KCNA Practice Test 2 — 25 Questions

Question 1

Refer to the exhibit. A pod 'my-pod' shows repeated 'BackOff' events after the container starts. Which is the most likely cause?

Accepted Answer

The application crashes shortly after starting.. The 'BackOff' event in Kubernetes indicates that the container has started but repeatedly crashes, causing the kubelet to increase the restart delay. Option D is correct because an application that crashes shortly after starting will trigger this restart loop, as the container exits with a non-zero exit code, leading to exponential backoff.

Answer

The image 'myapp:v2' does not exist.

Answer

The container exceeds its memory limit.

Answer

The liveness probe is failing.

Question 2

A Kubernetes cluster has two nodes: control-plane and worker. The worker node runs several pods. The control-plane node becomes unreachable. What is the immediate impact on the pods running on the worker node?

Accepted Answer

Pods continue running, but new pods cannot be scheduled. When the control-plane node becomes unreachable, the kube-controller-manager cannot communicate with the kubelet on the worker node, so it stops performing scheduling and reconciliation. However, the kubelet on the worker node continues to run existing pods based on the last known desired state stored locally, and the pods themselves are managed by the container runtime (e.g., containerd) independently of the control-plane. Therefore, pods continue running normally, but no new pods can be scheduled because the scheduler, which runs on the control-plane, is unavailable.

Answer

All pods are immediately terminated

Answer

Pods are rescheduled to the control-plane node

Answer

The worker node is automatically cordoned

Question 3

Which Kubernetes object provides a stable IP address and DNS name for a set of Pods?

Accepted Answer

Service. A Service provides a stable virtual IP address and a DNS name (e.g., my-svc.namespace.svc.cluster.local) that remains constant even as Pods are created or destroyed. This enables reliable network access to a dynamic set of Pods selected via labels, abstracting away Pod IP volatility.

Answer

Ingress

Answer

ConfigMap

Answer

Deployment

Question 4

Which command would you use to view the logs of a container named 'sidecar' inside a pod named 'app'?

Accepted Answer

kubectl logs app -c sidecar. The `kubectl logs` command uses the `-c` flag to specify a container name within a pod. When a pod contains multiple containers, you must explicitly indicate which container's logs to retrieve. The syntax `kubectl logs -c ` is the standard way to view logs from a specific container in a multi-container pod.

Answer

kubectl logs app sidecar

Answer

kubectl logs sidecar app

Answer

kubectl logs sidecar -p app

Question 5

Which THREE of the following are key characteristics of microservices architecture?

Accepted Answer

Independent deployment of services. Microservices architecture mandates that each service can be independently deployed, updated, and scaled without affecting other services. This is achieved through separate deployment pipelines, containerization (e.g., Docker), and orchestration platforms like Kubernetes that manage service lifecycles independently. Independent deployment enables continuous delivery and reduces the blast radius of changes.

Answer

Single monolithic codebase

Answer

Shared database schema across services

Question 6

Which of the following is NOT one of the three pillars of observability in cloud-native environments?

Accepted Answer

Security. The three pillars are logs, metrics, and traces. Security is not one of them, though it is important.

Answer

Metrics

Answer

Traces

Answer

Logs

Question 7

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running reconciliation loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, each of which watches the current state of the cluster via the kube-apiserver and makes changes to drive the actual state toward the desired state defined in etcd. This reconciliation loop pattern is fundamental to Kubernetes' self-healing behavior, ensuring that resources like deployments, replica sets, and nodes match their specifications.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 8

You need to ensure that a set of pods in a Deployment can be reached by other pods using a stable IP address and DNS name. Which Kubernetes object should you use?

Accepted Answer

Service. A Service provides a stable IP address and DNS name for a set of pods, abstracting the underlying pod IPs that can change due to scaling or failures. By default, a Service uses a cluster-internal virtual IP and DNS record (e.g., ..svc.cluster.local) that other pods can resolve, ensuring reliable connectivity without needing to track individual pod IPs.

