KCNA Practice Exam 3 — 20 Questions

Question 1

Which service mesh component is responsible for handling inter-service communication as a sidecar proxy?

Accepted Answer

Envoy. Envoy is the correct answer because it is the sidecar proxy component in Istio that handles all inter-service communication. It intercepts traffic between microservices and applies routing, load balancing, and security policies defined by the control plane. Envoy runs as a sidecar container alongside each service instance, managing inbound and outbound traffic at the L4/L7 layer.

Answer

Mixer

Answer

Pilot

Answer

Citadel

Question 2

What is the smallest deployable unit in Kubernetes that can be created, scheduled, and managed?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model that can be created, scheduled, and managed. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. While containers are the underlying runtime, Kubernetes does not schedule containers directly; it schedules Pods as the atomic unit of deployment.

Answer

Deployment

Answer

Node

Answer

Container

Question 3

Which THREE of the following are benefits of structured logging? (Select three.)

Accepted Answer

Easier querying and filtering. Structured logging emits events as key-value pairs (typically JSON), so option A is correct because fields like level, service, or trace_id can be queried and filtered directly in tools such as Elasticsearch, Loki, or CloudWatch Logs Insights without fragile regex parsing. Option D is correct because that same machine-parseable format lets log processors, SIEMs, and observability pipelines ingest and index records programmatically and reliably. Option E is correct because adopting a shared schema with consistent field names across services enables correlation and aggregation across distributed systems, which is a core goal of structured logging. Option B is not a benefit: structured logs are usually less human-readable than free-form plain text, which is why pretty-printers exist. Option C is not a benefit either: JSON key-value output typically increases log size versus terse plain-text lines due to repeated field names and delimiters, so storage requirements usually grow rather than shrink.

Answer

More human-readable than plain text

Answer

Reduced storage requirements

Question 4

A company is deploying a microservices application on Kubernetes. They want to ensure that configuration data, such as database URLs and feature flags, can be updated without rebuilding container images. Which Kubernetes resource should they use?

Accepted Answer

ConfigMaps. ConfigMaps are the correct Kubernetes resource for decoupling configuration data (like database URLs and feature flags) from container images. They allow you to inject configuration as environment variables or mounted volumes without rebuilding or redeploying the container image, enabling runtime updates.

Answer

Secrets

Answer

Services

Answer

Deployments

Question 5

Which Prometheus metric type is used to represent a value that can increase or decrease over time, such as memory usage?

Accepted Answer

Gauge. A gauge is the Prometheus metric type designed to represent a value that can arbitrarily go up or down, such as memory usage, temperature, or current connections. Unlike counters, gauges are not monotonic and can be set to any value, making them ideal for instantaneous measurements. Memory usage fluctuates as processes allocate and free memory, so a gauge accurately captures this behavior.

Answer

Histogram

Answer

Summary

Answer

Counter

Question 6

A Deployment named 'app-deploy' is configured with strategy type: RollingUpdate. You want to update the container image to a new version. What kubectl command should you use?

Accepted Answer

kubectl set image deployment/app-deploy app=new:tag. `kubectl set image` is the dedicated command for updating the container image of an existing deployment without modifying other fields. It directly modifies the deployment's pod template spec to use the new image, triggering a rolling update as defined by the deployment's strategy type.

Answer

kubectl apply -f updated-deployment.yaml

Answer

kubectl edit deployment app-deploy

Answer

kubectl patch deployment app-deploy -p '{"spec":{"template":{"spec":{"containers":[{"name":"app","image":"new:tag"}]}}}}'

Question 7

Which Prometheus metric type is best suited for counting the total number of HTTP requests received by a service?

Accepted Answer

Counter. A counter is a cumulative metric that only increases (or resets to zero). It is ideal for counting events like HTTP requests.

Answer

Summary

Answer

Gauge

Answer

Histogram

Question 8

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event '0/4 nodes are available: 4 Insufficient cpu'. What is the most likely cause?

Accepted Answer

None of the nodes have enough CPU resources to satisfy the pod's request. The '0/4 nodes are available: 4 Insufficient cpu' event directly indicates that the Kubernetes scheduler attempted to place the pod on each of the four nodes but found that none had enough allocatable CPU capacity to satisfy the pod's CPU request (specified in the container's `resources.requests.cpu`). This causes the pod to remain in 'Pending' state because the scheduler cannot find a feasible node.

