KCNA Practice Test 35 — 15 Questions

Question 1

What is the role of etcd in a Kubernetes cluster?

Accepted Answer

It stores cluster state and configuration. etcd is a distributed, consistent key-value store that serves as Kubernetes' primary datastore for all cluster state and configuration data. It stores objects like pods, services, deployments, secrets, and configmaps, and is the source of truth for the entire cluster. The Kubernetes API server is the only component that communicates directly with etcd, ensuring strong consistency via the Raft consensus protocol.

Answer

It serves as the container runtime

Answer

It provides DNS-based service discovery

Answer

It schedules pods onto nodes

Question 2

Which TWO statements about GitOps are correct?

Accepted Answer

Git is the single source of truth for desired system state. GitOps uses Git as the single source of truth and automatically reconciles cluster state with the repository.

Answer

GitOps requires a container registry

Answer

GitOps eliminates the need for CI pipelines

Answer

Changes are made directly to the cluster using kubectl

Question 3

An administrator runs 'kubectl get pods' and sees that a pod named 'app-pod' is in 'CrashLoopBackOff'. They run 'kubectl logs app-pod' and see a segmentation fault error. What is the most likely cause?

Accepted Answer

The application code has a bug. A segmentation fault (segfault) is a specific error caused by a program attempting to access memory it does not have permission to access, typically due to a bug in the application code (e.g., null pointer dereference, buffer overflow). Since the container starts but then crashes repeatedly (CrashLoopBackOff), the segfault indicates the application itself is failing, not the infrastructure or configuration. This is the most direct cause of the pod entering CrashLoopBackOff.

Answer

The node is out of memory

Answer

The container has a configuration error

Answer

The readiness probe is misconfigured

Question 4

You have a Deployment with three replicas. You want to update the container image but ensure that only one pod is updated at a time, and the update proceeds only if the new pod becomes healthy. Which update strategy should you configure?

Accepted Answer

RollingUpdate with maxSurge=1 and maxUnavailable=0. A RollingUpdate strategy with maxSurge=1 and maxUnavailable=0 ensures that exactly one new pod is created before any old pod is terminated, and the update only proceeds when the new pod passes its readiness probe (i.e., becomes healthy). This guarantees that at all times during the update, the desired number of replicas (3) are available, and only one pod is updated at a time, matching the requirement.

Answer

RollingUpdate with maxSurge=3 and maxUnavailable=1

Answer

Canary deployment via Ingress

Answer

Recreate strategy

Question 5

A Deployment is configured with 'replicas: 5' and a rolling update strategy. During an update, you notice that the number of available pods drops to 3 momentarily. Which field in the Deployment spec can be adjusted to control the minimum number of pods available during a rolling update?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. `spec.strategy.rollingUpdate.maxUnavailable` defines the maximum number (or percentage) of Pods that can be unavailable during a rolling update. With `replicas: 5`, setting `maxUnavailable: 2` would allow at most 2 Pods to be unavailable at any time, ensuring that at least 3 Pods remain available — which matches the observed drop to 3. This field directly controls the minimum number of available Pods during the update process.

Answer

spec.strategy.rollingUpdate.maxSurge

Answer

spec.minReadySeconds

Answer

spec.replicas

Question 6

A company wants to adopt immutable infrastructure for its containerized applications. Which practice BEST exemplifies immutability?

Accepted Answer

When a container fails, the orchestrator terminates it and launches a new container from the same image. Immutable infrastructure means that once a container is deployed from a specific image, it is never modified in place. When a container fails, the orchestrator (e.g., Kubernetes) terminates it and launches a new container from the same image, ensuring consistency and reproducibility. This approach eliminates configuration drift and aligns with the principle that all changes should be made by rebuilding the image, not by altering running instances.

Answer

Developers use kubectl exec to change environment variables in a running pod

Answer

A configuration management tool runs periodically to ensure containers are up-to-date

Answer

An operator logs into a running container and applies a security patch with apt-get update

Question 7

You need to deploy a batch job that processes a queue and runs to completion. The job should run exactly once and create exactly one pod per work item, but some items may fail. Which Kubernetes resource is best suited?

Accepted Answer

Job. A Kubernetes Job is the correct resource for batch processing tasks that run to completion, such as processing a queue where each work item corresponds to a pod. By configuring the `.spec.completions` and `.spec.parallelism` fields, you can ensure exactly one pod per work item and control concurrency. The Job automatically retries failed pods (up to a configurable limit) without restarting the entire batch, making it ideal for handling some failures. In contrast, a Deployment (A) is for long-running, continuously available services; a CronJob (C) is for scheduled recurring jobs; and a DaemonSet (D) runs a pod on every node for infrastructure tasks. Therefore, Job (B) is the best fit.

