KCNA Practice Exam 53 — 20 Questions

Question 1

A Deployment named 'web-app' is configured with replicas: 3. You update the container image. Which Kubernetes object directly manages the pods during the rolling update?

Accepted Answer

ReplicaSet. When a Deployment is updated (e.g., container image change), it creates a new ReplicaSet to manage the new pods and scales down the old ReplicaSet. The ReplicaSet is the Kubernetes object that directly owns and manages the pods during the rolling update, ensuring the desired number of replicas are running at each step.

Answer

StatefulSet

Answer

DaemonSet

Answer

Job

Question 2

A pod is stuck in 'Pending' state. Which of the following is a likely cause?

Accepted Answer

Insufficient CPU or memory resources on any available node. A pod remains in 'Pending' state when the scheduler cannot find a suitable node to run it. The most common reason is insufficient CPU or memory resources on any available node, as the scheduler checks resource requests against node allocatable resources before binding the pod. If no node meets the pod's resource requirements, the pod stays pending until resources become available.

Answer

The pod's command returned a non-zero exit code

Answer

The container image is invalid

Answer

The pod's liveness probe failed

Question 3

A platform team is designing a monitoring strategy for a multi-tenant Kubernetes cluster. Each tenant runs workloads in separate namespaces. The team needs to ensure tenant isolation while providing aggregated cluster-wide dashboards. Which approach best meets these requirements?

Accepted Answer

Deploy a Prometheus instance per tenant and use Thanos to aggregate metrics globally. Deploying a Prometheus instance per tenant enforces strong tenant isolation by preventing cross-tenant metric access or resource contention, while Thanos provides a global view by aggregating metrics from all tenants via sidecar-based or query-frontend federation. This approach satisfies both isolation and aggregated dashboards without compromising security or scalability.

Answer

Deploy a single Prometheus instance with namespace labels on all metrics

Answer

Use a global Prometheus with recording rules to aggregate per-namespace metrics

Answer

Have each tenant deploy their own monitoring stack and view separately

Question 4

Refer to the exhibit. The nginx Pod is created, but the Pod never becomes Ready. The container starts and runs. What is the most likely reason?

Accepted Answer

The liveness probe is failing because /healthz endpoint does not exist, causing the container to restart.. The liveness probe is configured to check the /healthz endpoint, but the default nginx container does not serve a /healthz endpoint. This causes the liveness probe to fail, and Kubernetes restarts the container according to the probe's failure threshold. Since the container keeps restarting, it never reaches the Ready state, even though the container starts and runs initially.

Answer

The nginx:latest image does not exist.

Answer

The containerPort is not matching the actual port nginx listens on.

Answer

The readiness probe is failing because the root path is not returning 200.

Question 5

Which TWO of the following statements about Kubernetes Deployments are correct? (Select 2)

Accepted Answer

Deployments support rolling updates and rollbacks. A is correct because Deployments provide a declarative update mechanism that supports rolling updates, where Pods are gradually replaced with new ones, and rollbacks, which revert the Deployment to a previous revision. This is achieved through the Deployment controller managing ReplicaSets, allowing seamless transitions between versions without downtime.

Answer

Deployments ensure that a copy of a Pod runs on each node in the cluster

Answer

Deployments are used for batch processing jobs that run to completion

Answer

Deployments provide stable network identities for Pods

Question 6

Which command correctly creates a Deployment named 'web-app' with the image 'nginx:1.21' and 3 replicas?

Accepted Answer

kubectl create deployment web-app --image=nginx:1.21 --replicas=3. `kubectl create deployment` is the imperative command specifically designed to create a Deployment resource in Kubernetes. The `--image` flag specifies the container image, and `--replicas=3` sets the desired number of pod replicas, which matches the requirement exactly.

