KCNA Practice Test 30 — 15 Questions

Question 1

A pod is experiencing high memory usage. The administrator wants to enforce that the pod is terminated if it exceeds a memory limit and restarted automatically, but also wants to guarantee a minimum amount of memory for the pod. Which resource specification should be used in the container definition?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

spec.containers[].resources.requests.memory and limits.memory. Setting both `requests.memory` and `limits.memory` guarantees a minimum memory allocation (the request) while enforcing a hard cap (the limit). If the pod exceeds the memory limit, it is terminated (OOMKilled) and, if part of a Deployment or StatefulSet, the controller automatically restarts it. This satisfies the requirement for both guaranteed minimum and enforced maximum with automatic restart.

Answer

spec.containers[].resources.requests.memory only

Answer

spec.containers[].resources.limits.memory and requests.cpu

Answer

spec.containers[].resources.limits.memory only

Question 2

A team is deploying a new microservice that processes sensitive user data. They want to ensure that secrets such as database passwords are not exposed in the container image or environment variables. Which approach should they use?

Accepted Answer

Store the secret in a Kubernetes Secret and mount it as a volume in the pod. Kubernetes Secrets are designed specifically to store sensitive data like database passwords. Mounting the Secret as a volume ensures the secret data is available to the pod as files, without being exposed in environment variables (which can be leaked via logs or `kubectl describe`) or embedded in the container image. This approach follows security best practices for handling sensitive information in cloud-native applications.

Answer

Embed the secret directly in the Docker image and use it via environment variables

Answer

Store the secret in a ConfigMap and reference it in the pod spec

Answer

Use a PersistentVolumeClaim to store the secret and mount it into the pod

Question 3

What is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. The Pod is the smallest and simplest unit in the Kubernetes object model. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. Deployments manage ReplicaSets, which in turn manage Pods, but the Pod itself is the atomic deployable unit.

Answer

Deployment

Answer

Node

Answer

Container

Question 4

Which component on a worker node is responsible for enforcing the network rules and implementing Service abstractions?

Accepted Answer

kube-proxy. kube-proxy is the component on each worker node that implements Service abstractions by maintaining network rules (iptables, IPVS, or userspace) that allow traffic to reach Pods from inside or outside the cluster. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates the node's packet filtering rules to forward traffic to the correct backend Pods, handling load balancing and session affinity.

Answer

kubelet

Answer

container runtime

Answer

kube-scheduler

Question 5

You are designing a microservices application. Which of the following is a key principle of microservices architecture?

Accepted Answer

Services are loosely coupled and can be deployed independently. Microservices architecture is fundamentally defined by loose coupling and independent deployability. Each service encapsulates its own domain logic, communicates via lightweight protocols like HTTP/REST or gRPC, and can be updated, scaled, or deployed without affecting other services. This aligns with the Kubernetes-native pattern of managing each microservice as a separate Deployment or StatefulSet, enabling continuous delivery and resilience.

Answer

Services are tightly coupled to allow fast communication

Answer

All services must be written in the same programming language

Answer

All services must share a common database

Question 6

A financial services company runs a critical trading application on Kubernetes. The application is deployed as a Deployment with 3 replicas. Each pod exposes metrics on port 8080 and uses a ConfigMap to load configuration. Recently, after a configuration change via a ConfigMap update, two of the three pods started crashing with an out-of-memory (OOM) error, while the third pod continues to run fine. The team verified that the ConfigMap was updated correctly and that the application code did not change. The pods have resource limits set: memory limit of 512Mi and request of 256Mi. The application's memory usage before the change was around 200Mi. The new configuration increases the in-memory cache size. The team suspects the issue is related to the configuration change. What is the best course of action?

Accepted Answer

Increase the memory limit in the Deployment manifest to a higher value, such as 1Gi, and perform a rolling update.. The OOM errors are directly caused by the increased memory usage from the larger in-memory cache, which exceeds the current 512Mi memory limit. Increasing the limit to 1Gi accommodates the new cache size while preserving resource boundaries, and a rolling update applies the change without downtime. This aligns with Kubernetes best practices of setting realistic resource limits based on application requirements.

Answer

Scale the Deployment to 5 replicas to distribute the memory load.

Answer

Remove the memory limit from the container spec to allow unlimited memory usage.

Answer

Revert the ConfigMap to the previous configuration and monitor memory usage.

Question 7

You have a Deployment named 'web-app' that manages 3 replicas. You need to update the container image from version 1.0 to 2.0 with zero downtime. Which Kubernetes feature is designed to handle this automatically when you update the Deployment's pod template?

Accepted Answer

Rolling update strategy in the Deployment. A Deployment's default update strategy is 'RollingUpdate', which automatically replaces old Pods with new ones in a controlled manner, ensuring zero downtime by incrementally scaling down old replicas and scaling up new replicas. When you update the container image in the Deployment's pod template, Kubernetes triggers a rolling update that maintains the desired number of replicas throughout the process.

Answer

ReplicationController

Answer

DaemonSet

Answer

StatefulSet's onDelete strategy

Question 8

A company wants to implement a serverless function that processes events from an object storage bucket. The function should scale to zero when idle and only incur costs during execution. Which technology is BEST suited for this requirement?

Accepted Answer

A Functions-as-a-Service (FaaS) platform. A Functions-as-a-Service (FaaS) platform is a serverless compute service that scales to zero when idle and is event-driven, making it ideal for processing events from an object storage bucket with cost efficiency. Option A (Knative) is serverless but runs on Kubernetes, requiring cluster management and not scaling to zero as cleanly. Option B (Apache Kafka) is a streaming platform, not a serverless function service. Option D (Kubernetes CronJob) is for scheduled jobs, not event-driven, and does not scale to zero automatically.

