KCNA Practice Test 29 — 15 Questions

Question 1

Which THREE of the following are true about the Open Container Initiative (OCI)? (Select 3)

Accepted Answer

OCI defines the container image format specification. Option C is correct because the Open Container Initiative publishes the OCI Image Format Specification, which standardizes how container images (manifest, config, and layer filesystem changesets) are structured so any compliant tool can build, pull, and run them. Option D is correct because OCI is a vendor-neutral, open governance project hosted under the Linux Foundation, with contributions from many companies rather than a single vendor, ensuring interoperability across ecosystems. Option E is correct because OCI also defines the Runtime Specification, which describes how a container runtime executes a filesystem bundle (covering lifecycle operations such as create, start, and kill) and is implemented by runtimes like runc. Option A is wrong because OCI is not governed solely by Docker Inc.; it operates under the Linux Foundation with broad industry participation. Option B is wrong because OCI specifications are platform-agnostic and also apply to Windows containers, not only Linux containers.

Answer

OCI is governed solely by Docker Inc.

Answer

OCI only applies to Linux containers

Question 2

Which three components are part of the Kubernetes control plane? (Select THREE)

Accepted Answer

etcd. etcd (A) is correct because it is the control plane's distributed key-value store that persists all cluster state and object data. kube-apiserver (B) is correct because it is the central control plane component that exposes the Kubernetes API and is the front end through which all other components communicate. kube-controller-manager (D) is correct because it runs the built-in controller loops that reconcile cluster state toward the desired state. kube-proxy (C) is not part of the control plane; it runs on each node to implement Service networking via iptables/IPVS rules. kubelet (E) is also not part of the control plane; it is the node agent that manages Pods and containers on each worker node.

Answer

kube-proxy

Answer

kubelet

Question 3

Which THREE of the following are valid apiVersions for Kubernetes resources?

Accepted Answer

batch/v1. The three valid apiVersions here are batch/v1 (A), v1 (B), and apps/v1 (C). batch/v1 is the stable API group/version used for workload resources such as Job and CronJob, so it is a legitimate apiVersion value. v1 is the core (legacy) API group version used for resources like Pod, Service, ConfigMap, and Secret, and it is valid without a group prefix. apps/v1 is the stable API group/version for workloads such as Deployment, StatefulSet, DaemonSet, and ReplicaSet, making it valid as well. The unmarked options do not belong because extensions/v1beta1 (D) is a removed/deprecated API group version no longer served in modern Kubernetes clusters, and v1beta1 (E) is not a complete apiVersion by itself since a beta version must be qualified by its API group (for example, apps/v1beta1 or batch/v1beta1).

Answer

extensions/v1beta1

Answer

v1beta1

Question 4

What is the primary difference between a container and a virtual machine (VM)?

Accepted Answer

Containers share the host OS kernel, whereas VMs each have their own guest OS. The primary difference is that containers share the host operating system kernel, while each virtual machine runs its own complete guest OS. This means containers are lightweight processes with isolated user spaces, whereas VMs include a full OS stack (kernel, drivers, libraries) per instance. This architectural distinction is why containers start in seconds and have minimal overhead, while VMs require booting a guest OS and consume more resources.

Answer

Containers are slower to start than VMs

Answer

Containers require a hypervisor to run

Answer

Containers virtualize hardware, while VMs virtualize the operating system

Question 5

A DevOps engineer wants to deploy a stateful application that requires stable network identities and persistent storage. Which Kubernetes resource is most appropriate?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it is designed specifically for stateful applications that require stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage (via PersistentVolumeClaims that persist across Pod rescheduling). Unlike Deployments, StatefulSet guarantees ordered, graceful deployment and scaling, which is essential for applications like databases or distributed systems that rely on stable identities.

Answer

DaemonSet

Answer

Deployment

Answer

ReplicaSet

Question 6

Which of the following is a key difference between containers and virtual machines?

Accepted Answer

Containers share the host OS kernel; VMs run a separate guest OS. The key difference is that containers virtualize at the operating system level, sharing the host OS kernel via namespaces and cgroups, while each virtual machine runs a full, separate guest OS on top of a hypervisor. This architectural distinction means containers are more lightweight and start faster, but VMs provide stronger isolation because they do not share the host kernel.

Answer

Both containers and VMs share the host kernel

Answer

Containers have a full guest OS, VMs share the host kernel

Answer

Containers require a hypervisor, VMs do not

Question 7

Which Kubernetes command displays the current state of a pod, including its IP address, node, and container statuses?

Accepted Answer

kubectl get pod -o wide. `kubectl get pod -o wide` extends the default output to include additional columns such as the pod's IP address, the node it is scheduled on, and the container statuses (e.g., READY state). This command queries the Kubernetes API server for the pod's current state and formats the response with extra details, making it the most direct way to view the pod's IP and node assignment in a single line.

