Module: Compose Operations & IaC Activity type: Quiz / retrieval practice Target: ≥80% Objective: Explain why a mutable tag is unsuitable as the final deployment identity.
Learn
Questions
In plain words: Read this block, then try the next action. If you feel stuck, tap What this means.
Why is academy/demo:stable insufficient as the final identity of a controlled deployment?
When stable resolves to a multi-platform image index, which digest should a linux/amd64 deployment pin in this lesson?
Why does recomputing a catalog-provided digest not prove publisher trust or release approval?
What three out-of-band values does update.py require to constrain selection?
Why must the intentional simultaneous edit of the blob, descriptor digest, and policy still be rejected?
What must remain unchanged after a dry-run or rejected update?
Which audit fields prove linkage between the prior and promoted deployment identities?
Why does rollback copy deployment.backup.json instead of replacing the deployment by moving that backup?
When is the rollback audit event appended?
What important security property is not provided by the self-consistent hash check in this lab?
In plain words: Pause for a human yes/no before the automation changes anything important.
Learn
After scoring
In plain words: Read this block, then try the next action. If you feel stuck, tap What this means.