KCNA Practice Test 47 — 15 Questions

Question 1

You have a pod that needs to securely access a database password. Which Kubernetes resource should you use to store the password?

Accepted Answer

Secret. A Kubernetes Secret is specifically designed to store sensitive data, such as database passwords, in a base64-encoded format. Secrets can be mounted as volumes or exposed as environment variables in a pod, ensuring the password is not stored in plaintext in the pod specification or container image.

Answer

ServiceAccount

Answer

ConfigMap

Answer

PersistentVolume

Question 2

Which THREE of the following are core components of a Kubernetes worker node?

Accepted Answer

container runtime. A container runtime is a core component of a Kubernetes worker node. It is responsible for actually running the containers (e.g., containerd, CRI-O) and is required by the kubelet to manage pod lifecycle. Without a container runtime, the kubelet cannot start or stop containers on the node.

Answer

etcd

Answer

kube-apiserver

Question 3

You run 'kubectl get pods' and see a pod in 'Pending' state for over 5 minutes. You describe the pod and see '0/1 nodes are available: 1 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's memory request is larger than any node's allocatable memory. The '0/1 nodes are available: 1 Insufficient memory' message indicates that the Kubernetes scheduler could not place the pod because no node has enough allocatable memory to satisfy the pod's memory request. Option B is correct because the pod's memory request exceeds the available memory on any node, causing the pod to remain in Pending state indefinitely until sufficient resources become available.

Answer

The container image is too large

Answer

The pod has a liveness probe that is failing

Answer

The kubelet on the node is not running

Question 4

A Pod is in 'CrashLoopBackOff' state. You run 'kubectl logs <pod>' and see an error that the application cannot bind to port 8080 because the port is already in use. What is the most likely cause?

Accepted Answer

Another process inside the container is already using port 8080. The 'CrashLoopBackOff' state indicates the container repeatedly starts, fails, and is restarted by the kubelet. The error message 'port is already in use' means the application inside the container cannot bind to port 8080 because another process within the same container's network namespace is already listening on that port. This is a classic application-level conflict, not a Kubernetes configuration issue.

Answer

The container's health check is misconfigured

Answer

The container runtime is not installed

Answer

The Pod's resource limits are too low

Question 5

Which THREE are valid ways to perform a rolling update of a Deployment in Kubernetes? (Select THREE.)

Accepted Answer

Update the container image to a new version. Changing the container image in a Deployment's pod template triggers a rolling update. Kubernetes compares the current pod template hash with the desired one; when they differ, it creates new ReplicaSets with the updated image and gradually scales down the old ReplicaSet while scaling up the new one, ensuring zero-downtime updates.

Answer

Manually delete all pods and let the Deployment recreate them

Answer

Change the number of replicas

Question 6

A Pod has two containers. You need to see the logs of the second container named 'sidecar'. Which kubectl command should you use?

Accepted Answer

kubectl logs pod-name --container sidecar. The command `kubectl logs pod-name --container sidecar` (option A) explicitly specifies the sidecar container. While `-c sidecar` is also a valid shorthand, this question expects the command as listed in option A. Both forms achieve the same result, but in this single-choice format, option A is the designated correct answer.

Answer

kubectl logs sidecar pod-name

Answer

kubectl logs pod-name sidecar

Answer

kubectl logs pod-name -c sidecar

Question 7

Your organization runs a multi-service application on a Kubernetes cluster. Each service is deployed as a set of Pods managed by a Deployment. The application experiences intermittent slowdowns during peak traffic. Monitoring shows that the database service Pods have high CPU usage, but the HorizontalPodAutoscaler (HPA) configured for the database Deployment does not scale. The HPA is based on average CPU utilization across Pods, with target 70%. The database Deployment has resource requests and limits set: requests.cpu: 500m, limits.cpu: 1000m. During peak, CPU usage reaches 800m per Pod. The HPA has a cooldown period of 3 minutes. The cluster has ample capacity. What is the most likely reason the HPA is not scaling?

Accepted Answer

The HPA cooldown period of 3 minutes prevents scaling during the short peak duration.. The HPA cooldown period of 3 minutes prevents scaling during short peak durations. The scenario states 'intermittent slowdowns during peak traffic,' implying the high CPU usage is not sustained long enough to trigger a scale-up event. After a previous scale operation (possibly due to an earlier peak), the cooldown period must elapse before the HPA can initiate another scaling action. Since the peaks are short and intermittent, they may fall within the cooldown window, preventing the HPA from scaling despite high CPU usage.

