> For the complete documentation index, see [llms.txt](https://atomoh.gitbook.io/kubernetes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://atomoh.gitbook.io/kubernetes/en/quiz-collection/service-mesh/linkerd/multi-cluster.md).
# Multi-cluster Quiz
This quiz tests your understanding of Linkerd multi-cluster features.
## Quiz Questions
### 1. What is the core concept of Linkerd multi-cluster architecture?
A. Mesh federation B. Service mirroring C. Cluster merging D. Global load balancer
Show Answer
**Answer: B. Service mirroring**
**Explanation:** Linkerd uses a service mirroring architecture. Exported services from remote clusters appear as mirror services in the local cluster, accessible like local services.
### 2. What must be shared for mTLS communication between two clusters?
A. Identity Issuer B. Trust Anchor C. Workload certificates D. Kubernetes Secret
Show Answer
**Answer: B. Trust Anchor**
**Explanation:** For two clusters to mutually trust each other, they must share the same Trust Anchor (Root CA). Each cluster can have separate Identity Issuers, but they must be signed by the same Trust Anchor.
### 3. What label is used to export a service to other clusters?
A. linkerd.io/exported: "true" B. mirror.linkerd.io/exported: "true" C. multicluster.linkerd.io/export: "enabled" D. linkerd.io/multicluster: "export"
Show Answer
**Answer: B. mirror.linkerd.io/exported: "true"**
**Explanation:** Adding the `mirror.linkerd.io/exported: "true"` label to a service makes it mirrored by other linked clusters.
### 4. What is the naming format for mirror services?
A. `.` B. `-` C. `-` D. `@`
Show Answer
**Answer: B. `-`**
**Explanation:** Mirror services are created in the format `-`. Example: The web service from the west cluster is mirrored as web-west in the east cluster.
### 5. What is the purpose of the `linkerd multicluster link` command?
A. Network connection between two clusters B. Register remote cluster credentials locally C. Configure service-to-service traffic routing D. Certificate exchange
Show Answer
**Answer: B. Register remote cluster credentials locally**
**Explanation:** `linkerd multicluster link --cluster-name ` generates the current cluster's credentials (gateway address, service account token, etc.) to be registered in another cluster.
### 6. What command checks the status of multi-cluster gateways?
A. `linkerd multicluster status` B. `linkerd multicluster gateways` C. `linkerd multicluster check` D. `kubectl get gateway`
Show Answer
**Answer: B. `linkerd multicluster gateways`**
**Explanation:** `linkerd multicluster gateways` shows the gateway status of linked clusters. It displays ALIVE, NUM\_SVC (number of mirrored services), and LATENCY.
### 7. What is the recommended configuration for gateways in EKS multi-cluster?
A. ClusterIP service B. NodePort service C. NLB (Network Load Balancer) D. ALB (Application Load Balancer)
Show Answer
**Answer: C. NLB (Network Load Balancer)**
**Explanation:** NLB is recommended for multi-cluster gateways on EKS. It's optimized for TCP/TLS traffic and configured with the `service.beta.kubernetes.io/aws-load-balancer-type: "nlb"` annotation.
### 8. What backend services are used when splitting traffic between local and remote clusters with TrafficSplit?
A. Local service and remote gateway B. Local service and mirror service C. Local service only D. Direct reference to remote service
Show Answer
**Answer: B. Local service and mirror service**
**Explanation:** TrafficSplit backends specify the local service (e.g., web) and mirror service (e.g., web-west). Traffic to the mirror service is automatically routed to the remote cluster's gateway.
### 9. What is NOT a role of the mirror controller in multi-cluster environments?
A. Watch remote services B. Create/update mirror services C. Issue certificates D. Synchronize endpoints
Show Answer
**Answer: C. Issue certificates**
**Explanation:** The service mirror controller watches exported services in remote clusters, creates/updates mirror services locally, and synchronizes endpoints. Certificate issuance is the Identity Controller's role.
### 10. What AWS service is used for private connectivity between two EKS clusters?
A. Direct Connect only B. VPC Peering or Transit Gateway C. Route 53 only D. CloudFront
Show Answer
**Answer: B. VPC Peering or Transit Gateway**
**Explanation:** For private connectivity between EKS clusters, use VPC Peering (direct connection between two VPCs) or Transit Gateway (hub-and-spoke model). Configure the gateway with an internal NLB.
### 11. How do you allow access only to specific remote services in a multi-cluster environment?
A. NetworkPolicy B. ServerAuthorization with SPIFFE ID C. AWS Security Group D. Kubernetes RBAC
Show Answer
**Answer: B. ServerAuthorization with SPIFFE ID**
**Explanation:** Control access by specifying specific SPIFFE IDs from the remote cluster in ServerAuthorization's meshTLS.identities. Example: `spiffe://root.linkerd.cluster.local/ns/production/sa/api-gateway`
### 12. What does the `linkerd multicluster check` command NOT verify?
A. Link resource status B. Gateway connectivity C. Application business logic D. Service mirror controller status
Show Answer
**Answer: C. Application business logic**
**Explanation:** `linkerd multicluster check` verifies multi-cluster infrastructure status including Link resources, gateways, service mirror controller, and certificates. It does not verify application logic.