KCNA Practice Test 34 — 15 Questions

Question 1

A team is deploying a microservice application on Kubernetes. They want to ensure that during rolling updates, the new version of the service receives traffic only after the readiness probe succeeds. However, they observe that the old pods are terminated before the new pods are ready, causing a brief downtime. Which configuration change should they make to the Deployment to prevent this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set spec.strategy.rollingUpdate.maxSurge=1 and maxUnavailable=0. Setting maxSurge=1 and maxUnavailable=0 ensures that during a rolling update, Kubernetes creates a new pod (surge) before terminating any old pod, and never allows the available pod count to drop below the desired replica count. Combined with a readiness probe, the new pod only receives traffic after it passes readiness, so the old pod is not removed until the new one is ready — eliminating the downtime.

Answer

Set spec.strategy.rollingUpdate.minReadySeconds to 0

Answer

Set spec.strategy.rollingUpdate.maxSurge=0 and maxUnavailable=1

Answer

Add a liveness probe to the container spec

Question 2

Which of the following correctly describes the concept of 'immutable infrastructure' in the context of container orchestration?

Accepted Answer

Infrastructure components are recreated from a known good state rather than modified. Immutable infrastructure means that instead of modifying running servers or containers, you replace them entirely with new instances built from a known good image. In container orchestration, this is achieved by building a new container image, deploying it as a new pod/replica set, and tearing down the old ones. This eliminates configuration drift and makes rollbacks deterministic.

Answer

Configuration changes are applied via SSH into running containers

Answer

Servers are never rebooted

Answer

Container images are updated in-place by patching existing layers

Question 3

Refer to the exhibit. How many containers are defined in this Pod?

Accepted Answer

2. The exhibit shows a Pod manifest with two container definitions under the `containers` field: one named `nginx` and one named `sidecar`. In Kubernetes, the number of containers in a Pod is determined by counting the entries in the `spec.containers` list, not including init containers or ephemeral containers unless explicitly specified. Therefore, the correct answer is 2.

Answer

1

Answer

3

Answer

0

Question 4

Which TWO of the following components are part of the Kubernetes control plane? (Select 2)

Accepted Answer

kube-apiserver. The Kubernetes control plane consists of components that make global cluster decisions and store cluster state. Option B, kube-apiserver, is correct because it is the central management endpoint that exposes the Kubernetes API, validates and processes REST requests, and is the front end through which all other components communicate. Option D, etcd, is correct because it is the consistent, highly-available key-value store that persists all cluster data, including object specs and state, and is the backing store for the API server. The unmarked options are node-level components, not control plane components: the container runtime (A) executes containers on each node, kubelet (C) is the node agent that manages pods and containers on a node, and kube-proxy (E) implements Service networking rules on each node.

Answer

container runtime

Answer

kubelet

Answer

kube-proxy

Question 5

You have a Pod that needs to run a one-time batch job to completion. Which resource type should you use?

Accepted Answer

Job. A Job resource is designed for running a finite task to completion, such as a batch job or a one-time computation. Unlike controllers that maintain a desired number of replicas indefinitely, a Job creates one or more Pods and tracks their successful termination. Once the specified number of completions is reached, the Job is considered finished and no further Pods are created.

Answer

StatefulSet

Answer

DaemonSet

Answer

Deployment

Question 6

A Kubernetes cluster is experiencing network latency. The team suspects that the number of services and endpoints is causing iptables performance degradation. Which CNI plugin or network policy approach is most likely to improve performance?

Accepted Answer

Use an eBPF-based CNI plugin like Cilium. C is correct because eBPF-based CNI plugins like Cilium bypass the traditional iptables chains entirely, using a kernel-level BPF (Berkeley Packet Filter) program to handle service load balancing and network policy enforcement. This eliminates the O(n) scaling issue of iptables rules with the number of services and endpoints, significantly reducing latency in large clusters.

Answer

Switch to Flannel with host-gw backend

Answer

Use Calico with iptables mode

Answer

Apply a default-deny NetworkPolicy

Question 7

In a Helm chart, which file is used to define default configuration values that can be overridden by users during installation?

Accepted Answer

values.yaml. In a Helm chart, values.yaml is the file that defines default configuration values for the chart. Users can override these defaults by supplying their own values file (via -f) or using --set flags during helm install or helm upgrade. Helm merges user-supplied values with the chart's defaults at render time.

