KCNA Practice Exam 51 — 20 Questions

Question 1

Which of the following best describes the purpose of the CNCF (Cloud Native Computing Foundation)?

Accepted Answer

To host and foster open source cloud native projects and promote cloud native technologies. The CNCF is a vendor-neutral foundation that hosts and fosters cloud native projects like Kubernetes, Prometheus, and Envoy, promoting cloud native technologies and practices.

Answer

To standardize cloud APIs across all public cloud providers

Answer

To provide certification programs and best practices for cloud native computing

Answer

To develop and maintain a single cloud native technology stack

Question 2

A team wants to implement GitOps for their Kubernetes workloads using Argo CD. They have multiple environments (dev, staging, prod) in separate clusters. What is the best practice for structuring the Git repository?

Accepted Answer

A monorepo with a directory per environment and overlays for differences. A monorepo with a directory per environment and overlays (e.g., using Kustomize or Helm) allows you to manage environment-specific differences declaratively while keeping a single source of truth. Argo CD can sync each environment's directory to its respective cluster, and overlays minimize duplication by applying only the necessary patches (e.g., replica counts, ingress hosts) on top of a common base. This approach aligns with GitOps best practices for multi-environment deployments.

Answer

A single branch with all environment manifests in the same folder

Answer

Separate repositories per environment

Answer

Store all manifests in a single file with environment labels

Question 3

A company is adopting a GitOps workflow for their Kubernetes deployments. They want to ensure that the cluster state always matches the desired state defined in a Git repository. Which tool is specifically designed for this purpose?

Accepted Answer

Argo CD. Argo CD is a declarative, GitOps continuous delivery tool specifically designed for Kubernetes that automatically synchronizes the live cluster state with the desired state defined in a Git repository. It continuously monitors the cluster and Git, applying any drift to ensure the cluster matches the repository, which is the core requirement of a GitOps workflow.

Answer

Helm

Answer

Kustomize

Answer

Prometheus

Question 4

Which component in Kubernetes is responsible for maintaining the desired state of the cluster?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller processes, which are control loops that watch the shared state of the cluster through the API server and make changes to move the current state toward the desired state. It is responsible for ensuring that the cluster's actual state matches the desired state defined in Kubernetes objects such as Deployments, ReplicaSets, and StatefulSets.

Answer

kube-scheduler

Answer

kube-proxy

Answer

kubelet

Question 5

Which TWO statements about Namespaces are correct?

Accepted Answer

Namespaces provide a way to divide cluster resources among multiple users. Namespaces in Kubernetes provide a mechanism for partitioning a single cluster into multiple virtual clusters, enabling resource quota management and access control for different users or teams. This allows administrators to divide cluster resources (like CPU, memory, and storage) among multiple users via ResourceQuotas and LimitRanges, without requiring separate physical clusters.

Answer

Namespaces act as a strong security boundary by default

Answer

Every resource must be created in a namespace

Answer

Resources in different namespaces cannot communicate with each other

Question 6

Which of the following best describes immutable infrastructure?

Accepted Answer

Infrastructure components that are replaced rather than changed after deployment. Immutable infrastructure is a pattern where components (servers, containers, etc.) are never modified after deployment. Instead, any change requires building a new instance from a golden image or template and replacing the old one. This eliminates configuration drift and ensures consistency, which is a core principle in container orchestration with tools like Kubernetes, where Pods are replaced rather than patched in place.

Answer

Servers that are updated in-place with configuration management tools

Answer

Infrastructure that is version-controlled and deployed using blue/green deployments

Answer

Infrastructure that uses only read-only file systems

Question 7

A pod is stuck in Terminating state for several minutes. What is the most likely cause?

Accepted Answer

The node is unreachable or the kubelet is not responding. When a pod is stuck in Terminating state, the most likely cause is that the node where the pod was running is unreachable or the kubelet is not responding. The kubelet is responsible for executing the pod's termination lifecycle, including sending SIGTERM and, after the grace period, SIGKILL. If the kubelet cannot communicate with the API server (e.g., due to node failure, network partition, or kubelet crash), the pod's finalizer cannot be removed, leaving it stuck in Terminating.

