KCNA Practice Test 12 — 15 Questions

Question 1

Which command would you run to get a list of all pods in all namespaces?

Accepted Answer

kubectl get pods --all-namespaces. `kubectl get pods --all-namespaces` (or its shorthand `-A`) retrieves pods from every namespace in the cluster. This flag overrides the default behavior of `kubectl get pods`, which only returns pods in the current namespace (usually `default`).

Answer

kubectl get pods --namespace=*

Answer

kubectl get pods --global

Answer

kubectl get pods --include-uninitialized

Question 2

You need to run a batch job that processes a queue and then terminates. Which Kubernetes resource is most appropriate?

Accepted Answer

Job. A Job is the correct resource because it is designed to run a specified number of pods to completion and then terminate, making it ideal for batch processing tasks like processing a queue. Unlike controllers that maintain a desired state indefinitely, a Job ensures the pod runs successfully to completion, even if the pod fails and needs to be restarted, and then stops.

Answer

StatefulSet

Answer

Deployment

Answer

DaemonSet

Question 3

You create a Service of type ClusterIP with the name 'my-service' in the 'default' namespace. What DNS name resolves to the service's cluster IP from a pod in the same namespace?

Accepted Answer

my-service.default.svc.cluster.local. Kubernetes DNS resolves a Service's ClusterIP using the fully qualified domain name (FQDN) format `..svc.cluster.local`. Since the Service 'my-service' is in the 'default' namespace, a pod in the same namespace can reach it via `my-service.default.svc.cluster.local`. The DNS query returns the ClusterIP of the Service, allowing pods to communicate with it reliably.

Answer

my-service.svc.cluster.local

Answer

my-service.default.cluster.local

Answer

my-service.cluster.local

Question 4

An application requires that a set of Pods each be assigned a unique DNS name that can be used for peer-to-peer communication. Which Kubernetes resource should be used?

Accepted Answer

StatefulSet with a Headless Service. A StatefulSet with a Headless Service is correct because StatefulSets assign each Pod a stable, unique network identity (e.g., pod-name-0.service-name.namespace.svc.cluster.local) that persists across rescheduling. A Headless Service (clusterIP: None) disables load balancing and DNS round-robin, allowing direct DNS resolution to individual Pod IPs for peer-to-peer communication. This matches the requirement for unique DNS names for each Pod.

Answer

Job with a Service

Answer

DaemonSet with a Service

Answer

Deployment with a Service

Question 5

A Kubernetes administrator needs to restrict inbound traffic to a set of pods. Only pods with the label 'app: frontend' in the same namespace should be allowed to reach the pods on TCP port 8080. Which resource should be used?

Accepted Answer

NetworkPolicy. NetworkPolicy is the correct resource because it is a Kubernetes-native object that defines how groups of pods are allowed to communicate with each other and other network endpoints. By specifying a pod selector matching 'app: frontend' and an ingress rule allowing TCP port 8080, you can restrict inbound traffic to only those pods with that label in the same namespace.

Answer

Ingress

Answer

PodSecurityPolicy

Answer

ServiceAccount

Question 6

Which THREE of the following are responsibilities of the kube-controller-manager?

Accepted Answer

Creating Endpoints objects for Services. The kube-controller-manager includes the EndpointSlice controller (or the legacy Endpoints controller), which is responsible for creating and updating Endpoints (and EndpointSlice) objects to reflect the IP addresses and ports of Pods that match a Service's label selector. This ensures that the Service's DNS or iptables rules point to healthy Pods.

Answer

Assigning Pods to Nodes

Answer

Serving the Kubernetes API

Question 7

You need to expose a set of pods running a web application to internal cluster traffic on a stable IP address. Which resource should you create?

Accepted Answer

Service of type ClusterIP. A Service of type ClusterIP exposes the set of pods on a stable, internal IP address that is only reachable within the cluster. This is the default Service type and is specifically designed for internal cluster traffic, providing a stable virtual IP (VIP) that load-balances requests to the underlying pods.

Answer

Service of type NodePort

Answer

Ingress

Answer

NetworkPolicy

Question 8

What is the primary purpose of a Kubernetes Service?

Accepted Answer

To provide a stable endpoint for accessing a set of pods. A Kubernetes Service provides a stable, virtual IP address and DNS name that acts as a consistent endpoint for accessing a set of pods, regardless of pod IP changes due to scaling, restarts, or scheduling. It decouples frontend clients from backend pods by using label selectors to route traffic, ensuring high availability and load balancing across the pod group.

