KCNA Practice Exam 3 — 20 Questions

Question 1

Which THREE are valid container runtimes that implement the Kubernetes CRI? (Choose three.)

Accepted Answer

Docker (via dockershim, deprecated). containerd, CRI-O, and Docker (via dockershim, deprecated) implement CRI. rkt is discontinued and not CRI-compliant; runc is a low-level runtime, not a CRI implementation.

Answer

runc

Answer

rkt

Question 2

Which TWO of the following are recommended practices for achieving observability in a Kubernetes cluster?

Accepted Answer

Include correlation IDs in structured logs to enable tracing across services.. Including correlation IDs in structured logs is a key observability practice that enables distributed tracing across microservices. In Kubernetes, where requests often traverse multiple pods and services, correlation IDs allow you to link logs from different components into a single transaction flow, which is essential for debugging and understanding system behavior.

Answer

Use a single centralized logging solution to aggregate logs from all components.

Answer

Store all debug logs for a minimum of 90 days for compliance.

Answer

Disable leader election for monitoring components to reduce complexity.

Question 3

You run 'kubectl logs my-pod' and see: "Error from server (BadRequest): container "my-container" in pod "my-pod" is waiting to start: PodInitializing". What does this mean?

Accepted Answer

The Pod is in the process of initializing and logs are not yet available. The error 'PodInitializing' indicates that the pod's init containers are still running or the main container is waiting for init containers to complete. During this phase, the container has not started, so logs are not yet available. Option D correctly identifies that the pod is initializing and logs cannot be retrieved until the container enters the 'Running' state.

Answer

The container is running but producing no output

Answer

The container runtime is failing to start the container

Answer

The container has crashed and is restarting

Question 4

Which THREE of the following are true about the Open Container Initiative (OCI)? (Select 3)

Accepted Answer

OCI defines the container image format specification. The Open Container Initiative (OCI) defines the Image Specification, which standardizes the format and content of container images. This ensures that any OCI-compliant image can be run by any OCI-compliant runtime, enabling interoperability across different container platforms.

Answer

OCI is governed solely by Docker Inc.

Answer

OCI only applies to Linux containers

Question 5

A DevOps engineer wants to deploy a stateful application that requires stable network identities and persistent storage. Which Kubernetes resource is most appropriate?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it is designed specifically for stateful applications that require stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage (via PersistentVolumeClaims that persist across Pod rescheduling). Unlike Deployments, StatefulSet guarantees ordered, graceful deployment and scaling, which is essential for applications like databases or distributed systems that rely on stable identities.

Answer

DaemonSet

Answer

Deployment

Answer

ReplicaSet

Question 6

An application deployment in Kubernetes uses a Deployment object. During a rolling update, the new ReplicaSet fails to become healthy. What is the default behavior of the Deployment controller?

Accepted Answer

It pauses the rollout and keeps the old ReplicaSet running. By default, the Deployment controller will stop the rollout if the new pods are unhealthy, and the old ReplicaSet remains running.

Answer

It continues the rollout, ignoring the health check failures

Answer

It automatically rolls back to the previous revision

Answer

It scales down the old ReplicaSet to zero

Question 7

In the context of the 12-factor app methodology, which factor emphasizes storing configuration in environment variables?

Accepted Answer

Config. Factor III of the 12-factor app methodology states that config should be stored in environment variables to keep it separate from code.

Answer

Backing services

Answer

Dependencies

Answer

Codebase

Question 8

A team wants to ensure that at least 99.9% of all requests to their application complete within 500ms over a 30-day window. How should this requirement be classified?

Accepted Answer

Service Level Objective (SLO). An SLO is a target level of reliability, expressed as a percentage of a metric over a time window.

Answer

Service Level Agreement (SLA)

Answer

Service Level Indicator (SLI)

Answer

Key Performance Indicator (KPI)

Question 9

A company uses Prometheus for monitoring and wants to alert when the average CPU usage over 5 minutes exceeds 80%. Which PromQL query would correctly define this alert rule?

Accepted Answer

avg(rate(node_cpu_seconds_total{mode!="idle"}[5m])) > 0.8. The query should calculate the average CPU usage rate over 5 minutes and compare it to 0.8 (80%).

