KCNA Practice Exam 53 — 20 Questions

Question 1

Which TWO of the following are true about service discovery in Kubernetes? (Choose 2)

Accepted Answer

Environment variables are injected into pods for each Service. Option C is correct because Kubernetes injects environment variables (such as _SERVICE_HOST and _SERVICE_PORT) into every pod for each Service that exists at the time the pod is created, providing one built-in discovery mechanism. Option D is correct because CoreDNS (the cluster DNS add-on) assigns each Service a fully qualified domain name of the form ..svc.cluster.local, which pods resolve to reach the Service's ClusterIP. Option A is not correct because Ingress resources handle external HTTP/HTTPS routing into the cluster, not internal service discovery. Option B is not correct because Service discovery works cluster-wide across all nodes, not just for pods on the same node. Option E is not correct because a headless Service (clusterIP: None) deliberately has no virtual IP; it returns individual pod IPs via DNS records instead of a stable ClusterIP.

Answer

Ingress resources can be used for internal service discovery

Answer

Service discovery is only available for pods on the same node

Answer

Headless Services provide a stable virtual IP for service discovery

Question 2

Which TWO of the following are core principles of the 12-factor app? (Choose 2.)

Accepted Answer

Dependencies. Option C (Dependencies) is correct because the 12-factor app's Dependencies principle requires applications to explicitly declare and isolate all dependencies via a dependency declaration manifest (e.g., requirements.txt, Gemfile, package.json) and a dependency isolation tool (e.g., virtualenv, Bundler), so the app never relies on implicit system-wide packages. Option E (Config) is correct because the Config principle mandates storing configuration in environment variables rather than in code or checked-in files, keeping config strictly separate from the codebase so the same build can be deployed across environments. The unmarked options do not belong: Shared state (A) contradicts the stateless processes principle, which requires sharing nothing between processes and externalizing state to backing services; Manual deployment (B) contradicts the Build/Release/Run and CI/CD automation principles; and Singleton processes (D) contradicts the concurrency principle, which favors scaling out via multiple stateless processes rather than relying on a single long-lived instance.

Answer

Shared state

Answer

Manual deployment

Answer

Singleton processes

Question 3

Which TWO of the following are true about container networking basics? (Choose 2)

Accepted Answer

Containers on the same host can communicate via a bridge network. Option B is correct because containers on the same host can communicate through a bridge network, such as Docker's default bridge, where veth pairs connect container interfaces to a Linux bridge and IP forwarding enables same-host traffic. Option C is correct because each container is created with its own network namespace, giving it separate interfaces, routing tables, and IP addresses isolated from other containers and the host. Option A is incorrect because containers on different nodes can communicate via overlay networks, routing, or service meshes, not only on the same node. Option D is incorrect because container networking requires configuration such as bridge creation, IP address assignment, port mapping, or CNI plugin setup. Option E is incorrect because containers normally have their own IP addresses within their network namespace, not the host's IP address, unless using host networking mode.

Answer

Containers can only communicate if they are on the same node

Answer

Container networking does not require any configuration

Answer

All containers share the host's IP address

Question 4

Which THREE of the following are true about the Container Runtime Interface (CRI)? (Choose 3)

Accepted Answer

CRI allows kubelet to communicate with different container runtimes. Option C is correct because the Container Runtime Interface is precisely the gRPC API that kubelet uses to talk to a container runtime, decoupling Kubernetes from any single runtime implementation. Option D is correct because containerd ships a built-in CRI plugin (enabled by default) that lets kubelet use containerd directly as a CRI-compliant runtime. Option E is correct because CRI-O is a lightweight OCI-compliant container runtime built specifically to serve as a Kubernetes CRI implementation. Option A is not correct because Docker does not natively implement CRI; the historical dockershim adapter was needed to bridge kubelet to Docker, and it has since been removed. Option B is not correct because CRI is a Kubernetes project specification, not part of the Open Container Initiative, which instead defines the OCI runtime and image specifications.

Answer

Docker natively implements the CRI

Answer

CRI is part of the Open Container Initiative (OCI)

Question 5

A team uses ArgoCD with a Git repository that contains Helm charts. They want ArgoCD to automatically sync when a new image tag is pushed to the container registry. Which approach should they use?

Accepted Answer

Use ArgoCD Image Updater. ArgoCD Image Updater is a purpose-built companion tool that watches container registries for new image tags and automatically updates the Kubernetes manifests or Helm values in the Git repository that ArgoCD tracks. Once the commit lands in Git, ArgoCD's normal sync process deploys the change, preserving GitOps principles.

Answer

Use Flux Image Automation Controller

Answer

Configure a webhook from the registry to ArgoCD API server

Answer

Manually update the Helm values and commit

Question 6

Which TWO of the following are examples of Infrastructure as Code (IaC) tools? (Choose 2.)

