KCNA Practice Test 15 — 15 Questions

Question 1

In the context of DORA metrics, which metric measures how often an organization successfully releases to production?

Accepted Answer

Deployment frequency. Deployment frequency is a DORA metric that measures how often an organization deploys code to production or an operational environment.

Answer

Lead time for changes

Answer

Mean time to restore (MTTR)

Answer

Change failure rate

Question 2

Which TWO of the following are responsibilities of the kube-controller-manager? (Select 2)

Accepted Answer

Ensuring the desired number of pod replicas are running. Option A is correct because the kube-controller-manager runs the ReplicaSet controller (and Deployment controller), which continuously reconciles the actual number of pod replicas with the desired count specified in the ReplicaSet/Deployment spec. Option D is correct because the node lifecycle controller within the kube-controller-manager monitors node heartbeats and marks nodes as NotReady or evicts their pods when failures are detected. Option B is wrong because service networking rules are implemented by kube-proxy (via iptables/IPVS) on each node, not by the kube-controller-manager. Option C is wrong because cluster state is stored in etcd, the distributed key-value store. Option E is wrong because pod placement is the job of the kube-scheduler, which binds pods to nodes.

Answer

Implementing service networking rules

Answer

Storing the cluster state

Answer

Scheduling pods onto nodes

Question 3

You want to view the logs of a container named 'app' inside a pod named 'web-pod-7d4f8'. Which kubectl command should you use?

Accepted Answer

kubectl logs web-pod-7d4f8 -c app. The `kubectl logs` command is the standard way to retrieve container logs in Kubernetes. The `-c` flag specifies the container name within the pod, which is necessary when a pod contains multiple containers. Here, the container is named 'app' inside the pod 'web-pod-7d4f8', so `kubectl logs web-pod-7d4f8 -c app` correctly fetches its logs.

Answer

kubectl exec web-pod-7d4f8 -c app -- logs

Answer

kubectl log web-pod-7d4f8 --container app

Answer

kubectl logs web-pod-7d4f8 app

Question 4

Which Kubernetes control plane component is the entry point for all REST API requests?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all REST API requests. It validates and processes API calls (e.g., via kubectl, client libraries, or internal components) before persisting state to etcd or triggering other controllers. No other component directly exposes an API endpoint for external or internal management operations.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

etcd

Question 5

Which kubectl command would you use to view detailed information about a pod named 'web-pod' in the 'default' namespace?

Accepted Answer

kubectl describe pod web-pod. The `kubectl describe pod web-pod` command retrieves detailed information about the specified pod, including its current status, events, container details, resource limits, and labels. This is the correct command for viewing comprehensive metadata and state information beyond the basic summary provided by `kubectl get`.

Answer

kubectl get pod web-pod

Answer

kubectl logs web-pod

Answer

kubectl exec web-pod -- env

Question 6

You need to store a database password securely and make it available to a Pod as an environment variable. Which Kubernetes resource should you create?

Accepted Answer

Secret. Secrets are designed to store sensitive data, such as passwords, and can be exposed to Pods via environment variables or volumes.

Answer

PersistentVolume

Answer

ConfigMap

Answer

ServiceAccount

Question 7

A cloud-native application experiences intermittent failures when calling an external API. The team implements a pattern that allows the application to temporarily stop calling the failing API and serve stale data or a fallback response. Which resiliency pattern does this describe?

Accepted Answer

Circuit Breaker pattern. The Circuit Breaker pattern wraps calls to a remote dependency and trips 'open' after a threshold of failures, immediately returning a fallback (stale data, cached response, or default) instead of continuing to hammer the failing API. This prevents cascading failures and gives the downstream service time to recover, while periodically probing in a 'half-open' state to test restoration. Serving stale data while the breaker is open is the classic implementation of this pattern in cloud-native apps.

Answer

Retry pattern

Answer

Bulkhead pattern

Answer

Timeout pattern

Question 8

A DevOps engineer has created a ConfigMap named 'app-config' and wants to use it to set environment variables in a pod. Which field in the pod spec should reference the ConfigMap?

Accepted Answer

spec.containers[].envFrom. `spec.containers[].envFrom` allows you to inject all key-value pairs from a ConfigMap (or Secret) as environment variables into a container in a single declaration. This field supports a `configMapRef` that references the ConfigMap by name, making it the appropriate spec field for bulk environment variable injection.

Answer

spec.containers[].command

Answer

spec.containers[].env.name

Answer

spec.containers[].volumeMounts

Question 9

You need to run a batch job that processes a queue of 1000 items. The job should run to completion and then terminate. Which Kubernetes resource is BEST suited for this workload?

