KCNA Practice Questions 1 — 50 Questions

Question 1

Which tool is used to manage infrastructure as code and can provision resources across multiple cloud providers?

Accepted Answer

Terraform. Terraform is the correct tool because it is an open-source infrastructure as code (IaC) software tool by HashiCorp that uses declarative configuration files (HCL) to provision and manage resources across multiple cloud providers (AWS, Azure, GCP, etc.) via provider plugins. Unlike single-cloud tools, Terraform's provider architecture allows it to manage heterogeneous environments consistently, making it the standard multi-cloud IaC solution.

Answer

Helm

Answer

Ansible

Answer

AWS CloudFormation

Question 2

Which Kubernetes resource can be used to define network policies that control traffic between pods?

Accepted Answer

NetworkPolicy. NetworkPolicy is a Kubernetes resource that defines how groups of pods are allowed to communicate with each other and other network endpoints. It works by specifying ingress and egress rules using pod selectors, namespace selectors, and IP blocks, and is enforced by a network plugin (CNI) that supports it, such as Calico or Cilium.

Answer

Service

Answer

PodSecurityPolicy

Answer

Ingress

Question 3

Drag and drop the steps to troubleshoot a Pod stuck in CrashLoopBackOff into the correct order.

Accepted Answer

1. Use kubectl describe pod to check events, 2. Use kubectl logs to see application errors, 3. Check resource constraints (CPU/memory limits), 4. Verify image name and command in the pod spec, 5. Fix the issue and redeploy.. Start with describe for events, then logs for errors, check resources, verify image/command, then fix and redeploy.

Answer

1. Use kubectl logs to see application errors, 2. Use kubectl describe pod to check events, 3. Verify image name and command in the pod spec, 4. Check resource constraints (CPU/memory limits), 5. Fix the issue and redeploy.

Answer

1. Check resource constraints (CPU/memory limits), 2. Use kubectl describe pod to check events, 3. Use kubectl logs to see application errors, 4. Verify image name and command in the pod spec, 5. Fix the issue and redeploy.

Answer

1. Fix the issue and redeploy, 2. Use kubectl describe pod to check events, 3. Use kubectl logs to see application errors, 4. Check resource constraints (CPU/memory limits), 5. Verify image name and command in the pod spec.

Question 4

What is the difference between a liveness probe and a readiness probe?

Accepted Answer

Liveness probe indicates if the container is alive; if it fails, the container is restarted. A liveness probe determines if a container is still running (alive). If the liveness probe fails, Kubernetes restarts the container based on the `restartPolicy`. This is distinct from a readiness probe, which checks if a container is ready to accept traffic and removes it from Service endpoints if it fails.

Answer

Liveness probe checks if the container is ready to serve traffic

Answer

Readiness probe indicates if the container is healthy; liveness indicates if it should be restarted

Answer

Both probes serve the same purpose but with different endpoints

Question 5

Which TWO statements about Kubernetes Services are correct?

Accepted Answer

The default Service type is ClusterIP. The default Service type in Kubernetes is ClusterIP, which exposes the Service on a cluster-internal IP address. This means the Service is only reachable from within the cluster, providing a stable internal endpoint for pod-to-pod communication without external exposure.

Answer

A Service can expose only one container port

Answer

A Service can only route traffic to pods on the same node as the Service

Answer

A Service of type NodePort exposes the service only on the node where the pod is running

Question 6

Which tool is specifically designed for log aggregation and is built by Grafana Labs as a lightweight, cost-effective alternative to traditional log systems?

Accepted Answer

Loki. Loki is a log aggregation system optimized for Kubernetes, designed to be cost-effective and easy to operate.

Answer

Zipkin

Answer

Prometheus

Answer

Jaeger

Question 7

A developer creates a Pod with a single container that writes data to /data. The Pod spec includes a volume of type hostPath with path /mnt/data. After the Pod is deleted, the developer notices that the data persists on the node. What is the primary reason for this behavior?

