KCNA Practice Test 28 — 15 Questions

Question 1

You have a Kubernetes cluster with multiple namespaces. You need to allow communication only from pods with label 'app: frontend' to pods with label 'app: backend' in the same namespace. Which resource should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NetworkPolicy. NetworkPolicy is a Kubernetes resource that controls ingress and egress traffic between pods based on labels, namespaces, or IP blocks. By defining a NetworkPolicy with a podSelector matching 'app: backend' and an ingress rule that allows traffic only from pods with label 'app: frontend', you can restrict communication to only those pods in the same namespace. This is the correct approach because NetworkPolicy operates at Layer 3/4 (and optionally Layer 7 with Cilium) to enforce network segmentation.

Answer

RBAC Role

Answer

PodSecurityPolicy

Answer

Service

Question 2

What is the primary purpose of Kubernetes?

Accepted Answer

To orchestrate containers across a cluster of machines. Kubernetes is a container orchestration platform designed to automate the deployment, scaling, and management of containerized applications across a cluster of machines. Its primary purpose is to ensure that containers run reliably and efficiently by handling scheduling, load balancing, self-healing, and rolling updates, which is why option D is correct.

Answer

To provide a graphical interface for managing containers

Answer

To replace virtual machines with containers

Answer

To compile container images from source code

Question 3

In a Helm chart, which file is used to define default configuration values that can be overridden by users during installation?

Accepted Answer

values.yaml. values.yaml is the conventional file in Helm charts for default configuration values. Users can override these values during installation using --set or by providing a custom values file. Option A (templates/) contains Kubernetes manifest templates. Option B (charts/) holds subchart dependencies. Option D (Chart.yaml) includes chart metadata like name and version. Therefore, the correct answer is C.

Answer

templates/ directory

Answer

charts/ directory

Answer

Chart.yaml

Question 4

Which of the following best describes the GitOps pattern?

Accepted Answer

Declarative configuration stored in Git, with automated deployment via a controller. GitOps is a pattern where the entire system's desired state is declared in a Git repository, and an automated controller (such as Argo CD or Flux) continuously reconciles the live cluster state with that declarative configuration. This ensures that Git is the single source of truth, and any drift from the declared state is automatically corrected without manual intervention.

Answer

Imperative commands applied to the cluster and tracked in Git

Answer

Using Git as a backup for Kubernetes manifests

Answer

Using Git hooks to trigger CI/CD pipelines

Question 5

What is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. The Pod is the smallest deployable unit in Kubernetes because it encapsulates one or more containers that share the same network namespace, storage volumes, and lifecycle. Containers are not directly scheduled onto nodes; instead, Kubernetes always wraps them into Pods, which are the atomic unit of scheduling and execution. This design ensures that co-located containers (e.g., a sidecar and its main app) can communicate via localhost and share resources without additional orchestration.

Answer

Node

Answer

Container

Answer

Deployment

Question 6

Which TWO of the following are responsibilities of the kube-controller-manager? (Select 2)

Accepted Answer

Ensuring the desired number of pod replicas are running. The kube-controller-manager is responsible for running controller processes that regulate the state of the cluster. Option A is correct because the ReplicaSet controller, which runs inside the kube-controller-manager, continuously monitors the number of running pods and ensures it matches the desired replica count defined in the ReplicaSet or Deployment object. If a pod fails or is deleted, the controller creates a replacement to maintain the desired state.

Answer

Implementing service networking rules

Answer

Storing the cluster state

Answer

Scheduling pods onto nodes

Question 7

You create a Pod with a liveness probe that uses an HTTP GET on port 8080, path /healthz. The probe fails after the container starts. What will happen to the Pod?

Accepted Answer

The container will be restarted automatically. A liveness probe is designed to determine if a container is still running properly. When an HTTP GET liveness probe fails, kubelet considers the container unhealthy and automatically restarts it according to the Pod's restart policy (defaulting to Always). This ensures the container can recover from transient failures without manual intervention.

Answer

The Pod will be marked as Unhealthy and removed from Service endpoints

Answer

The Pod will be evicted from the node

Answer

The Pod will be deleted and recreated on a different node

Question 8

Which THREE of the following are valid ways to expose a Service to external traffic? (Select exactly three.)

Accepted Answer

Ingress. Ingress is correct because it provides HTTP/HTTPS routing rules to expose Services externally, typically using a reverse proxy like NGINX or HAProxy. It operates at Layer 7, allowing host and path-based routing to multiple Services behind a single external endpoint, which is a valid way to expose traffic.

Answer

ExternalName

Answer

ClusterIP

Question 9

Which kubectl command is used to see the logs of a container in a pod?

