KCNA Practice Test 38 — 15 Questions

Question 1

What is the primary benefit of containers over virtual machines?

Accepted Answer

Containers are more portable and lightweight because they share the host OS kernel. Containers are more portable and lightweight than virtual machines because they share the host OS kernel, eliminating the need for a separate guest OS per instance. This shared kernel approach reduces resource overhead (CPU, memory, and disk) and enables faster startup times, as containers only package the application and its dependencies without duplicating the operating system.

Answer

Containers provide stronger isolation than VMs

Answer

Containers use more disk space than VMs

Answer

Containers require a hypervisor to run

Question 2

What is the purpose of Alertmanager in Prometheus?

Accepted Answer

Handle alert notifications. Alertmanager is the component in the Prometheus ecosystem responsible for handling alerts fired by the Prometheus server. It deduplicates, groups, and routes alerts to configured notification channels such as email, PagerDuty, or Slack, ensuring that operators receive actionable notifications without alert fatigue.

Answer

Visualize metrics

Answer

Store long-term metrics

Answer

Collect metrics from targets

Question 3

Which component of Kubernetes is responsible for maintaining the desired state of the cluster?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller processes, which are responsible for regulating the state of the cluster. It continuously watches the current state via the kube-apiserver and takes corrective actions to match the desired state defined in the cluster's control loop, such as ensuring the correct number of pods are running.

Answer

kube-scheduler

Answer

kubelet

Answer

kube-apiserver

Question 4

Which CNCF project is at the 'Graduated' maturity level and is widely used for container orchestration?

Accepted Answer

Kubernetes. Kubernetes is the correct answer because it is the CNCF Graduated project specifically designed and widely adopted for container orchestration. It automates deployment, scaling, and management of containerized applications, making it the de facto standard in cloud-native environments. Note that Prometheus, Envoy, and Helm are also CNCF Graduated projects, but they serve different functions (monitoring, service proxy/networking, and package management respectively), not container orchestration.

Answer

Prometheus

Answer

Envoy

Answer

Helm

Question 5

You need to inspect the logs of a container named 'app' in a pod called 'web-1'. Which kubectl command should you use?

Accepted Answer

kubectl logs web-1 -c app. The `kubectl logs` command uses the `-c` flag to specify a container within a multi-container pod. The pod name must be specified first, followed by the container flag. Option A uses the long form `--container`, which is also valid syntax, but this single-choice question expects the short flag `-c` as the standard answer. Option C incorrectly places the container name as the first argument (kubectl logs app web-1). Option D uses the `-p` flag, which is for viewing logs of a previous container instance, not for selecting a container by name.

Answer

kubectl logs web-1 --container app

Answer

kubectl logs app web-1

Answer

kubectl logs -p web-1 app

Question 6

You need to run a batch job that processes data every hour and exits upon completion. Which Kubernetes resource should you use?

Accepted Answer

CronJob. The correct choice is CronJob. While a Job is designed to run a finite task to completion, the requirement to run 'every hour' indicates a recurring schedule. A CronJob creates Jobs on a specified schedule, so it is the appropriate resource to use. The Job itself will run and exit, but the CronJob manages the schedule.

Answer

Deployment

Answer

Job

Answer

DaemonSet

Question 7

A user wants to check the resource usage of Pods in a cluster. Which command should be used to display CPU and memory usage for all Pods in the default namespace?

Accepted Answer

kubectl top pods. The correct command is kubectl top pods, which retrieves CPU and memory usage metrics from the Metrics Server. This command is specifically designed for viewing resource consumption. The other options are either invalid commands or provide different types of information, such as configuration details or logs, but not live resource usage.

Answer

kubectl get pods --show-metrics

Answer

kubectl logs --metrics

Answer

kubectl describe pods

Question 8

Which TWO statements accurately describe Kubernetes scheduling?

Accepted Answer

The kube-scheduler is responsible for assigning pods to nodes based on resource availability and constraints.. The kube-scheduler is responsible for assigning pods to nodes based on resource availability and constraints. Node affinity allows a pod to specify preferred or required nodes for scheduling. Tolerations are applied to pods and allow the scheduler to schedule pods onto nodes with matching taints (though they do not guarantee scheduling). Taints are applied to nodes, not pods, to repel pods that do not tolerate them. A pod with no resource requests can be scheduled on any node with sufficient capacity, not necessarily the one with the most resources.

Answer

A pod with no resource requests will always be scheduled on the node with the most available resources.

Answer

Taints are applied to pods to prevent them from being scheduled on certain nodes.

Question 9

A developer wants to monitor the health of a Kubernetes deployment by checking if the number of ready replicas matches the desired replicas. Which metric from kube-state-metrics should they query?

