KCNA Practice Test 31 — 15 Questions

Question 1

You have a Deployment that runs a web application. You need to expose this application externally on a fixed port using a cloud load balancer. Which Service type should you use?

Accepted Answer

LoadBalancer. A LoadBalancer Service type provisions an external cloud load balancer (e.g., AWS ELB, GCP TCP/UDP Load Balancer) that exposes the application on a fixed port (typically 80/443) and distributes traffic to the Pods. This is the correct choice because the requirement explicitly asks for a cloud load balancer with a fixed external port, which is exactly what LoadBalancer provides by integrating with the underlying cloud provider's API.

Answer

NodePort

Answer

ExternalName

Answer

ClusterIP

Question 2

What is the purpose of kube-proxy on a worker node?

Accepted Answer

To implement network rules and handle service traffic routing. Kube-proxy is the component responsible for implementing network rules on each worker node, enabling service abstraction by managing IP tables or IPVS rules to route traffic to the appropriate pods. It handles service discovery and load balancing for ClusterIP, NodePort, and LoadBalancer service types, ensuring that traffic destined for a service is correctly forwarded to healthy pod endpoints.

Answer

To run the container runtime

Answer

To store cluster configuration data

Answer

To monitor pod health and restart unhealthy containers

Question 3

Which of the following is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. The Pod is the smallest deployable unit in Kubernetes because it represents a single instance of a running process in the cluster and encapsulates one or more containers that share the same network namespace, storage volumes, and lifecycle. Containers are not directly scheduled onto Nodes; instead, Kubernetes always schedules and manages Pods, making the Pod the atomic unit of deployment.

Answer

Container

Answer

Node

Answer

Deployment

Question 4

In the context of distributed tracing, what is a 'span'?

Accepted Answer

A single logical operation within a service, with a start and end time. A span is the fundamental building block of a trace, representing a single unit of work in a distributed system.

Answer

A metric that measures request latency

Answer

A tool for collecting logs from containers

Answer

The entire end-to-end transaction across services

Question 5

Which TWO components run on every worker node in a Kubernetes cluster?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node, responsible for managing pod lifecycle and ensuring containers are running as expected. kube-proxy runs on every node to handle network routing and load balancing for Kubernetes services, implementing rules via iptables or IPVS.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 6

Which THREE of the following are features of Helm that facilitate release management? (Choose three.)

Accepted Answer

Rollback to a previous release revision. Helm provides rollback to previous revisions, stores release history, and upgrades releases while preserving history. It does not natively do canary deployments or autoscaling.

Answer

Canary deployment strategy

Answer

Horizontal pod autoscaling

Question 7

A team is designing a Kubernetes cluster for a production workload that requires high availability. They have three worker nodes in different availability zones. Which statement about scheduling Pods is correct?

Accepted Answer

Define a Pod topology spread constraint with topologyKey: topology.kubernetes.io/zone.. A Pod topology spread constraint with `topologyKey: topology.kubernetes.io/zone` explicitly instructs the scheduler to distribute Pods evenly across the specified failure domains (availability zones). This ensures that if one zone fails, the remaining zones still have running Pods, achieving high availability for the production workload.

Answer

Use nodeSelector to assign Pods to nodes in different zones.

Answer

Add tolerations for the zone taint.

Answer

Use podAntiAffinity with a requiredDuringSchedulingIgnoredDuringExecution rule.

Question 8

Which Kubernetes resource provides stable network endpoints for a set of pods, enabling service discovery and load balancing?

Accepted Answer

Service. A Service is the correct Kubernetes resource because it provides a stable virtual IP (ClusterIP) and DNS name that persists independently of pod lifecycles, enabling reliable service discovery and client-side load balancing across a set of pods selected by labels. This abstraction decouples clients from ephemeral pod IPs, ensuring traffic is routed to healthy pods via kube-proxy and iptables/IPVS rules.

Answer

NetworkPolicy

Answer

Ingress

Answer

EndpointSlice

Question 9

Which of the following is a way to provide configuration data to a pod without baking it into the container image?

Accepted Answer

Using a ConfigMap. A ConfigMap is a Kubernetes API object used to decouple configuration artifacts from container images, allowing you to inject configuration data (e.g., environment variables, command-line arguments, or configuration files) into pods without rebuilding the image. This is the standard way to provide non-sensitive configuration data to pods at runtime, as defined in the Kubernetes documentation.

Answer

Using an annotation

Answer

Using a Secret

Answer

Using a PersistentVolume

Question 10

Which statement accurately describes a key difference between containers and virtual machines?

Accepted Answer

Containers share the host OS kernel, while virtual machines include a full guest OS. Containers virtualize at the OS level, sharing the host kernel, while virtual machines (VMs) include a full guest OS with its own kernel, running on a hypervisor. This fundamental architectural difference means containers are lighter and start faster, but VMs provide stronger isolation since each VM has its own kernel and OS instance.

Answer

Virtual machines share the host kernel, while containers have their own kernel

Answer

Both containers and virtual machines require a hypervisor

Answer

Containers include a full guest operating system

Question 11

Which resource type provides a stable IP address and DNS name to access a set of Pods, regardless of Pod IP changes?

Accepted Answer

Service. A Service in Kubernetes provides a stable virtual IP (ClusterIP) and a DNS name (via CoreDNS) that remains constant even as Pods are created, destroyed, or rescheduled. This decouples client access from the ephemeral nature of Pod IPs, ensuring reliable connectivity to the Pods selected by the Service's label selector.

Answer

Ingress

Answer

ConfigMap

Answer

Deployment

Question 12

Which Kubernetes resource should be used to run a one-time task that performs a computation and then exits?

Accepted Answer

Job. A Kubernetes Job is designed specifically for finite, one-time tasks that run to completion and then exit. Unlike controllers that maintain a desired number of continuously running Pods, a Job creates one or more Pods and tracks their successful termination, making it the correct choice for a computation that should run once and stop.

Answer

DaemonSet

Answer

StatefulSet

Answer

Deployment

Question 13

Which of the following is a worker node component responsible for ensuring that containers are running in a pod as specified in the pod's spec?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each worker node. It receives PodSpecs (via the API server or a file) and ensures that the containers described in those PodSpecs are running and healthy. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers as required.

Answer

kube-scheduler

Answer

kube-proxy

Answer

etcd

Question 14

A developer creates a pod that needs to securely access a database password stored in the cluster. Which Kubernetes resource should be used to inject the password as an environment variable?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for injecting sensitive data like a database password into a Pod as an environment variable. Secrets store base64-encoded data and are designed specifically for confidential information, unlike ConfigMaps which store non-sensitive configuration. When mounted as environment variables, Secrets ensure the password is not exposed in plaintext in the Pod specification or image layers.

Answer

ServiceAccount

Answer

ConfigMap

Answer

PersistentVolumeClaim

Question 15

You have a Pod with a container that runs a web server. The Pod has a memory request of 256Mi and a memory limit of 512Mi. The container attempts to allocate 600Mi of memory. What happens?

Accepted Answer

The container is killed by the OOM killer, and the Pod enters CrashLoopBackOff. When a container's memory usage exceeds its memory limit (512Mi), the Linux Out-Of-Memory (OOM) killer terminates the container process. Kubernetes then restarts the container based on the Pod's restart policy, but because the container immediately tries to allocate 600Mi again, it is repeatedly killed, resulting in a CrashLoopBackOff state. Memory limits are hard constraints enforced by the kernel via cgroups, not soft limits.

Answer

The memory limit is automatically increased to 600Mi

Answer

The Pod is evicted from the node

Answer

The container is allowed to use up to 600Mi because the limit is a soft constraint