KCNA Practice Test 38 — 15 Questions

Question 1

You are designing a microservices application that requires each service to be independently deployable and scalable. The services communicate over HTTP and need service discovery. Which orchestration feature BEST addresses the need for service discovery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Kubernetes Service. Kubernetes Service is the correct choice because it provides a stable network endpoint (IP address and DNS name) for a set of pods, enabling service discovery via DNS or environment variables. This allows microservices to locate and communicate with each other over HTTP without hardcoding IP addresses, which is essential for independent deployability and scalability.

Answer

Horizontal Pod Autoscaler

Answer

ConfigMap

Answer

PersistentVolume

Question 2

Which of the following patterns is used to improve resilience by isolating failures to a subset of components?

Accepted Answer

Bulkhead. The Bulkhead pattern (D) is correct because it isolates failures by partitioning resources (e.g., thread pools, connections) into separate pools for different components or services. This prevents a failure in one component from exhausting shared resources and cascading to others, directly improving resilience by containing the blast radius.

Answer

Timeout

Answer

Retry

Answer

Circuit breaker

Question 3

What is the Container Runtime Interface (CRI)?

Accepted Answer

An API between kubelet and container runtime. The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a variety of container runtimes without needing to recompile the kubelet. It defines a gRPC API (protocol buffers) for the kubelet to communicate with the container runtime, covering operations like pod lifecycle management and image management. Option D correctly identifies this as the API between the kubelet and the container runtime.

Answer

A tool for building container images

Answer

A standard for container runtime logs

Answer

A specification for container images

Question 4

A pod spec includes a liveness probe that runs 'cat /tmp/healthy'. The probe is configured with initialDelaySeconds: 10, periodSeconds: 5. At what point does the kubelet first execute the probe?

Accepted Answer

10 seconds after the container starts. The kubelet first executes the liveness probe 10 seconds after the container starts because `initialDelaySeconds: 10` tells the kubelet to wait that long before initiating the first probe. The `periodSeconds: 5` only defines the interval between subsequent probes, not the initial delay. This ensures the container has time to start and create the `/tmp/healthy` file before being checked.

Answer

Immediately after the pod is created

Answer

Only when the container is unhealthy

Answer

5 seconds after the container starts

Question 5

What is the primary purpose of the Open Container Initiative (OCI)?

Accepted Answer

To standardize container image and runtime specifications. The Open Container Initiative (OCI) is an open governance structure that standardizes container image and runtime specifications. It ensures that any OCI-compliant image can run on any OCI-compliant runtime, promoting interoperability across the container ecosystem. This is the core purpose, not to provide a specific runtime or orchestration tool.

Answer

To provide a container runtime called Docker

Answer

To create a container orchestration platform

Answer

To define the Kubernetes Container Runtime Interface (CRI)

Question 6

Which TWO statements about container images are correct? (Choose two.)

Accepted Answer

Each layer is identified by a unique hash. Each layer in a container image is identified by a unique content-addressable hash (typically a SHA-256 digest). This hash is computed from the layer's contents and metadata, ensuring integrity and enabling layer caching and deduplication across images. The hash is used in the image manifest (as defined by the OCI Image Specification) to reference each layer uniquely.

Answer

Images are always pulled from a private registry

Answer

Images can be modified at runtime by writing to the container layer

Answer

Images are stored on the host filesystem after being pulled

Question 7

A developer wants to inject environment variables into a pod from a ConfigMap named 'app-config'. Which YAML snippet correctly mounts all key-value pairs from the ConfigMap as environment variables?

Accepted Answer

envFrom:
  - configMapRef:
      name: app-config. `envFrom` with a `configMapRef` injects all key-value pairs from the ConfigMap named 'app-config' as environment variables into the container. This is the standard Kubernetes method for bulk injection of ConfigMap data into environment variables, as opposed to selecting individual keys.

Answer

env:
  - name: CONFIG
    value: "$(CONFIGMAP)"

Answer

volumes:
  - name: config
    configMap:
      name: app-config
    volumeMounts:
      - name: config
        mountPath: /etc/config

Answer

env:
  - name: CONFIG
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: config.yaml

Question 8

A DevOps team notices that a new deployment of a web application is not receiving traffic even though the pods are running. The deployment has a selector matching the pod labels, and a Service of type ClusterIP exists. What is the most likely cause?

Accepted Answer

The Service's targetPort does not match the container's containerPort.. The most likely cause is that the Service's targetPort does not match the container's containerPort. In Kubernetes, a Service routes traffic to pods by forwarding packets to the port specified in the Service's `targetPort` field. If this does not match the `containerPort` defined in the pod's container spec, the traffic will be dropped because the kube-proxy will forward packets to a closed port on the pod, resulting in no connectivity even though the pods are running.

Answer

The pods do not have a readiness probe defined.