Answer

To manage container image versions

Answer

To store configuration data as key-value pairs

Answer

To schedule pods onto nodes

Question 9

A developer reports that a Pod cannot reach another Service in the same namespace via its DNS name. The Service name is 'api'. What is the correct DNS query for a Pod to resolve this Service?

Accepted Answer

api. When a Pod and a Service are in the same namespace, Kubernetes DNS resolves the Service using just the Service name (e.g., 'api'). The DNS search domain configured in the Pod's resolv.conf (e.g., <namespace>.svc.cluster.local) appends the namespace and cluster suffix automatically, so a short query like 'api' resolves correctly without needing the full FQDN.

Answer

api.svc.cluster.local

Answer

api.namespace.svc.cluster.local

Answer

api.default.svc.cluster.local

Question 10

Which of the following is an example of immutable infrastructure?

Accepted Answer

Rebuilding a server from a pre-baked image and replacing the old one. Immutable infrastructure means that once a server or container is deployed, it is never modified in place. Instead, any change requires building a new image and redeploying. Option D describes exactly this: rebuilding from a pre-baked image and replacing the old server, which is the core pattern of immutability in container orchestration (e.g., Kubernetes rolling updates or Recreate deployments).

Answer

SSH into a server to apply patches

Answer

Manually installing packages on a running container

Answer

Using configuration management tools to update software on running servers

Question 11

Which of the following is a key difference between containers and virtual machines?

Accepted Answer

Containers share the host OS kernel; VMs run a separate guest OS. The key difference is that containers virtualize at the operating system level, sharing the host OS kernel via namespaces and cgroups, while each virtual machine runs a full, separate guest OS on top of a hypervisor. This architectural distinction means containers are more lightweight and start faster, but VMs provide stronger isolation because they do not share the host kernel.

Answer

Both containers and VMs share the host kernel

Answer

Containers have a full guest OS, VMs share the host kernel

Answer

Containers require a hypervisor, VMs do not

Question 12

Which TWO statements about Kubernetes Services are correct?

Accepted Answer

A Service provides a stable IP address for Pods. A Kubernetes Service provides a stable virtual IP address that remains constant even as the underlying Pods are created, destroyed, or rescheduled. This decouples clients from the ephemeral nature of Pod IPs, ensuring reliable connectivity within the cluster.

Answer

A Service can only route traffic to Pods in the same namespace

Answer

A Service can only be of type ClusterIP

Answer

A Service automatically scales Pods based on load

Question 13

Which TWO resources can be used to store configuration data separately from container images?

Accepted Answer

Secret. ConfigMaps and Secrets are Kubernetes API objects designed specifically to decouple configuration data and sensitive information from container images. ConfigMaps store non-sensitive key-value pairs (e.g., environment variables, command-line arguments, or configuration files), while Secrets store sensitive data (e.g., passwords, tokens, or SSH keys) in base64-encoded or encrypted form. Both can be mounted into pods as volumes or injected as environment variables, allowing image reuse across different environments without rebuilding.

Answer

Service

Answer

PersistentVolume

Answer

Deployment

Question 14

Which TWO practices are recommended for designing cloud-native microservices? (Choose 2)

Accepted Answer

Implement health check endpoints for each service.. Health check endpoints (e.g., /healthz or /ready) are a fundamental pattern in cloud-native microservices. They allow orchestration platforms like Kubernetes to perform liveness and readiness probes, ensuring that traffic is only routed to healthy instances and that unhealthy pods are automatically restarted. This aligns with the cloud-native principle of designing for resilience and self-healing.

Answer

Share a common database schema across all services.

Answer

Store configuration in environment variables inside the container image.

Answer

Use synchronous HTTP calls for all inter-service communication.

Question 15

You are asked to deploy a Kubernetes service that exposes a set of pods internally within the cluster only. The service should not be accessible from outside the cluster. Which Service type should you choose?

Accepted Answer

ClusterIP. ClusterIP is the default Kubernetes Service type that exposes the service on a cluster-internal IP address. This makes the service reachable only from within the cluster, which is exactly what is required for internal-only communication between pods. No external traffic can reach a ClusterIP service unless an ingress controller or proxy is explicitly configured.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer