KCNA Practice Test 5 — 25 Questions

Question 1

Which CNCF project maturity level indicates that a project has successfully adopted the CNCF governance and is considered stable for production use?

Accepted Answer

Graduated. The Graduated maturity level is the highest in the CNCF project lifecycle, indicating that a project has both successfully adopted CNCF governance and is considered stable for production use. To achieve Graduated, a project must meet rigorous criteria including adoption by multiple end users, a defined governance structure, and completion of a security audit. This distinguishes it from lower maturity levels such as Sandbox (early-stage) and Incubating (growing but not yet stable).

Answer

Incubating

Answer

Experimental

Answer

Sandbox

Question 2

Which component in a service mesh architecture is responsible for handling inter-service communication on behalf of the application container?

Accepted Answer

Sidecar proxy. The sidecar proxy (e.g., Envoy) intercepts all network traffic to and from the application container, providing observability, traffic management, and security.

Answer

Control plane

Answer

Ingress controller

Answer

API gateway

Question 3

You have a microservices application deployed as a set of Pods in a Kubernetes cluster. You need to ensure that Pods can discover each other using stable DNS names. Which Kubernetes resource should you create?

Accepted Answer

Service. A Service of type ClusterIP (the default) provides a stable virtual IP and DNS name (e.g., my-service.namespace.svc.cluster.local) that resolves to the Pods selected by its label selector. This allows Pods to discover each other using consistent DNS names, regardless of Pod IP changes due to scaling or restarts. The kube-dns or CoreDNS addon automatically creates DNS records for Services, enabling service discovery within the cluster.

Answer

ConfigMap

Answer

Ingress

Answer

Deployment

Question 4

In a microservices architecture, which pattern is used to prevent cascading failures by limiting the number of concurrent requests to a service?

Accepted Answer

Bulkhead. The bulkhead pattern isolates resources (e.g., thread pools, connection pools) for different services or operations so that a failure or overload in one area does not exhaust resources and cause cascading failures. By limiting the number of concurrent requests to a service, bulkheads contain the impact of slow or failing dependencies. This is analogous to watertight compartments in a ship.

Answer

Timeout

Answer

Retry

Answer

Circuit breaker

Question 5

A developer wants to deploy a stateful application that requires stable network identities and persistent storage. Which Kubernetes resource is best suited for this workload?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it is designed specifically for stateful applications that require stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage (via PersistentVolumeClaims that are retained across Pod rescheduling). Unlike Deployments, StatefulSets guarantee ordered deployment, scaling, and termination, which is essential for databases or message queues.

Answer

Deployment

Answer

DaemonSet

Answer

Job

Question 6

Match each Kubernetes storage concept to its description.

Accepted Answer

PersistentVolume: A piece of storage in the cluster provisioned by an administrator.. The correct matches are: PersistentVolume is a cluster storage resource, PersistentVolumeClaim is a user request for storage, and StorageClass defines storage classes. Two common confusions are swapping PV and PVC definitions.

Answer

PersistentVolume: A request for storage by a user that binds to a PersistentVolume.

Answer

PersistentVolumeClaim: A piece of storage in the cluster provisioned by an administrator.

Question 7

Which TWO of the following are benefits of using containers over virtual machines? (Choose 2)

Accepted Answer

Containers are more lightweight and start faster than VMs. Containers share the host OS kernel and run as isolated processes, making them lightweight and able to start in milliseconds, unlike VMs which require booting a full guest OS. This efficiency stems from container images being mere megabytes compared to gigabytes for VM images, and containers using cgroups and namespaces for resource management rather than a hypervisor.

Answer

Containers require hypervisor software to run

Answer

Containers include a full guest operating system

Answer

Containers provide stronger isolation than VMs

Question 8

In an event-driven architecture, what is the role of an event broker?

