KCNA Practice Test 43 — 15 Questions

Question 1

Which three of the following are valid methods to expose a Service to external traffic? (Select THREE)

Accepted Answer

Ingress. Ingress is correct because it provides HTTP/HTTPS routing rules to expose services externally, typically using a reverse proxy like NGINX or HAProxy. It operates at Layer 7 and can route traffic based on hostnames or paths to different services within the cluster, making it a valid method for external exposure.

Answer

ClusterIP

Answer

ExternalName

Question 2

Which two of the following are responsibilities of the kubelet? (Select TWO.)

Accepted Answer

Reporting the node's status to the control plane. The kubelet is the primary node agent that registers the node with the Kubernetes control plane and periodically reports the node's status, including conditions like Ready, DiskPressure, and MemoryPressure, via the NodeStatus API. This heartbeat mechanism allows the control plane to maintain an accurate view of cluster health and node availability.

Answer

Implementing network rules for services

Answer

Assigning pods to nodes based on resource availability

Answer

Storing cluster state in a key-value store

Question 3

Which component of the metrics-server provides resource metrics like CPU and memory usage?

Accepted Answer

metrics-server. The metrics-server collects resource metrics from kubelets and exposes them via the Metrics API.

Answer

kube-apiserver

Answer

kubelet

Answer

Prometheus

Question 4

What is the smallest deployable unit in Kubernetes that can be created and managed?

Accepted Answer

Pod. The Pod is the smallest and simplest unit in the Kubernetes object model, representing a single instance of a running process in the cluster. A Pod encapsulates one or more containers, shared storage, and a unique cluster IP, and it is the atomic unit of scheduling, scaling, and management. Deployments and Services are higher-level abstractions that manage Pods, not the smallest deployable unit themselves.

Answer

Deployment

Answer

Service

Answer

Container

Question 5

An application requires that configuration data be mounted as a file inside the container. The data may change at runtime, and the application should automatically read the updated values without restarting. Which approach should be used?

Accepted Answer

Use a ConfigMap mounted as a volume without subPath. Mounting a ConfigMap as a volume (without subPath) creates a symlink-based mount that automatically updates when the ConfigMap changes. The kubelet periodically syncs the ConfigMap data and updates the symlinks, allowing the application to read the new values without a restart. This satisfies the requirement for runtime configuration updates without container restart.

Answer

Store the configuration in a Secret and mount it using subPath

Answer

Use a PersistentVolumeClaim to store the configuration

Answer

Store the configuration in an environment variable from a ConfigMap

Question 6

Which component of the Kubernetes control plane is responsible for storing the cluster state?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as Kubernetes' primary data store, persisting all cluster state including configuration, secrets, and resource specifications. The kube-apiserver is the only component that interacts directly with etcd, ensuring consistency and providing a RESTful interface for all other components and users.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager

Question 7

You have a Namespace 'team-a' and you want to see all Pods in that namespace, including those that are not ready. Which command should you use?

Accepted Answer

kubectl get pods -n team-a. `kubectl get pods -n team-a` retrieves all Pods in the specified namespace, regardless of their readiness or status. By default, `kubectl get pods` shows all Pods, including those that are not ready, and the `-n` flag targets the namespace. No additional filters are needed to include non-ready Pods.

Answer

kubectl get pods -n team-a -l app=myapp

Answer

kubectl get pods --namespace=team-a --field-selector=status.phase!=Running

Answer

kubectl get pods --all-namespaces

Question 8

A CI pipeline scans container images for vulnerabilities. The scan report shows a critical vulnerability in a base image layer. What is the most efficient way to remediate this issue?

Accepted Answer

Update the base image to a patched version and rebuild the application image. Rebuilding the image with an updated base image that includes the security fix is the standard approach to address base image vulnerabilities.

Answer

Use a runtime security tool to block exploitation

Answer

Apply a security patch directly to the running container

Answer

Ignore the vulnerability if the application code is not affected

Question 9

You have a microservices application where Service A needs to discover the IP of Service B. Both services run in the same Kubernetes cluster. Which approach is the most Kubernetes-native way for Service A to reach Service B?

