KCNA Practice Test 30 — 15 Questions

Question 1

A team wants to deploy a multi-cloud application that uses cloud-specific services. Which pattern is most appropriate?

Accepted Answer

Using cloud-agnostic abstractions and infrastructure as code across providers. Using cloud-agnostic abstractions (e.g., Kubernetes for container orchestration, Terraform for infrastructure as code) allows the team to deploy across multiple clouds while still integrating cloud-specific services via provider-agnostic interfaces or abstraction layers. This pattern reduces vendor lock-in, enables consistent deployment workflows, and supports portability without sacrificing the ability to use unique services from each cloud provider.

Answer

Single-cloud vendor lock-in to reduce complexity

Answer

Manually managing each cloud separately without automation

Answer

Only using serverless functions from one provider

Question 2

Match each Kubernetes command (kubectl) to its primary function.

Accepted Answer

kubectl get: List one or more resources. The correct matches are: kubectl get for listing resources, kubectl describe for detailed info, and kubectl apply for applying configurations. Common confusions include swapping the functions of kubectl delete and kubectl logs.

Answer

kubectl delete: Print logs for a container in a pod

Answer

kubectl logs: Delete resources

Question 3

Which THREE of the following are valid ways to assign a pod to a specific node? (Choose three.)

Accepted Answer

Setting the 'nodeName' field in the pod spec. Option A is correct because setting the 'nodeName' field directly in the pod spec bypasses the scheduler and binds the pod to that exact node by name. Option B is correct because 'nodeAffinity' rules under 'affinity' let the scheduler place the pod on nodes matching label expressions, including required and preferred constraints. Option C is correct because 'nodeSelector' matches node labels and constrains the scheduler to only nodes carrying the specified labels. Option D is not a placement mechanism; a ServiceAccount provides an identity for pods to authenticate to the API server, not to select a node. Option E is invalid because 'clusterName' is not a pod spec field used for node assignment and has no scheduling effect.

Answer

Using a ServiceAccount

Answer

Setting the 'clusterName' field

Question 4

A pod is stuck in the 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/3 nodes are available: 1 node had taint that the pod didn't tolerate, 2 Insufficient cpu.' What is the most likely cause?

Accepted Answer

The pod's resource requests exceed available node capacity and a node taint is not tolerated. The pod is in 'Pending' state because the scheduler cannot find a node that meets its requirements. The event '0/3 nodes are available: 1 node had taint that the pod didn't tolerate, 2 Insufficient cpu' directly indicates that the pod's resource requests exceed the available CPU on two nodes, and the remaining node has a taint that the pod does not tolerate. This matches option B: the pod's resource requests exceed available node capacity and a node taint is not tolerated.

Answer

The pod's liveness probe is failing

Answer

The pod's container runtime is not installed

Answer

The pod's image pull secret is missing

Question 5

Which command would you use to view the logs of a container named 'web' in a pod named 'frontend' running in the 'production' namespace?

Accepted Answer

kubectl logs frontend -c web -n production. The `kubectl logs` command requires the pod name as the first positional argument, and the `-c` flag specifies the container name when a pod has multiple containers. The `-n` flag sets the namespace. The correct syntax is `kubectl logs -c -n `, which matches option B exactly.

Answer

kubectl logs -c web frontend --namespace production

Answer

kubectl logs frontend -n production container web

Answer

kubectl logs frontend web --namespace production

Question 6

You have two pods in different namespaces that need to communicate using a stable IP address. Which Kubernetes object provides a stable endpoint for a set of pods?

Accepted Answer

Service. A Kubernetes Service provides a stable IP address and DNS name that remains constant regardless of pod restarts or rescheduling, enabling reliable communication between pods in different namespaces. Unlike pods, which have ephemeral IPs, a Service selects a set of pods via label selectors and load-balances traffic to them, ensuring a stable endpoint across namespace boundaries.

Answer

ConfigMap

Answer

Ingress

Answer

Deployment

Question 7

A Kubernetes administrator needs to restrict inbound traffic to a set of pods. Only pods with the label 'app: frontend' in the same namespace should be allowed to reach the pods on TCP port 8080. Which resource should be used?

Accepted Answer

NetworkPolicy. NetworkPolicy is the correct resource because it is a Kubernetes-native object that defines how groups of pods are allowed to communicate with each other and other network endpoints. By specifying a pod selector matching 'app: frontend' and an ingress rule allowing TCP port 8080, you can restrict inbound traffic to only those pods with that label in the same namespace.

