KCNA Practice Test 37 — 15 Questions

Question 1

You have a Kubernetes cluster with multiple nodes. You need to ensure that a pod runs on a node that has an SSD. How should you achieve this?

Accepted Answer

Use a nodeSelector with the label 'disktype: ssd'. NodeSelector is the simplest and most direct way to constrain a Pod to run only on nodes that have a specific label, such as 'disktype=ssd'. When you add a nodeSelector field to the Pod spec, the kube-scheduler filters nodes that do not have the matching label, ensuring the Pod lands on a node with an SSD.

Answer

Manually edit kube-scheduler configuration

Answer

Use a DaemonSet to run the pod on all nodes

Answer

Use a toleration for the node

Question 2

Which Kubernetes object can be used to store sensitive data, such as passwords or API keys, and inject them into pods?

Accepted Answer

Secret. A Secret is the dedicated Kubernetes object for storing sensitive data like passwords, API keys, and tokens. Secrets store data as base64-encoded strings and can be injected into pods as environment variables or mounted as volumes, with optional encryption at rest via etcd or KMS.

Answer

PersistentVolume

Answer

ServiceAccount

Answer

ConfigMap

Question 3

Which of the following is a key principle of the 12-factor app methodology?

Accepted Answer

Treat logs as event streams. The 12-factor app includes the principle of treating logs as event streams, not as files.

Answer

Bind services at build time

Answer

Use local disk storage for persistence

Answer

Store configuration in the codebase

Question 4

Which command would you run to get a list of all pods in all namespaces?

Accepted Answer

kubectl get pods --all-namespaces. `kubectl get pods --all-namespaces` (or its shorthand `-A`) retrieves pods from every namespace in the cluster. This flag overrides the default behavior of `kubectl get pods`, which only returns pods in the current namespace (usually `default`).

Answer

kubectl get pods --namespace=*

Answer

kubectl get pods --global

Answer

kubectl get pods --include-uninitialized

Question 5

Which TWO of the following are true about Kubernetes Pods?

Accepted Answer

A pod is the smallest deployable unit in Kubernetes. Option B is correct because the Pod is the smallest deployable unit in Kubernetes — you cannot deploy a bare container directly; the kubelet schedules and runs Pods, and every workload object (Deployment, StatefulSet, Job, etc.) ultimately creates Pods. Option C is correct because containers within a single Pod share the same network namespace, meaning they share one IP address and can communicate over localhost, and they can also share volumes for data exchange. Option A is wrong because containers in a Pod can share volumes and, when configured, share process namespace; filesystem isolation is not guaranteed across all containers. Option D is wrong because Pods are ephemeral by design — they are terminated, deleted, or replaced (e.g., by a ReplicaSet) and are not intended to be long-lived. Option E is wrong because the Pod, not each container, is assigned a single IP address; all containers in the Pod share that one IP.

Answer

Containers in a pod always have isolated filesystems

Answer

Pods are designed to be long-lived and never terminated

Answer

Each container in a pod gets its own IP address

Question 6

You need to deploy an application that requires exactly one pod per cluster node for logging purposes. Which Kubernetes workload resource should you use?

Accepted Answer

DaemonSet. A DaemonSet ensures that a copy of a pod runs on every node in the cluster, or on a subset of nodes if a node selector is used. This is the correct resource for deploying a logging agent that must be present on each node to collect logs from that node's containers and system components.

Answer

Job

Answer

StatefulSet

Answer

Deployment

Question 7

In a blue-green deployment strategy, at any given time, only one environment (blue or green) is active. What is the primary advantage of this approach?

Accepted Answer

Instant rollback by switching traffic back to the previous environment. Blue-green deployments allow instant rollback by switching traffic back to the previous environment. This is the primary advantage: if issues arise in the new version, you can immediately revert by pointing the router/load balancer to the old environment. Option A describes gradual traffic shifting, which is characteristic of canary deployments, not blue-green. Option C is incorrect because blue-green requires two full environments, doubling resource consumption. Option D is false because a load balancer or ingress controller is essential to switch traffic between the two environments.

Answer

Gradual traffic shifting to detect issues early

Answer

Minimal resource consumption by using only one environment

Answer

No need for load balancers or ingress controllers

Question 8

Drag and drop the steps for a rolling update of a Kubernetes Deployment into the correct order.

Accepted Answer

1. Change the image, 2. Apply the change, 3. Monitor the rollout, 4. Verify the health, 5. Rollback if issues. Change the image, apply, monitor rollout, verify health, and rollback if issues arise.

Answer

1. Change the image, 2. Monitor the rollout, 3. Apply the change, 4. Verify the health, 5. Rollback if issues

Answer

1. Apply the change, 2. Change the image, 3. Monitor the rollout, 4. Verify the health, 5. Rollback if issues

Answer

1. Change the image, 2. Apply the change, 3. Verify the health, 4. Monitor the rollout, 5. Rollback if issues

Question 9

Drag and drop the steps to perform a backup of etcd in a Kubernetes cluster into the correct order.