Answer

templates/ directory

Answer

charts/ directory

Answer

Chart.yaml

Question 8

You are asked to deploy a Kubernetes service that exposes a set of pods internally within the cluster only. The service should not be accessible from outside the cluster. Which Service type should you choose?

Accepted Answer

ClusterIP. ClusterIP is the default Kubernetes Service type that exposes the service on a cluster-internal IP address. This makes the service reachable only from within the cluster, which is exactly what is required for internal-only communication between pods. No external traffic can reach a ClusterIP service unless an ingress controller or proxy is explicitly configured.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer

Question 9

You have a Deployment named 'web-app' that manages 3 replicas. You need to update the container image from version 1.0 to 2.0 with zero downtime. Which Kubernetes feature is designed to handle this automatically when you update the Deployment's pod template?

Accepted Answer

Rolling update strategy in the Deployment. A Deployment's default update strategy is 'RollingUpdate', which automatically replaces old Pods with new ones in a controlled manner, ensuring zero downtime by incrementally scaling down old replicas and scaling up new replicas. When you update the container image in the Deployment's pod template, Kubernetes triggers a rolling update that maintains the desired number of replicas throughout the process.

Answer

ReplicationController

Answer

DaemonSet

Answer

StatefulSet's onDelete strategy

Question 10

What is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model, representing a single instance of a running process in the cluster. It encapsulates one or more containers, shared storage, and a unique network IP, making it the atomic unit of scheduling and deployment.

Answer

Deployment

Answer

Node

Answer

Container

Question 11

Which of the following is a key benefit of container orchestration?

Accepted Answer

Automated scaling, self-healing, and declarative management. Container orchestration platforms like Kubernetes provide automated scaling (HPA/VPA/cluster autoscaler), self-healing (restarting failed containers, rescheduling pods, replacing unhealthy nodes), and declarative management (desired-state YAML reconciled by controllers). These three capabilities are the defining value proposition that distinguishes orchestration from manually running `docker run` commands.

Answer

Manual scaling of applications

Answer

Requires manual intervention for pod failures

Answer

Only supports monolithic applications

Question 12

A Deployment manages ReplicaSets and supports rolling updates. You want to change the container image of a Deployment without downtime. What is the recommended approach?

Accepted Answer

Edit the Deployment's pod template spec to use the new image; the Deployment will automatically perform a rolling update. Editing the Deployment's pod template spec triggers an automatic rolling update, which is the recommended approach for zero-downtime updates. The Deployment controller creates a new ReplicaSet with the updated image and gradually scales it up while scaling down the old ReplicaSet, ensuring that a minimum number of pods remain available throughout the process.

Answer

Use kubectl expose to update the image on the service

Answer

Delete the existing Deployment and create a new one with the updated image

Answer

Manually delete all pods one by one; they will be recreated with the new image by the ReplicaSet

Question 13

In a microservices application, you want to prevent cascading failures by limiting the number of concurrent requests to a downstream service. Which resilience pattern should you implement?

Accepted Answer

Bulkhead pattern. The bulkhead pattern isolates resources by limiting the number of concurrent calls to a downstream service, so that a slow or failing dependency cannot exhaust the caller's thread pool or connection pool and cause cascading failures. In microservices, bulkheads partition thread pools, connection pools, or instances per dependency (e.g., Hystrix thread pool isolation), so one degraded service only saturates its own compartment. This directly matches the requirement of limiting concurrent requests to a downstream service.

Answer

Circuit breaker

Answer

Timeout pattern

Answer

Retry pattern

Question 14

Which component runs on every node and is responsible for maintaining network rules that allow communication to Pods from network endpoints?

Accepted Answer

kube-proxy. B is correct because kube-proxy is the component that runs on every node in a Kubernetes cluster and is responsible for maintaining network rules (e.g., iptables, IPVS, or userspace proxy) that allow network communication to Pods from network endpoints, both inside and outside the cluster. It implements the Kubernetes Service concept by managing the mapping of Service IPs to backend Pod IPs and performing load balancing.

Answer

kube-controller-manager

Answer

container runtime

Answer

kubelet

Question 15

Which THREE of the following are valid ways to expose a set of pods as a network service in Kubernetes?

Accepted Answer

Creating a Service of type NodePort.. A Service of type NodePort exposes the pods on a static port on each node's IP address, making the service accessible externally. This is a valid method for exposing a set of pods as a network service in Kubernetes.

Answer

Creating a headless Service (clusterIP: None).

Answer

Creating a Deployment with a label selector.