KCNA Practice Test 46 — 15 Questions

Question 1

What is the primary function of a service mesh like Istio?

Accepted Answer

To handle inter-service communication with features like traffic control and security. A service mesh provides observability, traffic management, and security for microservices communication.

Answer

To build container images

Answer

To manage container orchestration

Answer

To provide persistent storage for stateful applications

Question 2

Which component of the control plane is responsible for persisting the entire cluster state?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as the single source of truth for the entire cluster state, including all objects (Pods, Services, ConfigMaps, etc.), their specifications, and their current status. It is the only component that persists data to disk, ensuring that the cluster can recover its full state after a restart or failure. The kube-apiserver reads from and writes to etcd, but etcd itself is the storage backend.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 3

What is the primary purpose of Kubernetes?

Accepted Answer

To orchestrate containers across a cluster of machines. Kubernetes is a container orchestration platform designed to automate the deployment, scaling, and management of containerized applications across a cluster of machines. Its primary purpose is to abstract the underlying infrastructure and provide declarative management of container workloads, ensuring desired state convergence through controllers like the ReplicaSet and Deployment.

Answer

To provide a graphical user interface for managing containers

Answer

To replace Docker as a container runtime

Answer

To provide a virtual machine management platform

Question 4

Which of the following is a key benefit of using containers over virtual machines?

Accepted Answer

Containers share the host OS kernel. Containers share the host operating system kernel, which makes them lightweight and fast to start compared to virtual machines. Each container runs as an isolated user-space process on the same kernel, avoiding the overhead of a separate guest OS per instance. This shared-kernel architecture is a fundamental design principle of containerization technologies like Docker and containerd.

Answer

Each container runs its own operating system

Answer

Containers provide stronger isolation than VMs

Answer

Containers require hypervisor to run

Question 5

Which component is responsible for aggregating metrics from Kubernetes nodes and exposing them to the metrics API?

Accepted Answer

metrics-server. The metrics-server is the correct component because it is specifically designed to collect resource metrics (CPU and memory) from the kubelet on each node via the Summary API and expose them through the Kubernetes Metrics API. This allows tools like `kubectl top` and the Horizontal Pod Autoscaler to access real-time resource usage without requiring a full monitoring stack.

Answer

Prometheus Server

Answer

Grafana

Answer

Fluentd

Question 6

Which TWO of the following are valid ways to expose a Service to external traffic?

Accepted Answer

LoadBalancer. NodePort (D) is correct because it exposes a Service on each cluster node's IP at a static port in the 30000–32767 range, allowing external clients to reach the Service via :. LoadBalancer (C) is correct because it builds on NodePort and provisions an external load balancer (e.g., via a cloud provider) that routes external traffic to the Service's endpoints. ExternalName (A) is not a way to expose a Service to external traffic; it simply returns a CNAME DNS record pointing to an external hostname without proxying traffic. Headless (B) sets clusterIP: None and returns pod IPs directly via DNS, which is used for direct pod discovery, not external exposure. ClusterIP (E) is the default internal-only Service type, reachable only from within the cluster, so it does not expose the Service externally.

Answer

ExternalName

Answer

Headless

Answer

ClusterIP

Question 7

Which TWO statements about Kubernetes namespaces are true?

Accepted Answer

Namespaces are used to divide cluster resources between multiple users or teams.. Namespaces are a fundamental mechanism in Kubernetes for dividing cluster resources among multiple users or teams, enabling multi-tenancy and resource management through policies like Role-Based Access Control (RBAC) and ResourceQuotas. Option E is correct because ResourceQuotas are Kubernetes objects that can be applied to a namespace to enforce aggregate limits on CPU, memory, and other resources, preventing any single team from exhausting cluster capacity.

Answer

All Kubernetes objects are namespaced.

Answer

Namespaces automatically isolate services in different namespaces from communicating.

Answer

Namespaces provide network isolation between pods by default.

Question 8

An administrator wants to perform a rolling update of a Deployment. Which TWO actions will achieve this?

Accepted Answer

Run 'kubectl set image deployment/myapp myapp=myapp:v2'. Option A is correct because 'kubectl set image deployment/myapp myapp=myapp:v2' updates the container image in the Deployment's Pod template, which triggers the Deployment controller to perform a rolling update by creating a new ReplicaSet and gradually replacing old Pods while maintaining availability. Option E is also correct because editing the Deployment YAML to change the image version and running 'kubectl apply -f deployment.yaml' updates the Pod template spec, causing the same rolling update behavior managed by the Deployment controller. Option B is incorrect because scaling to zero replicas causes downtime and does not perform a rolling update; scaling back up simply creates new Pods without the controlled surge/unavailable semantics of a rollout. Option C is incorrect because deleting and recreating the Deployment destroys the existing rollout history and causes an outage rather than a rolling update. Option D is incorrect because 'kubectl rollout undo' reverts to a previous revision, which is a rollback, not a rolling update to a new image version.

