KCNA Practice Test 33 — 15 Questions

Question 1

Which component runs on every node and is responsible for ensuring that containers are running as specified in Pod manifests?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every node in a Kubernetes cluster. It is responsible for ensuring that containers described in Pod manifests (typically provided via the API server) are running and healthy. The kubelet does not manage containers directly; instead, it interacts with the container runtime (e.g., containerd, CRI-O) to create, start, and stop containers as specified.

Answer

kube-proxy

Answer

container runtime

Answer

kube-controller-manager

Question 2

Which TWO of the following are features of a service mesh like Istio or Linkerd? (Select 2)

Accepted Answer

Traffic management (routing, load balancing). Option B is correct because a service mesh like Istio or Linkerd deploys sidecar proxies (Envoy in Istio, linkerd2-proxy in Linkerd) alongside each workload to intercept east-west traffic and provide fine-grained traffic management such as HTTP/gRPC routing, retries, timeouts, circuit breaking, and load balancing. Option C is correct because these sidecars also emit telemetry — request metrics (e.g., Prometheus-scraped latency/error counters), distributed traces (via Zipkin/Jaeger/OpenTelemetry), and access logs — giving uniform observability without changing application code. Option A is not a service mesh feature; container image building is handled by tools like Docker BuildKit, Buildah, or Kaniko in a CI pipeline. Option D, service discovery, is a related but distinct capability typically provided by the platform (Kubernetes Services/DNS, Consul) that the mesh consumes rather than being a defining feature of the mesh itself. Option E, auto-scaling, is performed by Kubernetes controllers such as the Horizontal Pod Autoscaler or KEDA, not by the service mesh data plane.

Answer

Container image building

Answer

Service discovery

Answer

Auto-scaling of services

Question 3

What is the primary purpose of a container registry in the CI/CD pipeline?

Accepted Answer

To store and distribute container images. A container registry is a centralized repository for storing and distributing container images, such as Docker images. In a CI/CD pipeline, after an image is built, it is pushed to a registry (e.g., Docker Hub, Harbor, or a cloud provider's registry) so that it can be pulled and deployed to various environments. This enables versioning, sharing, and consistent deployment of containerized applications.

Answer

To run unit tests on container images

Answer

To store application source code

Answer

To scan images for vulnerabilities

Question 4

You need to run a stateless web application with three replicas, and you want to ensure that if a pod fails, it is automatically replaced. Which Kubernetes resource should you use?

Accepted Answer

Deployment. A Deployment is the correct resource because it manages a ReplicaSet to ensure the desired number of pod replicas (three) are running at all times. If a pod fails, the Deployment's controller automatically creates a replacement pod, maintaining the stateless application's availability.

Answer

DaemonSet

Answer

Job

Answer

StatefulSet

Question 5

A cluster administrator notices that a Deployment's pods are not receiving traffic as expected. The Service selector matches the pod labels. What is a possible cause?

Accepted Answer

The pods have a failing readiness probe. A failing readiness probe removes the pod's endpoint from the Service's EndpointSlice, so the Service stops routing traffic to that pod even though the pod is running and its labels match the Service selector. This is the most direct reason why a Deployment's pods would not receive traffic despite correct label matching.

Answer

The pods have a liveness probe that fails

Answer

The Deployment replicas are set to zero

Answer

The Service type is NodePort

Question 6

Which THREE of the following are true about container lifecycle? (Choose 3)

Accepted Answer

A container can be paused and resumed. Option A is correct because container runtimes such as Docker support pausing a running container (e.g., `docker pause`), which freezes all processes via the cgroup freezer, and resuming it later with `docker unpause`. Option D is correct because a container's lifecycle is tied to its main process (PID 1); when that process exits, the container terminates and its writable layer stops. Option E is correct because a stopped container retains its filesystem and configuration, allowing it to be restarted later with `docker start`, resuming the same container instance. Option B is not correct because containers do not hibernate state to disk the way virtual machines or operating systems do; there is no standard container hibernation mechanism. Option C is not correct because 'built' is a phase of creating an image, not a container lifecycle stage; containers are created and then started, not built.

Answer

A container can be hibernated to save state to disk

Answer

A container goes through a 'built' phase before running

Question 7

Which three of the following are valid ways to interact with the Kubernetes API? (Select THREE.)

Accepted Answer

Using a Kubernetes client library (e.g., client-go). Option A is correct because Kubernetes provides official client libraries such as client-go (Go), client-python, and client-java that programmatically communicate with the API server via REST, allowing applications and controllers to create, read, update, and delete resources. Option D is correct because kubectl is the standard command-line tool that authenticates to the API server and translates commands like 'kubectl get pods' into REST API calls. Option E is correct because the Kubernetes API server exposes a RESTful HTTP API, so tools like curl can send authenticated requests directly to endpoints such as /api/v1/namespaces/default/pods. Option B is not a way to interact with the API; kubeadm is a bootstrap tool for initializing clusters and joining nodes, not for querying or managing API resources. Option C is incorrect because the Docker CLI manages containers on a Docker daemon and has no native interface to the Kubernetes API server.