Answer

kubectl apply deployment web-app --image=nginx:1.21 --replicas=3

Answer

kubectl run web-app --image=nginx:1.21 --replicas=3

Answer

kubectl create deployement web-app --image=nginx:1.21 --replicas=3

Question 7

A DevOps team uses Helm to manage Kubernetes applications. They want to ensure that sensitive data (e.g., database passwords) is not stored in plaintext in the Helm chart or in the cluster's ConfigMaps/Secrets. Which TWO practices should they adopt? (Choose two.)

Accepted Answer

Use an external secrets operator (e.g., AWS Secrets Manager, HashiCorp Vault) to inject secrets at runtime. Using an external secrets operator (e.g., AWS Secrets Manager, HashiCorp Vault) allows secrets to be injected directly into Pods at runtime without ever storing them in the Helm chart or as Kubernetes Secrets in plaintext. This approach leverages the Kubernetes CSI (Container Storage Interface) or a sidecar pattern to mount secrets from an external store, ensuring sensitive data never resides in the cluster's etcd or version control.

Answer

Store secrets in a separate Git repository with restricted access

Answer

Store secrets as Kubernetes Secrets and reference them in the chart values

Answer

Use Helm's built-in encryption for values files

Question 8

Which TWO are valid reasons to use a Namespace in Kubernetes?

Accepted Answer

To enforce network policies that restrict traffic between Pods in different Namespaces.. Kubernetes NetworkPolicies are namespace-scoped resources that can restrict ingress and egress traffic between Pods in different Namespaces. By default, all Pods can communicate across Namespaces, but applying a NetworkPolicy with a podSelector and namespaceSelector allows you to enforce isolation. Option C is correct because Namespaces provide a logical boundary for resource names, preventing naming collisions when multiple teams or projects deploy objects with the same name within the same cluster.

Answer

To reduce the number of API calls to the control plane.

Answer

To improve application performance by reducing latency.

Answer

To store environment variables for containers.

Question 9

A team wants to deploy a serverless function that scales to zero when not in use. Which CNCF project is specifically designed for this purpose?

Accepted Answer

Knative. Knative is the correct answer because it is a CNCF project built on Kubernetes that provides a serverless platform specifically designed to scale workloads to zero when not in use. It achieves this through its Serving component, which automatically scales pods down to zero replicas based on traffic, and scales up from zero on the first request, enabling true serverless behavior.

Answer

Helm

Answer

Prometheus

Answer

Envoy

Question 10

Which of the following describes the Open Container Initiative (OCI) image specification?

Accepted Answer

A standard for container images and runtimes. The Open Container Initiative (OCI) image specification defines a standard format for container images, ensuring that any OCI-compliant image can be run by any OCI-compliant runtime (e.g., runc, crun). This specification covers the image manifest, filesystem layers, and configuration, enabling interoperability across different container platforms like Docker, Podman, and containerd. Option A is correct because the OCI specifically standardizes both the image format and the runtime behavior, not higher-level orchestration or infrastructure concerns.

Answer

A specification for container orchestration

Answer

A specification for container storage

Answer

A specification for container networking

Question 11

In event-driven architecture, what is the role of an event broker?

Accepted Answer

It stores events and enables asynchronous communication between producers and consumers. An event broker acts as a central intermediary that receives events from producers, stores them durably (often in a log or queue), and delivers them to consumers asynchronously. This decouples producers and consumers, allowing them to operate independently without blocking or direct knowledge of each other. Technologies like Apache Kafka, RabbitMQ, or AWS Kinesis exemplify this role by persisting events and enabling replay, fan-out, and load-leveling.

Answer

It executes business logic in response to events

Answer

It provides a user interface to view events

Answer

It converts events into HTTP requests

Question 12

An administrator notices that a pod in a Deployment is stuck in CrashLoopBackOff. The pod logs show 'Error: failed to start container: exec: "app": executable file not found in $PATH'. What is the most likely cause?

Accepted Answer

The container image does not contain the binary specified in the pod's command field. The error 'exec: "app": executable file not found in $PATH' indicates that the container image does not contain the binary or script specified in the pod's command field (e.g., `command: ["app"]`). This typically happens when the image is built without the expected executable, the command path is incorrect, or the image tag points to a different version. The container fails to start because the runtime cannot locate the entrypoint.

