KCNA Practice Test 24 — 15 Questions

Question 1

A team is implementing a multi-cloud strategy to avoid vendor lock-in. Which Kubernetes feature is most helpful for abstracting the underlying cloud provider?

Accepted Answer

Kubernetes API. The Kubernetes API is the abstraction layer that decouples workloads from any specific cloud provider — manifests, controllers, and clients interact with the API server, not with AWS, GCP, or Azure APIs directly. This portability is what enables multi-cloud and avoids vendor lock-in. While Services, ConfigMaps, and Namespaces are API objects, the API itself is the unifying abstraction.

Answer

Services

Answer

ConfigMaps

Answer

Namespaces

Question 2

You are a platform engineer at a fast-growing startup. The company runs a Kubernetes cluster with 50 worker nodes for its production microservices. Recently, the operations team has been struggling with manual configuration drift: developers SSH into nodes to install debugging tools, and some nodes have different kernel parameters or installed packages. This has caused intermittent outages when a pod is scheduled onto a non-standard node. The CTO wants a solution that ensures each node is identical, immutable, and reproducible. The cluster uses kubeadm for bootstrapping and runs on AWS EC2. Which approach best achieves the goal of immutable nodes?

Accepted Answer

Create a golden AMI using Packer with all required configurations, then use Auto Scaling groups with a launch template that references the AMI and enable instance refresh for updates.. It uses a golden AMI built with Packer to create identical, immutable nodes that are reproducible via Auto Scaling groups and launch templates. This approach ensures that every EC2 instance launched has the exact same kernel parameters, packages, and configuration, eliminating configuration drift. Instance refresh allows rolling updates to the AMI without manual intervention, aligning with the goal of immutable infrastructure.

Answer

Use a configuration management tool like Ansible to enforce desired state on each node via periodic runs.

Answer

Apply Kubernetes node labels and taints to categorize nodes and prevent workloads from running on non-standard nodes.

Answer

Deploy a DaemonSet that runs a privileged container to enforce node configuration and remove debugging tools.

Question 3

Which component is the primary entry point for all administrative tasks and API requests in a Kubernetes cluster?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative tasks and API requests. It exposes the Kubernetes API (over HTTPS), validates and processes RESTful operations (e.g., kubectl commands, pod creation), and serves as the communication gateway between internal components (e.g., etcd, scheduler, controller-manager) and external clients. Without the API server, no administrative action or resource change can be initiated in the cluster.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 4

Which THREE of the following are key benefits of container orchestration? (Choose 3)

Accepted Answer

Declarative management using desired state configuration. Declarative management using desired state configuration is a core benefit of container orchestration platforms like Kubernetes. Instead of manually issuing commands to start, stop, or scale containers, you define the desired state of your application (e.g., 'run 3 replicas of nginx:1.25') in a YAML or JSON manifest. The orchestrator's control loop continuously reconciles the actual state with this desired state, automatically making changes to achieve and maintain it.

Answer

Built-in network isolation between all containers

Answer

Automatic code compilation from source repositories

Question 5

A team wants to deploy a serverless function that scales to zero when not in use. Which CNCF project is specifically designed for this purpose?

Accepted Answer

Knative. Knative is the correct answer because it is a CNCF project built on Kubernetes that provides a serverless platform specifically designed to scale workloads to zero when not in use. It achieves this through its Serving component, which automatically scales pods down to zero replicas based on traffic, and scales up from zero on the first request, enabling true serverless behavior.

Answer

Helm

Answer

Prometheus

Answer

Envoy

Question 6

Which THREE of the following are resiliency patterns commonly used in cloud native applications? (Choose three.)

Accepted Answer

Retry. The Retry pattern is a fundamental resiliency mechanism in cloud-native applications. When a transient failure occurs (e.g., a network timeout or a temporary database unavailability), the application automatically reattempts the failed operation. This pattern is often implemented with exponential backoff and jitter to avoid overwhelming the downstream service, as seen in libraries like Netflix Hystrix or Kubernetes client-go retry logic.

Answer

Singleton pattern

Answer

Round-robin load balancing

Question 7

You have a ConfigMap named 'app-config' and a Secret named 'db-password'. You want to mount them into a pod. Which statement is correct?

Accepted Answer

Both ConfigMaps and Secrets can be mounted as volumes. Both ConfigMaps and Secrets are Kubernetes API objects designed to decouple configuration data from container images. They can be mounted as volumes into pods, allowing files to be created in the container's filesystem with the data from the ConfigMap or Secret. This is a core feature for managing configuration and sensitive data in Kubernetes.

