KCNA Practice Test 41 — 15 Questions

Question 1

A cloud-native application is designed with multiple microservices that need to handle a sudden spike in traffic without manual intervention. Which Kubernetes feature best enables this?

Accepted Answer

HorizontalPodAutoscaler. The HorizontalPodAutoscaler (HPA) automatically scales the number of pod replicas in a deployment based on observed CPU/memory utilization or custom metrics. This directly addresses the need to handle a sudden traffic spike without manual intervention by adding more pod instances to distribute the load.

Answer

VerticalPodAutoscaler

Answer

Cluster Autoscaler

Answer

PodDisruptionBudget

Question 2

Which TWO of the following are characteristics of a Kubernetes Pod?

Accepted Answer

Pods are the smallest deployable units in Kubernetes. B is correct because Pods are the smallest and most fundamental deployable units in Kubernetes, representing a single instance of a running process in the cluster. A Pod encapsulates one or more containers, storage resources, and a unique network IP, and is the atomic unit of scheduling. This is defined in the Kubernetes core API and is a foundational concept for the KCNA exam.

Answer

Pods can only run a single container

Answer

Pods are designed to be long-lived and rarely replaced

Answer

Pods are typically replicated by a Deployment or ReplicaSet

Question 3

Match each Kubernetes command (kubectl) to its primary function.

Accepted Answer

kubectl get: List one or more resources. The correct matches are: kubectl get for listing resources, kubectl describe for detailed info, and kubectl apply for applying configurations. Common confusions include swapping the functions of kubectl delete and kubectl logs.

Answer

kubectl delete: Print logs for a container in a pod

Answer

kubectl logs: Delete resources

Question 4

Which TWO of the following are true about service discovery in Kubernetes? (Choose 2)

Accepted Answer

Environment variables are injected into pods for each Service. Kubernetes provides DNS-based service discovery, where Services get DNS names resolved by CoreDNS. Services also have environment variables injected into pods. Headless Services do not provide a single IP; they return the pod IPs. Ingress is for external traffic, not internal service discovery.

Answer

Ingress resources can be used for internal service discovery

Answer

Service discovery is only available for pods on the same node

Answer

Headless Services provide a stable virtual IP for service discovery

Question 5

You want to ensure that a Pod runs on every Node in the cluster. Which resource should you use?

Accepted Answer

DaemonSet. A DaemonSet ensures that a copy of a Pod runs on every Node in the cluster, including when new Nodes are added. This is the correct resource for cluster-wide services like log collectors, monitoring agents, or kube-proxy, as it automatically schedules a Pod on each Node and respects node taints and tolerations.

Answer

Deployment

Answer

ReplicaSet

Answer

StatefulSet

Question 6

Which of the following correctly describes the concept of 'immutable infrastructure' in the context of container orchestration?

Accepted Answer

Infrastructure components are recreated from a known good state rather than modified. Immutable infrastructure means that once a container image is built, it is never modified; updates are done by replacing the entire container with a new image.

Answer

Configuration changes are applied via SSH into running containers

Answer

Servers are never rebooted

Answer

Container images are updated in-place by patching existing layers

Question 7

You create a Service of type ClusterIP in the 'default' namespace. You try to reach the Service from a pod in the 'production' namespace using the service name. The connection fails. What is the most likely reason?

Accepted Answer

The pod cannot resolve the DNS name because service DNS names are only resolvable within the same namespace. By default, Kubernetes DNS resolves Service names only within the same namespace. A Service named 'my-svc' in the 'default' namespace is resolvable as 'my-svc' only from pods in the 'default' namespace. From a pod in the 'production' namespace, the DNS name must be fully qualified as 'my-svc.default.svc.cluster.local' to be resolved, otherwise the DNS lookup fails, causing the connection to fail.

Answer

Cross-namespace service access is not allowed by default

Answer

The service has no endpoints

Answer

The service port is not correctly configured

Question 8

Which component is responsible for ensuring that containers are running as specified in a Pod's specification on a node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each node in a Kubernetes cluster. It is responsible for ensuring that containers described in Pod specifications (PodSpecs) are running and healthy. The kubelet watches for Pod assignments from the API server, creates or terminates containers via the container runtime, and continuously reports the node and Pod status back to the control plane.

Answer

Container runtime

Answer

kube-proxy

Answer

kube-scheduler

Question 9

You want to update a Deployment's container image from 'nginx:1.20' to 'nginx:1.21' and record the change. Which kubectl command should you use?

