KCNA Practice Test 17 — 15 Questions

Question 1

Which component of the Istio service mesh is responsible for certificate signing and identity management?

Accepted Answer

Citadel. Istio's security features are managed by Citadel (now part of istiod), which handles certificate signing and identity. Envoy is the proxy, Pilot provides service discovery, and Mixer was an older component for policy (now deprecated).

Answer

Envoy

Answer

Mixer

Answer

Pilot

Question 2

What is the Open Container Initiative (OCI) responsible for?

Accepted Answer

Defining standards for container images and runtimes. The Open Container Initiative (OCI) is a Linux Foundation project that defines open industry standards for container formats and runtimes. Specifically, it maintains the OCI Image Specification (which standardizes the container image format, including layers and configuration) and the OCI Runtime Specification (which defines the lifecycle and interface for container runtimes like runc). This ensures interoperability between different container tools and platforms.

Answer

Certifying Kubernetes administrators

Answer

Providing a hosted container registry

Answer

Managing the Kubernetes source code

Question 3

You have a Pod that is in 'Pending' state. What is the most likely cause?

Accepted Answer

The node is out of CPU or memory resources.. A Pod in 'Pending' state indicates that the scheduler has not yet assigned it to a node. The most common reason is insufficient resources (CPU or memory) on any available node, causing the scheduler to fail to find a suitable node that meets the Pod's resource requests. This is a core scheduling failure in Kubernetes.

Answer

The application inside the container crashed.

Answer

The container image is missing.

Answer

The Service does not have any endpoints.

Question 4

Which TWO of the following are benefits of using a Deployment over managing ReplicaSets directly? (Choose two.)

Accepted Answer

Declarative scaling. Deployments provide a higher-level abstraction that manages ReplicaSets, enabling declarative scaling by simply updating the `replicas` field in the Deployment manifest. This allows Kubernetes to automatically adjust the number of pods without manual ReplicaSet edits, ensuring the desired state is maintained.

Answer

Support for stateful workloads

Answer

Direct access to pod IP addresses

Answer

Ability to run a pod on every node

Question 5

Which three of the following are valid methods to create or update resources in Kubernetes? (Choose three.)

Accepted Answer

kubectl apply -f manifest.yaml. `kubectl apply -f manifest.yaml` is correct because it uses a declarative approach to create or update resources by applying a configuration file, performing a three-way merge between the local file, the current live object, and the last-applied annotation. `kubectl create -f manifest.yaml` is also correct because it creates resources from a file or stdin, though it will fail if the resource already exists. Using the Kubernetes REST API directly (via HTTP requests like POST for create and PUT for update) is another valid method. `kubectl update` is not a valid kubectl command; the correct imperative commands for updates are `kubectl edit` or `kubectl patch`. `kubectl replace -f manifest.yaml` is an imperative command that will fail if the resource does not exist and is not recommended for general resource management.

Answer

kubectl update -f manifest.yaml

Answer

kubectl replace -f manifest.yaml

Question 6

Which THREE of the following are true about the Container Runtime Interface (CRI)? (Choose 3)

Accepted Answer

CRI allows kubelet to communicate with different container runtimes. CRI is a plugin interface that enables kubelet to use different container runtimes without recompiling. containerd and CRI-O are CRI-compliant runtimes. Docker was deprecated as a Kubernetes runtime and is not CRI-native; it uses dockershim.

Answer

Docker natively implements the CRI

Answer

CRI is part of the Open Container Initiative (OCI)

Question 7

A platform team wants to implement observability for a Kubernetes cluster running 500+ microservices. They need to reduce the cost of storing logs while retaining the ability to search for specific error patterns. Which strategy best achieves this?

Accepted Answer

Use structured logging and sample debug logs, retaining error logs fully. Structured logging (e.g., JSON format) enables efficient indexing and querying of logs, while sampling debug logs and retaining error logs fully reduces storage costs without losing critical error patterns. This approach balances observability needs with cost optimization, a key principle in cloud-native environments.

Answer

Increase log retention to one year for compliance

Answer

Store all logs in a centralized Elasticsearch cluster with high retention

Answer

Aggregate logs into a single pod for easier indexing

Question 8

Which of the following best describes the purpose of the CNCF (Cloud Native Computing Foundation)?

Accepted Answer

To foster and sustain the cloud native ecosystem through project lifecycle management. The CNCF's primary purpose is to foster and sustain the ecosystem of cloud native technologies through project lifecycle management, including sandbox, incubation, and graduation stages. Option B is incorrect because the CNCF is not a standards body for cloud APIs; that is the role of other organizations. Option C is incorrect because the CNCF does not exclusively own Kubernetes; Kubernetes is a CNCF graduated project but governed by the community. Option D is incorrect because the CNCF does not provide cloud infrastructure services; it supports open source projects but does not offer cloud services.