Answer

NetworkPolicy

Answer

Ingress

Answer

ConfigMap

Question 9

An application running in a Kubernetes cluster needs to securely access a third-party API. The API key must be stored in the cluster and mounted into the Pod as an environment variable. Which is the best practice?

Accepted Answer

Create a Secret with the API key and use envFrom or valueFrom in the Pod spec.. Kubernetes Secrets are specifically designed to store sensitive data like API keys, and using `envFrom` or `valueFrom` in the Pod spec injects the Secret value as an environment variable without exposing it in the Pod definition. This approach follows the principle of least privilege and avoids hardcoding secrets in images or plaintext ConfigMaps.

Answer

Store the API key in a ConfigMap and reference it in the Pod spec.

Answer

Embed the API key directly in the container image.

Answer

Store the API key in a Pod annotation and read it with kubectl.

Question 10

Which command is used to create a Deployment that runs an nginx container with 3 replicas?

Accepted Answer

kubectl create deployment nginx --image=nginx --replicas=3. `kubectl create deployment` is the standard Kubernetes command to create a Deployment resource, and the `--replicas=3` flag directly sets the desired replica count to 3. This command creates a Deployment that manages a ReplicaSet to ensure three nginx pods are running and maintained.

Answer

kubectl create pod nginx --image=nginx --replicas=3

Answer

kubectl run nginx --image=nginx --replicas=3

Answer

kubectl scale deployment nginx --replicas=3

Question 11

According to DORA metrics, which metric measures the percentage of deployments that fail in production?

Accepted Answer

Change Failure Rate. Change Failure Rate (CFR) is the DORA metric that directly measures the percentage of deployments that result in a failure in production, such as a service outage or a bug requiring a hotfix. It is calculated as (number of failed deployments / total deployments) * 100. This metric reflects the quality and stability of the software delivery process, complementing speed metrics like Deployment Frequency and Lead Time for Changes.

Answer

Mean Time to Restore (MTTR)

Answer

Deployment Frequency

Answer

Lead Time for Changes

Question 12

A pod is stuck in the Pending state. Running 'kubectl describe pod <pod-name>' shows the event: '0/3 nodes are available: 1 node had taint {node.kubernetes.io/disk-pressure: }, 2 nodes had taint {node.kubernetes.io/memory-pressure: }'. What is the most likely cause?

Accepted Answer

All nodes have taints that the pod does not have tolerations for. The pod is stuck in Pending because the scheduler cannot find a node that satisfies its scheduling constraints. The events show that all three nodes have taints (disk-pressure and memory-pressure), and the pod does not have corresponding tolerations to allow it to be scheduled on those nodes. Without tolerations, the pod is not permitted to run on any of the available nodes, leaving it in the Pending state.

Answer

The container image is not found in the registry

Answer

The pod has a resource request that exceeds available capacity on all nodes

Answer

The pod's liveness probe is failing

Question 13

A Service of type ClusterIP is created to expose a set of pods. How does the Service achieve load balancing to the pods?

Accepted Answer

The kube-proxy component on each node sets up network rules to forward traffic to the pods. Kube-proxy on each node implements load balancing for ClusterIP Services by creating iptables or IPVS rules that distribute traffic from the Service's virtual IP to the backend pods. These rules use a random or round-robin selection (depending on the mode) to forward packets to healthy pods, ensuring no single pod is overwhelmed.

Answer

The API server routes traffic directly to the pods

Answer

The kubelet configures the container runtime to route traffic

Answer

Using a cloud load balancer

Question 14

Which two of the following are Kubernetes controllers that run inside the kube-controller-manager? (Select TWO)

Accepted Answer

Replication controller. The Replication controller (B) is correct because it is a built-in controller that runs within the kube-controller-manager process, continuously reconciling the desired number of pod replicas with the actual state by creating or deleting pods. The Node controller (D) is also correct because it is another controller embedded in the kube-controller-manager, responsible for monitoring node health, applying taints like node.kubernetes.io/not-ready, and evicting pods from unreachable nodes. The kubelet (A) is not part of the kube-controller-manager; it is a node-level agent that runs on each worker node and manages pod lifecycle via the container runtime. etcd (C) is the distributed key-value store that persists cluster state, not a controller, and it runs as a separate process. The kube-scheduler (E) is a separate control-plane component that assigns pods to nodes and runs independently of the kube-controller-manager.

