KCNA Practice Test 16 — 15 Questions

Question 1

Which DORA metric measures the percentage of deployments that cause a failure in production?

Accepted Answer

Change Failure Rate. Change Failure Rate is the percentage of changes that result in a failure (e.g., service degradation, rollback). It is one of the four key DORA metrics.

Answer

Deployment Frequency

Answer

Mean Time to Recovery (MTTR)

Answer

Lead Time for Changes

Question 2

Which THREE of the following are key characteristics of microservices architecture?

Accepted Answer

Independent deployment of services. Microservices architecture mandates that each service can be independently deployed, updated, and scaled without affecting other services. This is achieved through separate deployment pipelines, containerization (e.g., Docker), and orchestration platforms like Kubernetes that manage service lifecycles independently. Independent deployment enables continuous delivery and reduces the blast radius of changes.

Answer

Single monolithic codebase

Answer

Shared database schema across services

Question 3

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The OOMKilled status indicates the container was terminated because it exceeded its memory limit. Increasing the memory limit in the pod's container resource specification allows the container to use more memory without being killed, directly addressing the root cause of the CrashLoopBackOff.

Answer

Delete the namespace and redeploy all workloads

Answer

Delete and recreate the pod to clear the crash loop

Answer

Increase the CPU request for the container

Question 4

Which of the following is NOT one of the three pillars of observability in cloud-native environments?

Accepted Answer

Security. The three pillars are logs, metrics, and traces. Security is not one of them, though it is important.

Answer

Metrics

Answer

Traces

Answer

Logs

Question 5

You need to ensure that a set of pods in a Deployment can be reached by other pods using a stable IP address and DNS name. Which Kubernetes object should you use?

Accepted Answer

Service. A Service provides a stable IP address and DNS name for a set of pods, abstracting the underlying pod IPs that can change due to scaling or failures. By default, a Service uses a cluster-internal virtual IP and DNS record (e.g., ..svc.cluster.local) that other pods can resolve, ensuring reliable connectivity without needing to track individual pod IPs.

Answer

NetworkPolicy

Answer

Ingress

Answer

ConfigMap

Question 6

A team wants to deploy a batch job that runs once to process a large dataset. The job should run to completion and then terminate. Which Kubernetes resource should be used?

Accepted Answer

Job. A Job resource is designed for batch processing tasks that run to completion and then terminate. It creates one or more Pods and ensures they successfully finish their work, making it the correct choice for a one-time data processing job.

Answer

DaemonSet

Answer

CronJob

Answer

Deployment

Question 7

You need to deploy an application that requires exactly one pod per cluster node for logging purposes. Which Kubernetes workload resource should you use?

Accepted Answer

DaemonSet. A DaemonSet ensures that a copy of a pod runs on every node in the cluster, or on a subset of nodes if a node selector is used. This is the correct resource for deploying a logging agent that must be present on each node to collect logs from that node's containers and system components.

Answer

Job

Answer

StatefulSet

Answer

Deployment

Question 8

What is the primary purpose of the Container Runtime Interface (CRI) in Kubernetes?

Accepted Answer

To provide a standard interface between the kubelet and container runtimes. The Container Runtime Interface (CRI) is a plugin protocol that enables the kubelet to use any OCI-compliant container runtime (e.g., containerd, CRI-O) without needing to recompile Kubernetes. It defines gRPC APIs for runtime and image service operations, abstracting the runtime implementation from the kubelet's pod lifecycle management.

Answer

To store container images in a registry

Answer

To define the format of container images

Answer

To manage container network interfaces

Question 9

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running reconciliation loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, each of which watches the current state of the cluster via the kube-apiserver and makes changes to drive the actual state toward the desired state defined in etcd. This reconciliation loop pattern is fundamental to Kubernetes' self-healing behavior, ensuring that resources like deployments, replica sets, and nodes match their specifications.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 10

Which TWO components are part of the Kubernetes control plane?

Accepted Answer

etcd. C (etcd) is correct because it is the distributed key-value store that holds all cluster data, including configuration, state, and metadata. D (kube-apiserver) is correct because it is the front-end for the control plane, exposing the Kubernetes API and handling all RESTful requests for cluster operations.

Answer

kube-proxy

Answer

kubelet

Answer

container runtime

Question 11

Which two of the following are Kubernetes controllers that run inside the kube-controller-manager? (Select TWO)

Accepted Answer

Replication controller. The kube-controller-manager is a control plane component that runs controller processes to regulate the state of the cluster. The Replication controller (option B) is a legacy controller that ensures a specified number of pod replicas are running at all times, and the Node controller (option D) is responsible for monitoring the health of nodes and managing node lifecycle events. Both are built-in controllers that run inside the kube-controller-manager binary.

Answer

kubelet

Answer

etcd

Answer

kube-scheduler

Question 12

A Kubernetes cluster has two nodes: control-plane and worker. The worker node runs several pods. The control-plane node becomes unreachable. What is the immediate impact on the pods running on the worker node?

Accepted Answer

Pods continue running, but new pods cannot be scheduled. When the control-plane node becomes unreachable, the kube-controller-manager cannot communicate with the kubelet on the worker node, so it stops performing scheduling and reconciliation. However, the kubelet on the worker node continues to run existing pods based on the last known desired state stored locally, and the pods themselves are managed by the container runtime (e.g., containerd) independently of the control-plane. Therefore, pods continue running normally, but no new pods can be scheduled because the scheduler, which runs on the control-plane, is unavailable.

Answer

All pods are immediately terminated

Answer

Pods are rescheduled to the control-plane node

Answer

The worker node is automatically cordoned

Question 13

Which TWO of the following are valid methods for exposing a Service externally?

Accepted Answer

LoadBalancer. (LoadBalancer) is correct because it provisions an external load balancer (e.g., AWS ELB, GCP TCP LB) that assigns a public IP address to the Service, making it accessible from outside the cluster. Option E (NodePort) is correct because it exposes the Service on a static port (30000–32767) on every Node's IP, allowing external traffic to reach the Service via `:`. Both are valid Service types in Kubernetes for external exposure.

Answer

ExternalName

Answer

Ingress

Answer

ClusterIP

Question 14

Which Kubernetes resource is commonly used to implement the sidecar pattern for injecting a service mesh proxy?

Accepted Answer

MutatingAdmissionWebhook. A MutatingAdmissionWebhook intercepts Pod creation requests and automatically injects a sidecar container (e.g., Envoy or Linkerd-proxy) into the Pod spec. This is the standard mechanism used by service mesh control planes like Istio and Linkerd to transparently add the proxy without modifying application manifests.

Answer

NetworkPolicy

Answer

Service

Answer

ConfigMap

Question 15

A cloud-native application uses a service mesh (Istio) for traffic management. The team notices increased latency in inter-service communication. Which likely cause should be investigated first?

Accepted Answer

Misconfigured sidecar proxy settings. In Istio, the sidecar proxy (Envoy) intercepts all inbound and outbound traffic for the application container. Misconfigured proxy settings—such as incorrect timeouts, retry policies, or circuit breaker thresholds—can introduce significant latency by causing unnecessary retries, connection delays, or queueing. This is the most common and immediate cause of increased latency in a service mesh, as the data plane is directly in the request path.

Answer

Kubernetes Network Policies blocking traffic

Answer

Application code is not optimized for the mesh

Answer

mTLS encryption overhead