Answer

The deployment is configured with a grace period

Answer

The pod has a liveness probe that is failing

Answer

The pod's container runtime is paused

Question 8

You are an SRE managing a Kubernetes cluster with 200 nodes and 10,000 pods. The cluster runs a critical payment processing application. Users report that transactions are occasionally failing with a 'timeout' error. You have Prometheus and Grafana set up for monitoring, and you use Fluentd with Elasticsearch for logging. You notice that during peak hours, the CPU usage of the payment service pods spikes to 90%, but memory usage remains stable. The pod restart count is low. You also see that the response time of the payment service increases significantly during these spikes. You need to identify the root cause and propose a fix. Which course of action is most appropriate?

Accepted Answer

Increase the CPU limits for the payment service pods to allow more CPU resources during spikes. The CPU usage spikes to 90% during peak hours, indicating that the payment service pods are CPU-bound. Increasing CPU limits allows the pods to burst and utilize more CPU resources, reducing response times and preventing timeouts. This directly addresses the bottleneck without adding unnecessary replicas or changing memory settings.

Answer

Add more replicas of the payment service to distribute the load

Answer

Increase the memory limits for the payment service pods to improve caching

Answer

Implement a circuit breaker pattern to fail fast and avoid timeouts

Question 9

An application running in a Kubernetes pod needs to access a database that is deployed on a VM outside the cluster. The database IP is stable. Which is the best way to expose the database to the pod?

Accepted Answer

Create a Service of type ExternalName pointing to the database hostname. A Service of type ExternalName provides a DNS-based abstraction for external resources, mapping a Kubernetes service name to an external DNS name (the database hostname). This allows the pod to access the database via a stable in-cluster DNS name without needing to manage IP changes or network policies for external endpoints. It is the simplest and most Kubernetes-native way to expose a stable external IP to a pod.

Answer

Expose the database via Ingress

Answer

Use a Headless Service

Answer

Create an EndpointSlice manually with the pod IP

Question 10

A pod is in 'Pending' state for a long time. What is the most likely cause?

Accepted Answer

The scheduler cannot find a node that satisfies the pod's resource requests or constraints. A pod remains in 'Pending' state when it has been accepted by the API server but cannot be scheduled onto a node. The most common cause is that the scheduler cannot find a node that meets the pod's resource requests (CPU/memory) or constraints (node selectors, affinity rules, taints/tolerations). Until a suitable node is found, the pod stays in Pending, waiting for scheduling.

Answer

The pod's container has crashed

Answer

The pod's service endpoint is misconfigured

Answer

The container image is invalid

Question 11

Which TWO of the following are functions of the kube-controller-manager?

Accepted Answer

Managing replication and ensuring the desired number of pods are running. The kube-controller-manager runs controller processes that regulate the state of the cluster. The replication controller (part of the controller manager) ensures that the actual number of pod replicas matches the desired count specified in a ReplicaSet or ReplicationController, automatically creating or terminating pods as needed. Additionally, the node controller within the kube-controller-manager periodically checks node health via the Node Lifecycle Controller, which monitors heartbeats (NodeStatus updates) and responds to node failures by tainting the node and evicting pods after a configurable timeout (default 5 minutes).

Answer

Storing cluster state

Answer

Exposing the Kubernetes API

Answer

Assigning pods to nodes

Question 12

Refer to the exhibit. A pod is created with the above manifest. The container runs nginx listening on port 80, but the liveness probe is configured to check port 8080. What will happen?

Accepted Answer

The liveness probe will fail, causing the container to be restarted.. The liveness probe is configured to check port 8080, but the container only listens on port 80. Since the probe will never receive a successful HTTP response from port 8080, it will fail repeatedly. According to Kubernetes behavior, after the failure threshold is reached (default: 3 failures with a 10-second interval), kubelet will restart the container to attempt to recover it. This is the intended mechanism for detecting and remediating deadlocked or unresponsive applications.

Answer

The pod will fail to start because the probe port mismatches the container port.

Answer

The liveness probe will fail, but the pod will still be marked as Ready.

Answer

The pod will run successfully because the probe is not required.

Question 13

You have a ConfigMap named 'app-config' and a Secret named 'db-password'. You want to mount them into a pod. Which statement is correct?

