KCNA Practice Test 2 — 30 Questions

Question 1

You have a Kubernetes cluster with multiple namespaces. You need to allow communication only from pods with label 'app: frontend' to pods with label 'app: backend' in the same namespace. Which resource should you use?

Accepted Answer

NetworkPolicy. A NetworkPolicy is used to control ingress and egress traffic to pods based on labels and other selectors. It can be used to restrict communication between pods.

Answer

RBAC Role

Answer

PodSecurityPolicy

Answer

Service

Question 2

A user reports that a web application is not accessible via its Service. The Service is of type ClusterIP. Which TWO steps should be taken to troubleshoot?

Accepted Answer

Verify that the kube-proxy is running on the node. Option A is correct because kube-proxy is the component responsible for implementing the ClusterIP Service abstraction by managing iptables or IPVS rules on each node. If kube-proxy is not running, traffic destined for the Service's ClusterIP will not be forwarded to the backend pods, making the Service unreachable from within the cluster.

Answer

Check that the container runtime is working

Answer

Check the kube-apiserver status

Answer

Restart all nodes in the cluster

Question 3

An administrator wants to ensure that a specific pod only runs on nodes that have solid-state drives (SSDs). Nodes with SSDs are labeled with 'disktype=ssd'. Which pod specification field should be used?

Accepted Answer

nodeSelector. The `nodeSelector` field in a Pod spec is the simplest and most direct way to constrain a Pod to nodes with specific labels. By setting `nodeSelector: { disktype: ssd }`, the scheduler will only place the Pod on nodes that have the label `disktype=ssd`, which matches the administrator's requirement exactly. This field is a hard constraint that does not support complex expressions, but it is ideal for straightforward label-based node selection.

Answer

container resource limits

Answer

tolerations

Answer

nodeAffinity

Question 4

You have a microservices application where Service A needs to discover the IP of Service B. Both services run in the same Kubernetes cluster. Which approach is the most Kubernetes-native way for Service A to reach Service B?

Accepted Answer

Use the Kubernetes DNS service to resolve the Service name 'service-b'. Kubernetes has a built-in DNS service (typically CoreDNS) that automatically creates DNS records for Services. When Service A resolves the name 'service-b' (or 'service-b.<namespace>.svc.cluster.local'), the DNS returns the cluster IP of Service B's Service object, which then load-balances traffic to the healthy Pods. This is the most Kubernetes-native approach because it leverages the platform's own service discovery mechanism without external dependencies.

Answer

Use an external service registry like Consul or etcd

Answer

Hardcode the cluster IP of Service B in the configuration of Service A

Answer

Use environment variables injected by the Kubernetes API into each pod

Question 5

What does SLA stand for in the context of service reliability?

Accepted Answer

Service Level Agreement. SLA stands for Service Level Agreement, a contract specifying expected service level.

Answer

Service Level Indicator

Answer

Service Level Availability

Answer

Service Level Objective

Question 6

Which TWO of the following are responsibilities of the kubelet? (Select 2)

Accepted Answer

Registering the node with the cluster and reporting node status. The kubelet is the node agent that ensures containers are running and healthy, and it reports node status to the control plane. kube-proxy handles network rules, and the scheduler assigns pods to nodes.

Answer

Scheduling pods onto nodes based on resource availability

Answer

Creating and managing network iptables rules for Services

Answer

Storing cluster configuration data

Question 7

Which of the following is used to logically isolate resources within a Kubernetes cluster?

Accepted Answer

Namespaces. Namespaces provide logical isolation for resources. Option C is correct.

Answer

Annotations

Answer

Selectors

Answer

Labels

Question 8

A Kubernetes cluster has two nodes: control-plane and worker. The worker node runs several pods. The control-plane node becomes unreachable. What is the immediate impact on the pods running on the worker node?

Accepted Answer

Pods continue running, but new pods cannot be scheduled. When the control-plane node becomes unreachable, the kube-controller-manager cannot communicate with the kubelet on the worker node, so it stops performing scheduling and reconciliation. However, the kubelet on the worker node continues to run existing pods based on the last known desired state stored locally, and the pods themselves are managed by the container runtime (e.g., containerd) independently of the control-plane. Therefore, pods continue running normally, but no new pods can be scheduled because the scheduler, which runs on the control-plane, is unavailable.

Answer

All pods are immediately terminated

Answer

Pods are rescheduled to the control-plane node

Answer

The worker node is automatically cordoned

Question 9

A user reports that they cannot connect to a Service from within the cluster. The Service is of type ClusterIP. Running 'kubectl get endpoints service-name' shows no endpoints. What is the most likely cause?

Accepted Answer

The Service's pod selector does not match any running pods. If endpoints are empty, the Service selector does not match any pods, or the pods are not ready.

Answer

The Service is not associated with a namespace

Answer

The Service is exposed on the wrong port

Answer

The kube-proxy is not running on the node

Question 10

A user reports that they cannot connect to a database service named 'db-service' from another pod in the same namespace. The service selector matches the database pod's labels. Which command would you run FIRST to troubleshoot the service's endpoints?

Accepted Answer

kubectl get endpoints db-service. Option B is correct because `kubectl get endpoints db-service` directly shows whether the service has any endpoints (i.e., pod IPs) associated with it. If the endpoints list is empty, it indicates that the service's label selector is not matching any pods, which is the most common cause of connectivity failure. This is the fastest way to verify the fundamental prerequisite for service-to-pod traffic.