Accepted Answer

hostPath volumes are not deleted when the Pod is deleted; they persist on the node's filesystem.. hostPath volumes directly mount a node's filesystem path into a Pod. Data written to that path is stored on the node and remains there even after the Pod is deleted. This is why the data persists, as the node's directory is not automatically cleaned up by Kubernetes.

Answer

The Pod's restartPolicy is set to Always, which causes the volume to be recreated after deletion.

Answer

The volume is backed by a PersistentVolume that retains data even after the Pod is deleted.

Answer

The kubelet caches volume data in memory and writes it back to the hostPath after Pod deletion.

Question 8

You need to securely store a database password for use by a Pod. Which Kubernetes resource should you use?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the value in base64 and can be mounted as a volume or injected as an environment variable into a Pod. Unlike ConfigMaps, Secrets are designed for confidential information and support optional encryption at rest when enabled in the cluster. This ensures the password is not stored in plaintext in the Pod specification or version control.

Answer

PersistentVolumeClaim

Answer

ServiceAccount

Answer

ConfigMap

Question 9

Which TWO statements are true about Kubernetes Deployments?

Accepted Answer

Deployments support rolling updates and rollbacks.. Option A is correct because a Deployment's pod template is versioned, and the Deployment controller performs rolling updates by incrementally replacing old ReplicaSet pods with new ones, while `kubectl rollout undo` reverts to a previous revision. Option C is correct because a Deployment does not manage pods directly; it creates and manages a ReplicaSet, which in turn maintains the desired number of pod replicas and scales them as the Deployment's spec changes. Option B is not correct because StatefulSets, not Deployments, are the recommended controller for stateful applications requiring stable network identities and persistent per-pod storage. Option D is not correct because Deployments provide no built-in external load balancer; external exposure requires a Service of type LoadBalancer, NodePort, or an Ingress. Option E is not correct because running a pod on every node is the job of a DaemonSet, not a Deployment.

Answer

Deployments are the recommended controller for stateful applications.

Answer

Deployments can expose applications externally via a built-in load balancer.

Answer

Deployments are used to run a pod on every node in the cluster.

Question 10

Which TWO of the following are recommended practices for achieving observability in a Kubernetes cluster?

Accepted Answer

Include correlation IDs in structured logs to enable tracing across services.. Including correlation IDs in structured logs is a key observability practice that enables distributed tracing across microservices. In Kubernetes, where requests often traverse multiple pods and services, correlation IDs allow you to link logs from different components into a single transaction flow, which is essential for debugging and understanding system behavior.

Answer

Use a single centralized logging solution to aggregate logs from all components.

Answer

Store all debug logs for a minimum of 90 days for compliance.

Answer

Disable leader election for monitoring components to reduce complexity.

Question 11

What does the 'kubectl logs' command retrieve?

Accepted Answer

Container logs. The 'kubectl logs' command retrieves the standard output (stdout) and standard error (stderr) streams from a container running in a pod. It directly accesses the container's log files on the node (e.g., /var/log/pods/...) or streams them from the container runtime. This is the primary way to debug application issues in Kubernetes.

Answer

Audit logs

Answer

Cluster events

Answer

Node logs

Question 12

What is the primary purpose of a liveness probe in a container?

Accepted Answer

To check if the container is still alive; restart if not. The primary purpose of a liveness probe is to determine whether a container is still running and healthy. If the probe fails, the kubelet kills the container and restarts it according to the pod's restart policy, ensuring self-healing. This is distinct from readiness probes, which control traffic routing, and resource checks, which are handled by metrics servers or cAdvisor.

Answer

To check resource usage like CPU and memory

Answer

To check if the container is ready to serve traffic

Answer

To check if the pod is scheduled on the correct node

Question 13

Which TWO of the following are required fields when defining a container in a Kubernetes Pod spec? (Choose 2)

Accepted Answer

image. In a Kubernetes Pod spec, the `name` and `image` fields are mandatory for each container definition. The `name` field uniquely identifies the container within the Pod, and the `image` field specifies the container image to run (e.g., `nginx:1.25`). Without these two fields, the Pod creation will fail with a validation error from the Kubernetes API server.

