KCNA Practice Test 20 — 15 Questions

Question 1

Which Kubernetes object is used to store non-sensitive configuration data that can be consumed by pods?

Accepted Answer

ConfigMap. ConfigMap is the correct Kubernetes object for storing non-sensitive configuration data, such as environment variables, command-line arguments, or configuration files, that can be consumed by pods. Unlike Secrets, ConfigMaps store data in plaintext and are designed for configuration that does not require encryption, making them ideal for application settings that are not confidential.

Answer

Secret

Answer

ServiceAccount

Answer

PersistentVolume

Question 2

A user wants to run a one-time batch job that runs to completion. Which Kubernetes resource should they use?

Accepted Answer

Job. A Kubernetes Job is the correct resource for a one-time batch job that runs to completion. Unlike controllers designed for long-running processes, a Job creates one or more Pods and ensures they successfully terminate, making it ideal for finite tasks like data processing or backups.

Answer

StatefulSet

Answer

DaemonSet

Answer

Deployment

Question 3

A user runs 'kubectl get pods -n default' but receives an error: 'Error from server (Forbidden): pods is forbidden: User cannot list resource pods in API group'. What is the most likely cause?

Accepted Answer

The user lacks RBAC permissions to list pods. The error message 'Error from server (Forbidden): pods is forbidden: User cannot list resource pods in API group' directly indicates that the Kubernetes RBAC (Role-Based Access Control) system has denied the request. The user's current context in their kubeconfig does not have a Role or ClusterRole binding that grants the 'list' verb on 'pods' in the 'v1' API group (core group). This is a standard authorization failure, not a connectivity or resource existence issue.

Answer

The pod does not exist in the namespace

Answer

The user's kubeconfig file is corrupted

Answer

The API server is down

Question 4

A ClusterIP Service named 'db-service' in namespace 'prod' selects pods with label 'app: database'. A pod in the same cluster needs to reach this service using DNS. What is the fully qualified domain name (FQDN) for the service?

Accepted Answer

db-service.prod.svc.cluster.local. The correct FQDN for a Kubernetes Service follows the pattern ..svc.cluster.local. Since the 'db-service' ClusterIP Service is in the 'prod' namespace, the FQDN is 'db-service.prod.svc.cluster.local'. This allows any pod in the cluster to resolve the service's cluster IP via DNS, using the cluster domain 'cluster.local' by default.

Answer

db-service.cluster.local

Answer

db-service.svc.cluster.local

Answer

db-service.prod.cluster.local

Question 5

A developer wants to expose a set of pods running a web application on a stable IP address. Which Kubernetes resource should they create?

Accepted Answer

Service. A Service in Kubernetes provides a stable IP address and DNS name to expose a set of pods, abstracting away pod IP changes due to scaling or restarts. It acts as a load balancer across the pods, typically using ClusterIP (default), NodePort, or LoadBalancer types. This directly meets the requirement of exposing pods on a stable IP.

Answer

ConfigMap

Answer

Ingress

Answer

NetworkPolicy

Question 6

Which kubectl command is used to see the logs of a container in a pod?

Accepted Answer

kubectl logs . `kubectl logs ` is the dedicated command to retrieve and display the logs from the default container in a specified pod. This command directly accesses the container's stdout and stderr streams, which are captured by the container runtime (e.g., containerd or CRI-O) and stored by the kubelet, making it the standard and simplest way to view application logs.

Answer

kubectl attach <pod-name>

Answer

kubectl exec <pod-name> -- cat /var/log/app.log

Answer

kubectl describe pod <pod-name>

Question 7

Which field in a Deployment YAML specifies the number of pod replicas?

Accepted Answer

spec.replicas. In a Kubernetes Deployment YAML, the `spec.replicas` field directly defines the desired number of pod replicas that the Deployment controller should maintain. This is a top-level field under the Deployment spec, not nested under `template.spec`, because the replica count is a property of the Deployment itself, not of the Pod template.

Answer

spec.template.spec.replicas

Answer

spec.replicaCount

Answer

spec.selector.matchLabels

Question 8

A developer wants to run a stateless web application with 5 replicas and ensure that when a new version is released, Pods are updated one by one with no downtime. Which Kubernetes resource is best suited?

Accepted Answer

Deployment. A Deployment is the correct resource because it is designed for managing stateless, replicated applications with declarative updates. It supports rolling updates (configurable via `strategy.type: RollingUpdate`), which update Pods one by one, ensuring zero downtime by gradually replacing old Pods with new ones while maintaining the desired replica count.

Answer

Job

Answer

DaemonSet

Answer

StatefulSet

Question 9

Which TWO of the following are characteristics of a Kubernetes Pod?

