KCNA Practice Exam 56 — 20 Questions

Question 1

What is the primary purpose of the `kubectl apply` command?

Accepted Answer

To create or update resources from a manifest. The `kubectl apply` command uses a declarative approach to manage Kubernetes resources. It sends a PATCH request to the API server, which compares the desired state in the provided manifest (YAML/JSON) with the current state of the resource in the cluster. If the resource does not exist, it creates it; if it does exist, it updates only the fields specified in the manifest, preserving any fields not mentioned.

Answer

To view resource details

Answer

To delete resources

Answer

To execute commands inside a container

Question 2

A developer has created a Deployment with 3 replicas. The application should be reachable from other Pods within the same cluster. Which Kubernetes resource should be used to provide a stable network endpoint?

Accepted Answer

Service. A Service provides a stable network endpoint (ClusterIP) that load-balances traffic across the Pod replicas, abstracting away Pod IP changes due to restarts or scaling. This allows other Pods within the cluster to reach the application reliably using the Service's DNS name, without needing to track individual Pod IPs.

Answer

Ingress

Answer

PersistentVolumeClaim

Answer

ConfigMap

Question 3

A pod in a ReplicaSet is failing with 'CrashLoopBackOff'. 'kubectl logs pod' shows 'Error: listen tcp :8080: bind: address already in use'. What is the most likely cause?

Accepted Answer

The container's process is not terminating quickly enough on SIGTERM, causing a port conflict on restart.. The error 'address already in use' on port 8080 indicates that when the container restarts, the previous process is still holding the port. This typically happens when the application does not handle SIGTERM properly and does not shut down within the terminationGracePeriodSeconds (default 30s), so the old process lingers while the new one tries to bind to the same port, causing a CrashLoopBackOff.

Answer

The readiness probe is misconfigured.

Answer

The container image is missing the application binary.

Answer

The pod is using hostPort and two pods on the same node conflict.

Question 4

A team deploys a microservice that requires sticky sessions. The service runs on Kubernetes with multiple replicas. Which Kubernetes resource should be used to ensure requests from a client are consistently routed to the same pod?

Accepted Answer

Service with sessionAffinity: ClientIP. Setting `sessionAffinity: ClientIP` on a Kubernetes Service ensures that all requests from the same client IP are routed to the same Pod. This is the standard Kubernetes mechanism for implementing sticky sessions without requiring changes to the application or ingress layer.

Answer

Headless Service

Answer

Ingress with default settings

Answer

Deployment with hostNetwork: true

Question 5

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The OOMKilled status indicates the container was terminated because it exceeded its memory limit. Increasing the memory limit in the pod's container resource specification directly addresses the root cause by allowing the container to use more memory before being killed. This is the most appropriate action because the pod was running successfully for days, suggesting a gradual memory growth or a recent workload change rather than a configuration error.

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Question 6

A Deployment named 'myapp' is managing a ReplicaSet. You need to update the application image to version 2.0. What is the recommended approach?

Accepted Answer

Update the Deployment's pod template image to version 2.0. The recommended approach to update a Deployment's application image is to modify the pod template in the Deployment specification. The Deployment controller then automatically performs a rolling update, creating a new ReplicaSet with the updated image and gradually scaling down the old ReplicaSet, ensuring zero-downtime updates and maintaining desired replica count.

Answer

Scale down the Deployment to 0 replicas, then scale up with the new image

Answer

Delete the existing ReplicaSet and create a new one with the updated image

Answer

Directly update the pods in the ReplicaSet by using 'kubectl edit pod'

Question 7

A pod is running but its container exits with code 137. The pod logs show 'Killed'. What is the most likely cause?

Accepted Answer

The container was OOMKilled due to memory limit. Exit code 137 (128 + 9) indicates the container was terminated by SIGKILL. Combined with 'Killed' in logs, this is the definitive signature of an OOMKill event, where the Linux kernel's Out-Of-Memory (OOM) killer terminates the container process because it exceeded its memory limit (specified in the pod's resource limits). Kubernetes enforces memory limits via cgroups, and when the container's memory usage surpasses the limit, the OOM killer sends SIGKILL, resulting in exit code 137.

Answer

The container's CPU limit was exceeded

Answer

The container's liveness probe failed

Answer

The node ran out of disk space

Question 8

Refer to the exhibit. The deployment above is created, but the pods are not receiving traffic from the associated Service. The Service selector matches 'app: web'. The Service endpoints list is empty. What is the most likely cause?

Accepted Answer

The readiness probe endpoint /health does not exist in the nginx container. A readiness probe that fails (e.g., the /health endpoint does not exist in the nginx container) will cause the pod to be marked as not ready. Kubernetes removes pods with failing readiness probes from the Service's endpoints list, resulting in an empty endpoints list even though the Service selector matches the pod labels. This is a common misconfiguration where the probe endpoint is not actually served by the container.

Answer

The Service selector does not match the pod labels

Answer

The containerPort is set to 80, but the Service targetPort is 8080

Answer

The nginx:1.21 image is not available in the container registry

Question 9

Which TWO of the following are Kubernetes control plane components?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes API. It validates and processes RESTful requests (using JSON/YAML over HTTP/HTTPS) that create, update, or delete cluster resources, and it is the only component that communicates directly with etcd. Without the API server, no control plane operations can be performed.

Answer

container runtime

Answer

kube-proxy

Answer

kubelet

Question 10

In event-driven architecture, which component is responsible for decoupling event producers from consumers?

Accepted Answer

Event broker. The event broker (e.g., Apache Kafka, RabbitMQ, or AWS EventBridge) acts as an intermediary that receives events from producers and forwards them to consumers. By decoupling the two, the producer does not need to know the consumer's location or status, and the consumer does not need to be actively listening when the event is published. This enables asynchronous, scalable, and fault-tolerant communication in event-driven architectures.

