KCNA Practice Test 4 — 25 Questions

Question 1

In the context of distributed tracing, what is a 'span'?

Accepted Answer

A single logical operation within a service, with a start and end time. A span represents a single logical operation within a service, with a start time and end time, forming the basic unit of work in distributed tracing. Spans are nested to form a trace, where the root span represents the overall request and child spans represent downstream calls, database queries, or internal operations.

Answer

A metric that measures request latency

Answer

A tool for collecting logs from containers

Answer

The entire end-to-end transaction across services

Question 2

A developer wants to run a one-time task that creates a database schema and then exits. Which Kubernetes workload type is most appropriate?

Accepted Answer

Job. A Job is the correct choice because it is designed for finite, one-time tasks that run to completion, such as creating a database schema. Unlike long-running workloads, a Job creates one or more Pods and ensures they terminate successfully after the task finishes, making it ideal for batch processing or initialization tasks.

Answer

DaemonSet

Answer

StatefulSet

Answer

Deployment

Question 3

Which Kubernetes component is responsible for maintaining the desired state of the cluster by running controllers?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller processes, which are control loops that watch the shared state of the cluster through the kube-apiserver and make changes to drive the current state toward the desired state. It bundles together controllers such as the Node Controller, Replication Controller, and Endpoint Controller, each responsible for specific aspects of cluster state management.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

etcd

Question 4

A team is designing a Kubernetes cluster for a production workload that requires high availability. They have three worker nodes in different availability zones. Which statement about scheduling Pods is correct?

Accepted Answer

Define a Pod topology spread constraint with topologyKey: topology.kubernetes.io/zone.. A Pod topology spread constraint with `topologyKey: topology.kubernetes.io/zone` explicitly instructs the scheduler to distribute Pods evenly across the specified failure domains (availability zones). This ensures that if one zone fails, the remaining zones still have running Pods, achieving high availability for the production workload.

Answer

Use nodeSelector to assign Pods to nodes in different zones.

Answer

Add tolerations for the zone taint.

Answer

Use podAntiAffinity with a requiredDuringSchedulingIgnoredDuringExecution rule.

Question 5

Which two of the following are valid ways to set resource constraints on a container in a Pod spec?

Accepted Answer

Specify 'resources.limits.memory' for maximum memory. Option B is correct because the Pod spec's container definition uses the 'resources.limits' field to declare the maximum amount of a resource the container may consume, so 'resources.limits.memory' sets a hard memory ceiling that the container cannot exceed. Option D is correct because 'resources.requests.cpu' declares the minimum CPU the container is guaranteed for scheduling purposes, and the kubelet uses this value when allocating CPU shares. The other options are invalid field names: 'resources.guarantees.cpu' (A), 'resources.min.memory' (C), and 'resources.max.cpu' (E) do not exist in the Kubernetes API, which only supports 'requests' and 'limits' under 'resources'.

Answer

Specify 'resources.guarantees.cpu' for CPU guarantees

Answer

Specify 'resources.min.memory' for minimum memory

Answer

Specify 'resources.max.cpu' for CPU limits

Question 6

A team wants to manage their Kubernetes infrastructure using code. Which tool is specifically designed for Infrastructure as Code (IaC) and can manage Kubernetes resources?

Accepted Answer

Terraform. Terraform is a dedicated Infrastructure as Code (IaC) tool that uses declarative configuration files (HCL) to provision and manage cloud resources, including Kubernetes clusters and their workloads. It maintains state to track resource dependencies and can orchestrate Kubernetes resources via its Kubernetes provider, making it the correct choice for managing Kubernetes infrastructure as code.

Answer

Helm

Answer

kubectl

Answer

Kustomize

Question 7

In a multi-cloud architecture, what is a common use case for a service mesh?

Accepted Answer

To enable secure service-to-service communication across clusters. A service mesh, such as Istio or Linkerd, provides a dedicated infrastructure layer for handling service-to-service communication. In a multi-cloud architecture, its common use case is to enable secure, observable, and resilient communication between services running in different Kubernetes clusters across clouds, using mutual TLS (mTLS) for encryption and traffic policies for routing.

Answer

To synchronize Kubernetes resources across clouds

Answer

To provide cloud-agnostic block storage

Answer

To provide a single ingress gateway for all clouds

Question 8

In an event-driven architecture using a message broker, which component is responsible for receiving events and forwarding them to subscribed services?

Accepted Answer

Message broker. In event-driven architecture, the message broker (Kafka, RabbitMQ, NATS, Pulsar) is the intermediary that receives published events and routes them to subscribers based on topics, queues, or routing keys. It decouples producers from consumers, buffers events, and handles delivery semantics. Option B names this component directly.

Answer

Service mesh

Answer

API gateway

Answer

Load balancer

Question 9

Which component runs on every worker node and is responsible for ensuring that containers are running in a pod according to the pod specification?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node in a Kubernetes cluster. It registers the node with the API server, watches for PodSpecs assigned to its node, and ensures the containers described in those PodSpecs are running and healthy. It does this by interacting with the container runtime to create, start, and stop containers as needed, and it reports the node and pod status back to the control plane.

Answer

kube-scheduler

Answer

container runtime

Answer

kube-proxy

Question 10

A Kubernetes Deployment manages a set of pods. What is the primary purpose of a Deployment?

Accepted Answer

To declare the desired state for a set of pods and manage rolling updates. A Kubernetes Deployment declares the desired state for a set of pods and manages rolling updates and rollbacks. It ensures that the specified number of pod replicas are running and provides declarative updates to the application, which is its primary purpose.