Answer

kubectl describe pod

Answer

kubectl logs pod

Answer

kubectl get pod

Question 8

A developer creates a pod that needs to securely access a database password stored in the cluster. Which Kubernetes resource should be used to inject the password as an environment variable?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for injecting sensitive data like a database password into a Pod as an environment variable. Secrets store base64-encoded data and are designed specifically for confidential information, unlike ConfigMaps which store non-sensitive configuration. When mounted as environment variables, Secrets ensure the password is not exposed in plaintext in the Pod specification or image layers.

Answer

ServiceAccount

Answer

ConfigMap

Answer

PersistentVolumeClaim

Question 9

What is the primary purpose of structured logging?

Accepted Answer

To format logs in a consistent, machine-readable way for easier processing. Structured logging emits log entries as machine-readable data — typically JSON with consistent key-value fields (timestamp, level, service, message, request_id) — rather than free-form text. This makes logs trivially parseable by log processors and query engines, enabling reliable filtering, aggregation, and alerting. The primary purpose is consistent, machine-readable formatting for easier downstream processing.

Answer

To compress log files and reduce storage usage

Answer

To encrypt log data for security purposes

Answer

To send logs directly to the user's terminal

Question 10

You want to expose a set of pods running on node port 30080 to external traffic. Which Service type should you use?

Accepted Answer

NodePort. (NodePort) is correct because a NodePort service exposes the application on a static port (30080) on each node's IP address, making it accessible from outside the cluster via <NodeIP>:30080. This is the appropriate choice when you need to expose pods to external traffic using a specific port number without requiring a cloud load balancer.

Answer

ExternalName

Answer

LoadBalancer

Answer

ClusterIP

Question 11

Your application consists of a frontend and a backend. The frontend needs to communicate with the backend using a stable DNS name. The backend is deployed as a Deployment with 3 replicas. Which Kubernetes resource should you create to provide a stable DNS name for the backend?

Accepted Answer

Service of type ClusterIP. A Service of type ClusterIP provides a stable virtual IP and DNS name (e.g., my-service.namespace.svc.cluster.local) that load-balances traffic across the backend Pods. This is the correct resource because the frontend only needs a stable DNS name for internal cluster communication, and ClusterIP is the default Service type that fulfills this requirement without exposing the backend externally.

Answer

EndpointSlice

Answer

Service of type NodePort

Answer

Ingress

Question 12

Which THREE of the following are responsibilities of the kube-controller-manager?

Accepted Answer

Creating Endpoints objects for Services. Option B is correct because the kube-controller-manager runs the endpoints controller (and endpointslice controller), which populates Endpoints/EndpointSlice objects for Services by tracking the Pods matching each Service's selector. Option C is correct because the node lifecycle controller inside the kube-controller-manager monitors Node heartbeats/status and applies taints such as node.kubernetes.io/not-ready or unreachable and evicts Pods when Nodes fail. Option D is correct because the ReplicaSet controller (and Deployment/StatefulSet controllers) run in the kube-controller-manager and reconcile the actual number of Pod replicas to the desired count. Option A is not part of the kube-controller-manager; Pod-to-Node assignment is performed by the kube-scheduler. Option E is not part of the kube-controller-manager; the Kubernetes API is served by kube-apiserver.

Answer

Assigning Pods to Nodes

Answer

Serving the Kubernetes API

Question 13

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster, such as ensuring the correct number of pods are running?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, including the Replication Controller, which is responsible for ensuring that the desired number of pod replicas are running at all times. It continuously watches the state of the cluster via the kube-apiserver and makes adjustments to reconcile the current state with the desired state defined in the cluster's configuration.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

etcd

Question 14

Which two components are part of the Kubernetes worker node? (Choose two.)

Accepted Answer

kube-proxy. kube-proxy (A) is correct because it runs on every worker node and maintains the node's network rules (iptables/IPVS) that implement Kubernetes Service load balancing and ClusterIP/NodePort routing. kubelet (D) is correct because it is the primary node agent that registers the node with the API server, watches PodSpecs, and drives the container runtime (via CRI) to start, stop, and monitor containers and their volumes. The other components belong to the control plane: kube-scheduler (B) assigns Pods to nodes, etcd (C) is the cluster's distributed key-value datastore, and kube-apiserver (E) exposes the REST API and is the front end of the control plane, so none of them are worker node components.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 15

In Kustomize, what is the purpose of an overlay?

Accepted Answer

To apply environment-specific customizations on top of a base. In Kustomize, an overlay is a kustomization that references a base and applies environment-specific customizations such as patches, name prefixes, or label changes. This allows you to reuse a common base configuration while tailoring it for different environments like dev, staging, and prod. The overlay does not modify the base itself; it produces a new set of resources with the changes applied.

Answer

To merge multiple Kubernetes manifests into one

Answer

To template variables into YAML files

Answer

To define the base configuration of an application