KCNA Practice Test 17 — 15 Questions

Question 1

A cluster administrator needs to run a node-level logging agent on every node, including nodes added later. The agent must collect logs from the host filesystem and must run even if a node is cordoned. Which workload resource should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A DaemonSet. DaemonSets are purpose-built for per-node workloads. The DaemonSet controller creates a pod on each eligible node and adds new pods when nodes join the cluster. Its default tolerations allow the pods to run on nodes that are unschedulable or carry common taints, which is essential for infrastructure agents like log shippers, monitoring exporters, and CNI plugins that must operate everywhere.

Answer

A StatefulSet with one replica per node

Answer

A Job with a parallelism equal to the number of nodes

Answer

A Deployment with a nodeSelector matching each node's label

Question 2

A cluster administrator needs to schedule a pod that requires 4 CPU cores and 16Gi of memory on a node with sufficient resources. The pod also must tolerate a taint on a dedicated node. Which combination of pod spec fields must be set to ensure the pod lands on the correct node?

Accepted Answer

resources.requests and tolerations. The scheduler uses resource requests to filter nodes that have enough allocatable CPU and memory. Tolerations are required to permit scheduling onto a node with a taint. Limits and nodeSelector do not satisfy the dual requirement of resource fit and taint tolerance. Therefore, the pod must specify both requests and tolerations.

Answer

resources.limits and nodeSelector

Answer

tolerations and resources.limits

Answer

affinity and resources.limits

Question 3

A developer wants to store non-sensitive configuration data, such as a database hostname and port, that multiple pods in different namespaces will consume as environment variables. The data must be reusable and not hardcoded in pod specs. Which Kubernetes resource is most appropriate?

Accepted Answer

A ConfigMap. ConfigMaps are the standard Kubernetes object for storing non-confidential configuration data in key-value form. They decouple configuration from pod specifications, allowing the same data to be consumed by multiple pods across namespaces. Pods can reference ConfigMaps as environment variables, command-line arguments, or mounted files. This promotes reusability and avoids hardcoding values in pod definitions.

Answer

An emptyDir volume

Answer

A downward API volume

Answer

A Secret with type Opaque

Question 4

Which of the following is a characteristic of immutable infrastructure?

Accepted Answer

Infrastructure components are never changed after deployment; they are replaced. Immutable infrastructure means that once a component (e.g., a server, container, or VM) is deployed, it is never modified. If an update is needed, the entire component is replaced with a new version. This eliminates configuration drift and ensures consistency across environments, which is a core principle in container orchestration with Kubernetes.

Answer

Infrastructure is version-controlled using Git

Answer

Servers are updated in-place with configuration management tools

Answer

Containers are used to ensure portability

Question 5

A developer creates a Deployment with 3 replicas. After a few seconds, they run `kubectl get deployments` and see `READY 2/3`. They want to quickly identify why one replica is not ready. Which command should they use to inspect the status of the individual Pods?

Accepted Answer

kubectl get pods -l app=myapp -o wide. To quickly identify which Pod is not ready, listing Pods with the Deployment's label selector and wide output shows each Pod's status and node. This provides an immediate view of which replica is failing and basic context. Describing the Deployment or fetching logs from the Deployment does not show per-Pod readiness. Filtering events by the Deployment name misses Pod-level events. The correct approach is to query the Pods directly.

Answer

kubectl describe deployment myapp

Answer

kubectl get events --field-selector involvedObject.name=myapp

Answer

kubectl logs deployment/myapp

Question 6

A Kubernetes cluster runs a critical application that must be highly available. The application consists of three pods managed by a Deployment. To ensure the application remains accessible during a node failure, which configuration should be applied?

Accepted Answer

Set podAntiAffinity with requiredDuringSchedulingIgnoredDuringExecution to enforce pods on different nodes.. To guarantee that pods are spread across different nodes, a hard pod anti-affinity rule is needed. requiredDuringSchedulingIgnoredDuringExecution enforces that no two pods with the specified labels can be on the same node. This ensures that a single node failure does not take down all replicas. Soft anti-affinity, topology spread with ScheduleAnyway, and node affinity do not provide the same hard guarantee.

Answer

Set nodeAffinity to require pods to run on specific nodes.

Answer

Set topologySpreadConstraints with maxSkew: 1 and whenUnsatisfiable: ScheduleAnyway.

Answer

Set podAntiAffinity to prefer scheduling pods on different nodes.

Question 7

A cluster administrator needs to run a node-level logging agent on every node, including nodes added later. The agent must collect logs from the host filesystem and must run even if a node is cordoned. Which workload resource should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A DaemonSet with a toleration for the control-plane taint.. A DaemonSet is designed for node-level agents such as log shippers, monitoring exporters, and CNI plugins. It places one Pod on each node that matches scheduling constraints and automatically covers nodes that join later. Combining it with a toleration for the control-plane taint allows the agent to run on control-plane nodes as well, satisfying the administrator's full-coverage requirement.

Answer

A StatefulSet with podAntiAffinity requiring one Pod per node.

