KCNA Practice Test 27 — 15 Questions

Question 1

Which resource provides stable network endpoints to a set of pods, regardless of pod IP changes?

Accepted Answer

Service. A Service provides a stable virtual IP and DNS name that remains constant even as pods are created, destroyed, or rescheduled. It uses label selectors to dynamically route traffic to the backing pods, abstracting away their individual IP changes. This is the core mechanism for reliable network endpoints in Kubernetes.

Answer

ConfigMap

Answer

Deployment

Answer

Ingress

Question 2

Which three of the following are true about Services in Kubernetes? (Select three.)

Accepted Answer

A Service provides a stable IP address for a set of pods. Option A is correct because a Kubernetes Service is assigned a stable virtual IP (the ClusterIP) and DNS name that front a dynamic set of pod endpoints, so clients get a consistent address even as pods are created or destroyed. Option B is correct because kube-proxy programs iptables/IPVS (or the equivalent) rules so that traffic sent to the Service's ClusterIP is load balanced across the matching pods selected by the Service's label selector. Option C is correct because the default ClusterIP Service type exposes the Service only on an internal, cluster-routable virtual IP, making it reachable solely from within the cluster unless NodePort, LoadBalancer, or an Ingress is added. Option D is not correct because storing configuration data is the role of ConfigMaps and Secrets, not Services, which only handle network endpoint abstraction. Option E is not correct because Ingress provides HTTP/HTTPS layer-7 host- and path-based routing via an ingress controller, whereas a Service only offers layer-4 (or simple L7 with newer Gateway API) access to a single set of pods and cannot perform Ingress-style routing.

Answer

A Service can store configuration data for applications

Answer

A Service can replace an Ingress for HTTP routing

Question 3

A Deployment named 'web' has 3 replicas. You run 'kubectl scale deployment web --replicas=5'. What will happen?

Accepted Answer

Two additional Pods are created to reach a total of 5 replicas.. The `kubectl scale` command adjusts the replica count of a Deployment to the desired number. Since the Deployment currently has 3 replicas and the command sets `--replicas=5`, the ReplicaSet controller creates 2 additional Pods to match the desired state. No existing Pods are deleted or restarted unless the Pod template changes.

Answer

An error occurs because scaling a Deployment is not allowed.

Answer

The Deployment is updated and all Pods are restarted.

Answer

The existing Pods are deleted and 5 new Pods are created.

Question 4

Which of the following is a worker node component responsible for ensuring that containers are running in a pod as specified in the pod's spec?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each worker node. It receives PodSpecs (via the API server or a file) and ensures that the containers described in those PodSpecs are running and healthy. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers as required.

Answer

kube-scheduler

Answer

kube-proxy

Answer

etcd

Question 5

Which three of the following are valid ways to expose a service externally in Kubernetes? (Select THREE.)

Accepted Answer

Ingress. Ingress (A) is correct because it exposes HTTP/HTTPS services externally by routing traffic through an Ingress controller to internal ClusterIP services based on host/path rules. NodePort (C) is correct because it opens a static port (default range 30000–32767) on every node's IP, forwarding external traffic to the target service. LoadBalancer (D) is correct because it provisions an external load balancer (e.g., via a cloud provider) that distributes traffic to the service, typically building on NodePort and ClusterIP. ExternalName (B) is not a way to expose a service externally; it merely creates a CNAME DNS alias to an external hostname without proxying traffic. ClusterIP (E) is incorrect because it only provides an internal virtual IP reachable within the cluster, not from outside.

Answer

ExternalName

Answer

ClusterIP

Question 6

Which THREE of the following are valid options for the 'kubectl get' command to display output in different formats?

Accepted Answer

-o wide. Option B (-o wide) is correct because the -o wide output format extends the default table with additional columns such as node name, IP addresses, and nominated node, which is a documented kubectl output format. Option C (-o json) is correct because kubectl supports -o json to serialize the resource as a JSON object, useful for scripting and parsing with tools like jq. Option D (-o yaml) is correct because -o yaml renders the resource as YAML, another officially supported output format for kubectl get. The unmarked options do not belong: -o verbose is not a valid output format (verbose logging is controlled by -v/--v), and --describe is not an output format but a separate kubectl subcommand (kubectl describe) that shows detailed human-readable information.

Answer

-o verbose

Answer

--describe

Question 7

Which THREE of the following are features of Helm that facilitate release management? (Choose three.)

Accepted Answer

Rollback to a previous release revision. Helm facilitates release management through its revision-based model: option B is correct because Helm stores each install/upgrade as a numbered revision, and `helm rollback ` restores a prior revision, making recovery from a bad deployment straightforward. Option C is correct because Helm tracks release history and revision metadata (viewable via `helm history ` and stored in Kubernetes Secrets by default), which is the foundation for auditing and managing releases. Option E is correct because `helm upgrade --set key=value` (or `-f values.yaml`) lets you apply new configuration values to an existing release, incrementing the revision while preserving release identity. Option A is not a Helm feature — canary deployment is a strategy implemented by tools such as Argo Rollouts, Flagger, or service meshes, not by Helm itself. Option D is not a Helm feature either; Horizontal Pod Autoscaling is a Kubernetes controller (the `autoscaling/v2` HPA resource) that scales pods based on metrics, independent of Helm's release management.