Accepted Answer

To intermediate between event producers and consumers. In an event-driven architecture, the event broker acts as a middleware that decouples event producers from consumers by receiving events from producers and forwarding them to interested consumers. This intermediary role ensures asynchronous communication, scalability, and fault tolerance without requiring producers and consumers to be directly aware of each other. Technologies like Apache Kafka, RabbitMQ, or cloud-native services such as AWS EventBridge exemplify this pattern.

Answer

To run event-processing logic

Answer

To transform events into API calls

Answer

To store event schemas

Question 9

Which component of the Kubernetes control plane stores the cluster state?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as the single source of truth for the entire Kubernetes cluster. It stores all cluster state data, including configuration, secrets, and the desired state of every object (Pods, Deployments, Services, etc.). The kube-apiserver is the only component that directly communicates with etcd, ensuring that all state changes go through a consistent, versioned API.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kube-apiserver

Question 10

What is the primary purpose of the Container Runtime Interface (CRI) in Kubernetes?

Accepted Answer

To provide a standard interface between the kubelet and container runtimes. The Container Runtime Interface (CRI) is a plugin protocol that enables the kubelet to use any OCI-compliant container runtime (e.g., containerd, CRI-O) without needing to recompile Kubernetes. It defines gRPC APIs for runtime and image service operations, abstracting the runtime implementation from the kubelet's pod lifecycle management.

Answer

To store container images in a registry

Answer

To define the format of container images

Answer

To manage container network interfaces

Question 11

Which TWO of the following are benefits of using a container orchestration platform like Kubernetes? (Select 2)

Accepted Answer

Self-healing of failed containers. Option C is correct because Kubernetes continuously reconciles desired state with actual state: its controllers (e.g., ReplicaSet, Deployment) detect crashed or unhealthy pods via liveness/readiness probes and restart or reschedule them, providing self-healing. Option E is correct because Kubernetes supports automatic scaling through the Horizontal Pod Autoscaler (HPA), which adjusts replica counts based on metrics such as CPU utilization or custom metrics, and the Cluster Autoscaler, which adds or removes nodes as demand changes. Option A is wrong because orchestration automates container scheduling and deployment rather than requiring manual placement. Option B is wrong because Kubernetes runs containers via a container runtime (containerd, CRI-O) on each node and does not require a hypervisor. Option D is wrong because orchestration platforms are designed for dynamic, declarative infrastructure that changes as workloads and scaling demands evolve.

Answer

Manual deployment of containers to servers

Answer

Requirement for a hypervisor on every node

Answer

Static infrastructure that never changes

Question 12

A team is using Kustomize to manage configurations for different environments. They want to create a variant of a base deployment that uses a different number of replicas. Which Kustomize feature should they use?

Accepted Answer

Patches. Patches in Kustomize allow you to modify specific fields of resources from a base or overlay, such as changing the replica count of a Deployment. This is the intended feature for creating variants without duplicating the entire base. Generators create new resources (e.g., ConfigMaps), bases are the starting point, and components are reusable pieces that can be included, but none are designed for modifying existing fields like replica count.

Answer

Generators

Answer

Bases

Answer

Components

Question 13

Which component on a worker node is responsible for enforcing the network rules and implementing Service abstractions?

Accepted Answer

kube-proxy. kube-proxy is the component on each worker node that implements Service abstractions by maintaining network rules (iptables, IPVS, or userspace) that allow traffic to reach Pods from inside or outside the cluster. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates the node's packet filtering rules to forward traffic to the correct backend Pods, handling load balancing and session affinity.

Answer

kubelet

Answer

container runtime

Answer

kube-scheduler

Question 14

What is a key advantage of containers compared to virtual machines?

Accepted Answer

Containers are lightweight and share the host OS kernel. Containers are lightweight because they share the host operating system kernel, avoiding the overhead of a separate guest OS per instance. Unlike VMs, which each include a full OS and require hypervisor mediation, containers run as isolated user-space processes on the same kernel, enabling faster startup times and higher density. This kernel sharing is the fundamental architectural advantage that makes containers more resource-efficient than virtual machines.

