KCNA Practice Exam 57 — 20 Questions

Question 1

A developer wants to store non-confidential configuration data as key-value pairs that can be consumed by Pods as environment variables or mounted files. Which Kubernetes resource is designed for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ConfigMap. ConfigMaps are the standard Kubernetes resource for managing non-confidential configuration data. They allow you to decouple configuration artifacts from image content, and Pods can consume them as environment variables or mounted files. Secrets are for sensitive data, while Volumes and PersistentVolumeClaims are storage abstractions, not configuration stores.

Answer

PersistentVolumeClaim

Answer

Volume

Answer

Secret

Question 2

A company is evaluating cloud-native observability practices for its Kubernetes-based microservices. Which TWO practices are essential for achieving effective observability? (Choose two.)

Accepted Answer

Aggregating logs into a centralized system. Effective observability in cloud-native systems relies on the three pillars: metrics, logs, and traces. Collecting metrics and aggregating logs are foundational because they provide quantitative and qualitative insights into distributed applications. Together they enable monitoring, alerting, and debugging across ephemeral and dynamic environments.

Answer

Storing all data in a single monolithic database

Answer

Disabling health checks to reduce overhead

Answer

Using only manual inspection of individual pod logs

Question 3

A platform engineer is designing a multi-tenant cluster. They want to ensure that a specific team's workloads can only be scheduled onto nodes labeled `team=blue`, and that workloads from other teams cannot be scheduled there. The team's Pods should not run on any other nodes. Which combination of Kubernetes features should the engineer use to enforce this?

Accepted Answer

nodeSelector on the Pods plus taints and tolerations on the nodes.. Dedicated node pools are implemented by combining attraction and repulsion. nodeSelector or nodeAffinity pulls the team's Pods toward nodes labeled team=blue, while a taint on those nodes, paired with a toleration on the Pods, keeps other workloads away. Neither feature alone provides full isolation: nodeSelector without a taint lets others share the node, and a taint without nodeSelector lets the team's Pods land elsewhere.

Answer

NetworkPolicy applied to the team's namespace with a node selector.

Answer

Pod affinity rules alone, using requiredDuringSchedulingIgnoredDuringExecution.

Answer

ResourceQuota and LimitRange applied to the team's namespace.

Question 4

A platform engineer wants to restrict a Pod so that it runs only on nodes that have the label disktype=ssd. The engineer adds a nodeSelector field to the Pod specification. Which statement best describes the effect of nodeSelector in this scenario?

Accepted Answer

The Pod is scheduled only onto nodes whose labels match all specified key-value pairs.. nodeSelector is a hard constraint that filters the node set to those containing all specified labels. The scheduler binds the Pod only to a matching node; otherwise the Pod remains Pending. This makes it suitable for simple placement requirements such as selecting SSD-backed nodes. The other descriptions confuse nodeSelector with soft preferences, kubelet behavior, or label existence checks, all of which are inaccurate.

Answer

The Pod is scheduled only onto nodes that have at least one label, regardless of the label value.

Answer

The Pod is scheduled onto any node, but nodes without the label are given lower priority.

Answer

The Pod can run on any node, but the kubelet on unlabeled nodes refuses to start the container.

Question 5

A developer creates a Pod with a single container that writes logs to stdout. The Pod is scheduled and running, but the developer needs to view the logs from the past hour. Which kubectl command should the developer use?

Accepted Answer

kubectl logs mypod --since=1h. Container logs are captured from stdout and stderr by the container runtime and exposed through kubectl logs. The --since flag filters entries by relative time, so --since=1h returns exactly the last hour. Describing the Pod, executing commands inside the container, or listing events all fail to retrieve the application's stdout logs.

Answer

kubectl get events --field-selector involvedObject.name=mypod

Answer

kubectl describe pod mypod

Answer

kubectl exec mypod -- cat /var/log/app.log

Question 6

A Kubernetes operator wants to view real-time CPU and memory usage of pods and nodes in a cluster using kubectl top. Which component must be installed and running in the cluster for this command to work?