Accepted Answer

Terraform. Terraform (A) is a declarative Infrastructure as Code tool that uses HCL configuration files and providers to provision and manage cloud and on-premises resources through a state file. Pulumi (C) is also an IaC tool, allowing infrastructure to be defined in general-purpose programming languages such as TypeScript, Python, Go, and C# and deployed via its engine. kubectl (B) is a command-line client for interacting with Kubernetes clusters, not an IaC provisioning tool. Helm (D) is a Kubernetes package manager that templates and deploys manifests, and Docker Compose (E) orchestrates multi-container Docker applications from a YAML file; both manage application deployment rather than provisioning infrastructure as code.

Answer

kubectl

Answer

Helm

Answer

Docker Compose

Question 7

Which TWO of the following are key characteristics of cloud-native applications? (Select two.)

Accepted Answer

Microservices architecture. Option B is correct because cloud-native applications are built as microservices architecture, decomposing functionality into small, independently deployable services that communicate over lightweight APIs (e.g., REST/gRPC), enabling independent scaling and resilience. Option C is correct because cloud-native apps are typically packaged and deployed in containers (e.g., Docker images orchestrated by Kubernetes), which provide portability, immutable artifacts, and fast, consistent deployment across environments. Option A is incorrect because monolithic architecture is the opposite of the loosely coupled, independently deployable services that characterize cloud-native design. Option D is incorrect because cloud-native applications rely on automated/elastic scaling (e.g., Horizontal Pod Autoscaler, auto-scaling groups) rather than manual scaling. Option E is incorrect because long-lived virtual machines reflect traditional, pet-style infrastructure, whereas cloud-native workloads favor ephemeral, disposable instances and containers managed declaratively.

Answer

Monolithic architecture

Answer

Manual scaling

Answer

Long-lived virtual machines

Question 8

Which THREE of the following are important considerations when defining SLOs (Service Level Objectives)? (Select three.)

Accepted Answer

They must be aligned with business impact. Option B is correct because SLOs must be aligned with business impact: an SLO only makes sense if the reliability target reflects what users and the business actually need, so the chosen SLI and threshold are tied to a meaningful customer or revenue outcome rather than an arbitrary technical metric. Option C is correct because SLOs must be based on measurable SLIs: an SLO is a target applied to a Service Level Indicator, so the underlying measurement (for example, request latency or success rate) must be quantifiable and observable via monitoring. Option D is correct because SLOs define a target percentage over a time window: a valid SLO takes the form of a target such as 99.9% of successful requests measured over a rolling 30-day window, giving a concrete, time-bounded reliability goal. Option A is not correct as a defining consideration because the error budget is derived from the SLO (100% minus the SLO target) rather than being a required component when defining the SLO itself. Option E is not correct because minimizing infrastructure cost is a cost-optimization concern, not a criterion for setting reliability objectives, and can even conflict with achieving the intended service level.

Answer

They should include an error budget

Answer

They should minimize infrastructure cost

Question 9

Which THREE of the following are true about the Open Container Initiative (OCI)? (Choose 3)

Accepted Answer

OCI defines both an image spec and a runtime spec. Option C is correct because the Open Container Initiative publishes two core specifications: the OCI Image Format Specification (defining image manifests, configs, and layers) and the OCI Runtime Specification (defining how to run an unpacked filesystem bundle, e.g., via runc). Option D is correct because containerd is a widely used OCI-compliant container runtime that implements the OCI runtime spec through runc and can pull/run OCI images. Option E is correct because Docker images follow the OCI Image Format Specification (Docker helped create the OCI and its image format is compatible with OCI images). Option A is incorrect because Docker is a container platform/engine, not an OCI runtime specification; the OCI runtime spec is implemented by runtimes like runc. Option B is incorrect because the OCI is an independent Linux Foundation project, not governed by the CNCF (though CNCF projects like containerd are OCI-compliant).

Answer

Docker is an OCI runtime specification

Answer

OCI is governed by the Cloud Native Computing Foundation (CNCF)

Question 10

Which component is responsible for managing the lifecycle of containers on a Kubernetes node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each Kubernetes node. It is responsible for ensuring that containers are running in a Pod as expected by interacting with the container runtime (e.g., Docker, containerd) to manage the container lifecycle—starting, stopping, and monitoring containers based on PodSpecs received from the API server.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 11

Which TWO are benefits of using a service mesh in cloud-native applications?

Accepted Answer

Advanced traffic management capabilities. Option B is correct because a service mesh provides advanced traffic management capabilities such as fine-grained routing, canary releases, blue-green deployments, retries, timeouts, circuit breaking, and traffic splitting through sidecar proxies, which are core features of tools like Istio and Linkerd. Option D is correct because service meshes automatically provision and rotate mutual TLS (mTLS) certificates between services, providing identity-based authentication and encryption-in-transit without requiring application code changes. Option A is incorrect because a service mesh does not eliminate the need for application monitoring; it enhances observability with metrics, traces, and logs, but monitoring tools and practices are still required. Option C is incorrect because persistent storage management is handled by storage classes, CSI drivers, and persistent volume claims in Kubernetes, not by a service mesh. Option E is incorrect because service meshes typically add a sidecar proxy hop that can introduce slight latency overhead rather than reduce network latency.

