KCNA Practice Test 22 — 15 Questions

Question 1

A DevOps team notices that a new deployment of a web application is not receiving traffic even though the pods are running. The deployment has a selector matching the pod labels, and a Service of type ClusterIP exists. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Service's targetPort does not match the container's containerPort.. The most likely cause is that the Service's targetPort does not match the container's containerPort. In Kubernetes, a Service routes traffic to pods by forwarding packets to the port specified in the Service's `targetPort` field. If this does not match the `containerPort` defined in the pod's container spec, the traffic will be dropped because the kube-proxy will forward packets to a closed port on the pod, resulting in no connectivity even though the pods are running.

Answer

The pods do not have a readiness probe defined.

Answer

The Service type should be NodePort to receive traffic.

Answer

The Service is not exposed via an Ingress.

Question 2

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running controllers?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, which are control loops that watch the shared state of the cluster through the kube-apiserver and make changes to bring the current state closer to the desired state. It bundles together multiple controllers (e.g., Node Controller, Replication Controller, Endpoint Controller, Service Account Controller) that each handle a specific aspect of cluster management, ensuring the cluster's actual state matches the user-defined desired state.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 3

A developer wants to inject environment variables into a pod from a ConfigMap named 'app-config'. Which YAML snippet correctly mounts all key-value pairs from the ConfigMap as environment variables?

Accepted Answer

envFrom:
  - configMapRef:
      name: app-config. `envFrom` with a `configMapRef` injects all key-value pairs from the ConfigMap named 'app-config' as environment variables into the container. This is the standard Kubernetes method for bulk injection of ConfigMap data into environment variables, as opposed to selecting individual keys.

Answer

env:
  - name: CONFIG
    value: "$(CONFIGMAP)"

Answer

volumes:
  - name: config
    configMap:
      name: app-config
    volumeMounts:
      - name: config
        mountPath: /etc/config

Answer

env:
  - name: CONFIG
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: config.yaml

Question 4

Which command is used to rollback a Helm release to a previous revision?

Accepted Answer

helm rollback . The `helm rollback` command rolls back a release to a specified revision. Option B (helm rollback ) is the correct command. Option A (helm history) shows revision history, not a rollback. Option C (helm install) installs a new release. Option D (helm upgrade) upgrades to a new version, not a rollback.

Answer

helm history <release-name>

Answer

helm install <release-name>

Answer

helm upgrade <release-name>

Question 5

A team is deploying a new microservice that processes sensitive user data. They want to ensure that secrets such as database passwords are not exposed in the container image or environment variables. Which approach should they use?

Accepted Answer

Store the secret in a Kubernetes Secret and mount it as a volume in the pod. Kubernetes Secrets are designed specifically to store sensitive data like database passwords. Mounting the Secret as a volume ensures the secret data is available to the pod as files, without being exposed in environment variables (which can be leaked via logs or `kubectl describe`) or embedded in the container image. This approach follows security best practices for handling sensitive information in cloud-native applications.

Answer

Embed the secret directly in the Docker image and use it via environment variables

Answer

Store the secret in a ConfigMap and reference it in the pod spec

Answer

Use a PersistentVolumeClaim to store the secret and mount it into the pod

Question 6

Which Open Container Initiative (OCI) specification defines the format of container images?

Accepted Answer

Image Spec. The OCI Image Spec defines the format and content of container images, including the manifest, configuration, and layers. This ensures that any OCI-compliant runtime can run images built by any OCI-compliant tool, enabling interoperability across different container platforms.

Answer

Runtime Spec

Answer

Container Runtime Interface (CRI)

Answer

Dockerfile specification

Question 7

A pod is experiencing high memory usage. The administrator wants to enforce that the pod is terminated if it exceeds a memory limit and restarted automatically, but also wants to guarantee a minimum amount of memory for the pod. Which resource specification should be used in the container definition?

Accepted Answer

spec.containers[].resources.requests.memory and limits.memory. Setting both `requests.memory` and `limits.memory` guarantees a minimum memory allocation (the request) while enforcing a hard cap (the limit). If the pod exceeds the memory limit, it is terminated (OOMKilled) and, if part of a Deployment or StatefulSet, the controller automatically restarts it. This satisfies the requirement for both guaranteed minimum and enforced maximum with automatic restart.

Answer

spec.containers[].resources.requests.memory only

Answer

spec.containers[].resources.limits.memory and requests.cpu

Answer

spec.containers[].resources.limits.memory only

Question 8

Which service mesh component is typically deployed as a sidecar proxy alongside application containers?

