KCNA Practice Test 21 — 15 Questions

Question 1

Which THREE of the following are benefits of using a service mesh? (Select three.)

Accepted Answer

Fine-grained traffic control (e.g., canary deployments). A service mesh, such as Istio or Linkerd, provides fine-grained traffic control through features like traffic splitting, header-based routing, and weighted load balancing. This enables canary deployments by directing a small percentage of traffic to a new version of a service, allowing safe testing in production without affecting all users.

Answer

Automatic scaling of pods

Answer

Increased application performance

Question 2

Which tool is specifically designed for distributed tracing and was originally developed by Uber?

Accepted Answer

Jaeger. Jaeger is an open source distributed tracing system originally developed by Uber and later donated to the CNCF, where it became a graduated project. It is designed to monitor and troubleshoot microservices-based distributed systems by tracing requests across service boundaries. This makes Jaeger the correct answer for a tool specifically built for distributed tracing and originating from Uber.

Answer

Prometheus

Answer

Loki

Answer

Grafana

Question 3

In a GitOps workflow, a team uses ArgoCD. A developer manually changes a Deployment's replica count in the cluster via kubectl. ArgoCD has self-healing enabled. What will happen?

Accepted Answer

ArgoCD reverts the replica count to the value in Git. With self-healing enabled, ArgoCD continuously monitors the cluster for drift. When a manual change is made via kubectl, ArgoCD detects that the live state no longer matches the desired state defined in Git. It then automatically reverts the change to bring the cluster back into sync with the Git repository.

Answer

ArgoCD creates a new Deployment with the manual change

Answer

ArgoCD updates the Git repository to reflect the manual change

Answer

ArgoCD ignores the change because it was made manually

Question 4

You are designing a microservices application that requires each service to be independently deployable and scalable. The services communicate over HTTP and need service discovery. Which orchestration feature BEST addresses the need for service discovery?

Accepted Answer

Kubernetes Service. Kubernetes Service is the correct choice because it provides a stable network endpoint (IP address and DNS name) for a set of pods, enabling service discovery via DNS or environment variables. This allows microservices to locate and communicate with each other over HTTP without hardcoding IP addresses, which is essential for independent deployability and scalability.

Answer

Horizontal Pod Autoscaler

Answer

ConfigMap

Answer

PersistentVolume

Question 5

What is the primary role of the OpenTelemetry Collector?

Accepted Answer

To receive, process, and export telemetry data. The OpenTelemetry Collector is a vendor-agnostic component that receives telemetry data (traces, metrics, logs), processes it (e.g., batching, filtering, enriching), and exports it to one or more backends. Its primary role is to decouple instrumentation from backend systems, providing a flexible pipeline for telemetry data. It does not replace Prometheus, store data long-term, or generate traces.

Answer

To replace Prometheus for metric collection

Answer

To store traces and metrics long-term

Answer

To generate traces for applications

Question 6

Which TWO of the following are valid ways to assign a pod to a specific node?

Accepted Answer

nodeSelector. Option A (nodeSelector) is correct because it is a field in the pod spec that matches against node labels, causing the scheduler to place the pod only on nodes carrying the specified label key/value pairs. Option D (nodeName) is correct because setting spec.nodeName bypasses the scheduler entirely and directly binds the pod to the named node, which is a valid (if low-level) way to assign a pod to a specific node. Option B (affinity: nodeAntiAffinity) is incorrect because node anti-affinity repels pods from nodes matching certain labels rather than assigning a pod to a specific node. Option C (tolerations) is incorrect because tolerations only allow a pod to be scheduled onto nodes with matching taints; they do not target a specific node. Option E (podSelector) is incorrect because podSelector is used in resources like NetworkPolicy, PodDisruptionBudget, and topology spread constraints to select pods, not to assign a pod to a node.

Answer

affinity: nodeAntiAffinity

Answer

tolerations

Answer

podSelector

Question 7

What is the purpose of container image scanning in a CI/CD pipeline?

Accepted Answer

To identify security vulnerabilities in the image. Container image scanning in a CI/CD pipeline analyzes the image layers for known security vulnerabilities (CVEs) in OS packages, libraries, and application dependencies. It is a core DevSecOps practice that shifts security left, catching issues before the image is deployed to production.

Answer

To ensure the image is stored in a registry

Answer

To measure the image size and optimize it

Answer

To verify the image tag follows naming conventions

Question 8

A company is running a microservices application on a Kubernetes cluster. They have noticed that one of the services, 'payment-api', is experiencing intermittent high latency. The team wants to identify the root cause without modifying the application code. Which approach should they take?

Accepted Answer

Implement distributed tracing using tools like Jaeger or Zipkin to trace requests across services.. Distributed tracing with tools like Jaeger or Zipkin allows you to follow a single request as it traverses multiple microservices, identifying exactly which service or call introduces latency. This approach does not require code changes (if the service mesh or sidecar proxy handles instrumentation) and is specifically designed to pinpoint performance bottlenecks in distributed systems, unlike CPU/memory metrics or log analysis which cannot trace a request's end-to-end path.

