KCNA Practice Test 29 — 15 Questions

Question 1

Which GitOps tools use a pull-based approach to synchronize the desired state in a Git repository with the actual state in a Kubernetes cluster? (Select all that apply.)

Accepted Answer

Flux. Both Flux and ArgoCD are pull-based GitOps tools. Flux pioneered the pull-based pattern, while ArgoCD is also a popular implementation. Therefore, both A and D are correct.

Answer

Terraform

Answer

Helm

Question 2

You want to view the logs of a container named 'app' inside a pod named 'web-pod-7d4f8'. Which kubectl command should you use?

Accepted Answer

kubectl logs web-pod-7d4f8 -c app. The `kubectl logs` command is the standard way to retrieve container logs in Kubernetes. The `-c` flag specifies the container name within the pod, which is necessary when a pod contains multiple containers. Here, the container is named 'app' inside the pod 'web-pod-7d4f8', so `kubectl logs web-pod-7d4f8 -c app` correctly fetches its logs.

Answer

kubectl exec web-pod-7d4f8 -c app -- logs

Answer

kubectl log web-pod-7d4f8 --container app

Answer

kubectl logs web-pod-7d4f8 app

Question 3

What is the purpose of container image scanning in a CI/CD pipeline?

Accepted Answer

To identify security vulnerabilities in the image. Container image scanning checks for known security vulnerabilities (e.g., CVEs) in the image layers and dependencies. This helps prevent deploying vulnerable containers into production. Option A is incorrect because storing in a registry is unrelated; scanning can occur before or after pushing. Option B is incorrect because image size and optimization are separate concerns, often handled by multi-stage builds or other tools. Option C is incorrect because naming conventions are typically enforced via policies or linting, not scanning. Option D correctly identifies the purpose of scanning: identifying security vulnerabilities.

Answer

To ensure the image is stored in a registry

Answer

To measure the image size and optimize it

Answer

To verify the image tag follows naming conventions

Question 4

A company runs a Kubernetes cluster with 50 worker nodes, each hosting multiple microservices. They use Prometheus for metrics collection and Grafana for dashboards. Recently, the Prometheus server has been experiencing out-of-memory (OOM) kills during peak hours, causing gaps in metric collection. The cluster has a dedicated monitoring namespace. The team has already increased the Prometheus pod's memory limits to 8GB, but OOMs still occur. The metrics retention is set to 15 days. The cardinality of certain metrics (e.g., HTTP request labels with user IDs) is very high. The team needs to resolve the OOM issue without losing critical alerting capability for at least the last 7 days of data. Which action should they take first?

Accepted Answer

Implement recording rules to pre-aggregate high-cardinality metrics at a lower granularity. Recording rules allow Prometheus to pre-aggregate high-cardinality metrics (e.g., HTTP request labels with user IDs) at a lower granularity, reducing the number of unique time series stored in memory. This directly addresses the OOM issue caused by cardinality explosion without discarding raw data entirely, preserving the ability to query aggregated metrics for alerting over the required 7-day window.

Answer

Drop high-cardinality metrics like HTTP request labels using relabel_configs

Answer

Reduce metrics retention to 7 days to free memory

Answer

Enable vertical pod autoscaler for the Prometheus pod

Question 5

What is the primary purpose of Kubernetes?

Accepted Answer

To orchestrate containers across a cluster of machines. Kubernetes is a container orchestration platform designed to automate the deployment, scaling, and management of containerized applications across a cluster of machines. Its primary purpose is to abstract the underlying infrastructure and provide declarative management of container workloads, ensuring desired state convergence through controllers like the ReplicaSet and Deployment.

Answer

To provide a graphical user interface for managing containers

Answer

To replace Docker as a container runtime

Answer

To provide a virtual machine management platform

Question 6

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running controllers?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, which are control loops that watch the shared state of the cluster through the kube-apiserver and make changes to bring the current state closer to the desired state. It bundles together multiple controllers (e.g., Node Controller, Replication Controller, Endpoint Controller, Service Account Controller) that each handle a specific aspect of cluster management, ensuring the cluster's actual state matches the user-defined desired state.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 7

Which Kubernetes object is used to store non-sensitive configuration data that can be consumed by pods?

Accepted Answer

ConfigMap. ConfigMap is the correct Kubernetes object for storing non-sensitive configuration data, such as environment variables, command-line arguments, or configuration files, that can be consumed by pods. Unlike Secrets, ConfigMaps store data in plaintext and are designed for configuration that does not require encryption, making them ideal for application settings that are not confidential.