Answer

The Service type should be NodePort to receive traffic.

Answer

The Service is not exposed via an Ingress.

Question 9

A Kubernetes cluster has a single control plane node and two worker nodes. The control plane node fails. What is the immediate impact on the workloads running on the worker nodes?

Accepted Answer

Existing workloads continue running, but no new pods can be scheduled. In Kubernetes, the control plane is responsible for scheduling new pods and maintaining desired state via the API server, controller manager, and scheduler. When the control plane fails, the kubelets on worker nodes continue to run existing pods based on their local state, but the scheduler cannot assign new pods to nodes, and the API server is unavailable for updates or scaling operations.

Answer

All workloads will stop immediately

Answer

The kubelet on worker nodes will restart all pods

Answer

Workloads will be automatically migrated to another cluster

Question 10

A developer wants to run a one-time batch job that processes a queue and then terminates. Which Kubernetes resource should they use?

Accepted Answer

Job. A Kubernetes Job is designed for finite, batch-oriented tasks that run to completion, such as processing a queue and then terminating. Unlike controllers that maintain a desired state (like Deployments or StatefulSets), a Job creates one or more Pods and ensures they successfully exit, making it the correct choice for a one-time batch job.

Answer

StatefulSet

Answer

Deployment

Answer

DaemonSet

Question 11

Refer to the exhibit. A pod 'my-pod' shows repeated 'BackOff' events after the container starts. Which is the most likely cause?

Accepted Answer

The application crashes shortly after starting.. The 'BackOff' event in Kubernetes indicates that the container has started but repeatedly crashes, causing the kubelet to increase the restart delay. Option D is correct because an application that crashes shortly after starting will trigger this restart loop, as the container exits with a non-zero exit code, leading to exponential backoff.

Answer

The image 'myapp:v2' does not exist.

Answer

The container exceeds its memory limit.

Answer

The liveness probe is failing.

Question 12

You have a microservices application where Service A needs to communicate with Service B running in a different namespace ('backend'). Both namespaces have a NetworkPolicy that denies all ingress by default. You create a NetworkPolicy in the 'backend' namespace allowing ingress from pods with label 'app: frontend'. What else is needed for Service A to reach Service B?

Accepted Answer

Add a label to the 'default' namespace matching the NetworkPolicy's namespaceSelector. A NetworkPolicy with only a podSelector in an ingress rule matches pods in the same namespace only. To allow cross-namespace traffic, you must include a namespaceSelector that selects the namespace of the source pods. By adding a label to the 'default' namespace and including a namespaceSelector matching that label in the NetworkPolicy, you enable Service A's pods to be allowed. Ensure Service A's pod also has the required label 'app: frontend'. Option A is wrong: a podSelector alone only matches pods in the same namespace. Option B is wrong: egress policies are not needed for inbound traffic. Option C is too permissive and unnecessary.

Answer

Ensure Service A's pod has the label 'app: frontend' on its pod spec

Answer

Add a similar NetworkPolicy in the 'default' namespace allowing egress to the 'backend' namespace

Answer

Change the NetworkPolicy to allow all ingress traffic from any source

Question 13

What does the 'kubectl get pods' command display?

Accepted Answer

A list of all pods in the current namespace. The 'kubectl get pods' command lists all pods in the current namespace, providing a summary of their status, restarts, and age. This is the default behavior without specifying a namespace or pod name, making it the primary command for pod discovery and health checks.

Answer

Detailed information about a specific pod

Answer

The YAML definition of a pod

Answer

The logs of all pods

Question 14

In OpenTelemetry, what is the purpose of the Collector component?

Accepted Answer

Receive, process, and export telemetry data. The OpenTelemetry Collector is a vendor-agnostic agent or gateway that receives telemetry data (traces, metrics, logs) from instrumented applications, processes it (e.g., batching, filtering, sampling), and exports it to one or more backends (e.g., Jaeger, Prometheus, or any OTLP-compatible system). It decouples data generation from data export, enabling flexible pipeline management without modifying application code.

Answer

Instrument code automatically

Answer

Visualize traces and metrics

Answer

Aggregate logs from multiple sources

Question 15

Which TWO statements about Kubernetes namespaces are true?

Accepted Answer

Namespaces are used to divide cluster resources between multiple users or teams.. Namespaces are a fundamental mechanism in Kubernetes for dividing cluster resources among multiple users or teams, enabling multi-tenancy and resource management through policies like Role-Based Access Control (RBAC) and ResourceQuotas. Option E is correct because ResourceQuotas are Kubernetes objects that can be applied to a namespace to enforce aggregate limits on CPU, memory, and other resources, preventing any single team from exhausting cluster capacity.

Answer

All Kubernetes objects are namespaced.

Answer

Namespaces automatically isolate services in different namespaces from communicating.

Answer

Namespaces provide network isolation between pods by default.