KCNA Practice Test 19 — 15 Questions

Question 1

A Service of type ClusterIP is created for a Deployment, but Pods in other namespaces cannot reach it. What is the most likely cause?

Accepted Answer

The Pods in other namespaces are using the short Service name without the namespace suffix. The most likely cause is that Pods in other namespaces are using the short Service name (e.g., `my-service`) without appending the namespace suffix (e.g., `my-service.other-namespace.svc.cluster.local`). Kubernetes DNS resolves short names only within the same namespace; cross-namespace resolution requires the fully qualified domain name (FQDN) or at least the `..svc` form. Without this, the DNS lookup fails, making the Service unreachable from other namespaces.

Answer

NetworkPolicies are blocking cross-namespace traffic

Answer

The Service is not publishing the correct port

Answer

The Service selector does not match the Pod labels

Question 2

Which command would you use to view the logs of a container named 'nginx' in a Pod named 'web-pod'?

Accepted Answer

kubectl logs web-pod -c nginx. The `kubectl logs` command retrieves container logs from a Pod, and when a Pod contains multiple containers, the `-c` flag is required to specify which container's logs to view. Here, `kubectl logs web-pod -c nginx` explicitly targets the 'nginx' container within the 'web-pod' Pod, which is the standard Kubernetes API approach for fetching container stdout/stderr streams.

Answer

kubectl logs web-pod nginx

Answer

kubectl describe pod web-pod

Answer

kubectl exec web-pod -- cat /var/log/nginx/access.log

Question 3

Which of the following kubectl commands would you use to update a Deployment's image to 'nginx:1.21' and record the change in the rollout history?

Accepted Answer

kubectl set image deployment/nginx nginx=nginx:1.21 --record. `kubectl set image deployment/nginx nginx=nginx:1.21 --record` updates the container image of the specified deployment and, with the `--record` flag, annotates the change in the rollout history (stored in the `kubernetes.io/change-cause` annotation). This allows you to later inspect the change with `kubectl rollout history deployment/nginx`.

Answer

kubectl edit deployment nginx --image=nginx:1.21

Answer

kubectl set image deployment/nginx nginx=nginx:1.21

Answer

kubectl patch deployment nginx -p '{"spec":{"template":{"spec":{"containers":[{"name":"nginx","image":"nginx:1.21"}]}}}}' --record

Question 4

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running controller loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller loops, which are continuous processes that watch the shared state of the cluster through the kube-apiserver and make changes to drive the current state toward the desired state. Each controller (e.g., ReplicaSet, Node, Deployment) is a separate loop that handles a specific aspect of cluster management, ensuring that the actual cluster state matches the desired configuration defined in the API objects.

Answer

etcd

Answer

kube-apiserver

Answer

kube-scheduler

Question 5

A team is designing a cloud-native application that requires each microservice to have its own database. This pattern is known as:

Accepted Answer

Database-per-service pattern. The Database-per-service pattern is the correct answer because it ensures each microservice owns and manages its own database, enforcing loose coupling and data encapsulation. This aligns with the cloud-native principle of decentralized data management, where services communicate only via APIs and never access each other's databases directly. It prevents tight coupling at the data layer, which is critical for independent scaling, deployment, and resilience in a microservices architecture.

Answer

Saga pattern

Answer

Shared database pattern

Answer

CQRS pattern

Question 6

A team uses Flux with the Source Controller and Kustomize Controller. They update a YAML file in Git to change a Deployment's replica count. What describes the synchronization flow?

Accepted Answer

The Kustomize Controller fetches the source and applies the rendered manifests. Flux Source Controller fetches changes from Git; Kustomize Controller reconciles the kustomization and applies to the cluster.

Answer

The Source Controller directly applies the manifest to the cluster

Answer

Flux uses HelmReleases to apply changes

Answer

Flux requires a manual kubectl apply to sync

Question 7

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is failing with an 'OOMKilled' status, which indicates that the container's memory usage exceeded its configured memory limit. Increasing the memory limit in the pod's container resource specification allows the container to use more memory without being terminated by the Out-Of-Memory (OOM) killer, resolving the crash loop. This is the most direct and appropriate action to address the resource exhaustion.

Answer

Delete and recreate the pod to clear the crash loop

Answer

Increase the CPU request for the container

Answer

Delete the namespace and redeploy all workloads

Question 8

What is the purpose of the circuit breaker pattern in a microservices architecture?

Accepted Answer

To prevent a service from being overwhelmed by requests when it is failing. The circuit breaker pattern is a stability pattern that monitors for failures and prevents a service from making requests to a failing downstream service, allowing it to recover. When the failure rate exceeds a threshold (e.g., 50% of requests fail within a 10-second sliding window), the circuit 'opens' and subsequent calls fail immediately without consuming resources. This prevents cascading failures and resource exhaustion in distributed systems like Kubernetes or Spring Cloud.