Accepted Answer

kube_deployment_status_replicas_ready. `kube_deployment_status_replicas_ready` directly exposes the number of ready replicas for a Deployment, which can be compared against `kube_deployment_spec_replicas` to determine if the desired state matches the actual healthy state. This metric is emitted by kube-state-metrics, which generates Prometheus-compatible metrics from Kubernetes API objects, making it the standard choice for monitoring Deployment health.

Answer

kube_deployment_spec_replicas

Answer

kube_node_status_condition

Answer

kube_pod_container_status_running

Question 10

An administrator needs to grant a ServiceAccount in namespace 'dev' permission to list and watch Pods in the same namespace. Which combination of resources is required?

Accepted Answer

A Role and a RoleBinding in the 'dev' namespace. To grant a ServiceAccount permission to list and watch Pods in a single namespace, you create a Role in that namespace with the appropriate rules and bind it to the ServiceAccount using a RoleBinding. This follows the principle of least privilege, as the permissions are confined to the 'dev' namespace and do not extend cluster-wide.

Answer

A ClusterRole and a RoleBinding in the 'dev' namespace

Answer

A ClusterRole and a ClusterRoleBinding

Answer

A Role and a ClusterRoleBinding

Question 11

A Deployment has a strategy of RollingUpdate with maxSurge=1 and maxUnavailable=0. The Deployment manages 3 replicas. The image is updated. What happens during the update?

Accepted Answer

One new Pod is created, and once it is ready, one old Pod is terminated. This repeats until all Pods are updated.. The RollingUpdate strategy with maxSurge=1 and maxUnavailable=0 ensures that during the update, exactly one new Pod is created above the desired replica count (surge of 1) while keeping all existing Pods running (maxUnavailable=0). Once the new Pod reaches the Ready state, one old Pod is terminated, maintaining the desired 3 replicas throughout the process. This cycle repeats until all Pods are updated, guaranteeing zero downtime.

Answer

All 3 new Pods are created, and then the old ones are terminated all at once

Answer

All 3 old Pods are terminated simultaneously before new ones start

Answer

The update fails because maxUnavailable cannot be 0

Question 12

An application requires that a pod must not be scheduled on the same node as another pod from the same Deployment. Which configuration should be used?

Accepted Answer

Pod anti-affinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname. Pod anti-affinity with `requiredDuringSchedulingIgnoredDuringExecution` enforces a hard constraint that prevents two pods from the same Deployment from being scheduled on the same node. The `topologyKey: kubernetes.io/hostname` specifies that the anti-affinity rule applies at the node level, ensuring each pod is placed on a distinct host. This directly meets the requirement that a pod must not be scheduled on the same node as another pod from the same Deployment.

Answer

Node affinity with requiredDuringSchedulingIgnoredDuringExecution

Answer

Pod affinity with a preferredDuringSchedulingIgnoredDuringExecution

Answer

Taints and tolerations

Question 13

Which of the following best describes a key advantage of containers over virtual machines?

Accepted Answer

Containers share the host OS kernel, resulting in lower resource overhead compared to VMs. Containers share the host operating system kernel, which means they do not need to boot a separate kernel or emulate hardware. This shared kernel model eliminates the overhead of running a full guest OS per instance, resulting in significantly lower memory and CPU consumption compared to virtual machines, which each run a complete OS stack including a separate kernel.

Answer

Containers take longer to start than VMs because they need to initialize a kernel

Answer

Containers consume more disk space than VMs because they include a full operating system

Answer

Containers have stronger isolation than VMs because each container runs its own kernel

Question 14

Which TWO of the following are responsibilities of the kubelet? (Select 2)

Accepted Answer

Registering the node with the cluster and reporting node status. Option A is correct because the kubelet is the node agent that registers its node with the API server (via a Node object) and continuously reports node status, including conditions and capacity, through the node status heartbeat mechanism. Option B is correct because the kubelet watches for PodSpecs assigned to its node and ensures the described containers are started and running, performing liveness, readiness, and startup probes to maintain container health. Option C is incorrect because pod scheduling is the responsibility of the kube-scheduler, which selects nodes based on resource availability and constraints, not the kubelet. Option D is incorrect because Service iptables/IPVS rules are programmed by kube-proxy, not the kubelet. Option E is incorrect because cluster configuration data is stored in etcd, the cluster's key-value datastore, not managed by the kubelet.

Answer

Scheduling pods onto nodes based on resource availability

Answer

Creating and managing network iptables rules for Services

Answer

Storing cluster configuration data

Question 15

A developer wants to run a container image locally for testing before deploying to a Kubernetes cluster. Which tool is most appropriate for this task?

Accepted Answer

Docker. Docker is the most appropriate tool for running a container image locally because it is a container runtime that directly executes containers on a local machine using the OCI (Open Container Initiative) image specification. Unlike Kubernetes, which is designed for orchestrating containers across a cluster, Docker provides a simple `docker run` command to spin up a container from an image for testing purposes.

Answer

Ansible

Answer

Kubernetes

Answer

Terraform