Answer

Containers provide stronger isolation than VMs

Answer

Containers include a full guest operating system

Answer

Containers require hypervisor software to run

Question 15

Which TWO of the following are valid ways to view the logs of a pod named 'my-pod'?

Accepted Answer

kubectl exec my-pod -- cat /var/log/app.log. Option B is correct because kubectl exec my-pod -- cat /var/log/app.log runs the cat command inside the container of the pod, directly reading the application log file at that path, which is a valid way to view logs when the app writes to a file rather than stdout. Option C is correct because kubectl logs my-pod retrieves the stdout/stderr output captured by the container runtime for the pod's (default) container, which is the standard Kubernetes logging mechanism. Option A is not a log-viewing method: kubectl describe pod my-pod shows metadata, status, events, and container specs, not the application's log stream. Option D is invalid syntax and semantics: kubectl run creates a new pod from an image and does not accept a 'logs' subcommand to read an existing pod's logs. Option E is wrong because kubectl attach my-pod attaches the terminal to a running container's process (stdin/stdout of PID 1), which is interactive and not a log-retrieval command.

Answer

kubectl describe pod my-pod

Answer

kubectl run my-pod -- logs

Answer

kubectl attach my-pod

Question 16

A Pod has a container that needs to write logs to a file. The administrator wants the logs to persist even if the container restarts. What is the simplest solution?

Accepted Answer

Use an emptyDir volume and mount it at the log path.. An emptyDir volume provides a simple, ephemeral storage solution that persists across container restarts within the same Pod. When a container crashes and is restarted by the kubelet, the emptyDir volume's contents remain intact, allowing log files to survive container restarts without requiring external storage or complex configuration.

Answer

Use a PersistentVolumeClaim for each container.

Answer

Use a hostPath volume to write logs directly to the node filesystem.

Answer

Store logs in a ConfigMap.

Question 17

In the 12-factor app methodology, which factor describes the practice of storing configuration in environment variables?

Accepted Answer

Config. The Config factor (Factor III) of the 12-factor app methodology mandates that configuration—such as database URLs, credentials, or feature flags—be stored in environment variables. This decouples configuration from code, allowing the same build to be deployed across different environments without code changes, and prevents accidental commits of secrets to version control.

Answer

Backing services

Answer

Processes

Answer

Build, release, run

Question 18

In the context of the 12-factor app methodology, which factor is addressed by storing configuration in environment variables?

Accepted Answer

III. Config. Factor III (Config) of the 12-factor app methodology explicitly states that configuration should be stored in environment variables, separating config from code so the same build can be deployed across environments. This allows credentials, endpoints, and environment-specific values to be injected at runtime rather than baked into the artifact.

Answer

IV. Backing Services

Answer

II. Dependencies

Answer

I. Codebase

Question 19

A Kubernetes cluster runs a critical application that must be updated with zero downtime. The team wants to gradually shift traffic from the old version to the new version over a period of time. Which deployment pattern is MOST appropriate?

Accepted Answer

Canary deployment. Canary deployment is the most appropriate pattern for gradually shifting traffic from an old version to a new version over time. It involves deploying the new version to a small subset of users or servers, then incrementally increasing traffic while monitoring for issues. This allows zero-downtime updates and minimizes risk by limiting exposure. Rolling update replaces instances in batches but does not provide the same gradual, controlled traffic shifting with the ability to pause or rollback based on metrics.

Answer

Rolling update

Answer

Recreate deployment

Answer

Blue-green deployment

Question 20

In a service mesh architecture, what is the role of the sidecar proxy?

Accepted Answer

It intercepts and controls network communication to and from the main container. The sidecar proxy intercepts all network traffic to/from the main container, enabling observability, traffic management, and security without modifying application code.

Answer

It provides persistent storage for the pod

Answer

It manages the lifecycle of the pod

Answer

It serves as the main application container