Accepted Answer

metrics-server. kubectl top retrieves metrics from the Kubernetes Metrics API, which is implemented by the metrics-server. The metrics-server collects resource usage data from Kubelets and makes it available through the API. Other tools like Prometheus or kube-state-metrics serve different purposes and do not power kubectl top, so metrics-server is the correct component to install.

Answer

Prometheus

Answer

kube-state-metrics

Answer

OpenTelemetry Collector

Question 7

A DevOps engineer is designing a Kubernetes architecture for a stateful application that requires stable network identities and persistent storage across pod rescheduling. The engineer needs to choose the appropriate Kubernetes resource types to meet these requirements. Which two resources should the engineer use? (Choose two.)

Accepted Answer

StatefulSet. StatefulSet is the workload controller that provides stable network identities and ordered management for stateful applications. PersistentVolumeClaim, when used in a StatefulSet's volumeClaimTemplates, ensures each pod gets its own persistent storage that survives rescheduling. Together, they meet the requirements for stable identity and persistent data.

Answer

DaemonSet

Answer

ConfigMap

Answer

Deployment

Question 8

A developer needs to provide a pod with a persistent volume that must be mounted by multiple pods simultaneously for read-write access. The underlying storage system supports concurrent writes from multiple nodes. Which volume type should be used?

Accepted Answer

ReadWriteMany (RWX). The access mode ReadWriteMany (RWX) allows a persistent volume to be mounted as read-write by multiple nodes, enabling multiple pods to write concurrently. This is essential for shared storage scenarios like a shared database or file server. The underlying storage plugin must support RWX; not all storage systems do. ReadWriteOnce and ReadWriteOncePod are limited to a single node or pod, respectively, and ReadOnlyMany is read-only.

Answer

ReadWriteOncePod (RWOP)

Answer

ReadOnlyMany (ROX)

Answer

ReadWriteOnce (RWO)

Question 9

An SRE team is reviewing a stateless web tier that runs as a Deployment. They want the platform to automatically add replicas when average CPU utilization across the Pods rises above a target, and to remove replicas when load drops, without any manual intervention. Which Kubernetes resource should they configure?

Accepted Answer

HorizontalPodAutoscaler. The HorizontalPodAutoscaler is the controller that reads metrics such as average CPU utilization and adjusts a Deployment's replica count within a min/max range. The VerticalPodAutoscaler resizes individual Pods, Cluster Autoscaler resizes the node pool, and PodDisruptionBudget only protects availability during voluntary disruptions, so none of them provide demand-driven replica scaling.

Answer

PodDisruptionBudget

Answer

Cluster Autoscaler

Answer

VerticalPodAutoscaler

Question 10

A site reliability engineer is investigating high latency in a microservices application. They have distributed traces but need to understand how a single trace spans multiple services and where time is spent. Which OpenTelemetry concept allows correlating spans across service boundaries into a single trace?

Accepted Answer

Context propagation. Context propagation carries trace and span identifiers across service calls, allowing spans from different services to be stitched into one distributed trace. Resource attributes describe the producer, span status indicates success or failure, and metric exemplars link metrics to traces, but none of these provide the cross-service linkage required. Therefore, context propagation is the concept that enables end-to-end trace correlation.

Answer

Metric exemplars

Answer

Resource attributes

Answer

Span status

Question 11

A platform engineer is troubleshooting a Pod stuck in the Pending state and wants to identify scheduling-related causes. Which two commands or outputs are most useful for diagnosing why the scheduler cannot place the Pod? (Choose two.)

Accepted Answer

kubectl get events --field-selector involvedObject.name=<pod-name>. Scheduling failures are reported as events on the Pod object. Both kubectl describe pod and a field-selector-filtered kubectl get events expose FailedScheduling messages that name the blocking predicate, such as insufficient resources or an unsatisfied node affinity. Node listings and container logs or exec sessions cannot reveal scheduler decisions for a Pod that has never been bound to a node.