Accepted Answer

kubectl set image deployment/nginx nginx=nginx:1.21 --record. The `kubectl set image` command directly updates the container image of a specified deployment, and the `--record` flag annotates the change in the rollout history, allowing you to track the change for auditing or rollback purposes. This is the most efficient way to update the image and record the change without editing the full deployment manifest or reapplying a file.

Answer

kubectl edit deployment nginx

Answer

kubectl apply -f deployment.yaml

Answer

kubectl set image deployment/nginx nginx=nginx:1.21

Question 10

Which TWO of the following are true about container networking basics? (Choose 2)

Accepted Answer

Containers on the same host can communicate via a bridge network. Containers utilize network namespaces to isolate their network stack, so each container has its own network namespace (C). On the same host, containers can communicate through a bridge network, which provides connectivity via a virtual switch (B). Option A is false because containers on different nodes can communicate via overlay networks or routing. Option D is false because container networking typically requires configuration (e.g., Docker's bridge or CNI plugins). Option E is false because containers usually have their own IP addresses within the bridge network, not sharing the host's IP directly.

Answer

Containers can only communicate if they are on the same node

Answer

Container networking does not require any configuration

Answer

All containers share the host's IP address

Question 11

A company wants to adopt a GitOps workflow for managing their Kubernetes clusters. Which two tools are specifically designed for implementing GitOps on Kubernetes?

Accepted Answer

Flux. ArgoCD and Flux are both CNCF projects that implement GitOps principles, synchronizing cluster state with a Git repository. Helm is a package manager, Terraform is for infrastructure provisioning (not strictly GitOps for Kubernetes), and Jenkins is a CI/CD tool that can be used with GitOps but is not purpose-built for it.

Answer

Terraform

Answer

Jenkins

Answer

Helm

Question 12

A cluster administrator wants to ensure that a specific pod only runs on nodes that have an SSD for local storage. The nodes with SSDs have the label 'disk-type: ssd'. How should the administrator configure the pod to enforce this constraint?

Accepted Answer

Add a nodeSelector with 'disk-type: ssd' to the pod spec. The `nodeSelector` field in a Pod spec is the standard Kubernetes mechanism for constraining a Pod to run only on nodes that match specific labels. By setting `nodeSelector: { disk-type: ssd }`, the scheduler will ensure the Pod is placed exclusively on nodes with that label, enforcing the administrator's requirement.

Answer

Add a toleration for node.kubernetes.io/disk-type: ssd

Answer

Use a readiness probe to check for SSD

Answer

Add an annotation 'disk-type: ssd' to the pod

Question 13

What is the purpose of the Container Runtime Interface (CRI) in Kubernetes?

Accepted Answer

To allow kubelet to use different container runtimes without modifying its code. The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a wide variety of container runtimes without requiring changes to the core Kubernetes code. By defining a standard set of gRPC APIs for runtime operations (like pod and container lifecycle management), CRI decouples the kubelet from any specific runtime implementation, allowing runtimes like containerd, CRI-O, and Docker (via dockershim, now deprecated) to be used interchangeably.

Answer

To replace Docker as the only supported runtime

Answer

To define the format of container images

Answer

To provide a standard API for managing containers across different orchestration platforms

Question 14

What is the purpose of a circuit breaker pattern in microservices?

Accepted Answer

To stop cascading failures by preventing calls to a failing service. The circuit breaker pattern prevents an application from repeatedly trying to execute an operation that is likely to fail, allowing it to recover gracefully.

Answer

To distribute traffic across multiple instances

Answer

To encrypt communication between services

Answer

To automatically retry failed requests

Question 15

A Kubernetes cluster has a Service named 'my-svc' in the 'default' namespace. Which command would correctly expose this service as an external endpoint using a cloud load balancer?

Accepted Answer

kubectl expose service my-svc --type=LoadBalancer --name=my-svc-lb. `kubectl expose service my-svc --type=LoadBalancer --name=my-svc-lb` creates a new Service of type LoadBalancer that inherits the selector and port configuration from the existing 'my-svc' Service, which provisions a cloud load balancer (e.g., AWS ELB, GCP TCP/UDP LB) to expose it externally. The `--type=LoadBalancer` flag is essential to request a cloud load balancer, and `--name` specifies the new Service's name to avoid overwriting the original.

Answer

kubectl expose deployment my-svc --type=LoadBalancer --name=my-svc-lb

Answer

kubectl expose service my-svc --name=my-svc-lb

Answer

kubectl expose service my-svc --port=80 --target-port=8080