KCNA Practice Test 2 — 30 Questions

Question 1

Which of the following is NOT one of the three pillars of observability in cloud-native environments?

Accepted Answer

Security. The three pillars are logs, metrics, and traces. Security is not one of them, though it is important.

Answer

Metrics

Answer

Traces

Answer

Logs

Question 2

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running reconciliation loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, each of which watches the current state of the cluster via the kube-apiserver and makes changes to drive the actual state toward the desired state defined in etcd. This reconciliation loop pattern is fundamental to Kubernetes' self-healing behavior, ensuring that resources like deployments, replica sets, and nodes match their specifications.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 3

You need to ensure that a set of pods in a Deployment can be reached by other pods using a stable IP address and DNS name. Which Kubernetes object should you use?

Accepted Answer

Service. A Service provides a stable IP address and DNS name for a set of pods, abstracting the underlying pod IPs that can change due to scaling or failures. By default, a Service uses a cluster-internal virtual IP and DNS record (e.g., ..svc.cluster.local) that other pods can resolve, ensuring reliable connectivity without needing to track individual pod IPs.

Answer

NetworkPolicy

Answer

Ingress

Answer

ConfigMap

Question 4

An application running in a Kubernetes cluster needs to securely access a third-party API. The API key must be stored in the cluster and mounted into the Pod as an environment variable. Which is the best practice?

Accepted Answer

Create a Secret with the API key and use envFrom or valueFrom in the Pod spec.. Kubernetes Secrets are specifically designed to store sensitive data like API keys, and using `envFrom` or `valueFrom` in the Pod spec injects the Secret value as an environment variable without exposing it in the Pod definition. This approach follows the principle of least privilege and avoids hardcoding secrets in images or plaintext ConfigMaps.

Answer

Store the API key in a ConfigMap and reference it in the Pod spec.

Answer

Embed the API key directly in the container image.

Answer

Store the API key in a Pod annotation and read it with kubectl.

Question 5

Which command is used to create a Deployment that runs an nginx container with 3 replicas?

Accepted Answer

kubectl create deployment nginx --image=nginx --replicas=3. `kubectl create deployment` is the standard Kubernetes command to create a Deployment resource, and the `--replicas=3` flag directly sets the desired replica count to 3. This command creates a Deployment that manages a ReplicaSet to ensure three nginx pods are running and maintained.

Answer

kubectl create pod nginx --image=nginx --replicas=3

Answer

kubectl run nginx --image=nginx --replicas=3

Answer

kubectl scale deployment nginx --replicas=3

Question 6

According to DORA metrics, which metric measures the percentage of deployments that fail in production?

Accepted Answer

Change Failure Rate. Change Failure Rate (CFR) is the DORA metric that directly measures the percentage of deployments that result in a failure in production, such as a service outage or a bug requiring a hotfix. It is calculated as (number of failed deployments / total deployments) * 100. This metric reflects the quality and stability of the software delivery process, complementing speed metrics like Deployment Frequency and Lead Time for Changes.

Answer

Mean Time to Restore (MTTR)

Answer

Deployment Frequency

Answer

Lead Time for Changes

Question 7

A pod is stuck in the Pending state. Running 'kubectl describe pod <pod-name>' shows the event: '0/3 nodes are available: 1 node had taint {node.kubernetes.io/disk-pressure: }, 2 nodes had taint {node.kubernetes.io/memory-pressure: }'. What is the most likely cause?

Accepted Answer

All nodes have taints that the pod does not have tolerations for. The pod is stuck in Pending because the scheduler cannot find a node that satisfies its scheduling constraints. The events show that all three nodes have taints (disk-pressure and memory-pressure), and the pod does not have corresponding tolerations to allow it to be scheduled on those nodes. Without tolerations, the pod is not permitted to run on any of the available nodes, leaving it in the Pending state.

Answer

The container image is not found in the registry

Answer

The pod has a resource request that exceeds available capacity on all nodes

Answer

The pod's liveness probe is failing

Question 8

A Service of type ClusterIP is created to expose a set of pods. How does the Service achieve load balancing to the pods?

