KCNA Practice Test 42 — 15 Questions

Question 1

What is the function of kube-proxy on a worker node?

Accepted Answer

It implements part of the Kubernetes Service concept by managing network rules. kube-proxy runs on each worker node and is responsible for implementing the Kubernetes Service abstraction by managing network rules (e.g., iptables, IPVS, or userspace mode). It watches the API server for Service and EndpointSlice changes and configures local packet filtering or forwarding rules to route traffic to the correct backend pods, enabling load balancing and service discovery.

Answer

It ensures the desired number of pods are running

Answer

It runs the container runtime

Answer

It reports node status to the control plane

Question 2

Which THREE of the following practices are essential for a secure cloud native CI/CD pipeline?

Accepted Answer

Sign container images and verify signatures during deployment. Signing container images (e.g., using Cosign or Notary) and verifying those signatures during deployment ensures that only trusted, unmodified images are deployed, preventing supply chain attacks. This practice enforces image integrity and provenance, which is a core security requirement for cloud native CI/CD pipelines.

Answer

Store secrets in plain text in the pipeline configuration

Answer

Use a single long-lived service account for all pipeline steps

Question 3

You have two pods in different namespaces that need to communicate using a stable IP address. Which Kubernetes object provides a stable endpoint for a set of pods?

Accepted Answer

Service. A Kubernetes Service provides a stable IP address and DNS name that remains constant regardless of pod restarts or rescheduling, enabling reliable communication between pods in different namespaces. Unlike pods, which have ephemeral IPs, a Service selects a set of pods via label selectors and load-balances traffic to them, ensuring a stable endpoint across namespace boundaries.

Answer

ConfigMap

Answer

Ingress

Answer

Deployment

Question 4

Which of the following is a correct apiVersion for a Deployment in a modern Kubernetes cluster (v1.19+)?

Accepted Answer

apiVersion: apps/v1. `apps/v1` is the stable API version for Deployments in Kubernetes v1.19+, replacing the deprecated `extensions/v1beta1` and `apps/v1beta1` versions. The `apps/v1` API group provides the full set of features for Deployments, including rolling updates, rollbacks, and scaling, and is required for production clusters running v1.19 or later.

Answer

apiVersion: extensions/v1beta1

Answer

apiVersion: v1

Answer

apiVersion: apps/v1beta1

Question 5

Which of the following is true about Kubernetes Namespaces?

Accepted Answer

Namespaces are used to logically isolate resources like pods and services. Kubernetes Namespaces provide a mechanism to logically isolate resources such as Pods, Services, and Deployments within a single cluster. They enable multi-tenancy by partitioning cluster resources among multiple users or teams, each operating within their own virtual cluster. This logical isolation does not include network segmentation by default, but it allows for resource quota enforcement and access control via RBAC.

Answer

Namespaces can be nested

Answer

Namespaces are required for all resources

Answer

Namespaces provide network isolation by default

Question 6

You need to store a database password securely and expose it to a Pod as an environment variable. Which Kubernetes resource should you use?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the value in base64 and can be injected into a Pod as an environment variable. Unlike ConfigMaps, Secrets are designed for confidential information and support optional encryption at rest when etcd is configured accordingly.

Answer

Service

Answer

PersistentVolumeClaim

Answer

ConfigMap

Question 7

A cluster administrator notices that a Deployment's pods are not receiving traffic as expected. The Service selector matches the pod labels. What is a possible cause?

Accepted Answer

The pods have a failing readiness probe. A failing readiness probe removes the pod's endpoint from the Service's EndpointSlice, so the Service stops routing traffic to that pod even though the pod is running and its labels match the Service selector. This is the most direct reason why a Deployment's pods would not receive traffic despite correct label matching.

Answer

The pods have a liveness probe that fails

Answer

The Deployment replicas are set to zero

Answer

The Service type is NodePort

Question 8

Which of the following kubectl commands would you use to apply a manifest file and also save it for later updates?

