KCNA Practice Test 15 — 15 Questions

Question 1

Which THREE are key benefits of using a service mesh in a cloud-native architecture? (Choose 3)

Accepted Answer

Mutual TLS (mTLS) encryption between services.. A service mesh, such as Istio or Linkerd, transparently enables mutual TLS (mTLS) encryption between service sidecar proxies without requiring application code changes. This ensures all inter-service communication is encrypted and authenticated, which is a core security benefit in a zero-trust cloud-native architecture.

Answer

Persistent storage management for stateful applications.

Answer

Automatic horizontal scaling of pods.

Question 2

Which TWO of the following are responsibilities of the kube-controller-manager?

Accepted Answer

Ensuring the correct number of pod replicas are running. The kube-controller-manager runs controller processes that regulate the state of the cluster. The ReplicaSet controller, which runs inside the kube-controller-manager, is responsible for ensuring that the desired number of pod replicas are running at all times, creating or deleting pods as necessary to match the specified replica count.

Answer

Assigning pods to nodes based on resource requirements

Answer

Implementing network rules for Services

Answer

Storing the cluster state

Question 3

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The OOMKilled status indicates the container was terminated because it exceeded its memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, which allows the container to use more memory without being killed by the Out-Of-Memory (OOM) killer. This resolves the root cause by providing sufficient memory for the workload.

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Question 4

Which component of an API gateway pattern is responsible for routing requests to the appropriate microservice based on the request path?

Accepted Answer

API Gateway. The API gateway acts as a reverse proxy and routes requests to the correct backend service.

Answer

Load balancer

Answer

Service registry

Answer

Sidecar proxy

Question 5

During a canary deployment using Argo Rollouts, how does the tool determine the success of the canary before promoting it?

Accepted Answer

By analyzing predefined metrics (e.g., error rate) via an AnalysisTemplate. Argo Rollouts uses metrics from a service mesh or monitoring to analyze the canary's health and decide whether to proceed.

Answer

By checking the rollout's status field in the YAML

Answer

By requiring manual approval via a webhook

Answer

By comparing the ReplicaSet's age to a threshold

Question 6

You have a Deployment defined with replicas: 5. You run 'kubectl scale deployment myapp --replicas=3'. Which component is responsible for ensuring the actual number of Pods matches the desired 3?

Accepted Answer

Deployment controller in kube-controller-manager. The Deployment controller, which runs as part of the kube-controller-manager, is responsible for reconciling the desired state of a Deployment. When you run 'kubectl scale deployment myapp --replicas=3', the Deployment controller detects the change in the Deployment's replica count and creates or deletes Pods via the ReplicaSet controller to match the desired 3 replicas.

Answer

etcd

Answer

kubelet

Answer

kube-scheduler

Question 7

Which THREE fields are required in a Kubernetes manifest YAML file?

Accepted Answer

kind. The 'kind' field is required because it tells Kubernetes which type of object to create (e.g., Pod, Deployment, Service). Without it, the API server cannot route the manifest to the correct resource handler. It must be a valid Kubernetes resource kind from the core API or a custom resource definition.

Answer

status

Answer

spec

Question 8

A company defines an SLO that 99.9% of requests to a service should complete in under 200ms. Which metric type is used to measure this SLO?

Accepted Answer

Histogram. The SLO is based on latency, which is typically measured using a histogram to track request durations.

Answer

Summary

Answer

Gauge

Answer

Counter

Question 9

A Deployment is configured with 'replicas: 4' and 'strategy.type: RollingUpdate'. You update the container image. What behavior does the Deployment exhibit?

Accepted Answer

New Pods are created before old ones are terminated, one at a time. With a RollingUpdate strategy, the Deployment controller replaces old Pods with new ones incrementally to ensure zero downtime. By default, it creates new Pods before terminating old ones (maxSurge=25%, maxUnavailable=25%), so one new Pod is created first, then one old Pod is terminated, repeating until all 4 Pods run the new image.

Answer

The Deployment creates 8 Pods total, 4 old and 4 new

Answer

All 4 Pods are deleted immediately and then 4 new Pods are created

Answer

The update is paused until manually resumed

Question 10

A DevOps team wants to collect and forward logs from all nodes in a Kubernetes cluster to a centralized logging backend. Which component is specifically designed for lightweight log collection and forwarding?

Accepted Answer

Fluent Bit. Fluent Bit is a lightweight log processor and forwarder, ideal for Kubernetes nodes.

Answer

Prometheus

Answer

Jaeger

Answer

Grafana

Question 11

Drag and drop the steps to update a Kubernetes Secret and ensure Pods use the new value into the correct order.

Accepted Answer

Update the Secret → Verify the Secret update → Force Pod recreation if needed → Wait for new Pods to be ready → Verify the new value in the Pods. Update the Secret, verify, force Pod recreation if needed, wait for new Pods, and verify the new value.

Answer

Verify the Secret update → Update the Secret → Force Pod recreation if needed → Wait for new Pods to be ready → Verify the new value in the Pods

Answer

Update the Secret → Force Pod recreation if needed → Verify the Secret update → Wait for new Pods to be ready → Verify the new value in the Pods

Answer

Update the Secret → Wait for new Pods to be ready → Force Pod recreation if needed → Verify the new value in the Pods → Verify the Secret update

Question 12

Which of the following is a key principle of the 12-factor app methodology?

Accepted Answer

Treat logs as event streams. The 12-factor app includes the principle of treating logs as event streams, not as files.

Answer

Bind services at build time

Answer

Use local disk storage for persistence

Answer

Store configuration in the codebase

Question 13

Which of the following is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. Pod is the smallest deployable unit in Kubernetes because it encapsulates one or more containers that share the same network namespace, storage volumes, and lifecycle. Containers are not directly scheduled onto nodes; instead, Kubernetes always schedules and manages Pods as atomic units, making the Pod the fundamental building block of deployment.

Answer

Service

Answer

Container

Answer

Node

Question 14

You want to update a Deployment's container image to v2 and perform a rolling update using the simplest imperative command. Which kubectl command achieves this?

Accepted Answer

kubectl set image deployment/my-deployment my-container=myapp:v2 --record. The `kubectl set image` command is the standard imperative way to update a container image in a Deployment, and it automatically triggers a rolling update. Option A is invalid; `kubectl update` is not a real command. Option B, `kubectl replace`, requires a full YAML file and is a declarative replacement operation, not a simple image update command. Option C, `kubectl patch`, can be used but is overly complex and error-prone for a simple image update. The question asks for the simplest imperative command, making D the best answer.

Answer

kubectl update deployment my-deployment --image=myapp:v2

Answer

kubectl replace -f updated-deployment.yaml

Answer

kubectl patch deployment my-deployment -p '{"spec":{"template":{"spec":{"containers":[{"name":"my-container","image":"myapp:v2"}]}}}}'

Question 15

What is the primary function of a service mesh like Istio?

Accepted Answer

To handle inter-service communication with features like traffic control and security. A service mesh provides observability, traffic management, and security for microservices communication.

Answer

To build container images

Answer

To manage container orchestration

Answer

To provide persistent storage for stateful applications