Answer

To standardize cloud computing APIs across cloud providers

Answer

To own and maintain the Kubernetes project exclusively

Answer

To provide cloud infrastructure services to open source projects

Question 9

A user runs 'kubectl exec -it pod1 -- /bin/sh' and gets the error: 'error: unable to upgrade connection: container not found ("app")'. The pod has one container named 'app'. What is the most likely cause?

Accepted Answer

The pod is in a CrashLoopBackOff state. The error 'unable to upgrade connection: container not found ("app")' indicates that kubectl cannot find a running container named 'app' to attach to. When a pod is in CrashLoopBackOff state, the container repeatedly crashes and restarts, but during the backoff period the container is not running, so kubectl exec cannot locate it. This is the most likely cause because the error specifically mentions the container name, and a CrashLoopBackOff means the container is not in a running state.

Answer

The pod is running on a different node

Answer

The container image does not have /bin/sh

Answer

The container name is misspelled

Question 10

Which TWO statements correctly describe how Kubernetes handles self-healing? (Select two.)

Accepted Answer

If a node fails, the ReplicaSet controller automatically recreates the pods on healthy nodes. The ReplicaSet controller monitors the cluster for node failures and, when a node becomes unhealthy, it creates replacement pods on other healthy nodes to maintain the desired replica count. This is a core self-healing mechanism in Kubernetes that operates at the controller level, independent of the kubelet.

Answer

Kubernetes automatically fixes application-level bugs by rolling back to a previous version

Answer

Kubernetes can automatically resolve OOMKilled errors by increasing memory limits

Answer

Kubernetes can automatically resolve OOMKilled errors by increasing memory limits

Question 11

In a serverless architecture using Knative, what happens to a service that has not received traffic for an extended period?

Accepted Answer

It scales down to zero replicas and is reactivated on the next request. Knative scales to zero when idle, meaning no pods are running, thus no cost incurred.

Answer

It throws an error and must be redeployed

Answer

It continues running with one replica to reduce cold start latency

Answer

It is automatically deleted

Question 12

A pod is stuck in the Pending state. Running 'kubectl describe pod <pod-name>' shows the event: '0/3 nodes are available: 1 node had taint {node.kubernetes.io/disk-pressure: }, 2 nodes had taint {node.kubernetes.io/memory-pressure: }'. What is the most likely cause?

Accepted Answer

All nodes have taints that the pod does not have tolerations for. The pod is stuck in Pending because the scheduler cannot find a node that satisfies its scheduling constraints. The events show that all three nodes have taints (disk-pressure and memory-pressure), and the pod does not have corresponding tolerations to allow it to be scheduled on those nodes. Without tolerations, the pod is not permitted to run on any of the available nodes, leaving it in the Pending state.

Answer

The container image is not found in the registry

Answer

The pod has a resource request that exceeds available capacity on all nodes

Answer

The pod's liveness probe is failing

Question 13

A DevOps engineer wants to update a Deployment's container image from 'v1' to 'v2' with zero downtime. Which kubectl command should they use?

Accepted Answer

kubectl set image deployment/ =:v2. `kubectl set image` directly updates the container image in a Deployment's pod template, triggering a rolling update that replaces pods incrementally with zero downtime. Kubernetes Deployments manage ReplicaSets to ensure availability during the update, making this the simplest and most reliable command for a controlled image change.

Answer

kubectl rollout restart deployment/<name>

Answer

kubectl patch deployment -p '{"spec":{"template":{"spec":{"containers":[{"name":"","image":":v2"}]}}}}'

Answer

kubectl edit deployment <name>

Question 14

Which of the following is a key difference between a service mesh and an API gateway?

Accepted Answer

Service mesh manages east-west traffic between services, while API gateway manages north-south traffic from external clients. Service mesh focuses on internal service-to-service communication within the cluster, while API gateway handles external traffic entering the cluster (north-south traffic). Both can perform traffic management, but their scopes differ.

Answer

Service mesh is only used in multi-cloud environments, while API gateway is for single-cloud

Answer

Service mesh provides authentication and authorization, while API gateway does not

Answer

Service mesh handles north-south traffic, while API gateway handles east-west traffic

Question 15

A pod uses a ServiceAccount that has a RoleBinding to a Role with 'get', 'list', 'watch' on 'pods'. The pod tries to list pods in the same namespace. Will the request succeed?

Accepted Answer

Yes, because the Role grants 'list' on pods. In Kubernetes RBAC, permissions are additive. The Role grants 'list' on pods, so the ServiceAccount can list pods. There is no deny rule; RBAC is deny by default, but the permission is explicitly granted. Option A is incorrect because there is no deny rule for pods. Option C is incorrect because a ServiceAccount can list pods if it has the appropriate RBAC permissions. Option D is incorrect because a ClusterRoleBinding is not required; a RoleBinding in the same namespace is sufficient.

Answer

No, because there is a deny rule for pods

Answer

No, because ServiceAccount cannot list pods

Answer

Yes, but only if the ServiceAccount also has a ClusterRoleBinding