Accepted Answer

kubectl logs . `kubectl logs ` is the dedicated command to retrieve and display the logs from the default container in a specified pod. This command directly accesses the container's stdout and stderr streams, which are captured by the container runtime (e.g., containerd or CRI-O) and stored by the kubelet, making it the standard and simplest way to view application logs.

Answer

kubectl attach <pod-name>

Answer

kubectl exec <pod-name> -- cat /var/log/app.log

Answer

kubectl describe pod <pod-name>

Question 10

A production issue arises: a Deployment with 10 replicas is updated, but the new Pods are failing health checks and being terminated. The old Pods are also being terminated. What is the most likely cause?

Accepted Answer

maxSurge and maxUnavailable are set to values that allow termination of old Pods before new ones are ready. When maxSurge and maxUnavailable are set to values that allow termination of old Pods before new ones are ready, the RollingUpdate strategy can scale down old ReplicaSets even if the new Pods are failing health checks. This happens because maxUnavailable defines the maximum number of Pods that can be unavailable during the update, and if set to a value like 1 (or a percentage), the controller will terminate old Pods to meet that threshold, even if the new Pods are not yet healthy. The result is a cascading failure where both old and new Pods are terminated, leading to a service disruption.

Answer

The Deployment's 'paused' field is set to true

Answer

The Deployment's 'revisionHistoryLimit' is set to 1

Answer

The RollingUpdate strategy has maxSurge=0 and maxUnavailable=0

Question 11

You have a Deployment that uses a ConfigMap for configuration. You update the ConfigMap with new data. However, the pods in the Deployment continue to use the old configuration. What is the most likely reason?

Accepted Answer

The ConfigMap is mounted as a volume, and the pods have not been restarted. When a ConfigMap is mounted as a volume in a Pod, updates to the ConfigMap are automatically propagated to the mounted files, but the running process inside the container does not automatically reload the configuration. The Pod must be restarted (e.g., by rolling update or manual deletion) for the application to read the new values. This is the most common reason for stale configuration in a Deployment.

Answer

The ConfigMap data is immutable and cannot be updated

Answer

The ConfigMap is referenced by a different name in the pod spec

Answer

The Deployment's update strategy is set to Recreate

Question 12

Which THREE of the following are benefits of using a service mesh? (Select three.)

Accepted Answer

Fine-grained traffic control (e.g., canary deployments). A service mesh, such as Istio or Linkerd, provides fine-grained traffic control through features like traffic splitting, header-based routing, and weighted load balancing. This enables canary deployments by directing a small percentage of traffic to a new version of a service, allowing safe testing in production without affecting all users.

Answer

Automatic scaling of pods

Answer

Increased application performance

Question 13

When creating a Deployment, you want to ensure that only a certain number of pods run at a time across all nodes. Which field in the Deployment spec controls this?

Accepted Answer

spec.replicas. The `spec.replicas` field in a Deployment spec defines the desired number of identical Pod replicas that should be running at any given time. This field directly controls the count of Pods across all nodes in the cluster, ensuring that exactly that many Pods are maintained by the ReplicaSet controller. Option A is correct because it is the only field that sets the target Pod count.

Answer

spec.selector

Answer

spec.minReadySeconds

Answer

spec.template

Question 14

A company is running a microservices application on a Kubernetes cluster. They have noticed that one of the services, 'payment-api', is experiencing intermittent high latency. The team wants to identify the root cause without modifying the application code. Which approach should they take?

Accepted Answer

Implement distributed tracing using tools like Jaeger or Zipkin to trace requests across services.. Distributed tracing with tools like Jaeger or Zipkin allows you to follow a single request as it traverses multiple microservices, identifying exactly which service or call introduces latency. This approach does not require code changes (if the service mesh or sidecar proxy handles instrumentation) and is specifically designed to pinpoint performance bottlenecks in distributed systems, unlike CPU/memory metrics or log analysis which cannot trace a request's end-to-end path.

Answer

Monitor CPU and memory metrics from kube-state-metrics and correlate with latency.

Answer

Increase log verbosity for all services and search for error messages.

Answer

Check node-level metrics using Prometheus Node Exporter.

Question 15

Which Kubernetes object provides stable network endpoints and load balancing for a set of pods?

Accepted Answer

Service. A Kubernetes Service provides a stable virtual IP (ClusterIP) and DNS name that remains constant even as Pods are created or destroyed. It uses label selectors to identify target Pods and performs TCP/UDP load balancing across them, ensuring reliable network access without requiring clients to track ephemeral Pod IPs.

Answer

Deployment

Answer

ConfigMap

Answer

Pod