KCNA Practice Test 45 — 15 Questions

Question 1

A ClusterIP Service named 'db-service' in namespace 'prod' selects pods with label 'app: database'. A pod in the same cluster needs to reach this service using DNS. What is the fully qualified domain name (FQDN) for the service?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

db-service.prod.svc.cluster.local. The correct FQDN for a Kubernetes Service follows the pattern ..svc.cluster.local. Since the 'db-service' ClusterIP Service is in the 'prod' namespace, the FQDN is 'db-service.prod.svc.cluster.local'. This allows any pod in the cluster to resolve the service's cluster IP via DNS, using the cluster domain 'cluster.local' by default.

Answer

db-service.cluster.local

Answer

db-service.svc.cluster.local

Answer

db-service.prod.cluster.local

Question 2

Which TWO statements about containers compared to virtual machines are correct? (Select 2)

Accepted Answer

Containers have lower overhead than virtual machines. Options A and B are correct. Containers have lower overhead than virtual machines because they do not require a separate guest OS per instance, making them more lightweight. Containers share the host OS kernel, which allows them to be efficient and portable. In contrast, each virtual machine includes a full guest OS running on top of a hypervisor, leading to higher resource usage. Option C is false because virtual machines have their own kernel, not shared with the host. Option D is false because containers share the host kernel and do not run their own OS kernel. Option E is false because virtual machines provide stronger isolation due to hardware virtualization.

Answer

Virtual machines share the host OS kernel

Answer

Each container runs its own operating system kernel

Answer

Virtual machines provide weaker isolation than containers

Question 3

Which CNCF project is classified as a 'graduated' project?

Accepted Answer

Linkerd. Linkerd is a graduated CNCF project. K3s is in the CNCF sandbox, while Knative and Backstage are incubating projects.

Answer

K3s

Answer

Knative

Answer

Backstage

Question 4

Which TWO of the following are Prometheus metric types? (Select two.)

Accepted Answer

Gauge. Prometheus metric types include Counter, Gauge, Histogram, and Summary. The correct answers are B (Gauge) and D (Counter). Options A (Event), C (Set), and E (Timer) are not Prometheus metric types.

Answer

Event

Answer

Set

Answer

Timer

Question 5

Which THREE of the following are benefits of using a service mesh in a cloud native architecture?

Accepted Answer

Traffic management capabilities like canary deployments. Options B, D, and E are correct. A service mesh provides traffic management capabilities (e.g., canary deployments, routing, load balancing), security features like mutual TLS encryption (mTLS), and enhanced observability through metrics and tracing. Option A (management of application state across services) is not a function of a service mesh; state management is handled by other tools like databases or stateful frameworks. Option C (reduction of container image sizes) is unrelated to service mesh; image size is affected by base images and application dependencies.

Answer

Management of application state across services

Answer

Reduction of container image sizes

Question 6

Which THREE of the following are core components of Flux?

Accepted Answer

Source controller. Flux has a source-controller that manages artifact sources (e.g., Git repositories), a kustomize-controller that applies Kustomize overlays, and a helm-controller for Helm releases. The gitops-controller is not a specific Flux component (it's a generic term), and the notification-controller is not a core component (it's a separate controller for events).

Answer

Notification controller

Answer

GitOps controller

Question 7

A Kubernetes cluster has a Deployment running three replicas of an application. You need to update the container image to a new version with zero downtime. Which approach is most appropriate?

Accepted Answer

Use 'kubectl set image deployment/ =' to trigger a rolling update. `kubectl set image deployment/ =` triggers a rolling update, which is the default update strategy for Deployments. This gradually replaces old pods with new ones, ensuring that the desired number of replicas is always available, thus achieving zero downtime.

Answer

Manually delete each pod and rely on the ReplicaSet to recreate them with the new image

Answer

Delete the Deployment and recreate it with the new image

Answer

Scale the Deployment to zero and then scale back up with the new image

Question 8

Which of the following is a valid use case for a DaemonSet?

Accepted Answer

Running a logging agent on every node. A DaemonSet ensures that a copy of a pod runs on all (or a subset of) nodes in the cluster. This is ideal for infrastructure pods like logging agents (e.g., Fluentd), monitoring agents (e.g., Prometheus Node Exporter), or kube-proxy, which must be present on every node to collect logs or enforce network rules. Option D directly matches this use case.

Answer

Running a batch job that must complete once

Answer

Running a stateless web application with multiple replicas

Answer

Running a stateful application with persistent storage

Question 9

Which TWO of the following are valid reasons that a PersistentVolumeClaim (PVC) may remain in 'Pending' state?