Accepted Answer

Use the Kubernetes DNS service to resolve the Service name 'service-b'. Kubernetes has a built-in DNS service (typically CoreDNS) that automatically creates DNS records for Services. When Service A resolves the name 'service-b' (or 'service-b.<namespace>.svc.cluster.local'), the DNS returns the cluster IP of Service B's Service object, which then load-balances traffic to the healthy Pods. This is the most Kubernetes-native approach because it leverages the platform's own service discovery mechanism without external dependencies.

Answer

Use an external service registry like Consul or etcd

Answer

Hardcode the cluster IP of Service B in the configuration of Service A

Answer

Use environment variables injected by the Kubernetes API into each pod

Question 10

What is the purpose of the Container Runtime Interface (CRI) in Kubernetes?

Accepted Answer

To allow kubelet to use different container runtimes. The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a variety of container runtimes without needing to recompile the Kubernetes source code. By defining a standard API (gRPC-based) for runtime operations like pulling images and managing containers, CRI decouples Kubernetes from specific runtime implementations such as containerd, CRI-O, or Docker (via dockershim). This abstraction allows cluster administrators to choose the most suitable runtime for their environment while maintaining compatibility with the Kubernetes control plane.

Answer

To manage persistent storage for containers

Answer

To provide a network plugin interface for pods

Answer

To define a standard for container images

Question 11

A Service of type ClusterIP is not resolving DNS names for pods. The pods are running and can communicate with each other via IP addresses. Which component should be checked first?

Accepted Answer

CoreDNS pods in the kube-system namespace. DNS name resolution for Services in Kubernetes is handled by CoreDNS, which runs as pods in the kube-system namespace. When a ClusterIP Service fails to resolve DNS names but pods can communicate via IP addresses, the issue is almost certainly with the DNS resolver itself, not with network connectivity or Service endpoints. CoreDNS must be checked first to ensure it is running, has correct configuration, and can query the Kubernetes API for Service records.

Answer

The kubelet on the node where the pod is running

Answer

The Service's endpoint slices

Answer

kube-proxy on the nodes

Question 12

A developer wants to expose a set of pods running a web application on a stable IP address. Which Kubernetes resource should they create?

Accepted Answer

Service. A Service in Kubernetes provides a stable IP address and DNS name to expose a set of pods, abstracting away pod IP changes due to scaling or restarts. It acts as a load balancer across the pods, typically using ClusterIP (default), NodePort, or LoadBalancer types. This directly meets the requirement of exposing pods on a stable IP.

Answer

ConfigMap

Answer

Ingress

Answer

NetworkPolicy

Question 13

Which command would you use to view the logs of a container named 'sidecar' inside a pod named 'app'?

Accepted Answer

kubectl logs app -c sidecar. The `kubectl logs` command uses the `-c` flag to specify a container name within a pod. When a pod contains multiple containers, you must explicitly indicate which container's logs to retrieve. The syntax `kubectl logs -c ` is the standard way to view logs from a specific container in a multi-container pod.

Answer

kubectl logs app sidecar

Answer

kubectl logs sidecar app

Answer

kubectl logs sidecar -p app

Question 14

A Pod is stuck in 'Pending' state. Which command is most helpful to diagnose the issue?

Accepted Answer

kubectl describe pod my-pod. 'kubectl describe pod my-pod' provides detailed information about the pod's current state, including events, conditions, and resource constraints. When a pod is stuck in 'Pending', it typically means the scheduler cannot place it on a node due to issues like insufficient CPU/memory, persistent volume claims not being bound, or node selector mismatches. The 'describe' command surfaces these specific reasons in the 'Events' section and 'Conditions' field, making it the most direct diagnostic tool.

Answer

kubectl logs my-pod

Answer

kubectl get events

Answer

kubectl top pod my-pod

Question 15

What is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. Containers are not directly scheduled onto Nodes; instead, Kubernetes always schedules and manages Pods as the atomic unit of deployment.

Answer

Node

Answer

Deployment

Answer

Container