KCNA Practice Test 36 — 15 Questions

Question 1

A user reports that a ConfigMap update is not reflected in running pods. Which action should be taken to ensure pods receive the updated configuration?

Accepted Answer

Perform a rollout restart of the deployment. A is correct because ConfigMaps are mounted into pods as volumes or consumed via environment variables at pod creation time. Kubernetes does not automatically propagate ConfigMap updates to running pods; the only way to pick up the new configuration is to restart the pods. A rollout restart of the deployment (e.g., `kubectl rollout restart deployment`) triggers a new ReplicaSet, which creates fresh pods that read the updated ConfigMap.

Answer

Delete and recreate the ConfigMap

Answer

Edit the deployment and change a label

Answer

Restart the kubelet on the nodes

Question 2

Your organization runs a microservices application in a Kubernetes cluster with 5 worker nodes. Each microservice is deployed as a Deployment with 3 replicas. Recently, users report intermittent timeouts when accessing the frontend service. The frontend communicates with a backend service via ClusterIP. You check the backend pods and find that one of the three replicas is in CrashLoopBackOff. The other two backend pods are healthy. The frontend deployment has no readiness or liveness probes. You notice that the frontend's connection pool to the backend has a timeout of 5 seconds. The crashing backend pod logs show an occasional NullPointerException that causes the container to restart, but the pod becomes ready after restart within 2 seconds. However, the frontend's connection pool does not evict unhealthy connections quickly. What is the best course of action to reduce timeouts?

Accepted Answer

Add a readiness probe to the backend Deployment that checks the application health endpoint.. The intermittent timeouts occur because the frontend's connection pool holds stale connections to the backend pod that is in CrashLoopBackOff. Although the pod restarts and becomes ready within 2 seconds, the frontend does not detect that the old connection is broken and continues to use it until the 5-second timeout expires. Adding a readiness probe to the backend Deployment ensures that Kubernetes only sends traffic to pods that pass the health check; when the pod fails the probe, it is removed from the ClusterIP's endpoints, preventing the frontend from routing requests to it and thus eliminating the timeouts.

Answer

Increase the number of backend replicas to 5 to absorb the failures.

Answer

Add a liveness probe to the frontend Deployment.

Answer

Increase the frontend connection pool timeout to 10 seconds.

Question 3

A team uses Helm to manage their Kubernetes applications. They need to upgrade a release and want to reuse the values from the previous release while overriding a specific value. Which helm command should they use?

Accepted Answer

helm upgrade --reuse-values my-release ./charts/app --set image.tag=v2. The --reuse-values flag tells Helm to reuse the last release's values and merge any provided overrides. This is the correct approach to preserve existing values while updating a specific one.

Answer

helm upgrade --reset-values my-release ./charts/app --set image.tag=v2

Answer

helm upgrade --atomic my-release ./charts/app --set image.tag=v2

Answer

helm upgrade --history-max 5 my-release ./charts/app --set image.tag=v2

Question 4

Which three of the following are valid ways to interact with the Kubernetes API? (Select THREE.)

Accepted Answer

Using a Kubernetes client library (e.g., client-go). Client-go is an official Kubernetes client library that provides Go developers with programmatic access to the Kubernetes API. It handles authentication, serialization, and API version negotiation, allowing applications to create, read, update, and delete Kubernetes resources directly via the API server.

Answer

Using the 'kubeadm' command

Answer

Using the Docker CLI

Question 5

A DevOps team notices that a microservice is returning 503 errors intermittently. The service runs in Kubernetes and uses a liveness probe. The team wants to understand the root cause without restarting the pod. Which observability approach should they use first?

Accepted Answer

Query Prometheus for kubelet metrics on probe successes and failures. Prometheus can scrape kubelet metrics that expose liveness probe success and failure counts directly, allowing the team to see if the probe is failing without restarting the pod. This approach provides historical data on probe behavior, which is essential for diagnosing intermittent 503 errors that stem from the kubelet restarting the container when the liveness probe fails. Unlike other options, it does not require modifying the application or restarting the pod, and it directly surfaces the root cause if the probe is the issue.

Answer

Use kubectl describe pod to check recent events

Answer

Increase log verbosity in the application to capture all requests

Answer

Enable distributed tracing across the service mesh

Question 6

Which component implements the Container Runtime Interface (CRI) to manage container lifecycle in Kubernetes?

Accepted Answer

CRI-O. Both containerd and CRI-O are high-level container runtimes that implement the Container Runtime Interface (CRI) to manage the full lifecycle of containers (create, start, stop, delete) in Kubernetes. They communicate directly with the kubelet via the CRI protocol (gRPC) and handle image management, container execution, and resource isolation using low-level runtimes like runc. In contrast, the kubelet is the agent that calls the CRI but does not implement it itself, and Docker does not directly implement the CRI; it uses containerd internally and previously required the dockershim adapter.

Answer

kubelet

Answer

Docker

Question 7

Based on the exhibit, why is the pod web-pod not running?