Answer

Monitor CPU and memory metrics from kube-state-metrics and correlate with latency.

Answer

Increase log verbosity for all services and search for error messages.

Answer

Check node-level metrics using Prometheus Node Exporter.

Question 9

Which of the following is NOT a responsibility of the kubelet on a worker node?

Accepted Answer

Implementing network rules for Services. The kubelet is the primary node agent that runs on each worker node, responsible for ensuring containers are running in a Pod as specified by the PodSpec. It performs liveness and readiness probes, starts and stops containers, and reports node and pod status to the control plane. Implementing network rules for Services, such as iptables or IPVS rules, is the responsibility of the kube-proxy, not the kubelet.

Answer

Performing liveness and readiness probes

Answer

Starting and stopping containers based on PodSpecs

Answer

Reporting node and pod status to the control plane

Question 10

A user creates a Service of type ClusterIP with a selector matching pods labeled 'app: myapp'. However, a pod named 'myapp-pod' with label 'app: myapp' is not receiving traffic. What is a possible reason?

Accepted Answer

The pod's readiness probe is failing. A failing readiness probe causes the pod to be removed from the Service's Endpoints list, even if the pod is running and matches the selector. The kubelet checks the readiness probe periodically; if it fails, the pod is marked as not ready, and the Service controller removes its IP from the Endpoints object, preventing traffic from being forwarded to it.

Answer

The Service type should be NodePort

Answer

The pod is in a different namespace

Answer

The pod's container port is not defined

Question 11

What is the role of kube-scheduler in Kubernetes?

Accepted Answer

To assign pods to nodes. The kube-scheduler is responsible for selecting an optimal node for newly created pods that have not yet been assigned to a node. It evaluates constraints such as resource requirements, affinity/anti-affinity rules, and data locality, then binds the pod to the chosen node via the Kubernetes API. This makes option A correct because scheduling is the scheduler's primary and defining function.

Answer

To run container health checks

Answer

To store cluster configuration

Answer

To provide network rules for services

Question 12

A developer deploys a pod with the following resource specification:
```yaml
resources:
  requests:
    memory: "256Mi"
  limits:
    memory: "512Mi"
```
The pod is killed with OOMKilled. What is the most likely cause?

Accepted Answer

The container exceeded the memory limit of 512Mi. The OOMKilled exit code indicates the container was terminated by the Linux kernel's Out-Of-Memory (OOM) killer because it attempted to use more memory than its configured limit of 512Mi. Kubernetes enforces memory limits using cgroups; when the container exceeds the limit, the kernel kills the process, resulting in the OOMKilled status.

Answer

The container exceeded the memory request of 256Mi

Answer

The node ran out of memory

Answer

The CPU limit was too low

Question 13

Which command would you use to view the current state of all Pods in the default namespace?

Accepted Answer

kubectl get pods. The `kubectl get pods` command retrieves and displays the current state of all Pods in the default namespace. It is the standard imperative command for listing Kubernetes resources, showing key fields like NAME, READY, STATUS, RESTARTS, and AGE.

Answer

kubectl describe pods

Answer

kubectl list pods

Answer

kubectl show pods

Question 14

You create a Service of type ClusterIP with the name 'my-service' in the 'default' namespace. What DNS name resolves to the service's cluster IP from a pod in the same namespace?

Accepted Answer

my-service.default.svc.cluster.local. Kubernetes DNS resolves a Service's ClusterIP using the fully qualified domain name (FQDN) format `..svc.cluster.local`. Since the Service 'my-service' is in the 'default' namespace, a pod in the same namespace can reach it via `my-service.default.svc.cluster.local`. The DNS query returns the ClusterIP of the Service, allowing pods to communicate with it reliably.

Answer

my-service.svc.cluster.local

Answer

my-service.default.cluster.local

Answer

my-service.cluster.local

Question 15

Which TWO of the following are responsibilities of the kube-controller-manager?

Accepted Answer

Ensuring the correct number of pod replicas are running. Option B is correct because the kube-controller-manager runs the ReplicationController/ReplicaSet controller, which continuously reconciles the desired replica count in a workload's spec with the actual number of running pods, creating or deleting pods as needed. Option D is correct because the kube-controller-manager includes the node controller, which monitors node heartbeats/status and reacts to node failures by marking nodes NotReady and evicting or rescheduling their pods (subject to tolerations). Option A is not a kube-controller-manager responsibility; pod-to-node assignment is performed by the kube-scheduler. Option C is not correct because Service network rules are implemented by the kube-proxy component (and/or CNI/iptables/IPVS), not the kube-controller-manager. Option E is not correct because cluster state is stored in etcd, the distributed key-value store, not by the kube-controller-manager.

Answer

Assigning pods to nodes based on resource requirements

Answer

Implementing network rules for Services

Answer

Storing the cluster state