Answer

Knative

Answer

Apache Kafka

Answer

Kubernetes CronJob

Question 9

Which TWO of the following are characteristics of a Namespace in Kubernetes?

Accepted Answer

Resource names must be unique within a namespace, but can be reused across namespaces. Namespaces in Kubernetes provide a mechanism for logical grouping and scoping of resources. Two key characteristics are: (1) resource names must be unique within a namespace but can be reused across different namespaces (option C), and (2) namespaces allow multiple virtual clusters (logical clusters) within a single physical cluster (option D). While deleting a namespace does delete all its contained objects (option E), this is a consequence of namespace lifecycle management rather than a defining characteristic of what a namespace is. Network isolation is not provided by default; it requires explicit NetworkPolicy resources.

Answer

Namespaces are required for all Kubernetes objects

Answer

Namespaces provide network isolation by default

Answer

Deleting a namespace deletes all objects inside it

Question 10

In a GitOps workflow, a team uses ArgoCD. A developer manually changes a Deployment's replica count in the cluster via kubectl. ArgoCD has self-healing enabled. What will happen?

Accepted Answer

ArgoCD reverts the replica count to the value in Git. With self-healing enabled, ArgoCD continuously monitors the cluster for drift. When a manual change is made via kubectl, ArgoCD detects that the live state no longer matches the desired state defined in Git. It then automatically reverts the change to bring the cluster back into sync with the Git repository.

Answer

ArgoCD creates a new Deployment with the manual change

Answer

ArgoCD updates the Git repository to reflect the manual change

Answer

ArgoCD ignores the change because it was made manually

Question 11

An organization uses Prometheus and Grafana for monitoring. They want to alert when the 99th percentile of request latency exceeds 500ms for more than 5 minutes. Which PromQL query should they use in the alert rule?

Accepted Answer

histogram_quantile(0.99, rate(http_request_duration_seconds_bucket[5m])) > 0.5. It uses `histogram_quantile(0.99, rate(...[5m]))` to calculate the 99th percentile request latency over a 5-minute window, matching the requirement to alert when this value exceeds 500ms (0.5 seconds) for more than 5 minutes. The `rate()` function with a 5m range computes the per-second increase of bucket counters over that duration, which is necessary for accurate quantile estimation in Prometheus.

Answer

histogram_quantile(0.99, rate(http_request_duration_seconds_bucket[1m])) > 0.5

Answer

avg(rate(http_request_duration_seconds_bucket[5m])) > 0.5

Answer

max(rate(http_request_duration_seconds_bucket[5m])) > 0.5

Question 12

Which two components are part of the Kubernetes control plane? (Select TWO.)

Accepted Answer

kube-apiserver. The Kubernetes control plane manages the cluster and makes global decisions. kube-apiserver is the front-end for the control plane, exposing the Kubernetes API for all interactions. etcd is a consistent and highly-available key-value store used as Kubernetes' backing store for all cluster data, making it a core control plane component.

Answer

container runtime

Answer

kube-proxy

Answer

kubelet

Question 13

A cluster has a node with the taint 'node-role.kubernetes.io/control-plane:NoSchedule'. A pod must be scheduled on this node for a special workload. Which action is required?

Accepted Answer

Add a toleration to the pod spec.. A taint on a node causes the scheduler to avoid placing pods on that node unless the pod explicitly tolerates the taint. By adding a toleration in the pod spec that matches the taint key, effect, and optionally the value, the pod becomes eligible to be scheduled on the tainted node. This is the standard Kubernetes mechanism for allowing pods to run on control-plane or other specially tainted nodes.

Answer

Use a nodeSelector to select the node.

Answer

Remove the taint from the node.

Answer

Use podAffinity to attract the pod to the node.

Question 14

A team is migrating a legacy application to Kubernetes. The application requires persistent storage and needs to maintain session affinity. Which set of Kubernetes resources should they use?

Accepted Answer

StatefulSet with a headless Service and Service with session affinity.. StatefulSet is the correct choice because it provides stable, unique network identities and persistent storage per pod, which are essential for stateful applications. A headless Service allows direct pod-to-pod communication without load balancing, while a regular Service with session affinity (using `externalTrafficPolicy: Local` or `sessionAffinity: ClientIP`) ensures client requests stick to the same pod, maintaining session state.

Answer

Deployment with a ClusterIP Service and Ingress.

Answer

Job with a LoadBalancer Service.

Answer

DaemonSet with a NodePort Service.

Question 15

A pod is stuck in 'Pending' state. After running 'kubectl describe pod', you see the event: '0/3 nodes are available: 3 Insufficient cpu'. What is the most likely cause?

Accepted Answer

The pod's CPU request exceeds the available CPU on all nodes. The pod is stuck in 'Pending' state because the Kubernetes scheduler cannot find a node that satisfies the pod's resource requirements. The event '0/3 nodes are available: 3 Insufficient cpu' explicitly indicates that every node in the cluster lacks sufficient allocatable CPU capacity to meet the pod's CPU request. This means the sum of CPU requests across all pods on each node, plus the new pod's request, exceeds the node's CPU capacity, causing the scheduler to leave the pod unscheduled.

Answer

The pod is exceeding its memory limit

Answer

The network plugin is not installed

Answer

The container image is too large