KCNA Practice Exam 55 — 20 Questions

Question 1

When using a Service of type ClusterIP, how do pods reach the service?

Accepted Answer

Via the service's cluster IP and port. A Service of type ClusterIP exposes a stable virtual IP (the cluster IP) and port within the cluster. Pods reach the Service by sending traffic to this cluster IP and port, which is then load-balanced by kube-proxy (using iptables, IPVS, or eBPF rules) to one of the backing pod endpoints. This is the default and most fundamental Service type in Kubernetes.

Answer

Via the node's IP address and a high port

Answer

Via an external load balancer

Answer

Directly via the pod's IP address

Question 2

A Deployment is created with `replicas: 3`. After applying the manifest, only 2 pods are running and one is in Pending state. What is the most likely reason?

Accepted Answer

There are insufficient resources on the nodes. When a Pod remains in Pending state, it means the scheduler cannot find a node that satisfies the Pod's resource requirements (CPU, memory, or other constraints). Since two Pods are running successfully, the Deployment configuration (image, name, selector) is valid, and the issue is that the cluster lacks sufficient capacity to schedule the third replica. The scheduler continuously evaluates node resources and will leave the Pod pending until resources become available or the request is adjusted.

Answer

The Service selector does not match

Answer

The Deployment name is misspelled

Answer

The container image is invalid

Question 3

Which TWO of the following are characteristics of Kustomize?

Accepted Answer

Supports patching resources via patchesStrategicMerge. Option C is correct because Kustomize natively supports patchesStrategicMerge, a strategic merge patch mechanism that lets you modify specific fields of base Kubernetes resources without rewriting the whole manifest. Option E is correct because Kustomize's core model is bases plus overlays: a base holds common resources, and overlays apply environment-specific customizations on top of it. Option A is wrong because values.yaml is a Helm convention; Kustomize uses kustomization.yaml files instead. Option B is wrong because Kustomize is explicitly template-free and works by merging and patching YAML rather than rendering Go templates like Helm. Option D is wrong because chart dependency management is a Helm feature, not a Kustomize capability.

Answer

Requires a values.yaml file for configuration

Answer

Uses a templating engine similar to Helm

Answer

Can manage dependencies between charts

Question 4

You need to run a stateful application that requires stable network identities and persistent storage per pod. Which Kubernetes resource is BEST suited?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it is specifically designed for stateful applications that require stable, unique network identifiers (e.g., pod names like `web-0`, `web-1`) and persistent storage that persists across pod rescheduling. Each pod in a StatefulSet gets a dedicated PersistentVolumeClaim, and the ordinal index ensures consistent identity, which is critical for databases like Cassandra or MySQL.

Answer

DaemonSet

Answer

Job

Answer

Deployment

Question 5

A platform team wants to implement observability for a Kubernetes cluster running 500+ microservices. They need to reduce the cost of storing logs while retaining the ability to search for specific error patterns. Which strategy best achieves this?

Accepted Answer

Use structured logging and sample debug logs, retaining error logs fully. Structured logging (e.g., JSON format) enables efficient indexing and querying of logs, while sampling debug logs and retaining error logs fully reduces storage costs without losing critical error patterns. This approach balances observability needs with cost optimization, a key principle in cloud-native environments.

Answer

Increase log retention to one year for compliance

Answer

Store all logs in a centralized Elasticsearch cluster with high retention

Answer

Aggregate logs into a single pod for easier indexing

Question 6

A cluster administrator needs to ensure that a Deployment named 'frontend' in namespace 'web' is updated with a new image version using a rolling update strategy. The current deployment has 4 replicas. The administrator runs: kubectl set image deployment/frontend frontend=nginx:1.21 -n web. Which of the following describes the expected behavior?

Accepted Answer

The Deployment will create a new ReplicaSet and gradually replace old pods with new ones. `kubectl set image deployment/frontend frontend=nginx:1.21 -n web` updates the container image in the Deployment's pod template, triggering a rolling update. The Deployment controller creates a new ReplicaSet with the updated image and gradually scales it up while scaling down the old ReplicaSet, ensuring zero downtime and maintaining the desired replica count of 4.

Answer

All existing pods will be deleted immediately and new pods will be created with the new image

Answer

The command will fail because you cannot update a Deployment using kubectl set image

Answer

The Deployment's image will be updated, but only the container named 'app' will be affected

Question 7

Which TWO are benefits of using a container orchestration platform like Kubernetes? (Select TWO.)