Answer

The image registry credentials are missing

Answer

The liveness probe is misconfigured and killing the container

Answer

The container is running as a non-root user without proper permissions

Question 13

What is the primary benefit of containers over virtual machines?

Accepted Answer

Containers are more portable and lightweight because they share the host OS kernel. Containers are more portable and lightweight than virtual machines because they share the host OS kernel, eliminating the need for a separate guest OS per instance. This shared kernel approach reduces resource overhead (CPU, memory, and disk) and enables faster startup times, as containers only package the application and its dependencies without duplicating the operating system.

Answer

Containers provide stronger isolation than VMs

Answer

Containers use more disk space than VMs

Answer

Containers require a hypervisor to run

Question 14

Which TWO of the following are functions of the kube-controller-manager?

Accepted Answer

Running the node controller to monitor node health. The kube-controller-manager is a core control plane component that runs controller processes, including the node controller, which monitors node health by checking the NodeStatus and NodeLease objects. If a node becomes unreachable (e.g., the node controller fails to receive a heartbeat within the --node-monitor-grace-period, default 40 seconds), it marks the node as Unhealthy and eventually taints it to trigger pod eviction. This makes option D correct because the node controller is a built-in controller within the kube-controller-manager.

Answer

Serving the Kubernetes API

Answer

Implementing network rules for Services

Answer

Scheduling pods to nodes

Question 15

A pod is in CrashLoopBackOff. You check the logs and see 'Error: container process not found'. What is the most likely cause?

Accepted Answer

The container's entrypoint or command is incorrect. The container's entrypoint or command may be misconfigured, causing the container to exit immediately.

Answer

The pod has insufficient memory

Answer

The liveness probe is misconfigured

Answer

The container image is missing

Question 16

You create a Deployment with replicas: 3. You then scale the Deployment to 5 replicas. What is the order of operations that the Deployment controller follows?

Accepted Answer

It updates the existing ReplicaSet's replica count to 5, and the ReplicaSet creates the new pods. When you scale a Deployment, the Deployment controller updates the replica count on the existing ReplicaSet that matches the pod template. The ReplicaSet controller then observes the desired count and creates the additional pods to reach the new target. This ensures that the Deployment's rollout history and rollback capabilities remain intact.

Answer

It creates a new ReplicaSet with 5 replicas and deletes the old one

Answer

It directly creates 2 new pods without using a ReplicaSet

Answer

It creates 2 new pods immediately without modifying the existing ReplicaSet

Question 17

Which Kubernetes control plane component acts as the entry point for all administrative tasks and provides the REST API?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes REST API. All administrative tasks, such as creating pods, scaling deployments, and querying cluster state, are performed by sending HTTP requests to this component. It validates and processes these requests before storing the resulting state in etcd.

Answer

kube-scheduler

Answer

etcd

Answer

kube-controller-manager

Question 18

Which component is responsible for running containers on a Kubernetes node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each Kubernetes node. It is responsible for ensuring that containers are running in a Pod as expected, by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers based on PodSpecs received from the API server.

Answer

kube-controller-manager

Answer

kube-proxy

Answer

kube-apiserver

Question 19

What is the primary purpose of a continuous integration (CI) pipeline in cloud native application delivery?

Accepted Answer

To build and test code changes automatically. CI automates building and testing code changes to catch integration issues early, ensuring that code is always in a deployable state.

Answer

To provision infrastructure resources

Answer

To automatically deploy code to production

Answer

To manage container images in a registry

Question 20

Which of the following is a key benefit of container orchestration?

Accepted Answer

Automated scaling, self-healing, and declarative management. Container orchestration platforms like Kubernetes provide automated scaling, self-healing, and declarative management.

Answer

Manual scaling of applications

Answer

Requires manual intervention for pod failures

Answer

Only supports monolithic applications