Accepted Answer

Both ConfigMaps and Secrets can be mounted as volumes. Both ConfigMaps and Secrets are Kubernetes API objects designed to decouple configuration data from container images. They can be mounted as volumes into pods, allowing files to be created in the container's filesystem with the data from the ConfigMap or Secret. This is a core feature for managing configuration and sensitive data in Kubernetes.

Answer

Secrets can be mounted as volumes, but ConfigMaps cannot

Answer

ConfigMaps can be mounted as volumes, but Secrets cannot

Answer

ConfigMaps and Secrets can only be exposed as environment variables

Question 14

You want to run a batch job that processes data and then terminates. Which Kubernetes resource is best suited for this workload?

Accepted Answer

Job. A Kubernetes Job is designed for batch processing workloads that run to completion and then terminate. Unlike controllers that maintain a desired number of running Pods (like Deployments or StatefulSets), a Job creates one or more Pods and ensures they successfully exit. Once the specified number of successful completions is reached, the Job stops, making it the ideal choice for a one-time data processing task.

Answer

StatefulSet

Answer

DaemonSet

Answer

Deployment

Question 15

What is a primary benefit of using containers over virtual machines?

Accepted Answer

Containers are lightweight and share the host OS kernel. Containers virtualize at the operating system level, sharing the host OS kernel while running in isolated user-space instances. This eliminates the need for a full guest OS per workload, making containers significantly more lightweight in terms of memory, disk usage, and startup time compared to virtual machines, which each require a separate kernel and hypervisor.

Answer

Containers provide stronger isolation than VMs

Answer

Containers can run any operating system kernel

Answer

Containers require a hypervisor to run

Question 16

A team wants to implement a canary deployment strategy for their Kubernetes application. Which tool is specifically designed for progressive delivery and can be used to automate canary rollouts?

Accepted Answer

Argo Rollouts. Argo Rollouts is a Kubernetes controller and set of CRDs that provides advanced deployment capabilities such as blue-green and canary deployments with automated promotion and rollback.

Answer

Flux

Answer

Kustomize

Answer

Helm

Question 17

A Deployment named 'nginx' is failing to update. You run 'kubectl rollout status deployment nginx' and see 'Waiting for deployment "nginx" rollout to finish: 0 out of 3 new replicas have been updated...'. The pod template has an image that does not exist. What is the most likely cause?

Accepted Answer

The new image tag is incorrect or does not exist in the registry. The rollout status shows that no new replicas have been created, which is a classic symptom of a container image pull failure. When the image tag specified in the pod template does not exist in the registry, the kubelet cannot pull the image, so the ReplicaSet controller cannot start new pods. This prevents the rollout from progressing past 0 out of 3 new replicas.

Answer

The cluster is out of memory

Answer

The deployment has exceeded the revision history limit

Answer

The deployment is paused

Question 18

Which THREE are key characteristics of event-driven architecture? (Choose three.)

Accepted Answer

Event processing can trigger multiple downstream actions. Event-driven architecture is based on producing, detecting, and reacting to events, with loose coupling between components and asynchronous communication.

Answer

Requires a central database for state

Answer

Synchronous communication between components

Question 19

A developer wants to deploy a stateful application that requires stable network identities and persistent storage per pod instance. Which Kubernetes resource is most appropriate?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it is specifically designed for stateful applications that require stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage per pod instance (via PersistentVolumeClaims that are not shared across replicas). Unlike Deployments, StatefulSet maintains a sticky identity for each pod, ensuring that on rescheduling, the pod retains its name, network identity, and bound storage.

Answer

DaemonSet

Answer

Job

Answer

Deployment

Question 20

You have a multi-container pod with containers 'app' and 'sidecar'. You need to execute a shell command inside the 'sidecar' container. Which kubectl command should you use?

Accepted Answer

kubectl exec -it mypod -c sidecar -- /bin/sh. `kubectl exec` uses the `-c` flag (or `--container`) to specify a target container within a multi-container pod. The syntax `kubectl exec -it mypod -c sidecar -- /bin/sh` opens an interactive shell in the 'sidecar' container of the pod named 'mypod'. Without the `-c` flag, the command defaults to the first container in the pod's spec, which would be 'app'.

Answer

kubectl exec -it mypod -- /bin/sh

Answer

kubectl exec -it sidecar --container mypod -- /bin/sh

Answer

kubectl exec -it mypod --container sidecar -- /bin/sh