KCNA Practice Test 23 — 15 Questions

Question 1

Which component in Kubernetes is responsible for maintaining the desired state of the cluster?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller processes, which are control loops that watch the shared state of the cluster through the API server and make changes to move the current state toward the desired state. It is responsible for ensuring that the cluster's actual state matches the desired state defined in Kubernetes objects such as Deployments, ReplicaSets, and StatefulSets.

Answer

kube-scheduler

Answer

kube-proxy

Answer

kubelet

Question 2

Which TWO statements are true about Kustomize? (Choose 2)

Accepted Answer

It supports patching Kubernetes resources via strategic merge patches or JSON patches.. Option A is correct because Kustomize natively supports customizing Kubernetes resources through patches, including strategic merge patches (which merge by resource keys) and JSON patches (RFC 6902 operations), applied via the patchesStrategicMerge and patchesJson6902 fields in kustomization.yaml. Option D is correct because Kustomize's core design is a base-and-overlay model, where a base holds common manifests and overlays reference the base to apply environment-specific customizations without duplicating YAML. Option B is not correct because canary traffic routing is handled by service meshes or progressive delivery tools like Argo Rollouts or Flagger, not Kustomize, which only renders manifests. Option C is not correct because Kustomize deliberately avoids Go templating; it uses declarative YAML overlays and patches, unlike Helm which uses Go templates. Option E is not correct because packaging and deploying Helm charts is the role of Helm itself, not Kustomize, although the two tools can be used together.

Answer

It automatically handles canary traffic routing.

Answer

It relies on Go templating to generate Kubernetes manifests.

Answer

It can be used to package and deploy Helm charts.

Question 3

Which tool is commonly used for log aggregation in Kubernetes and is designed to be lightweight?

Accepted Answer

Fluent Bit. Fluent Bit is a CNCF-graduated, lightweight log processor and forwarder written in C with a tiny memory footprint (often under 1 MB), specifically designed for high-performance log aggregation in containerized and edge environments. It is commonly deployed as a DaemonSet in Kubernetes to collect container logs from /var/log/containers and ship them to backends like Elasticsearch, Loki, or CloudWatch. Its low resource usage distinguishes it from heavier aggregators like Fluentd.

Answer

Jaeger

Answer

Prometheus

Answer

Grafana

Question 4

Which of the following best describes immutable infrastructure?

Accepted Answer

Infrastructure components that are replaced rather than changed after deployment. Immutable infrastructure is a pattern where components (servers, containers, etc.) are never modified after deployment. Instead, any change requires building a new instance from a golden image or template and replacing the old one. This eliminates configuration drift and ensures consistency, which is a core principle in container orchestration with tools like Kubernetes, where Pods are replaced rather than patched in place.

Answer

Servers that are updated in-place with configuration management tools

Answer

Infrastructure that is version-controlled and deployed using blue/green deployments

Answer

Infrastructure that uses only read-only file systems

Question 5

In the context of the 12-factor app methodology, which factor requires that an app's configuration be stored in environment variables?

Accepted Answer

Config. The Config factor of the 12-factor app methodology explicitly states that configuration should be stored in environment variables, not in code or config files checked into the repository. This separates config that varies between deploys (database URLs, API keys, feature flags) from the immutable codebase, enabling the same artifact to be promoted across environments. Environment variables are language-agnostic and easily injected by the platform.

Answer

Dependencies

Answer

Codebase

Answer

Backing services

Question 6

A company wants to manage its Kubernetes resources using Git as the single source of truth, with automated synchronization. Which approach should they use?

Accepted Answer

GitOps with ArgoCD or Flux. GitOps uses Git as the declarative source of truth for cluster state, with an in-cluster agent (ArgoCD or Flux) continuously reconciling the live cluster to match the repository. This provides automated synchronization, drift detection, and auditable change history via Git commits and pull requests. It is the canonical answer when the requirement is 'Git as single source of truth with automated sync.'

Answer

Using Helm charts without version control

Answer

Infrastructure as Code with Terraform

Answer

Using kubectl apply -f with a CI/CD pipeline

Question 7

Which command would you use to view the logs of a specific container in a pod?

Accepted Answer

kubectl logs -c . `kubectl logs -c ` explicitly targets a specific container within a pod. In Kubernetes, a pod can host multiple containers, and without the `-c` flag, `kubectl logs` defaults to the first container in the pod spec, which may not be the intended one. This command is essential for multi-container pods where each container has its own log stream.

Answer

kubectl logs <pod-name>

Answer

kubectl logs <container-name>

Answer

kubectl describe pod <pod-name>

Question 8

What is the purpose of the Container Runtime Interface (CRI)?