Answer

The pod has exceeded its memory limit

Answer

The pod's image pull is failing

Answer

The pod's liveness probe is failing

Question 9

Which of the following is a core principle of the 12-factor app methodology?

Accepted Answer

Treat logs as event streams. The 12-factor app methodology, a set of best practices for building modern, scalable applications, includes the principle 'Treat logs as event streams.' This means an app should not concern itself with routing or storage of its output stream; instead, it writes logs to stdout/stderr, and the execution environment captures and routes them. This decouples log management from the application, enabling flexibility and scalability.

Answer

Store configuration in the application code

Answer

Store logs in the local filesystem of each container

Answer

Use shared filesystems for persistent storage

Question 10

Which of the following describes the Open Container Initiative (OCI) image specification?

Accepted Answer

A standard for container images and runtimes. The Open Container Initiative (OCI) image specification defines a standard format for container images, ensuring that any OCI-compliant image can be run by any OCI-compliant runtime (e.g., runc, crun). This specification covers the image manifest, filesystem layers, and configuration, enabling interoperability across different container platforms like Docker, Podman, and containerd. Option A is correct because the OCI specifically standardizes both the image format and the runtime behavior, not higher-level orchestration or infrastructure concerns.

Answer

A specification for container orchestration

Answer

A specification for container storage

Answer

A specification for container networking

Question 11

Which THREE of the following are valid use cases for distributed tracing in a microservices architecture?

Accepted Answer

Understanding the dependency graph between microservices. Distributed tracing is designed to follow a single request as it propagates across service boundaries, so option B is correct because the spans and parent-child relationships recorded in a trace directly reveal the dependency graph and call topology between microservices. Option C is correct because a trace correlates spans across services with shared trace IDs, letting you locate the exact failing span and thus the root cause of an error in a distributed transaction. Option D is correct because span durations and timestamps expose per-service latency contributions, making it possible to identify which service adds the most latency to an end-user request. Option A is not a tracing use case; CPU and memory usage per instance are collected by metrics/monitoring tools such as Prometheus or CloudWatch, not by distributed tracing. Option E is also not specific to tracing; detailed error messages and stack traces are typically captured by centralized logging or error-tracking systems, even though traces may carry limited error tags.

Answer

Monitoring CPU and memory usage of each service instance

Answer

Capturing detailed error messages and stack traces

Question 12

A user runs 'kubectl create deployment my-deploy --image=nginx' and then wants to scale the deployment to 5 replicas. Which command should they use?

Accepted Answer

kubectl scale deployment my-deploy --replicas=5. `kubectl scale` is the dedicated imperative command to change the replica count of a deployment. It directly updates the `spec.replicas` field in the deployment's desired state, and the deployment controller then adjusts the ReplicaSet and Pods accordingly. This is the simplest and most direct way to scale a deployment without modifying a YAML file or using an editor.

Answer

kubectl apply -f deployment.yaml with replicas: 5

Answer

kubectl edit deployment my-deploy and change replicas to 5

Answer

kubectl patch deployment my-deploy -p '{"spec":{"replicas":5}}'

Question 13

Which TWO of the following are functions of the kube-controller-manager?

Accepted Answer

Managing replication and ensuring the desired number of pods are running. Option A is correct because the kube-controller-manager runs the ReplicationController/ReplicaSet controller, which continuously reconciles the actual number of running pods with the desired replica count specified in the resource. Option D is correct because the kube-controller-manager includes the node controller, which monitors node health via heartbeats/leases and responds to node failures by marking nodes NotReady and evicting or rescheduling their pods. Option B is incorrect because cluster state is persisted in etcd, not by the kube-controller-manager. Option C is incorrect because the Kubernetes API is exposed by the kube-apiserver. Option E is incorrect because pod-to-node assignment (scheduling) is performed by the kube-scheduler.

Answer

Storing cluster state

Answer

Exposing the Kubernetes API

Answer

Assigning pods to nodes

Question 14

Which THREE are benefits of using container orchestration platforms like Kubernetes?