Answer

avg(rate(node_cpu_seconds_total{mode="idle"}[5m])) > 0.8

Answer

avg(node_cpu_seconds_total{mode!="idle"}[5m]) > 0.8

Answer

sum(rate(node_cpu_seconds_total{mode!="idle"}[5m])) > 0.8

Question 10

In a CI/CD pipeline, what is the difference between continuous delivery and continuous deployment?

Accepted Answer

Continuous delivery requires manual approval for production deployment; continuous deployment automates it. Continuous delivery ensures code is always in a deployable state but requires manual approval for production deployment. Continuous deployment automatically deploys every change to production without manual intervention.

Answer

Continuous delivery automatically deploys to production; continuous deployment does not

Answer

There is no difference; the terms are used interchangeably

Answer

Continuous deployment runs tests; continuous delivery does not

Question 11

Which THREE of the following are important security practices in a container image CI/CD pipeline?

Accepted Answer

Signing images to ensure integrity. Image scanning, signing, and using minimal base images are key security practices. Hardcoding credentials and running containers as root are anti-patterns.

Answer

Hardcoding credentials in the image

Answer

Running containers as root user

Question 12

Which of the following is true about Prometheus's pull-based model for collecting metrics?

Accepted Answer

Prometheus scrapes metrics from HTTP endpoints. Prometheus pulls metrics from targets at regular intervals, which is the pull-based model.

Answer

Targets push metrics to Prometheus

Answer

Prometheus only collects metrics from Kubernetes API server

Answer

Prometheus stores metrics in a relational database

Question 13

A Prometheus alert rule fires when the error rate exceeds 5% for 5 minutes. The alert is sent to Alertmanager. What must be configured in Alertmanager to ensure the alert is deduplicated, grouped, and routed to the correct team?

Accepted Answer

A route configuration. Alertmanager uses routes to match alerts and receivers to send notifications. Routes define grouping and routing logic.

Answer

An inhibition rule

Answer

A recording rule

Answer

A silence rule

Question 14

In a microservices architecture, which pattern is used to prevent cascading failures by limiting the number of concurrent requests to a service?

Accepted Answer

Bulkhead. The bulkhead pattern isolates resources to prevent failure propagation. Circuit breaker stops calls after failures, retry reattempts, and timeout limits wait time.

Answer

Timeout

Answer

Retry

Answer

Circuit breaker

Question 15

In event-driven architecture, which pattern is commonly used to decouple producers and consumers, allowing asynchronous communication?

Accepted Answer

Event broker (message queue or event bus). Event-driven architecture decouples producers and consumers via an event broker (e.g., message queue or event bus), enabling asynchronous communication. Direct synchronous calls would couple them.

Answer

Shared database

Answer

Circuit breaker pattern

Answer

Synchronous REST API calls

Question 16

Which TWO of the following are benefits of using Helm for managing Kubernetes applications?

Accepted Answer

Templating engine for parameterizing Kubernetes manifests. Helm provides templating for reusable configurations and allows for easy rollback to previous releases.

Answer

Automatic scaling of pods based on CPU usage

Answer

Native integration with service mesh for traffic splitting

Answer

Built-in support for canary deployments

Question 17

Which TWO tools are commonly used for GitOps? (Choose two.)

Accepted Answer

Flux. ArgoCD and Flux are two popular GitOps tools that automate deployment of applications from Git repositories.

Answer

Jenkins

Answer

Helm

Answer

Terraform

Question 18

When using Kustomize, how do you apply a common label to all resources in the base?

Accepted Answer

By setting 'commonLabels' in the kustomization.yaml. Kustomize's commonLabels field adds labels to all resources, including selectors.

Answer

By editing each YAML file individually

Answer

By using the 'patches' field to add labels

Answer

By using a Helm chart instead of Kustomize

Question 19

Which tool can be used to implement feature flags in a Kubernetes-native progressive delivery setup?

Accepted Answer

Argo Rollouts. Argo Rollouts supports progressive delivery with features like canary, blue-green, and integration with service mesh for traffic shifting, and can be combined with feature flag systems.

Answer

Kustomize

Answer

Helm

Answer

Flux

Question 20

Which DORA metric measures how quickly code changes are deployed to production?

Accepted Answer

Lead time for changes. Lead time for changes measures the time from code commit to running in production.

Answer

Mean time to recovery (MTTR)

Answer

Change failure rate

Answer

Deployment frequency