Answer

kubelet

Answer

etcd

Answer

kube-scheduler

Question 15

Which TWO are characteristics of the microservices architecture that are supported by container orchestration?

Accepted Answer

Independent deployment of each service. Option B is correct because container orchestration platforms such as Kubernetes let each microservice be built, versioned, and rolled out on its own schedule, so a change to one service does not force redeployment of the others. Option C is correct because microservices architecture decomposes an application into small, independently runnable services, and orchestration supports this by scheduling, scaling, and networking each service as a separate workload. Options A, D, and E are not characteristics of microservices supported by orchestration: tight coupling, a monolithic codebase with centralized deployment, and a single shared database all describe monolithic or tightly integrated designs that contradict the independence and loose coupling that orchestration enables.

Answer

Tight coupling between services to ensure performance

Answer

Monolithic codebase with centralized deployment

Answer

Use of a single, shared database for all services

Question 16

Which service mesh component is responsible for handling inter-service communication as a sidecar proxy?

Accepted Answer

Envoy. Envoy is the correct answer because it is the sidecar proxy component in Istio that handles all inter-service communication. It intercepts traffic between microservices and applies routing, load balancing, and security policies defined by the control plane. Envoy runs as a sidecar container alongside each service instance, managing inbound and outbound traffic at the L4/L7 layer.

Answer

Mixer

Answer

Pilot

Answer

Citadel

Question 17

What is the smallest deployable unit in Kubernetes that can be created, scheduled, and managed?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model that can be created, scheduled, and managed. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. While containers are the underlying runtime, Kubernetes does not schedule containers directly; it schedules Pods as the atomic unit of deployment.

Answer

Deployment

Answer

Node

Answer

Container

Question 18

Which THREE of the following are benefits of structured logging? (Select three.)

Accepted Answer

Easier querying and filtering. Structured logging emits events as key-value pairs (typically JSON), so option A is correct because fields like level, service, or trace_id can be queried and filtered directly in tools such as Elasticsearch, Loki, or CloudWatch Logs Insights without fragile regex parsing. Option D is correct because that same machine-parseable format lets log processors, SIEMs, and observability pipelines ingest and index records programmatically and reliably. Option E is correct because adopting a shared schema with consistent field names across services enables correlation and aggregation across distributed systems, which is a core goal of structured logging. Option B is not a benefit: structured logs are usually less human-readable than free-form plain text, which is why pretty-printers exist. Option C is not a benefit either: JSON key-value output typically increases log size versus terse plain-text lines due to repeated field names and delimiters, so storage requirements usually grow rather than shrink.

Answer

More human-readable than plain text

Answer

Reduced storage requirements

Question 19

A company is deploying a microservices application on Kubernetes. They want to ensure that configuration data, such as database URLs and feature flags, can be updated without rebuilding container images. Which Kubernetes resource should they use?

Accepted Answer

ConfigMaps. ConfigMaps are the correct Kubernetes resource for decoupling configuration data (like database URLs and feature flags) from container images. They allow you to inject configuration as environment variables or mounted volumes without rebuilding or redeploying the container image, enabling runtime updates.

Answer

Secrets

Answer

Services

Answer

Deployments

Question 20

Which Prometheus metric type is used to represent a value that can increase or decrease over time, such as memory usage?

Accepted Answer

Gauge. A gauge is the Prometheus metric type designed to represent a value that can arbitrarily go up or down, such as memory usage, temperature, or current connections. Unlike counters, gauges are not monotonic and can be set to any value, making them ideal for instantaneous measurements. Memory usage fluctuates as processes allocate and free memory, so a gauge accurately captures this behavior.

Answer

Histogram

Answer

Summary

Answer

Counter