Answer

kubectl get nodes and review the STATUS and Allocatable columns

Answer

kubectl exec -it <pod-name> -- /bin/sh to inspect the node from inside

Answer

kubectl logs <pod-name> to read the container startup output

Question 12

A team runs a stateless web application and wants to update its container image with zero downtime while gradually shifting traffic to the new version. They also need the ability to pause the rollout, inspect the new Pods, and then resume. Which Kubernetes workload and strategy best supports this workflow?

Accepted Answer

A Deployment using the RollingUpdate strategy with maxSurge and maxUnavailable.. A Deployment with the RollingUpdate strategy is the standard Kubernetes mechanism for zero-downtime, incremental updates of stateless applications. maxSurge and maxUnavailable let the team tune how many extra and unavailable Pods are allowed during the transition. The 'kubectl rollout pause' and 'kubectl rollout resume' commands support inspecting the new revision before completing the rollout.

Answer

A StatefulSet with the OnDelete update strategy.

Answer

A CronJob scheduled to delete old Pods at a fixed interval.

Answer

A Job with parallelism set to the desired replica count.

Question 13

A team is designing a cloud-native application and wants to ensure that the failure of a single availability zone does not cause a full outage. They deploy the application across multiple zones and configure the orchestrator to distribute replicas evenly. Which cloud-native architecture principle does this scenario primarily demonstrate?

Accepted Answer

Design for failure. The scenario describes spreading replicas across multiple availability zones so that a single zone failure does not cause a full outage. This is the essence of designing for failure, where redundancy and fault isolation are built into the architecture. While other principles like declarative configuration or loose coupling may also be present, they do not directly address surviving a zone-level failure.

Answer

Loose coupling

Answer

Declarative configuration

Answer

Immutable infrastructure

Question 14

A developer runs `kubectl apply -f pod.yaml` against a cluster running Kubernetes v1.29. The Pod manifest sets `spec.restartPolicy: Always` and `spec.containers[0].name: app`. The Pod starts successfully but the developer wants to change the container image from `nginx:1.24` to `nginx:1.25`. They edit the YAML file and re-run `kubectl apply -f pod.yaml`. What is the result?

Accepted Answer

The apply fails with an error indicating that the Pod spec is invalid or cannot be updated.. Pods have a largely immutable spec once created. Changing the container image via `kubectl apply` is rejected by the API server with an immutable-field error. The intended workflow for image updates is to use a controller such as a Deployment, which creates a new ReplicaSet and new Pods. For a bare Pod, you must delete it and recreate it with the new image.

Answer

The apply succeeds but the change is silently ignored because Pods are managed by the kubelet.

Answer

The existing Pod is patched in place and the container image is updated without restarting the Pod.

Answer

The Pod is deleted and recreated with the new image because Pods are immutable.

Question 15

A CI pipeline builds a container image and tags it only as latest before pushing to a registry. A release engineer needs to deploy a specific, immutable version and be able to roll back to a known good build. What is the best practice to adopt?

Accepted Answer

Tag each image with the Git commit SHA and deploy that immutable tag.. Immutable, traceable tags let a deployment reference an exact build and make rollback deterministic. A Git commit SHA uniquely identifies the source revision, so the same tag always resolves to the same image content, unlike latest or timestamp-based tags.

Answer

Keep using latest but enable imagePullPolicy: Always on all Pods.

Answer

Push images to multiple registries and deploy from whichever responds fastest.

Answer

Tag images with the build timestamp and deploy the newest tag each time.

Question 16

An administrator runs `kubectl get pods -n finance` and sees a Pod named `report-0` that is Running but not Ready. The Pod's container has a readiness probe configured with `httpGet` on path `/healthz` port 8080. Logs show the application is running and serving requests on port 8080. Which condition most likely explains why the Pod is Running but not Ready?