Accepted Answer

The kube-proxy component on each node sets up network rules to forward traffic to the pods. Kube-proxy on each node implements load balancing for ClusterIP Services by creating iptables or IPVS rules that distribute traffic from the Service's virtual IP to the backend pods. These rules use a random or round-robin selection (depending on the mode) to forward packets to healthy pods, ensuring no single pod is overwhelmed.

Answer

The API server routes traffic directly to the pods

Answer

The kubelet configures the container runtime to route traffic

Answer

Using a cloud load balancer

Question 9

Which two of the following are Kubernetes controllers that run inside the kube-controller-manager? (Select TWO)

Accepted Answer

Replication controller. The Replication controller (B) is correct because it is a built-in controller that runs within the kube-controller-manager process, continuously reconciling the desired number of pod replicas with the actual state by creating or deleting pods. The Node controller (D) is also correct because it is another controller embedded in the kube-controller-manager, responsible for monitoring node health, applying taints like node.kubernetes.io/not-ready, and evicting pods from unreachable nodes. The kubelet (A) is not part of the kube-controller-manager; it is a node-level agent that runs on each worker node and manages pod lifecycle via the container runtime. etcd (C) is the distributed key-value store that persists cluster state, not a controller, and it runs as a separate process. The kube-scheduler (E) is a separate control-plane component that assigns pods to nodes and runs independently of the kube-controller-manager.

Answer

kubelet

Answer

etcd

Answer

kube-scheduler

Question 10

Which TWO are characteristics of the microservices architecture that are supported by container orchestration?

Accepted Answer

Independent deployment of each service. Option B is correct because container orchestration platforms such as Kubernetes let each microservice be built, versioned, and rolled out on its own schedule, so a change to one service does not force redeployment of the others. Option C is correct because microservices architecture decomposes an application into small, independently runnable services, and orchestration supports this by scheduling, scaling, and networking each service as a separate workload. Options A, D, and E are not characteristics of microservices supported by orchestration: tight coupling, a monolithic codebase with centralized deployment, and a single shared database all describe monolithic or tightly integrated designs that contradict the independence and loose coupling that orchestration enables.

Answer

Tight coupling between services to ensure performance

Answer

Monolithic codebase with centralized deployment

Answer

Use of a single, shared database for all services

Question 11

Which service mesh component is responsible for handling inter-service communication as a sidecar proxy?

Accepted Answer

Envoy. Envoy is the correct answer because it is the sidecar proxy component in Istio that handles all inter-service communication. It intercepts traffic between microservices and applies routing, load balancing, and security policies defined by the control plane. Envoy runs as a sidecar container alongside each service instance, managing inbound and outbound traffic at the L4/L7 layer.

Answer

Mixer

Answer

Pilot

Answer

Citadel

Question 12

What is the smallest deployable unit in Kubernetes that can be created, scheduled, and managed?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model that can be created, scheduled, and managed. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. While containers are the underlying runtime, Kubernetes does not schedule containers directly; it schedules Pods as the atomic unit of deployment.

Answer

Deployment

Answer

Node

Answer

Container

Question 13

Which THREE of the following are benefits of structured logging? (Select three.)

Accepted Answer

Easier querying and filtering. Structured logging emits events as key-value pairs (typically JSON), so option A is correct because fields like level, service, or trace_id can be queried and filtered directly in tools such as Elasticsearch, Loki, or CloudWatch Logs Insights without fragile regex parsing. Option D is correct because that same machine-parseable format lets log processors, SIEMs, and observability pipelines ingest and index records programmatically and reliably. Option E is correct because adopting a shared schema with consistent field names across services enables correlation and aggregation across distributed systems, which is a core goal of structured logging. Option B is not a benefit: structured logs are usually less human-readable than free-form plain text, which is why pretty-printers exist. Option C is not a benefit either: JSON key-value output typically increases log size versus terse plain-text lines due to repeated field names and delimiters, so storage requirements usually grow rather than shrink.