Accepted Answer

Envoy proxy. Envoy proxy is the most common sidecar proxy in service meshes like Istio and Linkerd. Istiod is the control plane component, Kiali is a visualization tool, and Prometheus is a monitoring system.

Answer

Kiali

Answer

Istiod

Answer

Prometheus

Question 9

Which of the following is an example of Infrastructure as Code (IaC) tool?

Accepted Answer

Terraform. Terraform is a widely used Infrastructure as Code (IaC) tool that allows you to define and provision infrastructure using a declarative configuration language. It supports multiple cloud providers and on-premises environments, enabling version control, automation, and repeatability. Kubernetes, Docker, and Prometheus serve different purposes: container orchestration, containerization, and monitoring, respectively.

Answer

Kubernetes

Answer

Docker

Answer

Prometheus

Question 10

Which TWO resources can be used to store configuration data separately from container images?

Accepted Answer

Secret. ConfigMap (E) is correct because it is the Kubernetes API object designed to hold non-confidential configuration data as key-value pairs, which pods can consume via environment variables, command-line arguments, or mounted volumes, keeping that data out of the container image. Secret (C) is correct because it serves the analogous purpose for sensitive configuration data such as passwords, tokens, and certificates, storing them base64-encoded and injecting them into pods separately from the image. Both objects decouple configuration from the image, so the same image can be reused across environments with different settings. Service (A) is incorrect because it provides stable network access and load balancing to a set of pods, not configuration storage. PersistentVolume (B) is incorrect because it supplies durable block or file storage for application data, not configuration key-value data. Deployment (D) is incorrect because it manages the desired state and rollout of replicated pods, not configuration content.

Answer

Service

Answer

PersistentVolume

Answer

Deployment

Question 11

Which of the following is a core principle of cloud native architecture as defined by the CNCF?

Accepted Answer

Microservices packaged in containers. The CNCF defines cloud native as an approach that uses containers, service meshes, microservices, immutable infrastructure, and declarative APIs to build loosely coupled systems that are resilient, manageable, and observable. Microservices packaged in containers is the foundational pattern: each service is independently deployable, scalable, and isolated, which enables the automation and orchestration (e.g., Kubernetes) that cloud native relies on.

Answer

Monolithic application design

Answer

Manual scaling of applications

Answer

Static infrastructure provisioning

Question 12

Which Kubernetes primitive is the smallest and simplest unit in the Kubernetes object model that you can create or deploy?

Accepted Answer

Pod. B is correct because a Pod is the smallest and simplest unit in the Kubernetes object model. It represents a single instance of a running process in a cluster and can contain one or more containers that share the same network namespace, storage volumes, and lifecycle. You create and deploy Pods directly, while higher-level controllers like ReplicaSets and Deployments manage Pods as their fundamental building block.

Answer

ReplicaSet

Answer

Deployment

Answer

Container

Question 13

Which TWO tools are commonly used for GitOps? (Choose two.)

Accepted Answer

Flux. Flux (A) is a CNCF-graduated GitOps operator that continuously reconciles Kubernetes cluster state with manifests stored in a Git repository, making it a canonical GitOps tool. ArgoCD (E) is likewise a declarative GitOps continuous-delivery controller for Kubernetes that syncs applications from Git and detects drift, so it is also correct. Jenkins (B) is a general-purpose CI automation server; it can trigger GitOps-style pipelines but is not itself a GitOps reconciliation tool. Helm (C) is a Kubernetes package manager for templating and releasing charts, not a GitOps controller. Terraform (D) is an infrastructure-as-code provisioning tool that applies state from configuration, but it is not a GitOps continuous reconciliation engine.

Answer

Jenkins

Answer

Helm

Answer

Terraform

Question 14

What is the primary purpose of the Open Container Initiative (OCI)?

Accepted Answer

To standardize container image and runtime specifications. The Open Container Initiative (OCI) is an open governance structure that standardizes container image and runtime specifications. It ensures that any OCI-compliant image can run on any OCI-compliant runtime, promoting interoperability across the container ecosystem. This is the core purpose, not to provide a specific runtime or orchestration tool.

Answer

To provide a container runtime called Docker

Answer

To create a container orchestration platform

Answer

To define the Kubernetes Container Runtime Interface (CRI)

Question 15

Which DORA metric measures how quickly code changes are deployed to production?

Accepted Answer

Lead time for changes. Lead time for changes measures the time from code commit to code successfully running in production, directly reflecting deployment speed. It is one of the four DORA metrics and specifically captures how quickly changes flow through the pipeline.

Answer

Mean time to recovery (MTTR)

Answer

Change failure rate

Answer

Deployment frequency