Accepted Answer

No PersistentVolume exists that matches the PVC's storage class and size requirements. A PersistentVolumeClaim (PVC) stays in 'Pending' state until a suitable PersistentVolume (PV) is available to bind. Two common reasons are: (1) No existing PV matches the PVC's storage class and size requirements (static provisioning failure), and (2) The PVC references a StorageClass that does not exist, preventing dynamic provisioning. Other reasons like pod scheduling or dynamic provisioner unavailability are not among the two correct answers.

Answer

The pod that references the PVC is not scheduled yet

Answer

The PVC's access mode is 'ReadWriteMany' but the underlying storage only supports 'ReadWriteOnce'

Answer

The cluster's dynamic provisioner is unavailable or misconfigured

Question 10

Which TWO of the following are key principles of cloud native architecture?

Accepted Answer

Infrastructure automation. Infrastructure automation (B) is a key principle of cloud native architecture because it enables consistent, repeatable, and error-free provisioning and management of infrastructure through code (e.g., Terraform, AWS CloudFormation, Ansible). This aligns with the cloud native goal of reducing manual toil and enabling rapid, reliable deployments. Microservices (C) is also a core principle, as it structures applications as a collection of loosely coupled, independently deployable services that can be scaled and updated individually, which is fundamental to cloud native agility and resilience.

Answer

Immutable infrastructure

Answer

Monolithic design

Answer

Manual scaling

Question 11

An application requires that a specific set of pods be placed on nodes labeled with 'gpu=true'. Which Kubernetes field should be used in the pod spec to enforce this?

Accepted Answer

nodeSelector. `nodeSelector` is the simplest and most direct Kubernetes field for constraining a pod to nodes that have a specific label. By setting `nodeSelector: { gpu: 'true' }` in the pod spec, the scheduler will only place the pod on nodes that have the label `gpu=true`. This is a hard constraint that does not support complex expressions but is ideal for the stated requirement.

Answer

topologySpreadConstraints

Answer

affinity.nodeAffinity

Answer

tolerations

Question 12

A pod named 'db' in the 'default' namespace cannot connect to another pod named 'cache' in the 'prod' namespace via DNS. The service 'cache-svc' exists in the 'prod' namespace. What DNS name should the 'db' pod use to reach the 'cache-svc' service?

Accepted Answer

cache-svc.prod.svc.cluster.local. Kubernetes DNS resolves services across namespaces using the format ..svc.cluster.local. Since the 'cache-svc' service is in the 'prod' namespace, the 'db' pod in the 'default' namespace must use 'cache-svc.prod.svc.cluster.local' to reach it. The default cluster domain is 'cluster.local', and the 'svc' subdomain is part of the standard DNS schema for services.

Answer

cache-svc.default

Answer

cache-svc.prod

Answer

cache-svc.default.svc.cluster.local

Question 13

Which component runs on every worker node and ensures that containers are running in a Pod as specified in the Pod manifest?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node in a Kubernetes cluster. It receives Pod specifications (Pod manifests) from the API server, either directly or via the kube-apiserver, and ensures that the containers described in those manifests are running and healthy. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers as needed.

Answer

kube-controller-manager

Answer

container runtime

Answer

kube-proxy

Question 14

A developer creates a Service of type ClusterIP in namespace 'default'. They attempt to reach the Service from another pod in the same namespace using the Service name 'my-svc'. The connection fails. What is the most likely cause?

Accepted Answer

The cluster DNS service (CoreDNS) is not running or misconfigured. The most likely cause is that the cluster DNS service (CoreDNS) is not running or misconfigured. When a pod attempts to reach a Service by its DNS name (e.g., 'my-svc'), Kubernetes relies on CoreDNS to resolve that name to the ClusterIP. If CoreDNS is down, misconfigured, or the pod's DNS resolver is not pointing to it, the name resolution fails, causing the connection to fail even if the Service itself is correctly configured.

Answer

The Service port does not match the container port

Answer

The Service type should be NodePort

Answer

The Service selector does not match any pod labels

Question 15

Which component is responsible for running containers on a Kubernetes node?

Accepted Answer

Container runtime (e.g., containerd). The container runtime (e.g., containerd) is the component responsible for actually running containers on a Kubernetes node. It pulls container images, manages container lifecycles, and handles low-level operations such as starting and stopping containers via the CRI (Container Runtime Interface). Without a container runtime, the kubelet cannot launch or manage any containers on the node.

Answer

etcd

Answer

kube-scheduler

Answer

kubelet