IONOS modifies a model, for example by quantizing it. Which allocation is correct?

A The customer is always the distributor, IONOS is always the provider for every model, and modification such as quantization does not change any party's obligations. B IONOS is the deployer for all models, the customer is a mere user with no obligations, and modification shifts obligations onto the model's original open-source author. C The customer acts as the deployer (or as provider of their own AI system) and owns its risk assessment; IONOS is a distributor or intermediary for unmodified open-source models, but when IONOS modifies a model, such as by quantization, it takes on AI provider transparency obligations for that modification. D Roles are irrelevant because in-country processing and statelessness exempt the platform and the customer from the EU AI Act entirely.