KCNA Practice Test 46 — 15 Questions

Question 1

What is the primary purpose of the CNCF (Cloud Native Computing Foundation)?

Accepted Answer

To host and nurture open source cloud native projects. The CNCF's mission is to make cloud native computing ubiquitous by fostering and sustaining open source projects that follow cloud native principles.

Answer

To develop proprietary cloud software

Answer

To certify individuals in cloud technologies

Answer

To provide commercial support for Kubernetes

Question 2

An application running in a Kubernetes cluster needs to securely access a third-party API. The API key must be stored in the cluster and mounted into the Pod as an environment variable. Which is the best practice?

Accepted Answer

Create a Secret with the API key and use envFrom or valueFrom in the Pod spec.. Kubernetes Secrets are specifically designed to store sensitive data like API keys, and using `envFrom` or `valueFrom` in the Pod spec injects the Secret value as an environment variable without exposing it in the Pod definition. This approach follows the principle of least privilege and avoids hardcoding secrets in images or plaintext ConfigMaps.

Answer

Store the API key in a ConfigMap and reference it in the Pod spec.

Answer

Embed the API key directly in the container image.

Answer

Store the API key in a Pod annotation and read it with kubectl.

Question 3

In a container image built from a Dockerfile, what is the purpose of the CMD instruction?

Accepted Answer

To provide default arguments for the ENTRYPOINT instruction. The CMD instruction in a Dockerfile provides default arguments for the ENTRYPOINT instruction when the container is run. If no ENTRYPOINT is defined, CMD itself serves as the default command to execute. This allows users to override the default behavior at runtime by appending arguments to `docker run`, which replace the CMD values while preserving the ENTRYPOINT.

Answer

To specify a command that always runs at build time

Answer

To copy files into the image

Answer

To define environment variables

Question 4

Which TWO of the following are true about Kubernetes Pods?

Accepted Answer

A Pod is the smallest deployable unit in Kubernetes. A Pod is the smallest and most basic deployable unit in Kubernetes. It represents a single instance of a running process and encapsulates one or more containers, storage resources, and a unique network IP. You cannot deploy a container directly; you must always wrap it in a Pod.

Answer

A Pod always runs exactly one container

Answer

Pods are automatically rescheduled if a node fails

Answer

Pods are directly created by the kube-scheduler

Question 5

Which component in a service mesh is responsible for handling traffic management, security, and observability as a sidecar proxy?

Accepted Answer

Envoy. Envoy is the most common sidecar proxy used in service meshes like Istio.

Answer

Pilot

Answer

Mixer

Answer

Citadel

Question 6

Which TWO of the following are core principles of the 12-factor app methodology? (Select TWO.)

Accepted Answer

Strict separation of config from code. The 12-factor app methodology mandates strict separation of config from code. Config includes things like database connection strings, API keys, and environment-specific values that vary between deployments. Storing these in environment variables (or external config files not checked into version control) ensures that the same codebase can be deployed to different environments without modification, which is a core principle for cloud-native portability and security.

Answer

Manual approval for all production deployments

Answer

Use of a single programming language across all services

Answer

Store logs in a local file system

Question 7

Which CNCF project is a graduated project for service discovery and configuration management?

Accepted Answer

Consul. None of the listed options are CNCF graduated projects for service discovery and configuration management. Consul is a HashiCorp tool, not a CNCF project. Prometheus is for monitoring, Fluentd for logging, and Envoy is a service proxy.

Answer

Prometheus

Answer

Fluentd

Answer

Envoy

Question 8

You create a Deployment with 'replicas: 3' and update the pod template to use a new image. After the rollout, you notice that the new ReplicaSet has 3 pods but they are all failing with 'CrashLoopBackOff'. You want to rollback to the previous working revision. Which command should you run?

Accepted Answer

kubectl rollout undo deployment/my-deployment. `kubectl rollout undo deployment/my-deployment` reverts the Deployment to the previous revision, which is the standard Kubernetes method to roll back a failed rollout. This command restores the pod template from the last working ReplicaSet, effectively undoing the change that caused the CrashLoopBackOff.

Answer

kubectl set image deployment/my-deployment nginx=nginx:1.21

Answer

kubectl delete deployment/my-deployment --cascade=false

Answer

kubectl rollout pause deployment/my-deployment

Question 9

A DevOps team wants to implement GitOps for their Kubernetes cluster. Which tool is specifically designed for Kubernetes GitOps and can automatically sync the cluster state with a Git repository?