Accepted Answer

High availability through automatic container restart and replication. Option A is correct because Kubernetes provides high availability by automatically restarting failed containers and maintaining the desired number of replicas across nodes, ensuring workloads remain available even when individual containers or nodes fail. Option B is correct because Kubernetes supports automatic scaling of container replicas through mechanisms like the Horizontal Pod Autoscaler, which adjusts replica counts based on observed CPU, memory, or custom metrics. Option C is correct because Kubernetes performs self-healing by detecting failed containers, pods, or nodes and replacing or rescheduling them without manual intervention, restoring the declared desired state. Option D is not a benefit of orchestration because Kubernetes manages deployment and runtime concerns, not application source code, so developers still must write and modify code as needed. Option E is incorrect because orchestration platforms do not eliminate monitoring and logging; they integrate with tools like Prometheus, Grafana, and the ELK stack, and observability remains essential for operating containerized workloads.

Answer

Simplified application development by eliminating the need for code changes

Answer

Elimination of the need for monitoring and logging

Question 15

Which command is used to view the logs of a pod named 'web-pod'?

Accepted Answer

kubectl logs web-pod. The correct command to view logs from a pod in Kubernetes is 'kubectl logs web-pod'. This command retrieves the current stdout/stderr output from the primary container in the specified pod, which is the standard method for accessing container logs without entering the pod.

Answer

kubectl describe pod web-pod

Answer

kubectl get logs web-pod

Answer

kubectl exec web-pod -- logs

Question 16

You have a Deployment with the following rollout strategy: rollingUpdate: maxSurge: 1, maxUnavailable: 0. What behavior does this configuration enforce?

Accepted Answer

The rollout will create one additional pod before terminating the old pod, ensuring zero downtime. The rolling update strategy `maxSurge: 1, maxUnavailable: 0` ensures that during the rollout, one additional pod is created above the desired replica count before any existing pod is terminated. This guarantees that the total number of available pods never drops below the desired count, achieving zero downtime. The `maxUnavailable: 0` setting prevents any pod from being taken down until a new one is ready, while `maxSurge: 1` allows one extra pod to be created temporarily.

Answer

The rollout will terminate all old pods at once and then create new ones

Answer

The rollout will create all new pods first, then delete all old pods

Answer

The rollout will terminate one old pod before creating a new one

Question 17

What is the function of kube-proxy on a worker node?

Accepted Answer

It implements part of the Kubernetes Service concept by managing network rules. kube-proxy runs on each worker node and is responsible for implementing the Kubernetes Service abstraction by managing network rules (e.g., iptables, IPVS, or userspace mode). It watches the API server for Service and EndpointSlice changes and configures local packet filtering or forwarding rules to route traffic to the correct backend pods, enabling load balancing and service discovery.

Answer

It ensures the desired number of pods are running

Answer

It runs the container runtime

Answer

It reports node status to the control plane

Question 18

A user creates a Deployment with 'replicas: 3'. After applying the manifest, only 2 pods are running. What is the most likely cause?

Accepted Answer

There is insufficient node capacity to schedule the third pod. The most likely cause is insufficient node capacity, as the scheduler cannot place the third pod due to resource constraints (CPU, memory, or other limits). The Deployment controller creates a ReplicaSet, which instructs the scheduler to place pods; if nodes lack sufficient allocatable resources, pods remain in Pending state. This is a common scenario when cluster resources are exhausted.

Answer

The Deployment's YAML had a syntax error

Answer

The container image name is misspelled

Answer

The ReplicaSet controller is not running

Question 19

A microservice application is experiencing high latency during traffic spikes. The team identifies that the database connection pool is exhausted. They want to implement a pattern that helps decouple the microservice from direct database connections and smooth out traffic bursts. Which design pattern should they apply?

Accepted Answer

Queue-based Load Leveling pattern. The Queue-based Load Leveling pattern uses a message queue (e.g., RabbitMQ, Amazon SQS) as a buffer between the microservice and the database. When traffic spikes occur, requests are queued and processed at a manageable rate, preventing the database connection pool from being exhausted. This decouples the service from direct database connections and smooths out bursts, directly addressing the latency issue.

Answer

Bulkhead pattern

Answer

Circuit Breaker pattern

Answer

Retry pattern

Question 20

Which of the following is true about Kubernetes Namespaces?

Accepted Answer

Namespaces are used to logically isolate resources like pods and services. Kubernetes Namespaces provide a mechanism to logically isolate resources such as Pods, Services, and Deployments within a single cluster. They enable multi-tenancy by partitioning cluster resources among multiple users or teams, each operating within their own virtual cluster. This logical isolation does not include network segmentation by default, but it allows for resource quota enforcement and access control via RBAC.

Answer

Namespaces can be nested

Answer

Namespaces are required for all resources

Answer

Namespaces provide network isolation by default