Accepted Answer

The readiness probe endpoint `/healthz` returns a non-2xx status code or times out, so kubelet marks the container as not ready.. Readiness probes determine whether a container should receive traffic. When the HTTP GET to `/healthz` fails or times out, kubelet marks the container not ready while leaving the process running, producing exactly the Running-but-not-Ready state. Liveness failures cause restarts, and scheduling or storage issues do not selectively block readiness in the way described.

Answer

The Pod's liveness probe has failed repeatedly and kubelet is restarting the container, which temporarily reports not ready.

Answer

The Pod has no resource requests, so the scheduler has not fully allocated CPU and the readiness gate remains closed.

Answer

The Pod is using a hostPath volume that is not writable, causing the readiness probe to fail at the filesystem level.

Question 17

A developer creates a Pod with a container that writes data to /var/log/app.log inside the container. The Pod is deleted and recreated, and the log file is gone. Which Kubernetes volume type would preserve the log file across Pod restarts on the same node?

Accepted Answer

hostPath. hostPath mounts a node-local directory into the Pod, so data written there survives Pod deletion and is available when a new Pod is scheduled to the same node. emptyDir is ephemeral and tied to the Pod, while configMap and secret are read-only configuration mechanisms, not persistent storage for application logs.

Answer

configMap

Answer

secret

Answer

emptyDir

Question 18

An administrator manages a cluster where a Namespace named 'analytics' contains a ResourceQuota that limits pods to 10. A developer applies a manifest containing a ReplicaSet with replicas: 12 in that Namespace. The ReplicaSet controller creates the first 10 Pods successfully, but the remaining 2 Pods are rejected. Which statement best describes what the developer will observe and why?

Accepted Answer

The ReplicaSet status shows fewer ready replicas than desired, and the events for the ReplicaSet include quota-related failures for the denied Pods.. ResourceQuota is enforced by an admission controller in the API server, so Pod creation requests beyond the allowed count are rejected outright. The ReplicaSet controller continues to reconcile toward 12 replicas, records FailedCreate events describing the quota violation, and reports status with fewer ready replicas than desired. No extra Pod objects are persisted, and the ReplicaSet spec is not automatically lowered.

Answer

The ReplicaSet scales itself down to 10 replicas and reports a status condition indicating the quota was exceeded.

Answer

The API server accepts all 12 Pods but marks 2 of them with a Failed phase due to the quota, and the ReplicaSet ignores those Pods.

Answer

The 2 extra Pods are created but remain in a Pending state until quota becomes available, and the ReplicaSet reports 12 ready replicas.

Question 19

A company is adopting cloud-native architecture and wants to improve the resilience of its applications. Which TWO of the following are core principles of cloud-native architecture that directly contribute to resilience? (Choose two.)

Accepted Answer

Design for failure and automate recovery.. Designing for failure and automating recovery, along with implementing observability, are core cloud-native principles that directly enhance resilience. Designing for failure ensures that systems can withstand component outages and recover automatically, while observability provides the visibility needed to detect and respond to issues. Together, they enable applications to maintain availability and performance in dynamic environments.

Answer

Store all application state in a single centralized database.

Answer

Manually scale resources based on peak load forecasts.

Answer

Use monolithic deployments to simplify troubleshooting.

Question 20

A platform engineer runs `kubectl get pods -n web` and sees a pod stuck in the `Pending` phase. The pod's `nodeName` field is empty, and no events about image pulling appear. Which Kubernetes component is most directly responsible for assigning this pod to a node?

Accepted Answer

kube-scheduler. A pod enters the Pending phase when it has been accepted by the API server but not yet bound to a node. The kube-scheduler continuously watches for such pods and selects a node that satisfies resource requests, affinity, taints, and tolerations. Once it binds the pod, the kubelet on that node takes over and starts the containers, moving the pod toward Running.

Answer

kubelet

Answer

kube-controller-manager

Answer

kube-proxy