Answer

Eliminates need for application monitoring

Answer

Simplified persistent storage management

Answer

Reduced network latency

Question 12

You have a Deployment defined with replicas: 5. You run 'kubectl scale deployment myapp --replicas=3'. Which component is responsible for ensuring the actual number of Pods matches the desired 3?

Accepted Answer

Deployment controller in kube-controller-manager. The Deployment controller, which runs as part of the kube-controller-manager, is responsible for reconciling the desired state of a Deployment. When you run 'kubectl scale deployment myapp --replicas=3', the Deployment controller detects the change in the Deployment's replica count and creates or deletes Pods via the ReplicaSet controller to match the desired 3 replicas.

Answer

etcd

Answer

kubelet

Answer

kube-scheduler

Question 13

A company wants to run a batch job that processes data and then terminates. Which Kubernetes resource should they use?

Accepted Answer

Job. A Job is the correct Kubernetes resource for a batch job that processes data and then terminates. Unlike controllers that maintain a desired state (like Deployments), a Job creates one or more Pods and ensures they run to successful completion. Once the specified number of Pods terminate successfully, the Job is considered complete and does not restart the Pods, making it ideal for one-off or finite processing tasks.

Answer

CronJob

Answer

Deployment

Answer

DaemonSet

Question 14

A developer deploys a pod that continuously restarts. 'kubectl describe pod' shows the container exits with code 137. What is the most likely cause?

Accepted Answer

The container is exceeding its memory limit and being OOM-killed.. Exit code 137 (128 + 9) indicates the container was killed by SIGKILL. In Kubernetes, this most commonly occurs when the container exceeds its memory limit, triggering the OOM (Out-Of-Memory) killer. The kubelet enforces the resource limits specified in the pod spec, and when memory usage surpasses the limit, the kernel terminates the process with SIGKILL, resulting in exit code 137.

Answer

The liveness probe is failing and restarting the container.

Answer

The init container is failing and blocking the main container.

Answer

The pod is hitting a resource quota limit at the namespace level.

Question 15

Which Kubernetes resource is commonly used to implement the sidecar pattern for injecting a service mesh proxy?

Accepted Answer

MutatingAdmissionWebhook. A MutatingAdmissionWebhook intercepts Pod creation requests and automatically injects a sidecar container (e.g., Envoy or Linkerd-proxy) into the Pod spec. This is the standard mechanism used by service mesh control planes like Istio and Linkerd to transparently add the proxy without modifying application manifests.

Answer

NetworkPolicy

Answer

Service

Answer

ConfigMap

Question 16

Which TWO statements accurately describe the concept of immutable infrastructure in the context of container orchestration? (Select two.)

Accepted Answer

Container images are versioned and promoted through environments without modification. Immutable infrastructure treats container images as immutable artifacts that are versioned and promoted through environments (e.g., dev, staging, prod) without modification. This ensures consistency and reproducibility, as the same image is deployed across all stages without patching or altering it in place.

Answer

Configuration changes can be applied via SSH into the container

Answer

Containers are updated in place by executing commands inside running containers

Answer

Stateful applications require mutable infrastructure

Question 17

A team wants to implement a canary deployment strategy for their Kubernetes application. Which tool is specifically designed for progressive delivery and can be used to automate canary rollouts?

Accepted Answer

Argo Rollouts. Argo Rollouts is a Kubernetes controller and set of CRDs that provides advanced deployment capabilities such as blue-green and canary deployments with automated promotion and rollback.

Answer

Flux

Answer

Kustomize

Answer

Helm

Question 18

Which TWO of the following are examples of Infrastructure as Code (IaC) tools? (Choose two.)

Accepted Answer

Terraform. Terraform (B) is an Infrastructure as Code (IaC) tool that uses declarative configuration files (HashiCorp Configuration Language, HCL) to define and provision cloud and on-premises resources. It manages the full lifecycle of infrastructure through a state file and provider plugins, enabling version-controlled, repeatable deployments.

Answer

Docker

Answer

Kubernetes

Answer

Prometheus

Question 19

A team wants to minimize downtime during a Deployment rollout. Which strategy ensures that new pods are created before old pods are terminated?

Accepted Answer

Set strategy type to 'RollingUpdate' with maxSurge=1, maxUnavailable=0.. Setting `maxSurge=1` and `maxUnavailable=0` in a RollingUpdate strategy ensures that one additional pod is created above the desired replica count before any existing pod is terminated. This guarantees zero downtime by maintaining full capacity during the rollout, as new pods become ready before old ones are removed.

Answer

Set strategy type to 'Recreate'.

Answer

Set strategy type to 'RollingUpdate' with maxSurge=0, maxUnavailable=1.

Answer

Set strategy type to 'RollingUpdate' with maxSurge=1, maxUnavailable=1.

Question 20

Which component is responsible for running containers on a Kubernetes node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each Kubernetes node. It is responsible for ensuring that containers are running in a Pod as expected, by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers based on PodSpecs received from the API server.

Answer

kube-controller-manager

Answer

kube-proxy

Answer

kube-apiserver