Answer

To balance load across multiple instances

Answer

To handle authentication between services

Answer

To encrypt data in transit

Question 9

You are a platform engineer at a fast-growing startup. The company runs a Kubernetes cluster with 50 worker nodes for its production microservices. Recently, the operations team has been struggling with manual configuration drift: developers SSH into nodes to install debugging tools, and some nodes have different kernel parameters or installed packages. This has caused intermittent outages when a pod is scheduled onto a non-standard node. The CTO wants a solution that ensures each node is identical, immutable, and reproducible. The cluster uses kubeadm for bootstrapping and runs on AWS EC2. Which approach best achieves the goal of immutable nodes?

Accepted Answer

Create a golden AMI using Packer with all required configurations, then use Auto Scaling groups with a launch template that references the AMI and enable instance refresh for updates.. It uses a golden AMI built with Packer to create identical, immutable nodes that are reproducible via Auto Scaling groups and launch templates. This approach ensures that every EC2 instance launched has the exact same kernel parameters, packages, and configuration, eliminating configuration drift. Instance refresh allows rolling updates to the AMI without manual intervention, aligning with the goal of immutable infrastructure.

Answer

Use a configuration management tool like Ansible to enforce desired state on each node via periodic runs.

Answer

Apply Kubernetes node labels and taints to categorize nodes and prevent workloads from running on non-standard nodes.

Answer

Deploy a DaemonSet that runs a privileged container to enforce node configuration and remove debugging tools.

Question 10

Match each Kubernetes security concept to its definition.

Accepted Answer

RBAC: Controls access to the Kubernetes API based on roles and permissions.. RBAC and NetworkPolicy are fundamental security mechanisms. ServiceAccount provides identity. The distractors confuse RBAC with secrets management and NetworkPolicy with user access control.

Answer

RBAC: Manages secrets and encryption at rest.

Answer

NetworkPolicy: Controls which users can access the cluster.

Question 11

A StatefulSet named 'web' with 3 replicas is deployed in the 'production' namespace. The first two pods are running, but the third pod 'web-2' is pending with the error shown. What is the most likely cause?

Accepted Answer

The pod anti-affinity rule prevents more than one pod per node, and there are only 3 nodes. The error indicates that the third pod 'web-2' is pending due to a scheduling conflict. Pod anti-affinity rules, when configured with a 'requiredDuringSchedulingIgnoredDuringExecution' policy, prevent more than one pod from the same StatefulSet from being scheduled on the same node. With only 3 nodes available and the first two pods already occupying distinct nodes, the third pod cannot be placed, causing it to remain pending.

Answer

The StatefulSet requires a headless Service that does not exist

Answer

The pod has a resource request that cannot be satisfied by any node

Answer

There are not enough nodes in the cluster to schedule the third pod

Question 12

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/4 nodes are available: 4 node(s) had taint {node.kubernetes.io/unreachable: }, that the pod didn't tolerate.' What is the most likely cause?

Accepted Answer

All nodes are unreachable or have been cordoned.. The taint `node.kubernetes.io/unreachable` is automatically added by the node controller when a node becomes unreachable (e.g., network failure, kubelet stops heartbeating). The error shows all 4 nodes have this taint and the pod has no matching toleration, meaning the scheduler cannot place the pod. This directly indicates all nodes are unreachable or have been cordoned (which also adds the `node.kubernetes.io/unschedulable` taint, but here the specific taint is `unreachable`).

Answer

All nodes have disk pressure.

Answer

The pod has a toleration that matches the taint.

Answer

The nodes do not have enough CPU or memory.

Question 13

What is the primary purpose of a Kubernetes Service?

Accepted Answer

To provide a stable network endpoint for a set of Pods. A Service provides a stable endpoint for a set of Pods, enabling discovery and load balancing across them.

Answer

To manage rolling updates of Pods

Answer

To schedule Pods onto Nodes

Answer

To store configuration data for Pods

Question 14

A startup wants to minimize downtime during application updates in Kubernetes. Which deployment strategy should they use?

Accepted Answer

RollingUpdate. The RollingUpdate strategy is the default in Kubernetes and minimizes downtime by gradually replacing old Pods with new ones while the application remains available. It uses a configurable `maxSurge` and `maxUnavailable` parameters to control the rate of change, ensuring that a specified number of Pods are always serving traffic. This makes it ideal for startups seeking zero-downtime updates without the complexity of additional tooling or infrastructure.

Answer

Canary

Answer

Blue/Green

Answer

Recreate

Question 15

Which two of the following are valid ways to expose a set of Pods to external traffic?

Accepted Answer

Create a Service of type NodePort. A Service of type NodePort exposes each Pod's port on a static port (the NodePort) on every node's IP address, allowing external traffic to reach the Pods via :. This is a valid method for exposing a set of Pods to external traffic without requiring a cloud load balancer.

Answer

Use a ConfigMap to expose the Pods

Answer

Create an Ingress resource without a Service

Answer

Create a Service of type ClusterIP