Answer

kubectl describe pod db-service

Answer

kubectl exec -it <some-pod> -- curl db-service

Answer

kubectl logs db-service

Question 11

When creating a Deployment, you want to ensure that only a certain number of pods run at a time across all nodes. Which field in the Deployment spec controls this?

Accepted Answer

spec.replicas. The `spec.replicas` field in a Deployment spec defines the desired number of identical Pod replicas that should be running at any given time. This field directly controls the count of Pods across all nodes in the cluster, ensuring that exactly that many Pods are maintained by the ReplicaSet controller. Option A is correct because it is the only field that sets the target Pod count.

Answer

spec.selector

Answer

spec.minReadySeconds

Answer

spec.template

Question 12

Which component is responsible for running containers on a Kubernetes node?

Accepted Answer

Container runtime (e.g., containerd). The container runtime (e.g., containerd) is the component responsible for actually running containers on a Kubernetes node. It pulls container images, manages container lifecycles, and handles low-level operations such as starting and stopping containers via the CRI (Container Runtime Interface). Without a container runtime, the kubelet cannot launch or manage any containers on the node.

Answer

etcd

Answer

kube-scheduler

Answer

kubelet

Question 13

What is the role of etcd in a Kubernetes cluster?

Accepted Answer

It stores cluster state and configuration. etcd is a distributed, consistent key-value store that serves as Kubernetes' primary datastore for all cluster state and configuration data. It stores objects like pods, services, deployments, secrets, and configmaps, and is the source of truth for the entire cluster. The Kubernetes API server is the only component that communicates directly with etcd, ensuring strong consistency via the Raft consensus protocol.

Answer

It serves as the container runtime

Answer

It provides DNS-based service discovery

Answer

It schedules pods onto nodes

Question 14

A pod has resource requests of 512Mi memory and 500m CPU, and limits of 1Gi memory and 1 CPU. The node has 4Gi memory and 2 CPU cores. If the pod tries to use 700m CPU, what will happen?

Accepted Answer

The pod will be allowed to use 700m CPU. The pod's CPU request is 500m, and its CPU limit is 1 CPU (1000m). When the pod attempts to use 700m CPU, it is below the limit of 1000m, so it is allowed to burst up to that amount. Kubernetes uses the CPU request for scheduling and the limit for throttling; since 700m is within the limit, no throttling occurs. The pod is not evicted or terminated because it has not exceeded its memory limit or violated any resource constraints.

Answer

The pod will be throttled to 500m CPU

Answer

The pod will be evicted from the node

Answer

The pod will be terminated for exceeding the limit

Question 15

Which of the following is a key principle of microservices architecture?

Accepted Answer

Loose coupling and independent deployability. Microservices architecture emphasizes decomposition of an application into small, independently deployable services that communicate over well-defined APIs. Option B is correct. Option A describes a monolith; Option C is not a principle; Option D refers to containerization.

Answer

Shared database schema for all services

Answer

Tight coupling between services

Answer

Building a large, monolithic codebase

Question 16

You need to deploy a batch job that processes a queue and runs to completion. The job should run exactly once and create exactly one pod per work item, but some items may fail. Which Kubernetes resource is best suited?

Accepted Answer

Job. A Job with a specified number of completions and parallelism can run pods to completion, handling failures by restarting or marking as failed.

Answer

Deployment

Answer

CronJob

Answer

DaemonSet

Question 17

Which of the following best describes a key advantage of containers over virtual machines?

Accepted Answer

Containers share the host OS kernel, resulting in lower resource overhead compared to VMs. Option A is correct. Containers share the host OS kernel, making them more lightweight than VMs, which each include a full guest OS. Option B is false — containers share the host kernel. Option C is false — resource usage is lower for containers. Option D is false — VMs typically take longer to start.

Answer

Containers take longer to start than VMs because they need to initialize a kernel

Answer

Containers consume more disk space than VMs because they include a full operating system

Answer

Containers have stronger isolation than VMs because each container runs its own kernel

Question 18

Which TWO statements about Docker Compose and Kubernetes are correct?

Accepted Answer

Kubernetes provides built-in auto-scaling and self-healing capabilities. Options A and D are correct. Docker Compose is primarily for single-host container orchestration (A). Kubernetes provides built-in features like auto-scaling and self-healing (D). Option B is false — Kubernetes can also be used in production. Option C is false — Docker Compose does not manage a cluster; it uses a single Docker daemon. Option E is false — Docker Compose uses a compose file, not YAML manifests? Actually both use YAML, but the statement is misleading; Compose uses docker-compose.yml, Kubernetes uses YAML manifests, but they are not interchangeable.

Answer

Kubernetes is only used in production environments

Answer

Docker Compose and Kubernetes use the same YAML manifest format

Answer

Docker Compose supports multi-node clustering out-of-the-box

Question 19

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event '0/4 nodes are available: 4 Insufficient cpu'. What is the most likely cause?

Accepted Answer

None of the nodes have enough CPU resources to satisfy the pod's request. The scheduler cannot place the pod because no node has enough available CPU to meet the pod's request.

Answer

The pod has exceeded its memory limit

Answer

The pod's image pull is failing

Answer

The pod's liveness probe is failing

Question 20

A pod is in CrashLoopBackOff. You check the logs and see 'Error: container process not found'. What is the most likely cause?

Accepted Answer

The container's entrypoint or command is incorrect. The container's entrypoint or command may be misconfigured, causing the container to exit immediately.

Answer

The pod has insufficient memory

Answer

The liveness probe is misconfigured

Answer

The container image is missing