Answer

Canary deployment strategy

Answer

Horizontal pod autoscaling

Question 8

What is the purpose of kube-proxy on a worker node?

Accepted Answer

To implement network rules and handle service traffic routing. Kube-proxy is the component responsible for implementing network rules on each worker node, enabling service abstraction by managing IP tables or IPVS rules to route traffic to the appropriate pods. It handles service discovery and load balancing for ClusterIP, NodePort, and LoadBalancer service types, ensuring that traffic destined for a service is correctly forwarded to healthy pod endpoints.

Answer

To run the container runtime

Answer

To store cluster configuration data

Answer

To monitor pod health and restart unhealthy containers

Question 9

Which THREE of the following are valid fields in a Kubernetes Deployment spec (apps/v1)?

Accepted Answer

replicas. In an apps/v1 Deployment spec, the correct top-level fields include A. replicas, which declares the desired number of Pod replicas the ReplicaSet managed by the Deployment should maintain; B. template, which is the required PodTemplateSpec describing the Pods to be created; and C. selector, which is the required LabelSelector that must match the labels in the template and determines which Pods the Deployment manages. Options D and E are not valid Deployment spec fields: containers belongs inside the Pod template's spec (spec.template.spec.containers), not directly under the Deployment spec, and nodeName is a Pod-level scheduling field under spec.template.spec, not a Deployment spec field.

Answer

containers

Answer

nodeName

Question 10

Which log aggregation tool is designed specifically for Kubernetes and is often used as a lightweight alternative to Fluentd?

Accepted Answer

Fluent Bit. Fluent Bit is a CNCF-graduated, lightweight log processor and forwarder written in C with a small memory footprint, explicitly designed for containerized and Kubernetes environments. It is commonly deployed as a DaemonSet to collect node and pod logs and forward them to backends like Elasticsearch, Loki, or S3. Its low resource usage makes it the standard 'lightweight alternative to Fluentd' in Kubernetes logging stacks.

Answer

Logstash

Answer

Loki

Answer

Elasticsearch

Question 11

Which three components are part of the Kubernetes control plane?

Accepted Answer

kube-controller-manager. The Kubernetes control plane consists of the components that make global cluster decisions and expose the cluster API. Option D, kube-apiserver, is correct because it is the front end of the control plane, serving the Kubernetes API over HTTPS and persisting cluster state in etcd. Option C, kube-scheduler, is correct because it watches for newly created Pods with no assigned node and selects a node for them based on resource requirements, affinity, and taints/tolerations. Option A, kube-controller-manager, is correct because it runs the built-in controller loops (such as node, replication, endpoints, and service account controllers) that drive the cluster toward its desired state. Option B, kube-proxy, is not part of the control plane; it is a node-level component that maintains network rules (iptables/IPVS) for Service load balancing. Option E, kubelet, is also not part of the control plane; it is the node agent that registers the node and manages Pod containers via the container runtime.

Answer

kube-proxy

Answer

kubelet

Question 12

In event-driven architecture, which pattern is commonly used to decouple producers and consumers, allowing asynchronous communication?

Accepted Answer

Event broker (message queue or event bus). An event broker (message queue or event bus) decouples producers and consumers by allowing producers to publish events without knowing who consumes them, and consumers to subscribe and process events asynchronously. This enables loose coupling, scalability, and resilience. Examples include Apache Kafka, RabbitMQ, and cloud services like AWS EventBridge.

Answer

Shared database

Answer

Circuit breaker pattern

Answer

Synchronous REST API calls

Question 13

Which component runs on every Kubernetes node and ensures that the containers in a pod are running?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every Kubernetes node. It receives PodSpec definitions from the API server and ensures that the containers described in those PodSpecs are running and healthy. It continuously monitors container status and takes corrective actions, such as restarting containers that have failed, making it the correct answer.

Answer

kube-proxy

Answer

kube-scheduler

Answer

container runtime

Question 14

A Deployment is configured with 'replicas: 5' and a rolling update strategy. During an update, you notice that the number of available pods drops to 3 momentarily. Which field in the Deployment spec can be adjusted to control the minimum number of pods available during a rolling update?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. `spec.strategy.rollingUpdate.maxUnavailable` defines the maximum number (or percentage) of Pods that can be unavailable during a rolling update. With `replicas: 5`, setting `maxUnavailable: 2` would allow at most 2 Pods to be unavailable at any time, ensuring that at least 3 Pods remain available — which matches the observed drop to 3. This field directly controls the minimum number of available Pods during the update process.

Answer

spec.strategy.rollingUpdate.maxSurge

Answer

spec.minReadySeconds

Answer

spec.replicas

Question 15

A CI/CD pipeline includes image scanning. What is the primary security benefit of scanning container images in the CI phase?

Accepted Answer

It prevents vulnerable images from being deployed to production. Scanning images during CI catches known CVEs, misconfigurations, and embedded secrets before the artifact is pushed to a registry or promoted to production. By failing the pipeline on policy violations, teams create a gate that stops vulnerable images from ever reaching runtime environments, shifting security left. This is the core security value: prevention at the earliest feasible stage rather than detection after deployment.

Answer

It reduces the time it takes to build images

Answer

It automatically fixes vulnerabilities

Answer

It ensures that the image is built only once