Answer

Secrets can be mounted as volumes, but ConfigMaps cannot

Answer

ConfigMaps can be mounted as volumes, but Secrets cannot

Answer

ConfigMaps and Secrets can only be exposed as environment variables

Question 8

An administrator notices that a pod in a Deployment is stuck in CrashLoopBackOff. The pod logs show 'Error: failed to start container: exec: "app": executable file not found in $PATH'. What is the most likely cause?

Accepted Answer

The container image does not contain the binary specified in the pod's command field. The error 'exec: "app": executable file not found in $PATH' indicates that the container image does not contain the binary or script specified in the pod's command field (e.g., `command: ["app"]`). This typically happens when the image is built without the expected executable, the command path is incorrect, or the image tag points to a different version. The container fails to start because the runtime cannot locate the entrypoint.

Answer

The image registry credentials are missing

Answer

The liveness probe is misconfigured and killing the container

Answer

The container is running as a non-root user without proper permissions

Question 9

What is the primary purpose of a container orchestration platform like Kubernetes?

Accepted Answer

To automate the deployment, scaling, and management of containerized applications. Kubernetes is a container orchestration platform designed to automate the deployment, scaling, and management of containerized applications across clusters of hosts. It handles scheduling, load balancing, self-healing, and rolling updates, which are beyond the scope of a single container runtime.

Answer

To provide a lightweight runtime for running a single container

Answer

To manage virtual machines and their hypervisors

Answer

To compile source code into container images

Question 10

A developer wants to deploy a stateful application that requires stable network identities and persistent storage per pod instance. Which Kubernetes resource is most appropriate?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it is specifically designed for stateful applications that require stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage per pod instance (via PersistentVolumeClaims that are not shared across replicas). Unlike Deployments, StatefulSet maintains a sticky identity for each pod, ensuring that on rescheduling, the pod retains its name, network identity, and bound storage.

Answer

DaemonSet

Answer

Job

Answer

Deployment

Question 11

Which component of an API gateway pattern is responsible for routing requests to the appropriate microservice based on the request path?

Accepted Answer

API Gateway. In an API gateway pattern, the API Gateway is the entry point that receives client requests and routes them to the appropriate backend microservice based on the request path, method, or other attributes. It acts as a reverse proxy and centralizes cross-cutting concerns such as authentication, rate limiting, and request transformation.

Answer

Load balancer

Answer

Service registry

Answer

Sidecar proxy

Question 12

An administrator runs 'kubectl get pods' and sees that a pod is in 'Pending' state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taints that the pod didn't tolerate, 3 nodes had insufficient memory'. What is the most likely issue?

Accepted Answer

The pod's resource requests exceed available memory on three nodes.. The scheduler event explicitly states '3 nodes had insufficient memory', which directly indicates that the pod's resource requests (specifically memory) exceed the available allocatable memory on those three nodes. The fourth node is unavailable due to taints, leaving zero schedulable nodes, hence the 'Pending' state.

Answer

The node with the taint has a toleration mismatch.

Answer

The pod's image pull is failing.

Answer

The pod was evicted due to resource pressure.

Question 13

Which of the following is a key difference between a service mesh and an API gateway?

Accepted Answer

Service mesh manages east-west traffic between services, while API gateway manages north-south traffic from external clients. A service mesh (Istio, Linkerd) operates at the data-plane level, intercepting east-west traffic between internal microservices for mTLS, retries, and observability. An API gateway (Kong, Apigee, AWS API Gateway) sits at the network edge and manages north-south traffic — external client requests entering the cluster — handling authentication, rate limiting, and routing.

Answer

Service mesh is only used in multi-cloud environments, while API gateway is for single-cloud

Answer

Service mesh provides authentication and authorization, while API gateway does not

Answer

Service mesh handles north-south traffic, while API gateway handles east-west traffic

Question 14

Which open-source project provides a unified standard for collecting and exporting telemetry data (metrics, logs, and traces) from applications?

Accepted Answer

OpenTelemetry. OpenTelemetry (OTel) is a CNCF project that provides a vendor-neutral, unified standard — APIs, SDKs, and the Collector — for instrumenting applications to emit metrics, logs, and traces. It solves the fragmentation problem where each backend required its own agent and format. OTel is the answer when the question asks for a unified telemetry collection and export standard.

Answer

Prometheus

Answer

Jaeger

Answer

Fluentd

Question 15

Which of the following best describes the GitOps pattern?

Accepted Answer

Declarative configuration stored in Git, with automated deployment via a controller. GitOps is a pattern where the entire system's desired state is declared in a Git repository, and an automated controller (such as Argo CD or Flux) continuously reconciles the live cluster state with that declarative configuration. This ensures that Git is the single source of truth, and any drift from the declared state is automatically corrected without manual intervention.

Answer

Imperative commands applied to the cluster and tracked in Git

Answer

Using Git as a backup for Kubernetes manifests

Answer

Using Git hooks to trigger CI/CD pipelines