KCNA Practice Exam 52 — 20 Questions

Question 1

A Service of type ClusterIP is created to expose a set of pods. How does the Service achieve load balancing to the pods?

Accepted Answer

The kube-proxy component on each node sets up network rules to forward traffic to the pods. Kube-proxy on each node implements load balancing for ClusterIP Services by creating iptables or IPVS rules that distribute traffic from the Service's virtual IP to the backend pods. These rules use a random or round-robin selection (depending on the mode) to forward packets to healthy pods, ensuring no single pod is overwhelmed.

Answer

The API server routes traffic directly to the pods

Answer

The kubelet configures the container runtime to route traffic

Answer

Using a cloud load balancer

Question 2

A user creates a Service of type ClusterIP with a selector matching pods labeled 'app: myapp'. However, a pod named 'myapp-pod' with label 'app: myapp' is not receiving traffic. What is a possible reason?

Accepted Answer

The pod's readiness probe is failing. A failing readiness probe causes the pod to be removed from the Service's Endpoints list, even if the pod is running and matches the selector. The kubelet checks the readiness probe periodically; if it fails, the pod is marked as not ready, and the Service controller removes its IP from the Endpoints object, preventing traffic from being forwarded to it.

Answer

The Service type should be NodePort

Answer

The pod is in a different namespace

Answer

The pod's container port is not defined

Question 3

A developer runs 'helm upgrade --install myapp ./mychart' and sees the release status is 'failed'. What is the most likely cause?

Accepted Answer

The chart contains invalid Kubernetes manifests. A failed Helm upgrade usually means the Kubernetes API rejected the manifests (e.g., invalid YAML, resource conflict).

Answer

The Tiller pod is not running

Answer

The Helm binary is outdated

Answer

The namespace does not exist

Question 4

You have a Service named 'my-svc' in namespace 'default'. A pod in namespace 'other' tries to reach it using the DNS name 'my-svc'. What is the correct DNS name for cross-namespace service discovery?

Accepted Answer

my-svc.default. Kubernetes DNS resolves service names using the format `..svc.cluster.local`. For cross-namespace access, the namespace must be included. Since the pod is in namespace 'other' and the service is in 'default', the correct DNS name is 'my-svc.default' (the full cluster domain suffix is optional).

Answer

my-svc

Answer

my-svc.other

Answer

my-svc.namespace

Question 5

Which THREE of the following are valid reasons to use a StatefulSet instead of a Deployment? (Select 3)

Accepted Answer

You need stable, unique network identifiers (e.g., pod hostnames) that persist across reschedules. StatefulSets provide stable, unique network identifiers (e.g., pod hostnames) that persist across reschedules because each pod gets a fixed ordinal index (e.g., pod-0, pod-1) and a corresponding DNS name (e.g., pod-0.statefulset.namespace.svc.cluster.local). This is essential for applications like databases (e.g., Cassandra, ZooKeeper) that rely on consistent peer discovery and identity, which Deployments cannot guarantee since they assign random pod names and IPs.

Answer

You only need a single instance of the application

Answer

You need to deploy a stateless web application with multiple replicas

Question 6

Which command is used to create a Deployment that runs an nginx container with 3 replicas?

Accepted Answer

kubectl create deployment nginx --image=nginx --replicas=3. `kubectl create deployment` is the standard Kubernetes command to create a Deployment resource, and the `--replicas=3` flag directly sets the desired replica count to 3. This command creates a Deployment that manages a ReplicaSet to ensure three nginx pods are running and maintained.

Answer

kubectl create pod nginx --image=nginx --replicas=3

Answer

kubectl run nginx --image=nginx --replicas=3

Answer

kubectl scale deployment nginx --replicas=3

Question 7

Which THREE of the following are valid use cases for distributed tracing in a microservices architecture?

Accepted Answer

Understanding the dependency graph between microservices. Distributed tracing is designed to track the flow of a single request across multiple microservices, recording timing and causality. Option B is correct because tracing systems like Jaeger or Zipkin automatically build a dependency graph by analyzing the parent-child relationships between spans, which reveals how services interact. This is a core use case for understanding service topology and identifying bottlenecks in a distributed system.