Answer

Deployment

Answer

CronJob

Answer

DaemonSet

Question 8

Which TWO of the following are responsibilities of the kube-controller-manager?

Accepted Answer

Managing endpoint objects for Services. The kube-controller-manager runs controllers that handle routine tasks. The Node controller watches the health of nodes. The Endpoint controller (now EndpointSlice controller) manages endpoints for Services. Assigning pods to nodes is done by the scheduler. Storing cluster state is done by etcd. Serving the Kubernetes API is done by kube-apiserver.

Answer

Assigning pods to nodes

Answer

Storing cluster state

Answer

Serving the Kubernetes API

Question 9

A Deployment is configured with 'replicas: 3'. After a node failure, only 2 pods are running. What component ensures that a new pod is scheduled to restore the desired replica count?

Accepted Answer

kube-controller-manager. The kube-controller-manager runs the ReplicaSet controller, which detects the mismatch and creates a new pod.

Answer

kube-scheduler

Answer

kubelet

Answer

kube-proxy

Question 10

Which Kubernetes object can be used to store sensitive data, such as passwords or API keys, and inject them into pods?

Accepted Answer

Secret. A Secret is the dedicated Kubernetes object for storing sensitive data like passwords, API keys, and tokens. Secrets store data as base64-encoded strings and can be injected into pods as environment variables or mounted as volumes, with optional encryption at rest via etcd or KMS.

Answer

PersistentVolume

Answer

ServiceAccount

Answer

ConfigMap

Question 11

A pod is running a Java application that occasionally leaks memory. After a few hours, 'kubectl describe pod' shows the container exited with OOMKilled. You want to automatically restart the container but ensure the application has enough memory. What should you do?

Accepted Answer

Increase the memory limit in the container's resources.limits and add a liveness probe that triggers on high memory usage. Increasing the memory limit in resources.limits provides the Java application with more memory headroom, reducing the likelihood of OOMKilled terminations. Adding a liveness probe that triggers on high memory usage ensures the pod is restarted proactively if memory consumption approaches the limit, maintaining availability while the underlying memory leak is addressed.

Answer

Set restartPolicy: OnFailure in the pod spec

Answer

Use a DaemonSet instead of a Deployment

Answer

Set terminationGracePeriodSeconds to 0

Question 12

What is the purpose of a readiness probe in a Kubernetes pod?

Accepted Answer

To determine if the container is ready to accept traffic. A readiness probe in Kubernetes determines whether a container within a pod is ready to start accepting traffic. If the probe fails, the pod is removed from the Service's endpoints, ensuring that only healthy containers receive requests. This is distinct from liveness probes, which restart containers, and startup probes, which delay other probes until initialization completes.

Answer

To measure resource usage of the container

Answer

To restart the container when it becomes unresponsive

Answer

To check if the container is still running

Question 13

Which component is the primary entry point for all administrative tasks and API requests in a Kubernetes control plane?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the only component that directly interacts with etcd. All administrative tasks (via kubectl), API requests from pods, and internal control plane components (scheduler, controller-manager) must pass through the kube-apiserver, which validates and processes them before persisting state or triggering actions.

Answer

etcd

Answer

kube-scheduler

Answer

kube-controller-manager

Question 14

You have a Deployment with image: myapp:v1. You update the image to myapp:v2 using 'kubectl set image deployment/myapp myapp=myapp:v2'. The rollout status shows 'Waiting for rollout to finish: 0 out of 3 new replicas have been updated...'. What is the most likely cause of this behavior?

Accepted Answer

The new image myapp:v2 does not exist or cannot be pulled from the registry. The rollout is stuck waiting for new replicas to become ready, which typically happens when the container image cannot be pulled. The message '0 out of 3 new replicas have been updated' indicates that the ReplicaSet is attempting to create Pods with the new image, but the Pods are failing to start. The most common cause is that the image tag 'myapp:v2' does not exist in the registry or cannot be accessed due to authentication or network issues, preventing the kubelet from pulling it.

Answer

The command syntax is incorrect; you should use 'kubectl set image deployment/myapp myapp:v2'

Answer

The new Pods are crashing due to a missing command

Answer

The Deployment's update strategy is set to 'Recreate'

Question 15

A team wants to use feature flags to control the rollout of a new feature in a Kubernetes-deployed microservice. Which tool is specifically designed for managing feature flags in cloud-native applications?

Accepted Answer

LaunchDarkly. LaunchDarkly is a feature management platform specifically designed for managing feature flags in cloud-native applications. It allows for controlled rollouts and A/B testing. Argo Rollouts focuses on progressive delivery (canary, blue-green deployments), not feature flags. Helm is a package manager for Kubernetes. Kustomize is for configuration management. Therefore, option B (LaunchDarkly) is correct.

Answer

Helm

Answer

Kustomize

Answer

Argo Rollouts