Answer

Ingress

Answer

PodSecurityPolicy

Answer

ServiceAccount

Question 8

A user runs 'kubectl get pods -n production' and sees no output. What is the most likely reason?

Accepted Answer

There are no pods in the 'production' namespace. `kubectl get pods -n production` returning no output typically indicates that there are no pods in the specified namespace. The command successfully connected to the API server, authenticated, and queried the namespace, but the result set is empty. This is a common scenario when a namespace exists but has no running or pending pods.

Answer

The kube-apiserver is down

Answer

The user does not have permissions to list pods

Answer

The namespace does not exist

Question 9

You are implementing an API gateway pattern for a set of microservices. Which of the following is a typical responsibility of an API gateway?

Accepted Answer

Enforcing authentication and rate limiting. An API gateway sits in front of microservices and centralizes cross-cutting concerns such as authentication, authorization, rate limiting, request routing, and TLS termination. Enforcing authentication and rate limiting is a canonical gateway responsibility because it offloads these concerns from individual services. This lets each microservice focus on business logic while the gateway handles policy uniformly.

Answer

Managing container lifecycle and scaling

Answer

Directly accessing databases to serve requests

Answer

Storing application state and session data

Question 10

Which component on a worker node is responsible for enforcing the desired state of pods as defined in the pod specification?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each worker node and is responsible for ensuring that containers are running in a pod as specified by the pod's manifest (PodSpec). It continuously monitors pod status and takes corrective actions, such as restarting containers or re-creating pods, to match the desired state defined in the Kubernetes API.

Answer

kube-scheduler

Answer

kube-proxy

Answer

container runtime

Question 11

Which TWO of the following are benefits of container orchestration?

Accepted Answer

High availability through self-healing. Container orchestration platforms like Kubernetes implement self-healing mechanisms through controllers such as ReplicaSets and StatefulSets. These controllers continuously monitor the desired state of pods and automatically restart, reschedule, or replace containers that fail, crash, or become unresponsive, ensuring high availability without manual intervention.

Answer

Ability to run containers without a kernel

Answer

Manual scaling of containers

Answer

Simplified network configuration for each container

Question 12

Which of the following is a benefit of using container orchestration platforms like Kubernetes?

Accepted Answer

Self-healing (automatic restart of failed containers). Kubernetes includes a built-in controller (the kubelet and ReplicaSet controller) that continuously monitors the desired state of pods. If a container fails or its process crashes, the kubelet automatically restarts it based on the pod's restart policy (e.g., Always), ensuring high availability without manual intervention. This self-healing capability is a core benefit of container orchestration, reducing downtime and operational overhead.

Answer

Increased network latency

Answer

Manual scaling of applications

Answer

Tighter coupling between microservices

Question 13

A developer wants to run a containerized application locally for development. Which tool is most appropriate?

Accepted Answer

Docker Compose. Docker Compose is the most appropriate tool for running a containerized application locally during development because it allows you to define and manage multi-container applications using a simple YAML file. It handles container lifecycle, networking, and volume mounts with a single `docker compose up` command, making it ideal for local development workflows where rapid iteration and simplicity are key.

Answer

CRI-O

Answer

containerd

Answer

Kubernetes

Question 14

What is the primary purpose of a Kubernetes Service object?

Accepted Answer

To provide a stable IP address and DNS name for a set of Pods. The primary purpose of a Kubernetes Service object is to provide a stable network endpoint (a fixed IP address and DNS name) that abstracts and load-balances traffic across a dynamic set of Pods. Pods are ephemeral and can be rescheduled with new IP addresses, so the Service ensures clients can reliably reach the application without needing to track individual Pod IPs.

Answer

To store configuration data that can be consumed by Pods

Answer

To manage rolling updates and rollbacks for Pods

Answer

To persist data beyond the lifecycle of a Pod

Question 15

An application requires stable network identities and persistent storage. Which workload type should be used?

Accepted Answer

StatefulSet. StatefulSet is the correct workload type because it provides stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage (via PersistentVolumeClaims that persist across Pod rescheduling). This makes it ideal for stateful applications like databases, where each Pod requires a stable identity and dedicated storage that survives restarts.

Answer

Deployment

Answer

DaemonSet

Answer

Job