Accepted Answer

ArgoCD. ArgoCD is a GitOps tool specifically designed for Kubernetes. It continuously monitors a Git repository and automatically syncs the cluster state to match the desired state. Helm (option D) is a package manager. Kustomize (option C) is a configuration management tool. Jenkins (option B) is a CI/CD tool but not GitOps-native. Therefore, ArgoCD (option A) is the correct answer.

Answer

Jenkins

Answer

Kustomize

Answer

Helm

Question 10

A company is adopting a multi-cloud strategy to avoid vendor lock-in. Which pattern BEST supports deploying applications across different cloud providers with minimal changes?

Accepted Answer

Deploy applications using Kubernetes on each cloud. Using Kubernetes as a consistent abstraction layer allows applications to run across different cloud providers with minimal modifications since it uses a common API and container orchestration. Cloud-specific APIs would lock you in, and hybrid cloud typically refers to mixing public and private cloud, not necessarily multi-cloud.

Answer

Use a hybrid cloud approach with a single cloud for all workloads

Answer

Use each cloud provider's native services directly

Answer

Write application code that checks the cloud provider and adapts

Question 11

Your application consists of a frontend and a backend. The frontend needs to communicate with the backend using a stable DNS name. The backend is deployed as a Deployment with 3 replicas. Which Kubernetes resource should you create to provide a stable DNS name for the backend?

Accepted Answer

Service of type ClusterIP. A Service of type ClusterIP provides a stable virtual IP and DNS name (e.g., my-service.namespace.svc.cluster.local) that load-balances traffic across the backend Pods. This is the correct resource because the frontend only needs a stable DNS name for internal cluster communication, and ClusterIP is the default Service type that fulfills this requirement without exposing the backend externally.

Answer

EndpointSlice

Answer

Service of type NodePort

Answer

Ingress

Question 12

You deploy a new version of your application by updating the container image in the Deployment manifest. The rollout seems to be progressing, but after a few minutes you notice that the new Pods are failing and the old Pods are still running. What is the most likely reason?

Accepted Answer

The new Pods are failing readiness probes, so the Deployment pauses the rollout and keeps the old replicas. When a new Pod fails its readiness probe, the Deployment controller considers the new ReplicaSet unhealthy and pauses the rollout. The controller keeps the old ReplicaSet running to maintain the desired number of available replicas, preventing traffic disruption until the new Pods pass their probes or the rollout is manually resumed.

Answer

The Deployment was created with 'kubectl create deployment' instead of 'kubectl apply'

Answer

The new Pods are not receiving traffic because the Service selector doesn't match

Answer

The Deployment's update strategy is set to 'Recreate'

Question 13

Which field in a Pod's container specification defines the minimum amount of CPU guaranteed to the container?

Accepted Answer

resources.requests.cpu. In Kubernetes, the `resources.requests.cpu` field specifies the minimum amount of CPU guaranteed to a container. This value is used by the scheduler to ensure the node has enough allocatable CPU, and by the kubelet to enforce CPU shares via the Completely Fair Scheduler (CFS) in the Linux kernel.

Answer

spec.containers.cpu

Answer

resources.limits.cpu

Answer

spec.nodeSelector

Question 14

In Istio, which component is responsible for enforcing traffic policies and collecting telemetry data at the pod level?

Accepted Answer

Envoy proxy. Envoy proxy is the correct answer because in Istio, each pod is deployed with an Envoy sidecar proxy that intercepts all inbound and outbound traffic. This proxy enforces traffic policies (e.g., routing rules, fault injection, rate limiting) and collects telemetry data (e.g., metrics, logs, traces) at the pod level, sending it to the observability backends. The sidecar model ensures policy enforcement and telemetry collection happen without modifying the application code.

Answer

Mixer

Answer

Pilot

Answer

Citadel

Question 15

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff due to OOMKilled, which means the container's memory usage exceeded its configured memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container to use more memory without being terminated by the Out-Of-Memory (OOM) killer. This directly addresses the root cause—insufficient memory allocation—while preserving the existing pod configuration and data.

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Answer

Increase the CPU request for the container