Accepted Answer

Pods are the smallest deployable units in Kubernetes. Option B is correct because the Pod is the smallest and most basic deployable object in Kubernetes — you cannot deploy a container directly; it must be wrapped in a Pod, which represents a single instance of a running process in the cluster. Option C is correct because all containers in a Pod share the same network namespace, meaning they share one IP address and port space and can communicate with each other via localhost, and they can also share storage volumes. Option A is incorrect because a Pod can run one or multiple containers (e.g., sidecar, ambassador, or adapter patterns), not only a single container. Option D is incorrect because Pods are ephemeral by design — they are not intended to be long-lived; they are created, terminated, and replaced rather than repaired in place. Option E is incorrect as a defining characteristic of a Pod itself: replication is performed by higher-level controllers such as Deployments or ReplicaSets, which manage Pods but are not properties of the Pod object.

Answer

Pods can only run a single container

Answer

Pods are designed to be long-lived and rarely replaced

Answer

Pods are typically replicated by a Deployment or ReplicaSet

Question 10

Which three of the following are true about etcd in Kubernetes?

Accepted Answer

etcd stores all cluster state, including Pods, ConfigMaps, and Secrets. Option A is correct because etcd is the backing store for the Kubernetes API server, persisting the entire cluster state — every object such as Pods, ConfigMaps, Secrets, Deployments, and ServiceAccounts — as serialized data under keys like /registry/pods. Option C is correct because etcd is architecturally a distributed, strongly consistent key-value store built on the Raft consensus algorithm, which guarantees linearizable reads and writes across its cluster members. Option E is correct because etcd exposes a watch API that lets clients subscribe to a key or key range and receive streaming notifications whenever those keys change, which is exactly how the Kubernetes API server drives its informers and controllers. Option B is wrong because etcd is not relational: it has no tables, schemas, joins, or SQL, only a flat hierarchical keyspace. Option D is wrong because etcd is not a message queue; it offers no publish/subscribe topics, consumer groups, or delivery guarantees like RabbitMQ or Kafka, and using it as one is an anti-pattern.

Answer

etcd is a relational database

Answer

etcd can be used as a message queue

Question 11

A cluster administrator wants to ensure that a specific pod only runs on nodes that have an SSD for local storage. The nodes with SSDs have the label 'disk-type: ssd'. How should the administrator configure the pod to enforce this constraint?

Accepted Answer

Add a nodeSelector with 'disk-type: ssd' to the pod spec. The `nodeSelector` field in a Pod spec is the standard Kubernetes mechanism for constraining a Pod to run only on nodes that match specific labels. By setting `nodeSelector: { disk-type: ssd }`, the scheduler will ensure the Pod is placed exclusively on nodes with that label, enforcing the administrator's requirement.

Answer

Add a toleration for node.kubernetes.io/disk-type: ssd

Answer

Use a readiness probe to check for SSD

Answer

Add an annotation 'disk-type: ssd' to the pod

Question 12

A developer created a Deployment with image 'myapp:v1' and then ran 'kubectl set image deployment/myapp myapp=myapp:v2'. What is the effect of this command?

Accepted Answer

It updates the Deployment's pod template to use the new image, triggering a rolling update.. The `kubectl set image deployment/myapp myapp=myapp:v2` command updates the pod template within the Deployment's specification to use the new image `myapp:v2`. This change triggers a rolling update, where the Deployment controller creates new pods with the updated image and gradually terminates old pods, ensuring zero downtime. The command does not affect Services, create new Deployments, or restart pods immediately without a rolling update strategy.

Answer

It updates the Service selector to point to pods with the new image.

Answer

It creates a new Deployment named 'v2' with the new image.

Answer

It immediately restarts all pods with the new image.

Question 13

Which Kubernetes component is responsible for maintaining the desired state of the cluster by running controller loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller loops to regulate the state of the cluster. Each controller (e.g., Node Controller, Replication Controller) watches the shared state via the API server and makes changes to drive the actual cluster state toward the desired state defined in the control plane. This is the core mechanism for self-healing and maintaining declarative configuration.

Answer

etcd

Answer

kube-apiserver

Answer

kube-scheduler

Question 14

A pod in the 'default' namespace has the following YAML snippet:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
What is the effect of the fsGroup field?

Accepted Answer

It sets the group ID for any volumes mounted into the pod.. The `fsGroup` field in a Pod's security context sets the group ID (GID) that will be used for ownership of any volumes mounted into the pod. When a volume is mounted, Kubernetes recursively changes the group ownership of the volume's files to the specified GID (2000 in this case) and makes them readable and writable by that group. This ensures that processes running in the container, which may have a different primary group (3000 from `runAsGroup`), can still access the volume files if they are members of the fsGroup.

Answer

It restricts the pod to run only on nodes with that group ID.

Answer

It defines the group ID for the pod's service account.

Answer

It sets the group ID for the container's main process.

Question 15

Which Kubernetes object is used to logically isolate resources within a cluster, such as for separating environments like dev and prod?

Accepted Answer

Namespace. D is correct because a Namespace is the Kubernetes object designed to logically isolate resources within a single cluster. By creating separate Namespaces for environments like dev and prod, you can apply distinct policies, quotas, and access controls without needing multiple physical clusters.

Answer

ClusterRole

Answer

ResourceQuota

Answer

Node