Answer

More human-readable than plain text

Answer

Reduced storage requirements

Question 14

A company is deploying a microservices application on Kubernetes. They want to ensure that configuration data, such as database URLs and feature flags, can be updated without rebuilding container images. Which Kubernetes resource should they use?

Accepted Answer

ConfigMaps. ConfigMaps are the correct Kubernetes resource for decoupling configuration data (like database URLs and feature flags) from container images. They allow you to inject configuration as environment variables or mounted volumes without rebuilding or redeploying the container image, enabling runtime updates.

Answer

Secrets

Answer

Services

Answer

Deployments

Question 15

Which Prometheus metric type is used to represent a value that can increase or decrease over time, such as memory usage?

Accepted Answer

Gauge. A gauge is the Prometheus metric type designed to represent a value that can arbitrarily go up or down, such as memory usage, temperature, or current connections. Unlike counters, gauges are not monotonic and can be set to any value, making them ideal for instantaneous measurements. Memory usage fluctuates as processes allocate and free memory, so a gauge accurately captures this behavior.

Answer

Histogram

Answer

Summary

Answer

Counter

Question 16

A Deployment named 'app-deploy' is configured with strategy type: RollingUpdate. You want to update the container image to a new version. What kubectl command should you use?

Accepted Answer

kubectl set image deployment/app-deploy app=new:tag. `kubectl set image` is the dedicated command for updating the container image of an existing deployment without modifying other fields. It directly modifies the deployment's pod template spec to use the new image, triggering a rolling update as defined by the deployment's strategy type.

Answer

kubectl apply -f updated-deployment.yaml

Answer

kubectl edit deployment app-deploy

Answer

kubectl patch deployment app-deploy -p '{"spec":{"template":{"spec":{"containers":[{"name":"app","image":"new:tag"}]}}}}'

Question 17

Which Prometheus metric type is best suited for counting the total number of HTTP requests received by a service?

Accepted Answer

Counter. A counter is a cumulative metric that only increases (or resets to zero). It is ideal for counting events like HTTP requests.

Answer

Summary

Answer

Gauge

Answer

Histogram

Question 18

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event '0/4 nodes are available: 4 Insufficient cpu'. What is the most likely cause?

Accepted Answer

None of the nodes have enough CPU resources to satisfy the pod's request. The '0/4 nodes are available: 4 Insufficient cpu' event directly indicates that the Kubernetes scheduler attempted to place the pod on each of the four nodes but found that none had enough allocatable CPU capacity to satisfy the pod's CPU request (specified in the container's `resources.requests.cpu`). This causes the pod to remain in 'Pending' state because the scheduler cannot find a feasible node.

Answer

The pod has exceeded its memory limit

Answer

The pod's image pull is failing

Answer

The pod's liveness probe is failing

Question 19

Which of the following is a core principle of the 12-factor app methodology?

Accepted Answer

Treat logs as event streams. The 12-factor app methodology, a set of best practices for building modern, scalable applications, includes the principle 'Treat logs as event streams.' This means an app should not concern itself with routing or storage of its output stream; instead, it writes logs to stdout/stderr, and the execution environment captures and routes them. This decouples log management from the application, enabling flexibility and scalability.

Answer

Store configuration in the application code

Answer

Store logs in the local filesystem of each container

Answer

Use shared filesystems for persistent storage

Question 20

Which of the following describes the Open Container Initiative (OCI) image specification?

Accepted Answer

A standard for container images and runtimes. The Open Container Initiative (OCI) image specification defines a standard format for container images, ensuring that any OCI-compliant image can be run by any OCI-compliant runtime (e.g., runc, crun). This specification covers the image manifest, filesystem layers, and configuration, enabling interoperability across different container platforms like Docker, Podman, and containerd. Option A is correct because the OCI specifically standardizes both the image format and the runtime behavior, not higher-level orchestration or infrastructure concerns.

Answer

A specification for container orchestration

Answer

A specification for container storage

Answer

A specification for container networking