Answer

A ReplicaSet with replicas equal to the current node count.

Answer

A Deployment with a nodeSelector for each existing node name.

Question 8

In the context of resiliency patterns, which pattern is designed to prevent a cascade of failures by isolating each component so that a failure in one component does not affect others?

Accepted Answer

Bulkhead. The bulkhead pattern isolates resources (e.g., thread pools, connections) so that a failure in one part of the system doesn't bring down other parts. Circuit breaker is for handling failures of external calls, not isolation.

Answer

Retry

Answer

Circuit breaker

Answer

Timeout

Question 9

A developer creates a Pod with a single container that writes logs to stdout. The Pod is running, but the developer wants to view the last 50 lines of logs from that container and have the command keep streaming new output. Which kubectl command accomplishes this?

Accepted Answer

kubectl logs mypod -c app --tail=50 -f. The kubectl logs command retrieves container output. The --tail flag limits the number of historical lines, and -f or --follow streams subsequent entries. Combining them gives the last 50 lines plus live updates. The -c flag selects a container when more than one exists. Other flags such as --since use time durations, and describe is unrelated to log retrieval.

Answer

kubectl logs mypod --since=50 -f

Answer

kubectl describe pod mypod --tail=50 -f

Answer

kubectl logs mypod --tail=50 --follow=false

Question 10

A developer needs to deploy a stateless application with three replicas and ensure that updates are rolled out with zero downtime. Which Kubernetes resource is most appropriate?

Accepted Answer

Deployment. A Deployment is the correct resource because it manages a ReplicaSet to ensure the desired number of pod replicas (three) are running, and it supports rolling updates with configurable strategies (e.g., maxSurge and maxUnavailable) to achieve zero-downtime updates. Stateless applications are ideal for Deployments since pods are interchangeable and can be replaced without data loss.

Answer

StatefulSet

Answer

Job

Answer

DaemonSet

Question 11

A platform team is designing a system that must continue serving requests for a product catalog even if the recommendation service becomes unavailable. The recommendation service calls the catalog service to fetch item details, and when it fails, the catalog service should keep responding to user traffic. Which cloud-native architecture principle BEST describes the required behavior for the catalog service?

Accepted Answer

Design for failure and graceful degradation of non-critical dependencies. The catalog service must remain available even when the recommendation service fails. That requires treating the recommendation dependency as non-critical and designing for failure, so the catalog service can degrade gracefully rather than propagate the failure. The other choices either change communication style, scale the wrong service, or introduce tighter coupling, none of which satisfies the requirement.

Answer

Storing all catalog and recommendation data in a single shared relational database

Answer

Vertical scaling of the recommendation service to handle peak load

Answer

Loose coupling through asynchronous, queue-based communication

Question 12

A team is deploying a microservices application on Kubernetes. They want to ensure that each microservice can be updated independently without affecting others, and that the application can tolerate the failure of a single microservice. Which cloud-native architecture principle are they applying?

Accepted Answer

Microservices architecture. Microservices architecture is the correct principle because it structures an application as a collection of loosely coupled services, each independently deployable and scalable. This allows teams to update one service without redeploying others, and a failure in one service can be isolated, preventing cascading failures. The scenario highlights these exact benefits, aligning with microservices principles.

Answer

Monolithic architecture

Answer

Serverless architecture

Answer

Service mesh

Question 13

What is the purpose of the Container Runtime Interface (CRI) in Kubernetes?

Accepted Answer

To allow kubelet to use different container runtimes. The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a variety of container runtimes without needing to recompile the Kubernetes source code. By defining a standard API (gRPC-based) for runtime operations like pulling images and managing containers, CRI decouples Kubernetes from specific runtime implementations such as containerd, CRI-O, or Docker (via dockershim). This abstraction allows cluster administrators to choose the most suitable runtime for their environment while maintaining compatibility with the Kubernetes control plane.

Answer

To manage persistent storage for containers

Answer

To provide a network plugin interface for pods

Answer

To define a standard for container images

Question 14

A team is adopting cloud-native architecture and wants to ensure that a single failing component does not take down the entire application. They are reviewing the design of their microservices deployment. Which characteristic of cloud-native architecture is MOST directly related to limiting the impact of a component failure?

Accepted Answer

Loose coupling and isolation between services. Loose coupling and isolation allow services to fail independently without cascading failures across the application. By keeping services separate and communicating through stable interfaces, a failure in one service does not automatically bring down others. Immutable infrastructure, monolithic deployment, and manual configuration do not provide that fault containment, so they do not satisfy the stated goal.

Answer

Immutable infrastructure

Answer

Manual configuration of each service instance

Answer

Using a monolithic deployment for all services

Question 15

Which CNCF project maturity level indicates that a project has adopted the CNCF Code of Conduct and is considered early-stage?

Accepted Answer

Sandbox. The CNCF has three maturity levels: sandbox (early-stage), incubating (growing), and graduated (mature). Sandbox projects are early-stage and have accepted the CNCF Code of Conduct.

Answer

Incubating

Answer

Graduated

Answer

Experimental