Answer

Run 'kubectl scale deployment myapp --replicas=0' then 'kubectl scale deployment myapp --replicas=5'

Answer

Run 'kubectl delete deployment' and then 'kubectl create deployment' with the new image

Answer

Run 'kubectl rollout undo deployment/myapp'

Question 9

You have a Namespace 'team-a' and you want to see all Pods in that namespace, including those that are not ready. Which command should you use?

Accepted Answer

kubectl get pods -n team-a. `kubectl get pods -n team-a` retrieves all Pods in the specified namespace, regardless of their readiness or status. By default, `kubectl get pods` shows all Pods, including those that are not ready, and the `-n` flag targets the namespace. No additional filters are needed to include non-ready Pods.

Answer

kubectl get pods -n team-a -l app=myapp

Answer

kubectl get pods --namespace=team-a --field-selector=status.phase!=Running

Answer

kubectl get pods --all-namespaces

Question 10

In a CI pipeline, image scanning is integrated to detect vulnerabilities. What is the best practice when a critical vulnerability is found in a base image?

Accepted Answer

Fail the pipeline and notify the team to fix the base image. Failing the pipeline on a critical vulnerability in a base image enforces a secure software supply chain by preventing the vulnerable artifact from ever reaching a registry or production. It also triggers the team to remediate at the source — updating the base image tag or rebuilding on a patched parent — rather than masking the issue downstream. This is the standard 'shift-left' security practice recommended by CNCF projects like Trivy, Grype, and Clair.

Answer

Deploy to production and patch later

Answer

Automatically patch the image in the pipeline

Answer

Ignore the vulnerability and proceed with deployment

Question 11

Which Kubernetes control plane component acts as the entry point for all administrative tasks and provides the REST API?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes REST API. All administrative tasks, such as creating pods, scaling deployments, and querying cluster state, are performed by sending HTTP requests to this component. It validates and processes these requests before storing the resulting state in etcd.

Answer

kube-scheduler

Answer

etcd

Answer

kube-controller-manager

Question 12

A team wants to ensure that at least 99.9% of all requests to their application complete within 500ms over a 30-day window. How should this requirement be classified?

Accepted Answer

Service Level Objective (SLO). An SLO is a target value or range for a service level measured by an SLI — here, '99.9% of requests under 500ms over 30 days' is exactly a target threshold on a measured metric. It is the internal reliability goal that teams commit to and track. An SLA, by contrast, is a contractual agreement with consequences (credits, penalties) if the SLO is missed.

Answer

Service Level Agreement (SLA)

Answer

Service Level Indicator (SLI)

Answer

Key Performance Indicator (KPI)

Question 13

You need to provide configuration data as environment variables to a pod, but the data is not sensitive. Which object should you use?

Accepted Answer

ConfigMap. A ConfigMap is the correct Kubernetes object for providing non-sensitive configuration data as environment variables to a pod. ConfigMaps are designed to decouple configuration artifacts from image content to keep containers portable, and they support injection via environment variables, command-line arguments, or volume mounts. Unlike Secrets, ConfigMaps store data in plaintext (base64-encoded only for transport) and are intended for data that does not require encryption at rest or in transit.

Answer

Secret

Answer

ServiceAccount

Answer

PersistentVolume

Question 14

Which of the following is a benefit of using an API gateway pattern?

Accepted Answer

It provides a single entry point for clients and handles cross-cutting concerns. An API gateway sits in front of microservices and provides a single, unified entry point for all external clients, while centralizing cross-cutting concerns such as authentication, rate limiting, TLS termination, request routing, and logging. This decouples clients from the internal service topology, so services can be refactored or scaled without changing client code. It is a traffic-management and policy-enforcement layer, not a compute or storage layer.

Answer

It reduces the number of microservices needed

Answer

It replaces the need for a service mesh

Answer

It stores application state

Question 15

You run 'kubectl get pods' and see a pod with status 'Pending'. Which is the most likely cause?

Accepted Answer

The scheduler cannot find a node that meets the pod's resource requirements. A pod with status 'Pending' indicates that the pod has been accepted by the cluster but is not yet running. The most common cause is that the Kubernetes scheduler cannot find a node that satisfies the pod's resource requests (CPU, memory) or other constraints (node selector, taints/tolerations, affinity rules). The scheduler continuously evaluates nodes and if none match, the pod remains in Pending state until a suitable node becomes available.

Answer

The pod's container has crashed

Answer

The container image is not found

Answer

The pod has been deleted by a controller