Accepted Answer

kubectl apply -f manifest.yaml. `kubectl apply` uses a declarative approach: it creates the resource if it doesn't exist and updates it if it does, while also storing the last-applied configuration as an annotation (`kubectl.kubernetes.io/last-applied-configuration`). This allows future `apply` calls to perform a three-way merge diff (current live state, last-applied config, and new manifest) to intelligently update the resource, making it the standard for managing manifests that need ongoing updates.

Answer

kubectl create -f manifest.yaml

Answer

kubectl patch -f manifest.yaml

Answer

kubectl replace -f manifest.yaml

Question 9

Which THREE of the following are valid Kubernetes resource types?

Accepted Answer

Deployment. Deployment is a core Kubernetes resource that manages the lifecycle of Pods and ReplicaSets, providing declarative updates, scaling, and rollback capabilities. It is one of the most commonly used workload resources in Kubernetes, making option B correct.

Answer

DockerImage

Answer

VirtualMachine

Question 10

You create a Deployment with 'replicas: 3' and update the pod template without changing the selector. After the update, you notice that only the new Pods are running, but old Pods have been terminated. What is the default update strategy?

Accepted Answer

RollingUpdate. The default update strategy for a Deployment in Kubernetes is RollingUpdate. When you update the pod template (e.g., changing the container image), the Deployment controller creates new ReplicaSets with the updated template and gradually scales down the old ReplicaSet while scaling up the new one, ensuring zero downtime. Since only new Pods are running and old Pods have been terminated, this confirms the default behavior of a rolling update, which replaces Pods incrementally without manual intervention.

Answer

OnDelete

Answer

BlueGreen

Answer

Recreate

Question 11

What is the purpose of a Service in Kubernetes?

Accepted Answer

To expose a set of pods as a network service with a stable endpoint. A Service in Kubernetes provides a stable network endpoint (IP address and DNS name) to access a set of Pods, which are ephemeral and can be created or destroyed dynamically. It decouples the client from the Pods' IPs by using label selectors to route traffic, enabling reliable communication within the cluster or externally. This is defined in the Kubernetes API as a Service resource, with types like ClusterIP, NodePort, and LoadBalancer.

Answer

To provide persistent storage volumes

Answer

To manage rolling updates of pods

Answer

To store configuration data as key-value pairs

Question 12

An application requires stable network identities and persistent storage. Which workload type should be used?

Accepted Answer

StatefulSet. StatefulSet is the correct workload type because it provides stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage (via PersistentVolumeClaims that persist across Pod rescheduling). This makes it ideal for stateful applications like databases, where each Pod requires a stable identity and dedicated storage that survives restarts.

Answer

Deployment

Answer

DaemonSet

Answer

Job

Question 13

You run 'kubectl get pods' and see a pod with status 'Pending'. Which is the most likely cause?

Accepted Answer

The scheduler cannot find a node that meets the pod's resource requirements. A pod with status 'Pending' indicates that the pod has been accepted by the cluster but is not yet running. The most common cause is that the Kubernetes scheduler cannot find a node that satisfies the pod's resource requests (CPU, memory) or other constraints (node selector, taints/tolerations, affinity rules). The scheduler continuously evaluates nodes and if none match, the pod remains in Pending state until a suitable node becomes available.

Answer

The pod's container has crashed

Answer

The container image is not found

Answer

The pod has been deleted by a controller

Question 14

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/4 nodes are available: 4 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod requires more memory than any node can allocate. The error message '0/4 nodes are available: 4 Insufficient memory' directly indicates that the pod's memory request exceeds the allocatable memory on every node in the cluster. The Kubernetes scheduler evaluates resource requests (spec.containers[].resources.requests.memory) against node capacity, and if no node can satisfy the request, the pod remains in Pending state.

Answer

All nodes have taints that the pod cannot tolerate

Answer

The pod's liveness probe is failing

Answer

The container image is not found

Question 15

Which TWO of the following are core principles of the 12-factor app? (Choose 2.)

Accepted Answer

Dependencies. The 12-factor app includes principles such as explicit dependency declaration (Dependencies) and strict separation of config from code (Config).

Answer

Shared state

Answer

Manual deployment

Answer

Singleton processes