Answer

Monitoring CPU and memory usage of each service instance

Answer

Capturing detailed error messages and stack traces

Question 8

Which of the following is a key benefit of using containers over virtual machines?

Accepted Answer

Containers share the host OS kernel. Containers share the host operating system kernel, which makes them lightweight and fast to start compared to virtual machines. Each container runs as an isolated user-space process on the same kernel, avoiding the overhead of a separate guest OS per instance. This shared-kernel architecture is a fundamental design principle of containerization technologies like Docker and containerd.

Answer

Each container runs its own operating system

Answer

Containers provide stronger isolation than VMs

Answer

Containers require hypervisor to run

Question 9

You are writing a Deployment YAML (apps/v1) for a stateless web application. The application should have 3 replicas and use rolling updates with maxSurge=1 and maxUnavailable=0. Which field should you set under spec.strategy?

Accepted Answer

type: RollingUpdate with rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }. The Deployment's `spec.strategy.type` must be set to `RollingUpdate` to enable a controlled, incremental update of pods. The `rollingUpdate` field then allows you to specify `maxSurge: 1` (one extra pod above the desired count during update) and `maxUnavailable: 0` (ensure all existing pods remain available during the update), which is the exact configuration for a zero-downtime rolling update with a single surge pod.

Answer

type: Recreate

Answer

type: Canary

Answer

type: OnDelete

Question 10

An administrator needs to ensure that Pods from two different Deployments cannot communicate with each other. Which Kubernetes resource should be used?

Accepted Answer

NetworkPolicy. NetworkPolicy is the correct resource because it acts as a firewall for Kubernetes Pods, controlling ingress and egress traffic at the IP address and port level using layer 3/4 rules. By applying a NetworkPolicy that denies all traffic between the Pods of the two Deployments (e.g., using podSelector and ingress/egress rules with an empty `from` or `to` block), the administrator can enforce network isolation. This is the native Kubernetes mechanism for restricting Pod-to-Pod communication within a cluster.

Answer

RBAC Role

Answer

PodSecurityPolicy

Answer

ResourceQuota

Question 11

Which Kubernetes object provides a stable IP address and DNS name to access a set of pods, and can perform load balancing?

Accepted Answer

Service. A Service is the correct Kubernetes object because it provides a stable virtual IP (ClusterIP) and a DNS name (via CoreDNS) that remains constant even as pods are created or destroyed. It performs layer 4 (TCP/UDP) load balancing across the set of pods selected by its label selector, using iptables or IPVS rules to distribute traffic.

Answer

Ingress

Answer

Deployment

Answer

Pod

Question 12

A team notices that a pod remains in 'CrashLoopBackOff' state after deployment. The application logs show 'Error: unable to bind to port 8080'. What is the most likely cause?

Accepted Answer

The container's port is already in use on the host node.. The error 'unable to bind to port 8080' indicates that the container process cannot open port 8080 for listening. The most likely cause is that another process on the host node is already using port 8080, preventing the container from binding to it. This is a classic port conflict scenario, where the host's network namespace has a port already allocated, and the container (even with its own network namespace) may be using host networking or the port is mapped from the host.

Answer

The pod's resource limits are too low.

Answer

An environment variable has a typo in the Deployment spec.

Answer

The readiness probe is misconfigured.

Question 13

Match each Kubernetes component to its role in the control plane.

Accepted Answer

API Server: The central component that exposes the Kubernetes API, handling all RESTful interactions.. The core control plane components are: API Server (central API gateway), etcd (distributed store), and Scheduler (pod-to-node assignment). Common confusions include mixing roles of etcd and the API Server or Scheduler.

Answer

API Server: A distributed key-value store used as Kubernetes' backing store.

Answer

etcd: Watches for newly created pods and assigns them to nodes.

Question 14

Which command creates a Deployment named 'nginx' from the 'nginx:1.19' image?

Accepted Answer

kubectl create deployment nginx --image=nginx:1.19. The `kubectl create deployment` command is the standard Kubernetes imperative method to create a Deployment resource, and specifying `--image=nginx:1.19` directly sets the container image for the pod template. This command generates a Deployment object that manages a ReplicaSet with the specified image, ensuring declarative updates and rollback capabilities.