Accepted Answer

Automatic service discovery and load balancing. Option C is correct because Kubernetes provides built-in service discovery through Services and DNS (CoreDNS), automatically routing traffic to healthy Pods and distributing load across replicas via kube-proxy, eliminating manual endpoint configuration. Option D is correct because Kubernetes controllers such as the ReplicaSet and kubelet continuously reconcile desired state, automatically restarting or rescheduling failed containers to maintain the declared replica count. Option A is incorrect because orchestration platforms are designed to reduce operational complexity by abstracting infrastructure management, not increase application complexity. Option B is incorrect because Kubernetes runs containers via a container runtime (containerd, CRI-O) on shared nodes; it does not require a dedicated hypervisor per container. Option E is incorrect because Kubernetes supports automatic horizontal scaling through the Horizontal Pod Autoscaler (HPA) based on CPU, memory, or custom metrics, rather than requiring manual scaling.

Answer

Increases application complexity

Answer

Requires a dedicated hypervisor for each container

Answer

Manual scaling of applications

Question 8

Which TWO statements are true about Kubernetes namespaces? (Select 2)

Accepted Answer

Resource quotas can be applied to a namespace to limit resource usage. Option C is correct because ResourceQuota objects are applied at the namespace level to cap aggregate resource consumption (e.g., requests.cpu, limits.memory, pods) for all workloads within that namespace. Option D is correct because namespaces are the standard Kubernetes mechanism for logical multi-tenancy, allowing teams to isolate dev, staging, and prod workloads with separate RBAC, quotas, and naming scopes. Option A is wrong because several resources are cluster-scoped rather than namespaced, such as Node, PersistentVolume, ClusterRole, and Namespace itself. Option B is wrong because namespaces do not enforce network isolation by default; that requires NetworkPolicy objects (and a CNI plugin that supports them). Option E is wrong because deleting a namespace cascades to its namespaced resources only, not cluster-scoped resources, which persist independently.

Answer

All Kubernetes resources are namespaced

Answer

Namespaces provide network isolation by default

Answer

Deleting a namespace automatically deletes all resources in it, including cluster-scoped resources

Question 9

A team wants to visualize metrics from Prometheus in a dashboard. Which tool is commonly used for this purpose?

Accepted Answer

Grafana. Grafana is the de facto standard visualization tool for Prometheus metrics, connecting to Prometheus as a data source and rendering dashboards, graphs, and alerts. It supports PromQL queries directly and is widely deployed alongside Prometheus in Kubernetes environments.

Answer

Alertmanager

Answer

Jaeger UI

Answer

Kibana

Question 10

A team is designing a cloud-native application that requires each microservice to have its own database. This pattern is known as:

Accepted Answer

Database-per-service pattern. The Database-per-service pattern is the correct answer because it ensures each microservice owns and manages its own database, enforcing loose coupling and data encapsulation. This aligns with the cloud-native principle of decentralized data management, where services communicate only via APIs and never access each other's databases directly. It prevents tight coupling at the data layer, which is critical for independent scaling, deployment, and resilience in a microservices architecture.

Answer

Saga pattern

Answer

Shared database pattern

Answer

CQRS pattern

Question 11

A pod is stuck in Pending state. You run 'kubectl describe pod' and see the event '0/3 nodes are available: 1 node(s) had taint(s) that the pod didn't tolerate, 2 node(s) had insufficient memory.'. What is the most likely cause?

Accepted Answer

The pod does not have tolerations for the node's taints and memory is insufficient on other nodes. The event '0/3 nodes are available: 1 node(s) had taint(s) that the pod didn't tolerate, 2 node(s) had insufficient memory' directly indicates that the pod failed scheduling because it lacks required tolerations for a tainted node, and the remaining nodes do not have enough memory to satisfy the pod's resource requests. This matches option A, as the pod's tolerations are missing for the tainted node, and memory is insufficient on the other two nodes.

Answer

The kube-scheduler is not running

Answer

The container runtime is not installed on any node

Answer

The pod's resource requests exceed available resources on all nodes

Question 12

Which Kubernetes resource is used to run a batch job that runs to completion?