Answer

env

Answer

resources

Answer

ports

Question 14

A Deployment named 'myapp' is managing a ReplicaSet. You need to update the application image to version 2.0. What is the recommended approach?

Accepted Answer

Update the Deployment's pod template image to version 2.0. The recommended approach to update a Deployment's application image is to modify the pod template in the Deployment specification. The Deployment controller then automatically performs a rolling update, creating a new ReplicaSet with the updated image and gradually scaling down the old ReplicaSet, ensuring zero-downtime updates and maintaining desired replica count.

Answer

Scale down the Deployment to 0 replicas, then scale up with the new image

Answer

Delete the existing ReplicaSet and create a new one with the updated image

Answer

Directly update the pods in the ReplicaSet by using 'kubectl edit pod'

Question 15

A team wants to use feature flags to control the rollout of a new feature in a Kubernetes-deployed microservice. Which tool is specifically designed for managing feature flags in cloud-native applications?

Accepted Answer

LaunchDarkly. LaunchDarkly is a feature management platform specifically designed for managing feature flags in cloud-native applications. It allows for controlled rollouts and A/B testing. Argo Rollouts focuses on progressive delivery (canary, blue-green deployments), not feature flags. Helm is a package manager for Kubernetes. Kustomize is for configuration management. Therefore, option B (LaunchDarkly) is correct.

Answer

Helm

Answer

Kustomize

Answer

Argo Rollouts

Question 16

You run 'kubectl logs my-pod' and see: "Error from server (BadRequest): container "my-container" in pod "my-pod" is waiting to start: PodInitializing". What does this mean?

Accepted Answer

The Pod is in the process of initializing and logs are not yet available. The error 'PodInitializing' indicates that the pod's init containers are still running or the main container is waiting for init containers to complete. During this phase, the container has not started, so logs are not yet available. Option D correctly identifies that the pod is initializing and logs cannot be retrieved until the container enters the 'Running' state.

Answer

The container is running but producing no output

Answer

The container runtime is failing to start the container

Answer

The container has crashed and is restarting

Question 17

Which resource in Kubernetes is used to expose a set of pods as a network service?

Accepted Answer

Service. A Service in Kubernetes provides a stable network endpoint (IP address and DNS name) to expose a set of pods, which are ephemeral and can be replaced. Services use selectors to identify target pods and load-balance traffic across them, enabling reliable communication within or outside the cluster.

Answer

Pod

Answer

Deployment

Answer

Ingress

Question 18

A company is adopting a GitOps workflow for their Kubernetes deployments. They want to ensure that the cluster state always matches the desired state defined in a Git repository. Which tool is specifically designed for this purpose?

Accepted Answer

Argo CD. Argo CD is a declarative, GitOps continuous delivery tool specifically designed for Kubernetes that automatically synchronizes the live cluster state with the desired state defined in a Git repository. It continuously monitors the cluster and Git, applying any drift to ensure the cluster matches the repository, which is the core requirement of a GitOps workflow.

Answer

Helm

Answer

Kustomize

Answer

Prometheus

Question 19

Which TWO of the following are core principles of cloud native architecture? (Choose two.)

Accepted Answer

Containerization. Containerization (Option D) is a core principle of cloud native architecture because it packages applications and their dependencies into isolated, lightweight containers, enabling consistent deployment across environments and efficient resource utilization. This aligns with the cloud native goal of portability and scalability, as containers can be orchestrated by platforms like Kubernetes to manage dynamic workloads.

Answer

Manual infrastructure provisioning

Answer

Monolithic application design

Answer

Tight coupling between services

Question 20

Which Kubernetes resource is best suited for running a batch processing job that must complete successfully exactly once?

Accepted Answer

Job. A Kubernetes Job is designed specifically for batch processing tasks that need to run to completion exactly once. It creates one or more Pods and ensures that a specified number of them successfully terminate, making it ideal for workloads like data processing or backups that must finish without retries or restarts.

Answer

DaemonSet

Answer

Deployment

Answer

CronJob