Answer

The HPA is configured to use a different metric (e.g., memory) instead of CPU.

Answer

The CPU limit of 1000m restricts the Pods from using more than 1000m, but the HPA bases scaling on requests, not limits.

Answer

The cluster does not have enough nodes to schedule additional Pods.

Question 8

Which Kubernetes component is the primary entry point for all administrative tasks and API requests?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative tasks and API requests. It validates and processes RESTful API calls (using JSON/YAML over HTTP/HTTPS) before persisting state to etcd or delegating work to other controllers. Without the API server, no kubectl command, automation script, or internal component can interact with the cluster.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 9

In a microservices application, you want to prevent cascading failures by limiting the number of concurrent requests to a downstream service. Which resilience pattern should you implement?

Accepted Answer

Bulkhead pattern. The bulkhead pattern isolates resources into separate pools (e.g., thread pools) to limit the impact of a failure in one service on others.

Answer

Circuit breaker

Answer

Timeout pattern

Answer

Retry pattern

Question 10

Which three of the following are true about etcd in Kubernetes?

Accepted Answer

etcd stores all cluster state, including Pods, ConfigMaps, and Secrets. Etcd is the primary datastore for Kubernetes, storing all cluster state including objects like Pods, ConfigMaps, and Secrets. This ensures that the Kubernetes API server has a consistent, authoritative source of truth for the entire cluster.

Answer

etcd is a relational database

Answer

etcd can be used as a message queue

Question 11

Which THREE of the following are DORA metrics?

Accepted Answer

Mean time to restore (MTTR). Mean time to restore (MTTR) is one of the four key DORA metrics defined by the DevOps Research and Assessment (DORA) team. It measures the average time it takes to recover from a failure in a production environment, directly reflecting the resilience and incident response capability of a cloud-native system. In Kubernetes, this often involves automated rollback strategies, pod rescheduling, or canary deployments to minimize downtime.

Answer

Code coverage

Answer

Number of deployments per developer

Question 12

You have a microservices application deployed as a set of Pods in a Kubernetes cluster. You need to ensure that Pods can discover each other using stable DNS names. Which Kubernetes resource should you create?

Accepted Answer

Service. A Service of type ClusterIP (the default) provides a stable virtual IP and DNS name (e.g., my-service.namespace.svc.cluster.local) that resolves to the Pods selected by its label selector. This allows Pods to discover each other using consistent DNS names, regardless of Pod IP changes due to scaling or restarts. The kube-dns or CoreDNS addon automatically creates DNS records for Services, enabling service discovery within the cluster.

Answer

ConfigMap

Answer

Ingress

Answer

Deployment

Question 13

You create a Service of type NodePort with nodePort: 30080. The cluster's nodes have IP addresses 10.0.0.1 and 10.0.0.2. From outside the cluster, which address and port can you use to access the Service?

Accepted Answer

10.0.0.1:30080. A NodePort service exposes the same port (nodePort: 30080) on every node in the cluster. From outside the cluster, you can reach the service using the IP address of any node (e.g., 10.0.0.1) combined with the nodePort (30080). The kube-proxy on that node will forward traffic to the service's ClusterIP and then to the selected pods.

Answer

10.0.0.1:80

Answer

ClusterIP:80

Answer

10.0.0.2:8080

Question 14

Which TWO statements about Kubernetes Services are correct?

Accepted Answer

The default Service type is ClusterIP. The default Service type in Kubernetes is ClusterIP, which exposes the Service on a cluster-internal IP address. This means the Service is only reachable from within the cluster, providing a stable internal endpoint for pod-to-pod communication without external exposure.

Answer

A Service can expose only one container port

Answer

A Service can only route traffic to pods on the same node as the Service

Answer

A Service of type NodePort exposes the service only on the node where the pod is running

Question 15

Which practice is a key principle of cloud-native architecture?

Accepted Answer

Automated CI/CD pipelines. Automated CI/CD pipelines are a key principle of cloud-native architecture because they enable rapid, reliable, and repeatable delivery of microservices. By automating build, test, and deployment stages, teams can achieve continuous integration and continuous delivery, which aligns with the cloud-native goals of agility, scalability, and resilience. This automation reduces human error and accelerates the feedback loop, essential for managing distributed systems in dynamic cloud environments.

Answer

Manual configuration management

Answer

Tight coupling of services

Answer

Preferring stateful applications over stateless