Accepted Answer

The container image is not available in the registry.. The pod's status indicates an ImagePullBackOff error, which occurs when the kubelet fails to pull the specified container image from the registry. This typically means the image name or tag is incorrect, the registry is unreachable, or the image does not exist in the registry. The exhibit shows the pod is stuck in a waiting state with the reason 'ErrImagePull' or 'ImagePullBackOff', directly pointing to a missing or inaccessible image.

Answer

A network policy is blocking the image pull.

Answer

The node does not have enough memory.

Answer

The pod was not scheduled onto a node.

Question 8

A team uses a Deployment with 3 replicas and a RollingUpdate strategy. They update the container image. During the update, one of the new pods fails to start. What will happen by default?

Accepted Answer

The update pauses, keeping the remaining old replicas running. By default, a Deployment with a RollingUpdate strategy uses a `maxUnavailable` of 25% and a `maxSurge` of 25%. When a new pod fails to start (e.g., CrashLoopBackOff or ImagePullBackOff), the ReplicaSet controller will not create additional new pods beyond the surge limit, and the update will effectively pause because the new ReplicaSet cannot reach its desired replica count. The old ReplicaSet remains running with its existing pods, ensuring availability is maintained.

Answer

The entire update is rolled back and all old pods are deleted

Answer

The Deployment automatically rolls back to the previous image

Answer

The failed pod is terminated and not retried

Question 9

Which component runs on every node and is responsible for maintaining network rules that allow communication to Pods from network endpoints?

Accepted Answer

kube-proxy. B is correct because kube-proxy is the component that runs on every node in a Kubernetes cluster and is responsible for maintaining network rules (e.g., iptables, IPVS, or userspace proxy) that allow network communication to Pods from network endpoints, both inside and outside the cluster. It implements the Kubernetes Service concept by managing the mapping of Service IPs to backend Pod IPs and performing load balancing.

Answer

kube-controller-manager

Answer

container runtime

Answer

kubelet

Question 10

Which TWO of the following are valid ways to expose a set of pods as a network service in Kubernetes?

Accepted Answer

Service of type NodePort. A Service of type NodePort exposes a set of pods on a static port on each node's IP address, making the service accessible from outside the cluster. This is a valid Kubernetes resource for exposing pods as a network service, as it creates a mapping from a node port to the ClusterIP and then to the target pods.

Answer

NetworkPolicy

Answer

Ingress resource

Answer

Deployment with replicas

Question 11

A Kubernetes Deployment manages a set of pods. What is the primary purpose of a Deployment?

Accepted Answer

To declare the desired state for a set of pods and manage rolling updates. A Deployment provides declarative updates for Pods and ReplicaSets, enabling rolling updates and rollbacks.

Answer

To store configuration data as key-value pairs

Answer

To run a batch job to completion

Answer

To expose a set of pods as a network service

Question 12

Which THREE of the following are core principles of immutable infrastructure? (Choose 3)

Accepted Answer

Rollbacks are performed by redeploying a previous image. Immutable infrastructure means that components are replaced, not modified. This ensures consistency, reliability, and easy rollbacks. Patching running instances is mutable.

Answer

Infrastructure is patched by applying updates to running servers

Answer

All changes are made by updating configuration files on running instances

Question 13

You want to deploy a stateless web application that should maintain 5 running instances at all times. You need to support rolling updates and rollbacks. Which Kubernetes resource is most appropriate?

Accepted Answer

Deployment. A Deployment is the correct choice because it is designed to manage stateless applications with a desired replica count (5 instances), supports rolling updates to update pods gradually without downtime, and enables rollbacks to a previous revision if an update fails. Deployments internally create ReplicaSets to manage pod scaling and versioning, making them ideal for stateless workloads requiring high availability and update flexibility.

Answer

DaemonSet

Answer

ReplicaSet

Answer

StatefulSet

Question 14

A team wants to deploy a multi-cloud application that uses cloud-specific services. Which pattern is most appropriate?

Accepted Answer

Using cloud-agnostic abstractions and infrastructure as code across providers. Using cloud-agnostic abstractions (e.g., Kubernetes for container orchestration, Terraform for infrastructure as code) allows the team to deploy across multiple clouds while still integrating cloud-specific services via provider-agnostic interfaces or abstraction layers. This pattern reduces vendor lock-in, enables consistent deployment workflows, and supports portability without sacrificing the ability to use unique services from each cloud provider.

Answer

Single-cloud vendor lock-in to reduce complexity

Answer

Manually managing each cloud separately without automation

Answer

Only using serverless functions from one provider

Question 15

Which kubectl command is used to create or update resources defined in a YAML file?

Accepted Answer

kubectl apply -f file.yaml. `kubectl apply -f file.yaml` uses a declarative approach to create or update Kubernetes resources. It sends the YAML configuration to the API server, which compares the desired state with the current state and applies the necessary changes, storing the last-applied configuration in an annotation for future updates.

Answer

kubectl update -f file.yaml

Answer

kubectl create -f file.yaml

Answer

kubectl set -f file.yaml