Accepted Answer

Job. A Kubernetes Job is specifically designed to run a finite task to completion, creating one or more Pods and ensuring they successfully terminate. Unlike controllers that maintain a desired state of running Pods, a Job tracks the number of successful completions and stops when the specified parallelism or completions count is reached.

Answer

DaemonSet

Answer

StatefulSet

Answer

Deployment

Question 13

A developer has created a Deployment with 3 replicas. The application should be reachable from other Pods within the same cluster. Which Kubernetes resource should be used to provide a stable network endpoint?

Accepted Answer

Service. A Service provides a stable network endpoint (ClusterIP) that load-balances traffic across the Pod replicas, abstracting away Pod IP changes due to restarts or scaling. This allows other Pods within the cluster to reach the application reliably using the Service's DNS name, without needing to track individual Pod IPs.

Answer

Ingress

Answer

PersistentVolumeClaim

Answer

ConfigMap

Question 14

Which deployment strategy is characterized by gradually shifting traffic from an old version to a new version of an application, often requiring a service mesh or ingress controller to manage traffic splitting?

Accepted Answer

Canary deployment. A canary deployment gradually shifts a small percentage of traffic to the new version while the majority still hits the old version, allowing observation of metrics before full rollout. This traffic splitting is typically implemented via a service mesh (Istio, Linkerd) or an ingress controller (NGINX, Traefik) that supports weighted routing.

Answer

Rolling update

Answer

Blue-green deployment

Answer

Recreate

Question 15

Which two components are part of the Kubernetes worker node? (Select TWO)

Accepted Answer

kubelet. The kubelet (A) is correct because it is the primary node agent that runs on every worker node, registering the node with the API server and ensuring containers described in PodSpecs are running and healthy. The container runtime (E) is correct because the worker node needs a CRI-compliant runtime such as containerd or CRI-O to actually pull images and run containers. The kube-controller-manager (B), etcd (C), and kube-scheduler (D) are all control plane components that typically run on master nodes, not on worker nodes, so they are not part of the worker node.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 16

You need to store a sensitive database password in Kubernetes. Which resource should you use?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the data in base64 and is designed to be consumed securely by pods, with access controlled via RBAC. Unlike ConfigMaps, Secrets are not intended for non-sensitive configuration and provide a layer of separation for confidential information.

Answer

PersistentVolume

Answer

ConfigMap

Answer

ServiceAccount

Question 17

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/4 nodes are available: 4 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod requires more memory than any node can allocate. The error message '0/4 nodes are available: 4 Insufficient memory' directly indicates that the pod's memory request exceeds the allocatable memory on every node in the cluster. The Kubernetes scheduler evaluates resource requests (spec.containers[].resources.requests.memory) against node capacity, and if no node can satisfy the request, the pod remains in Pending state.

Answer

All nodes have taints that the pod cannot tolerate

Answer

The pod's liveness probe is failing

Answer

The container image is not found

Question 18

A pod is running but you need to view the contents of a file '/var/log/app.log' inside the container to debug an issue. Which kubectl command allows you to do this without modifying the pod?

Accepted Answer

kubectl exec pod-name -- cat /var/log/app.log. `kubectl exec pod-name -- cat /var/log/app.log` runs the `cat` command inside the container without modifying the pod or its state. This allows you to view the file contents directly from the container's filesystem, which is essential for debugging when the application logs are not written to stdout/stderr and thus not accessible via `kubectl logs`.

Answer

kubectl logs pod-name -c container-name --tail=100

Answer

kubectl cp pod-name:/var/log/app.log -

Answer

kubectl attach pod-name

Question 19

Which GitOps tools use a pull-based approach to synchronize the desired state in a Git repository with the actual state in a Kubernetes cluster? (Select all that apply.)

Accepted Answer

Flux. Both Flux and ArgoCD are pull-based GitOps tools. Flux pioneered the pull-based pattern, while ArgoCD is also a popular implementation. Therefore, both A and D are correct.

Answer

Terraform

Answer

Helm

Question 20

Which THREE of the following are valid container runtimes that can be used with Kubernetes via the Container Runtime Interface (CRI)? (Select three.)

Accepted Answer

containerd. B is correct because containerd is a core container runtime that implements the CRI (Container Runtime Interface) directly via its built-in CRI plugin. It was extracted from Docker and is now the default runtime in many Kubernetes distributions, handling image management, container lifecycle, and execution without requiring an external shim.

Answer

rkt

Answer

Docker