Answer

Secret

Answer

ServiceAccount

Answer

PersistentVolume

Question 8

Which TWO statements about Namespaces are correct?

Accepted Answer

Resource names must be unique within a namespace. Kubernetes enforces that resource names must be unique within a namespace. This is a fundamental constraint: within a given namespace, you cannot have two resources of the same type (e.g., two Pods) with the same name. This uniqueness allows the API server to resolve resource references unambiguously when using namespaced resources.

Answer

Namespaces provide network isolation by default

Answer

All Kubernetes resources are namespaced

Answer

You can delete a namespace without affecting the resources inside it

Question 9

Which TWO of the following are examples of Infrastructure as Code (IaC) tools? (Choose two.)

Accepted Answer

Terraform. Terraform (B) is an Infrastructure as Code (IaC) tool that uses declarative configuration files (HashiCorp Configuration Language, HCL) to define and provision cloud and on-premises resources. It manages the full lifecycle of infrastructure through a state file and provider plugins, enabling version-controlled, repeatable deployments.

Answer

Docker

Answer

Kubernetes

Answer

Prometheus

Question 10

Which TWO of the following are true about Pod resource limits? (Select TWO)

Accepted Answer

CPU limits are enforced using CFS quotas. Kubernetes enforces CPU limits using Completely Fair Scheduler (CFS) quotas. When a CPU limit is set, the kubelet configures the container's cgroup `cpu.cfs_quota_us` parameter, which restricts the total CPU time the container can consume over a CFS period (default 100ms). This ensures the container cannot exceed its specified CPU limit, even if the node has idle CPU resources.

Answer

A container can use more memory than its limit if the node has free memory

Answer

Memory limits are soft and can be exceeded temporarily

Answer

Setting CPU limits guarantees that a container will always get that much CPU

Question 11

Which TWO of the following are benefits of using Helm for application delivery?

Accepted Answer

Ability to roll back to previous releases. Helm manages Kubernetes application releases as packaged charts. The `helm rollback` command allows you to revert to a previous revision of a release, which is a core benefit for safe application delivery and disaster recovery. This capability is built into Helm's release management system, which tracks each deployment as a revision with a unique version number.

Answer

Automatic scaling based on CPU usage

Answer

Automatic canary deployments

Answer

Built-in monitoring and alerting

Question 12

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff with an OOMKilled message, which means the container was terminated by the Linux kernel's Out-Of-Memory (OOM) killer because it exceeded its memory limit. Increasing the memory limit in the container's resource specification allows the container to use more memory before being killed, directly addressing the root cause.

Answer

Delete the namespace and redeploy all workloads

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Question 13

A Kubernetes cluster is experiencing network latency. The team suspects that the number of services and endpoints is causing iptables performance degradation. Which CNI plugin or network policy approach is most likely to improve performance?

Accepted Answer

Use an eBPF-based CNI plugin like Cilium. C is correct because eBPF-based CNI plugins like Cilium bypass the traditional iptables chains entirely, using a kernel-level BPF (Berkeley Packet Filter) program to handle service load balancing and network policy enforcement. This eliminates the O(n) scaling issue of iptables rules with the number of services and endpoints, significantly reducing latency in large clusters.

Answer

Switch to Flannel with host-gw backend

Answer

Use Calico with iptables mode

Answer

Apply a default-deny NetworkPolicy

Question 14

Which Open Container Initiative (OCI) specification defines the format of container images?

Accepted Answer

Image Spec. The OCI Image Spec defines the format and content of container images, including the manifest, configuration, and layers. This ensures that any OCI-compliant runtime can run images built by any OCI-compliant tool, enabling interoperability across different container platforms.

Answer

Runtime Spec

Answer

Container Runtime Interface (CRI)

Answer

Dockerfile specification

Question 15

Which TWO of the following are true about Kubernetes Services? (Select 2)

Accepted Answer

Services can distribute traffic across Pods using labels and selectors.. Kubernetes Services use label selectors to identify a set of Pods and then distribute incoming traffic to those Pods. This is the core mechanism that decouples the Service from the specific Pod instances, enabling load balancing and dynamic routing.

Answer

Services automatically handle Pod replication and scaling.

Answer

Services can only expose Pods internally within the cluster.

Answer

Services are required for Pods to have persistent storage.