Answer

Event consumer

Answer

Event producer

Answer

API gateway

Question 11

What is the Container Runtime Interface (CRI)?

Accepted Answer

A plugin interface that allows kubelet to use a variety of container runtimes. The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to communicate with different container runtimes (e.g., containerd, CRI-O) without needing to know their internal implementation details. It defines a gRPC-based protocol for managing container lifecycles, image operations, and pod sandboxes, allowing Kubernetes to remain runtime-agnostic.

Answer

A specification for container images

Answer

A registry for storing container images

Answer

A command-line tool for managing containers

Question 12

What is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. The Pod is the smallest deployable unit in Kubernetes because it represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. While containers are the runtime units, Kubernetes schedules and manages Pods, not individual containers, making the Pod the atomic building block for deployment.

Answer

Deployment

Answer

Container

Answer

Node

Question 13

Which THREE of the following are benefits of using a service mesh? (Choose 3.)

Accepted Answer

Security. A service mesh, such as Istio or Linkerd, offloads cross-cutting concerns from application code into a dedicated infrastructure layer. Security is a core benefit because the service mesh can enforce mutual TLS (mTLS) between all service-to-service communications, providing encryption, identity verification, and fine-grained access policies without modifying application code.

Answer

Database management

Answer

Code compilation

Question 14

Drag and drop the steps to scale a Kubernetes Deployment horizontally into the correct order.

Accepted Answer

Run `kubectl scale` deployment, then check pods are created, then verify deployment status, then monitor rollout, then adjust resources if needed.. Scale command, check pods, verify deployment, monitor rollout, and adjust resources if needed.

Answer

Check pods are created, then run `kubectl scale` deployment, then verify deployment status, then monitor rollout, then adjust resources if needed.

Answer

Run `kubectl scale` deployment, then verify deployment status, then check pods are created, then monitor rollout, then adjust resources if needed.

Answer

Monitor rollout, then run `kubectl scale` deployment, then check pods are created, then verify deployment status, then adjust resources if needed.

Question 15

Which deployment strategy updates pods incrementally, replacing old pods with new ones while ensuring availability?

Accepted Answer

Rolling update. The Rolling update strategy is the correct answer because it incrementally replaces old pods with new ones while maintaining application availability. In Kubernetes, a rolling update updates pods one by one (or in small batches), ensuring that a specified number of pods remain available throughout the process. This is achieved by gradually scaling down the old ReplicaSet and scaling up the new one, controlled by parameters like `maxSurge` and `maxUnavailable` in the Deployment spec.

Answer

Canary deployment

Answer

Blue-green deployment

Answer

Recreate

Question 16

Which service mesh provides built-in support for multi-cluster and multi-cloud deployments?

Accepted Answer

Istio. Istio is correct because it provides native support for multi-cluster and multi-cloud deployments through its mesh federation capabilities, including features like multi-primary and primary-remote cluster models, as well as east-west gateways for cross-cluster traffic. It leverages Envoy proxies and a unified control plane to enable service discovery, traffic management, and security across clusters, making it the only option among the listed that offers built-in, production-ready multi-cluster support.

Answer

Kuma

Answer

Consul Connect

Answer

Linkerd

Question 17

Which of the following is a benefit of container orchestration?

Accepted Answer

Self-healing of failed containers. Container orchestration platforms like Kubernetes provide self-healing capabilities by automatically restarting failed containers, rescheduling them on healthy nodes, and replacing or terminating containers that fail health checks. This ensures high availability and reduces manual intervention, which is a core benefit of orchestration.

Answer

Requires a hypervisor for each container

Answer

Manual scaling of containers

Answer

Static infrastructure with no changes

Question 18

Drag and drop the steps to create a ConfigMap from a file in Kubernetes into the correct order.

Accepted Answer

Prepare the file, then create the ConfigMap, then verify it, then describe it, then use it in a Pod.. The correct sequence to create a ConfigMap from a file in Kubernetes is: first prepare the configuration file, then create the ConfigMap using kubectl create configmap, next verify the ConfigMap with kubectl get configmaps, then optionally describe it with kubectl describe configmap, and finally use it in a Pod as environment variables or volume mounts. This order ensures the ConfigMap is available and correctly configured before consumption.

Answer

Prepare the file, then create the ConfigMap, then describe it, then verify it, then use it in a Pod.

Answer

Prepare the file, then create the ConfigMap, then use it in a Pod, then verify it, then describe it.

Answer

Create the ConfigMap, then prepare the file, then verify it, then describe it, then use it in a Pod.

Question 19

Match each cloud native concept to its definition.

Accepted Answer

Microservices: An architectural style that structures an application as a collection of loosely coupled services.. The correct matches are: Microservices with loosely coupled services, Service Mesh with service-to-service communication, Serverless with cloud provider managing resources, and Orchestration with automated management. Common confusions include swapping definitions between Microservices and Service Mesh, or between Serverless and Orchestration.

Answer

Microservices: A dedicated infrastructure layer for handling service-to-service communication.

Answer

Serverless: The automated configuration, coordination, and management of computer systems.

Question 20

Which service mesh component is responsible for handling inter-service communication as a sidecar proxy?

Accepted Answer

Envoy. Envoy is the correct answer because it is the sidecar proxy component in Istio that handles all inter-service communication. It intercepts traffic between microservices and applies routing, load balancing, and security policies defined by the control plane. Envoy runs as a sidecar container alongside each service instance, managing inbound and outbound traffic at the L4/L7 layer.

Answer

Mixer

Answer

Pilot

Answer

Citadel