Accepted Answer

Job. A Kubernetes Job is designed for batch processing tasks that run to completion and then terminate. It creates one or more Pods and ensures that a specified number of them successfully terminate. For a queue of 1000 items, a Job can be configured with a parallelism value and a completions count to process all items and then exit, making it the ideal resource for this workload.

Answer

DaemonSet

Answer

Deployment

Answer

StatefulSet

Question 10

You have a Kubernetes cluster with multiple namespaces. You need to allow communication only from pods with label 'app: frontend' to pods with label 'app: backend' in the same namespace. Which resource should you use?

Accepted Answer

NetworkPolicy. NetworkPolicy is a Kubernetes resource that controls ingress and egress traffic between pods based on labels, namespaces, or IP blocks. By defining a NetworkPolicy with a podSelector matching 'app: backend' and an ingress rule that allows traffic only from pods with label 'app: frontend', you can restrict communication to only those pods in the same namespace. This is the correct approach because NetworkPolicy operates at Layer 3/4 (and optionally Layer 7 with Cilium) to enforce network segmentation.

Answer

RBAC Role

Answer

PodSecurityPolicy

Answer

Service

Question 11

Which CNCF project provides a graduated service mesh implementation that includes features like traffic management, security, and observability?

Accepted Answer

Linkerd. Linkerd is a graduated CNCF project that provides a service mesh with features like traffic management, security (mTLS), and observability. Istio is also a service mesh but is incubating, not graduated. Envoy is a graduated proxy but not a full service mesh. Consul is not a CNCF project.

Answer

Consul

Answer

Envoy

Answer

Istio

Question 12

An administrator wants to update the image of a Deployment named 'my-app' from 'nginx:1.19' to 'nginx:1.20' with a rolling update strategy. They want to ensure that during the update, the number of unavailable pods never exceeds 1. Which field should they set in the Deployment spec?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. `spec.strategy.rollingUpdate.maxUnavailable` controls the maximum number of Pods that can be unavailable during a rolling update. Setting this to 1 ensures that at most one Pod is unavailable at any time, meeting the administrator's requirement. This field is part of the Deployment's rolling update strategy and directly governs the availability guarantee during the update process.

Answer

spec.replicas

Answer

spec.minReadySeconds

Answer

spec.strategy.rollingUpdate.maxSurge

Question 13

Which TWO actions can improve the DORA metric 'Mean Time to Recovery (MTTR)'?

Accepted Answer

Using feature flags to disable faulty code quickly. Option C is correct because feature flags decouple deployment from release, letting you toggle off a faulty code path at runtime without a full redeploy, which directly shortens the time from failure detection to service restoration. Option E is correct because automated rollback triggered by health check failures removes human latency from the recovery path, restoring the last known-good version as soon as an unhealthy state is detected. Option A is incorrect because deployment frequency is a separate DORA metric (deployment frequency) and does not by itself reduce recovery time. Option B is incorrect because slowing the release cycle reduces deployment frequency and delays fixes, which typically worsens MTTR. Option D is incorrect because adding manual approval steps inserts human delay into remediation, increasing rather than decreasing MTTR.

Answer

Increasing deployment frequency

Answer

Slowing down the release cycle

Answer

Adding more manual approval steps

Question 14

Which TWO of the following are control plane components? (Select TWO)

Accepted Answer

etcd. In Kubernetes, the control plane is the set of components that make global cluster decisions and store cluster state, and etcd (A) is correct because it is the consistent, highly-available key-value store that persists all cluster data, including objects, configuration, and state. The kube-apiserver (B) is also correct because it is the central control plane component that exposes the Kubernetes API, validates and processes REST requests, and is the only component that talks directly to etcd. By contrast, kube-proxy (C) runs on each node and implements Service networking rules via iptables/IPVS, kubelet (D) is the node agent that manages Pods and containers on a worker node, and the container runtime (E) is the node-level software (e.g., containerd, CRI-O) that actually runs containers — all three are node components, not control plane components.

Answer

kube-proxy

Answer

kubelet

Answer

Container runtime

Question 15

What is the purpose of a Namespace in Kubernetes?

Accepted Answer

To logically isolate resources like pods and services. Namespaces in Kubernetes provide a mechanism for logically isolating resources such as Pods, Services, and Deployments within a cluster. They enable multiple virtual clusters to coexist on the same physical cluster, allowing for resource scoping, access control, and organization by team or environment (e.g., dev, staging, prod). This isolation is fundamental to multi-tenancy and resource management in Kubernetes.

Answer

To assign IP addresses to services

Answer

To limit the number of pods that can be created

Answer

To provide DNS names for pods