Answer

kubectl run nginx --image=nginx:1.19

Answer

kubectl start deployment nginx --image=nginx:1.19

Answer

kubectl apply -f nginx-deployment.yaml

Question 15

Which TWO of the following are best practices for structuring log output in cloud-native applications to maximize observability?

Accepted Answer

Output logs in structured format such as JSON. Structured logging (e.g., JSON) enables automated parsing, filtering, and querying by log aggregation tools like Fluentd, Logstash, or cloud-native observability backends (e.g., Elasticsearch, Loki). This format ensures each log entry has consistent key-value pairs, making it machine-readable and facilitating correlation across distributed services without manual text parsing.

Answer

Include verbose debug-level information in every log line

Answer

Use multi-line log entries for detailed error information

Answer

Avoid timestamps to reduce log size

Question 16

A retail company runs its e-commerce platform on Kubernetes. During a flash sale, the application experiences high latency. The team notices that the database pods are CPU-bound and the application pods are waiting on database responses. Which architectural change would best address this bottleneck?

Accepted Answer

Implement read replicas for the database and configure the application to use them for read operations.. The bottleneck is caused by the database being CPU-bound, meaning it cannot process requests fast enough. Implementing read replicas offloads read queries from the primary database, reducing its CPU load and allowing it to handle write operations more efficiently. The application can be configured to route read operations to the replicas, which directly addresses the latency caused by waiting on database responses.

Answer

Change the database service type from ClusterIP to NodePort.

Answer

Increase the number of application pod replicas.

Answer

Store database configuration in a ConfigMap to improve startup time.

Question 17

A developer wants to run a one-time task that creates a database schema and then exits. Which Kubernetes workload type is most appropriate?

Accepted Answer

Job. A Job is the correct choice because it is designed for finite, one-time tasks that run to completion, such as creating a database schema. Unlike long-running workloads, a Job creates one or more Pods and ensures they terminate successfully after the task finishes, making it ideal for batch processing or initialization tasks.

Answer

DaemonSet

Answer

StatefulSet

Answer

Deployment

Question 18

Drag and drop the steps to set up a Kubernetes cluster using kubeadm into the correct order.

Accepted Answer

Install container runtime and Kubernetes tools, then run kubeadm init on the control plane, then install a pod network plugin, then run kubeadm join on worker nodes.. First install runtime and Kubernetes tools, then init control plane, add network plugin, and join workers.

Answer

Install container runtime and Kubernetes tools, then install a pod network plugin, then run kubeadm init on the control plane, then run kubeadm join on worker nodes.

Answer

Run kubeadm init on the control plane, then install container runtime and Kubernetes tools, then install a pod network plugin, then run kubeadm join on worker nodes.

Answer

Install container runtime and Kubernetes tools, then run kubeadm init on the control plane, then run kubeadm join on worker nodes, then install a pod network plugin.

Question 19

What is the purpose of a Kubernetes Service?

Accepted Answer

To provide a stable endpoint for a set of pods. A Kubernetes Service provides a stable, virtual IP address and DNS name that acts as a consistent endpoint for accessing a set of pods, even as pods are created, destroyed, or rescheduled. This abstraction decouples clients from the ephemeral nature of pod IPs, enabling reliable communication within the cluster. Services use label selectors to dynamically route traffic to the appropriate pods, and they support multiple types (ClusterIP, NodePort, LoadBalancer) to expose applications internally or externally.

Answer

To store configuration data as key-value pairs

Answer

To manage rolling updates of container images

Answer

To schedule pods onto nodes

Question 20

Which component runs on every worker node and is responsible for ensuring that containers are running in a pod as specified in the PodSpec?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node in a Kubernetes cluster. It is responsible for ensuring that containers described in a PodSpec are running and healthy, by interacting with the container runtime (e.g., containerd, CRI-O) to create, start, and monitor pods. The kubelet does not manage containers that were not created by Kubernetes.

Answer

container runtime

Answer

kube-proxy

Answer

kube-scheduler