Accepted Answer

To allow kubelet to communicate with different container runtimes. The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a variety of container runtimes without needing to recompile the Kubernetes components. It defines the API for creating, starting, stopping, and deleting containers, allowing the kubelet to communicate with runtimes like containerd, CRI-O, or Docker (via dockershim, now deprecated). Option D is correct because the CRI's primary purpose is to abstract the runtime implementation from the kubelet, enabling interoperability.

Answer

To manage container networking

Answer

To define a standard for container images

Answer

To orchestrate multi-container pods

Question 9

You have a Pod that is in 'Pending' state. What is the most likely cause?

Accepted Answer

The node is out of CPU or memory resources.. A Pod in 'Pending' state indicates that the scheduler has not yet assigned it to a node. The most common reason is insufficient resources (CPU or memory) on any available node, causing the scheduler to fail to find a suitable node that meets the Pod's resource requests. This is a core scheduling failure in Kubernetes.

Answer

The application inside the container crashed.

Answer

The container image is missing.

Answer

The Service does not have any endpoints.

Question 10

What is a key benefit of container orchestration platforms like Kubernetes?

Accepted Answer

Self-healing capabilities automatically restart failed containers. Kubernetes provides self-healing capabilities through controllers like ReplicaSets and Deployments, which continuously monitor the desired state of containers. If a container fails or becomes unresponsive, the control plane automatically restarts or reschedules it, ensuring high availability without manual intervention. This is a core benefit of container orchestration platforms, as it abstracts away the operational overhead of managing individual container lifecycles.

Answer

Containers are tightly coupled to the underlying hardware

Answer

Each container runs its own operating system kernel

Answer

Containers can only run on a single host

Question 11

An administrator needs to ensure that Pods from two different Deployments cannot communicate with each other. Which Kubernetes resource should be used?

Accepted Answer

NetworkPolicy. NetworkPolicy is the correct resource because it acts as a firewall for Kubernetes Pods, controlling ingress and egress traffic at the IP address and port level using layer 3/4 rules. By applying a NetworkPolicy that denies all traffic between the Pods of the two Deployments (e.g., using podSelector and ingress/egress rules with an empty `from` or `to` block), the administrator can enforce network isolation. This is the native Kubernetes mechanism for restricting Pod-to-Pod communication within a cluster.

Answer

RBAC Role

Answer

PodSecurityPolicy

Answer

ResourceQuota

Question 12

A pod spec includes a liveness probe that runs 'cat /tmp/healthy'. The probe is configured with initialDelaySeconds: 10, periodSeconds: 5. At what point does the kubelet first execute the probe?

Accepted Answer

10 seconds after the container starts. The kubelet first executes the liveness probe 10 seconds after the container starts because `initialDelaySeconds: 10` tells the kubelet to wait that long before initiating the first probe. The `periodSeconds: 5` only defines the interval between subsequent probes, not the initial delay. This ensures the container has time to start and create the `/tmp/healthy` file before being checked.

Answer

Immediately after the pod is created

Answer

Only when the container is unhealthy

Answer

5 seconds after the container starts

Question 13

What does SLA stand for in the context of service reliability?

Accepted Answer

Service Level Agreement. SLA stands for Service Level Agreement, a contract specifying expected service level.

Answer

Service Level Indicator

Answer

Service Level Availability

Answer

Service Level Objective

Question 14

You are writing a Deployment YAML (apps/v1) for a stateless web application. The application should have 3 replicas and use rolling updates with maxSurge=1 and maxUnavailable=0. Which field should you set under spec.strategy?

Accepted Answer

type: RollingUpdate with rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }. The Deployment's `spec.strategy.type` must be set to `RollingUpdate` to enable a controlled, incremental update of pods. The `rollingUpdate` field then allows you to specify `maxSurge: 1` (one extra pod above the desired count during update) and `maxUnavailable: 0` (ensure all existing pods remain available during the update), which is the exact configuration for a zero-downtime rolling update with a single surge pod.

Answer

type: Recreate

Answer

type: Canary

Answer

type: OnDelete

Question 15

Which TWO of the following are Kubernetes control plane components?

Accepted Answer

kube-apiserver. kube-apiserver (A) is correct because it is the central control plane component that exposes the Kubernetes API, validating and processing all REST requests and serving as the front end of the control plane. etcd (C) is correct because it is the consistent, highly-available key-value store that persists all cluster state and is a core control plane component. The container runtime (B) is not a control plane component; it runs on each node as part of the kubelet's node-level machinery to execute containers. kube-proxy (D) is a node-level networking component that maintains network rules for Service traffic, not a control plane component. kubelet (E) is the node agent that manages pods on a worker node, so it is also not part of the control plane.

Answer

container runtime

Answer

kube-proxy

Answer

kubelet