Answer

To store configuration data as key-value pairs

Answer

To run a batch job to completion

Answer

To expose a set of pods as a network service

Question 11

In a service mesh architecture, which component is responsible for intercepting and managing traffic to and from a pod?

Accepted Answer

Sidecar proxy. The sidecar proxy (e.g., Envoy) runs alongside each service instance and intercepts all network traffic, enabling features like traffic management and observability.

Answer

Ingress controller

Answer

API gateway

Answer

Control plane

Question 12

What is the primary purpose of the `kubectl apply` command?

Accepted Answer

To create or update resources from a manifest. The `kubectl apply` command uses a declarative approach to manage Kubernetes resources. It sends a PATCH request to the API server, which compares the desired state in the provided manifest (YAML/JSON) with the current state of the resource in the cluster. If the resource does not exist, it creates it; if it does exist, it updates only the fields specified in the manifest, preserving any fields not mentioned.

Answer

To view resource details

Answer

To delete resources

Answer

To execute commands inside a container

Question 13

Which of the following is a benefit of using a service mesh?

Accepted Answer

Enhanced observability and traffic control. A service mesh (Istio, Linkerd, Consul Connect) injects sidecar proxies alongside application pods to intercept all service-to-service traffic, providing uniform mTLS, traffic shifting, retries, circuit breaking, and rich telemetry (latency, error rates, request tracing) without application code changes. Option C correctly identifies the two headline benefits: enhanced observability and traffic control. These capabilities are delivered at the infrastructure layer, transparently to the application.

Answer

Simplified storage management

Answer

Automatic scaling of applications

Answer

Direct database access

Question 14

You run 'kubectl get pods' and see a Pod in the 'Pending' state. Which of the following is a likely cause?

Accepted Answer

No node meets the requested CPU or memory resources. A Pod enters the 'Pending' state when it cannot be scheduled onto a node. The most common reason is that no node in the cluster has sufficient available CPU or memory resources to satisfy the Pod's resource requests. The Kubernetes scheduler continuously evaluates nodes against Pod resource requirements, and if none match, the Pod remains unscheduled in Pending.

Answer

The application crashed due to a bug

Answer

The container image is missing

Answer

The Pod has been deleted

Question 15

According to the 12-factor app methodology, how should an application store configuration that varies between deployments (e.g., database connection strings)?

Accepted Answer

In environment variables. The 12-factor app recommends strict separation of config from code, storing config in environment variables.

Answer

In a configuration file that is version-controlled

Answer

In a database table

Answer

Hard-coded in the application code

Question 16

You have a Deployment that runs a web application. You need to expose this application externally on a fixed port using a cloud load balancer. Which Service type should you use?

Accepted Answer

LoadBalancer. A LoadBalancer Service type provisions an external cloud load balancer (e.g., AWS ELB, GCP TCP/UDP Load Balancer) that exposes the application on a fixed port (typically 80/443) and distributes traffic to the Pods. This is the correct choice because the requirement explicitly asks for a cloud load balancer with a fixed external port, which is exactly what LoadBalancer provides by integrating with the underlying cloud provider's API.

Answer

NodePort

Answer

ExternalName

Answer

ClusterIP

Question 17

What is the purpose of a circuit breaker pattern in microservices?

Accepted Answer

To stop cascading failures by preventing calls to a failing service. The circuit breaker pattern wraps calls to a remote service and monitors for failures. When failures exceed a threshold, the breaker 'opens' and subsequent calls fail fast (or return a fallback) instead of being attempted, preventing a single failing dependency from exhausting threads/connections and cascading failures across the microservice graph. This is the core purpose: fault isolation and preventing cascading failures.

Answer

To distribute traffic across multiple instances

Answer

To encrypt communication between services

Answer

To automatically retry failed requests

Question 18

You need to ensure that a pod runs on a specific node that has an SSD. The node has the label 'disktype=ssd'. How should you configure the pod to target this node?

Accepted Answer

Set spec.nodeSelector with disktype: ssd.. `spec.nodeSelector` is the simplest and most direct way to constrain a Pod to run only on nodes that have a specific label. By setting `disktype: ssd` in the nodeSelector, the scheduler will only consider nodes with that exact label key-value pair, ensuring the Pod lands on an SSD-equipped node.

Answer

Set spec.affinity.nodeAffinity with requiredDuringSchedulingIgnoredDuringExecution.

Answer

Set spec.tolerations with key=disktype, value=ssd.

Answer

Set spec.nodeName to the node's name.

Question 19

A Pod is stuck in 'Pending' state. Which command is most helpful to diagnose the issue?

Accepted Answer

kubectl describe pod my-pod. 'kubectl describe pod my-pod' provides detailed information about the pod's current state, including events, conditions, and resource constraints. When a pod is stuck in 'Pending', it typically means the scheduler cannot place it on a node due to issues like insufficient CPU/memory, persistent volume claims not being bound, or node selector mismatches. The 'describe' command surfaces these specific reasons in the 'Events' section and 'Conditions' field, making it the most direct diagnostic tool.

Answer

kubectl logs my-pod

Answer

kubectl get events

Answer

kubectl top pod my-pod

Question 20

Which TWO of the following are true about the Open Container Initiative (OCI)?

Accepted Answer

OCI is a Linux Foundation project. The Open Container Initiative (OCI) is a Linux Foundation project that was established to create open industry standards around container formats and runtimes. It operates under the Linux Foundation's governance to ensure vendor-neutral specifications.

Answer

OCI requires the use of containerd

Answer

OCI defines the Dockerfile format

Answer

OCI defines the Container Runtime Interface (CRI)