Accepted Answer

Access the node, Save snapshot, Verify, Store securely. Access the node, save snapshot, verify, store securely, and restore when necessary.

Answer

Save snapshot, Verify, Access the node, Store securely

Answer

Access the node, Store securely, Save snapshot, Verify

Answer

Verify, Access the node, Save snapshot, Store securely

Question 10

Which TWO are pillars of observability? (Select two.)

Accepted Answer

Logs. Logs and Metrics are two of the three pillars of observability (alongside Traces). Logs provide immutable, timestamped records of discrete events, while Metrics are numeric aggregations of data over time (e.g., Prometheus counters, histograms). Together they form the foundation for understanding system behavior in cloud-native environments.

Answer

SLIs

Answer

Alerting

Answer

Dashboards

Question 11

What is a primary benefit of using containers over virtual machines?

Accepted Answer

Containers are lightweight and share the host OS kernel. Containers virtualize at the operating system level, sharing the host OS kernel while running in isolated user-space instances. This eliminates the need for a full guest OS per workload, making containers significantly more lightweight in terms of memory, disk usage, and startup time compared to virtual machines, which each require a separate kernel and hypervisor.

Answer

Containers provide stronger isolation than VMs

Answer

Containers can run any operating system kernel

Answer

Containers require a hypervisor to run

Question 12

Which THREE statements about Kubernetes Namespaces are correct?

Accepted Answer

Namespaces provide a way to divide cluster resources between multiple users or teams.. Option A is correct because Kubernetes Namespaces are designed as a logical partitioning mechanism that lets a single physical cluster be shared among multiple users, teams, or projects, scoping names and resource usage per group. Option D is correct because deleting a Namespace triggers cascading deletion of all namespaced objects contained in it (e.g., Pods, Services, ConfigMaps), so the namespace and its contents are removed together. Option E is correct because ResourceQuota objects are applied at the namespace scope to cap aggregate consumption of resources such as CPU, memory, and object counts within that namespace. Option B is incorrect because many resources are cluster-scoped and cannot live in a namespace, such as Nodes, PersistentVolumes, ClusterRoles, and StorageClasses. Option C is incorrect because namespaces do not enforce network isolation by default; without a NetworkPolicy, pods in different namespaces can communicate freely, so isolation must be explicitly configured.

Answer

All Kubernetes resources must be created within a namespace.

Answer

Namespaces provide network isolation by default.

Question 13

Which TWO of the following tools are commonly used for distributed tracing in cloud-native environments? (Select two.)

Accepted Answer

Zipkin. Zipkin (A) is correct because it is a dedicated distributed tracing system that collects and visualizes latency data across microservice call chains using trace and span IDs propagated via headers such as B3. Jaeger (C) is also correct because it is a CNCF-graduated distributed tracing platform that instruments requests across services, supports OpenTracing/OpenTelemetry, and provides trace storage and a UI for span analysis. Grafana (B) is primarily a visualization and dashboarding layer that can query tracing backends but is not itself a tracing system. Fluentd (D) is a log collection and forwarding agent, and Prometheus (E) is a metrics monitoring and time-series database, neither of which performs distributed request tracing.

Answer

Grafana

Answer

Fluentd

Answer

Prometheus

Question 14

Which command is used to view detailed information about a specific pod?

Accepted Answer

kubectl describe pod. The `kubectl describe pod` command retrieves detailed information about a specific pod, including its current state, events, labels, annotations, container details, resource limits, and volume mounts. This is the standard Kubernetes command for inspecting the full configuration and lifecycle of a pod object, as opposed to the summary view provided by `kubectl get pod`.

Answer

kubectl exec pod -- /bin/sh

Answer

kubectl logs pod

Answer

kubectl get pod

Question 15

Which THREE of the following are core principles of immutable infrastructure? (Choose 3)

Accepted Answer

Rollbacks are performed by redeploying a previous image. Option A is correct because in immutable infrastructure you never repair a running instance; to roll back you simply redeploy the previously built and validated image (e.g., a prior AMI, container image tag, or VM template), which restores the known-good state deterministically. Option C is correct because the defining rule of immutability is that once an instance or component is deployed it is never modified in place — no SSH patching, no config edits — so any change requires replacing it with a new artifact. Option D is correct because immutable patterns rely on versioned, codified artifacts (e.g., Packer-built images, IaC templates, container registries) so that the same build produces identical, reproducible deployments across environments. Option B is not correct because patching running servers is the mutable, in-place model that immutable infrastructure explicitly rejects. Option E is not correct because editing configuration files on running instances is also an in-place mutation, whereas immutable practice bakes configuration into a new image and redeploys it.

Answer

Infrastructure is patched by applying updates to running servers

Answer

All changes are made by updating configuration files on running instances