Answer

Using the 'kubeadm' command

Answer

Using the Docker CLI

Question 8

A microservice logs errors when connecting to the database. The logs show 'connection refused'. Which troubleshooting step should be taken first?

Accepted Answer

Verify the database Service and Endpoints in Kubernetes. The 'connection refused' error indicates that the microservice is attempting to connect to a TCP port on the database endpoint, but no process is listening there. In Kubernetes, the first step is to verify that the database Service exists and that its Endpoints object contains the correct pod IPs and port. If the Endpoints are empty or missing, the Service is not routing traffic to any healthy database pod, which directly causes the refusal. This aligns with the Kubernetes troubleshooting hierarchy: always check the Service and Endpoints before assuming application-level issues.

Answer

Scale up the microservice deployment

Answer

Restart the microservice pod

Answer

Check the logs of other microservices

Question 9

Which of the following patterns is used to improve resilience by isolating failures to a subset of components?

Accepted Answer

Bulkhead. The Bulkhead pattern (D) is correct because it isolates failures by partitioning resources (e.g., thread pools, connections) into separate pools for different components or services. This prevents a failure in one component from exhausting shared resources and cascading to others, directly improving resilience by containing the blast radius.

Answer

Timeout

Answer

Retry

Answer

Circuit breaker

Question 10

What is the role of the kubelet on a worker node?

Accepted Answer

It ensures containers are running in a Pod as specified. The kubelet is the primary node agent that runs on every worker node. Its core responsibility is to ensure that containers described in Pod specs (received from the API server via the kube-apiserver) are running and healthy. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers, and it reports the Pod and node status back to the control plane.

Answer

It stores cluster state

Answer

It manages network rules for Services

Answer

It runs the container runtime

Question 11

Which TWO of the following are core principles of cloud native architecture according to the CNCF?

Accepted Answer

Microservices architecture. Options B and C are correct. Microservices architecture and dynamic orchestration are core principles of cloud native architecture according to the CNCF. Option A (static scaling) is not a core principle; cloud native emphasizes dynamic scaling. Option D (manual infrastructure management) contradicts the principle of automation. Option E (monolithic deployment) is antithetical to the microservices principle. Thus, the correct answers are B and C.

Answer

Static scaling based on predefined thresholds

Answer

Manual infrastructure management

Answer

Monolithic deployment

Question 12

Which THREE of the following are features provided by a service mesh like Istio? (Select THREE.)

Accepted Answer

Traffic routing and load balancing. Service mesh provides traffic management (routing), observability (metrics, tracing), and security (mTLS, policies).

Answer

Container image building

Answer

Database schema migrations

Question 13

Which TWO of the following are core principles of the 12-factor app methodology? (Select TWO.)

Accepted Answer

Strict separation of config from code. The 12-factor app methodology mandates strict separation of config from code. Config includes things like database connection strings, API keys, and environment-specific values that vary between deployments. Storing these in environment variables (or external config files not checked into version control) ensures that the same codebase can be deployed to different environments without modification, which is a core principle for cloud-native portability and security.

Answer

Manual approval for all production deployments

Answer

Use of a single programming language across all services

Answer

Store logs in a local file system

Question 14

Which THREE are benefits of using a container orchestration platform? (Select 3)

Accepted Answer

Declarative configuration management. Option B is correct because container orchestration platforms such as Kubernetes use declarative configuration management, where you define the desired state in manifests (YAML) and the control plane continuously reconciles actual state to match it. Option C is correct because orchestration platforms provide automated scaling based on demand, for example Kubernetes Horizontal Pod Autoscaler adjusts replica counts using metrics like CPU utilization. Option E is correct because orchestration platforms deliver high availability through automatic failover, rescheduling pods onto healthy nodes when a node or container fails, and supporting self-healing and rolling updates. Option A is not correct because zero downtime is not guaranteed; it depends on proper configuration such as readiness probes, rolling update strategy, and sufficient capacity, so downtime can still occur. Option D is not correct because orchestration platforms run on infrastructure, including cloud or on-premises resources, and do not eliminate the need for cloud infrastructure.

Answer

Guarantees zero downtime during deployments

Answer

Eliminates the need for cloud infrastructure

Question 15

A developer wants to run a one-time batch job that processes a queue and then terminates. Which Kubernetes resource should they use?

Accepted Answer

Job. A Kubernetes Job is designed for finite, batch-oriented tasks that run to completion, such as processing a queue and then terminating. Unlike controllers that maintain a desired state (like Deployments or StatefulSets), a Job creates one or more Pods and ensures they successfully exit, making it the correct choice for a one-time batch job.

Answer

StatefulSet

Answer

Deployment

Answer

DaemonSet