KCNA Practice Exam 59 — 20 Questions

Question 1

A user wants to run a one-time batch task that processes a dataset and then exits. The task should not be restarted if it completes successfully. Which Kubernetes resource is most appropriate?

Accepted Answer

Job. A Job is the Kubernetes resource designed for batch workloads that run to completion. It tracks successful Pod completions and does not restart Pods that exit with success. Deployments, StatefulSets, and DaemonSets are all intended for long-running services and do not provide the same completion guarantees.

Answer

Deployment

Answer

StatefulSet

Answer

DaemonSet

Question 2

A Kubernetes cluster runs Prometheus for monitoring. The operations team wants to receive alerts when the 99th percentile latency of an HTTP service exceeds 500ms for 5 minutes. They have a metric http_request_duration_seconds histogram. Which PromQL expression should they use to calculate the 99th percentile latency?

Accepted Answer

histogram_quantile(0.99, rate(http_request_duration_seconds_bucket[5m])). To compute the 99th percentile from a Prometheus histogram, the histogram_quantile function is used with the desired quantile and a rate over the bucket metric. The rate function calculates the per-second increase of the cumulative bucket counters over a 5-minute window, which is necessary for accurate quantile estimation. This expression correctly yields the 99th percentile latency, enabling the alerting condition to be evaluated.

Answer

http_request_duration_seconds_bucket{le="0.5"} > 500

Answer

quantile(0.99, http_request_duration_seconds)

Answer

rate(http_request_duration_seconds_sum[5m]) / rate(http_request_duration_seconds_count[5m])

Question 3

A Kubernetes cluster runs a DaemonSet named 'node-agent' that must run on every node, including the control-plane node. The control-plane node has a taint 'node-role.kubernetes.io/control-plane:NoSchedule'. The DaemonSet currently does not schedule pods on the control-plane node. Which change to the DaemonSet spec will ensure its pods run on the control-plane node?

Accepted Answer

Add a toleration for the taint 'node-role.kubernetes.io/control-plane:NoSchedule' to the DaemonSet's pod template.. Taints and tolerations work together to control scheduling. A taint on a node repels pods that do not tolerate it. To run DaemonSet pods on a tainted node such as a control-plane node, the pod template must include a toleration for that specific taint. Other scheduling controls like node selectors or priority classes do not override taints.

Answer

Add a node selector to the DaemonSet's pod template that matches the control-plane node's labels.

Answer

Increase the DaemonSet's 'spec.template.spec.priorityClassName' to a higher priority class.

Answer

Set the DaemonSet's update strategy to 'OnDelete' so that pods are only created when nodes are added.

Question 4

A platform engineer is troubleshooting a Pod that is stuck in Pending. The engineer suspects the scheduler cannot place it. Which two commands are appropriate to gather evidence about why the Pod has not been scheduled? (Choose two.)

Accepted Answer

`kubectl get events --field-selector involvedObject.name=<pod-name>` to filter cluster events for that Pod.. The scheduler reports its reasoning through Events, so inspecting kubectl describe pod output and filtering cluster events for the Pod both expose FailedScheduling causes like insufficient resources, taints, or affinity mismatches. Commands that require a running container, rely on previous logs, or delete the Pod do not reveal why scheduling failed and are unsuitable for this diagnosis.

Answer

`kubectl delete pod <pod-name> --force --grace-period=0` to trigger rescheduling and observe the outcome.

Answer

`kubectl exec -it <pod-name> -- /bin/sh` to inspect the container's runtime logs.

Answer

`kubectl logs <pod-name> --previous` to view logs from the prior container instance.

Question 5

A team deploys an application as a StatefulSet with three replicas. They need each Pod to have a stable network identity and its own persistent storage that survives Pod rescheduling. Which two features of StatefulSet satisfy these requirements?

Accepted Answer

Stable Pod names and a headless Service for network identity, plus volumeClaimTemplates for per-Pod storage. StatefulSets provide stable ordinal Pod names and, with a headless Service, stable DNS records for each Pod. volumeClaimTemplates dynamically creates a PersistentVolumeClaim per Pod, giving each replica its own persistent storage that follows the Pod across rescheduling. A Deployment with shared storage or a StatefulSet with emptyDir or hostPath does not meet these requirements.

Answer

A StatefulSet with a ClusterIP Service and hostPath volumes for each Pod

Answer

A Deployment with a headless Service and a shared PersistentVolume mounted by all replicas

Answer

A StatefulSet with podManagementPolicy: Parallel and an emptyDir volume per Pod

Question 6

A developer wants to run a single instance of a stateless web application that should be automatically restarted if it fails, but does not require scaling or updates. Which Kubernetes resource is most appropriate?

Accepted Answer

Deployment. A Deployment is the standard controller for stateless applications. It provides self-healing by maintaining the desired replica count, and supports rolling updates. While a Pod can run a container, it lacks automatic rescheduling on node failure. StatefulSet and DaemonSet serve different purposes and are not appropriate for a simple stateless web app.

Answer

DaemonSet

Answer

Pod

Answer

StatefulSet

Question 7

An application Pod needs to read a database password at runtime. The security team requires that the secret material never be stored in the Pod's container image or in a ConfigMap, and that updates to the secret be reflected in the running container without recreating the Pod. Which approach satisfies these requirements?

Accepted Answer

Store the password in a Secret and mount it as a volume in the Pod.. Kubernetes Secrets keep sensitive data out of images and ConfigMaps. Mounting a Secret as a volume presents the value as a file, and the kubelet periodically refreshes projected Secret volumes so changed values appear in the container filesystem without restarting the Pod. The application must re-read the file to pick up changes, but the platform side meets the security and live-update constraints.

Answer

Bake the password into a private container image and pull it with an imagePullSecret.

Answer

Pass the password as a command-line argument in the Pod specification.

Answer

Store the password in a ConfigMap and consume it as an environment variable.

Question 8

A cluster administrator is configuring a NetworkPolicy for a set of pods labeled 'role=db' in the 'backend' namespace. The policy should allow ingress only from pods labeled 'role=api' in the 'frontend' namespace, and only on TCP port 6379. Which NetworkPolicy specification correctly enforces this?

Accepted Answer

spec: { podSelector: { matchLabels: { role: db } }, ingress: [ { from: [ { namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: frontend } }, podSelector: { matchLabels: { role: api } } } ], ports: [ { protocol: TCP, port: 6379 } ] } ] }. A NetworkPolicy ingress rule can combine namespaceSelector and podSelector to allow traffic from specific pods in specific namespaces. The namespaceSelector must match the namespace's labels; Kubernetes automatically labels namespaces with 'kubernetes.io/metadata.name=<namespace-name>'. The policy must also specify the allowed port. The correct specification uses the proper namespace label and includes both selectors.

Answer

spec: { podSelector: { matchLabels: { role: db } }, ingress: [ { from: [ { podSelector: { matchLabels: { role: api } } } ], ports: [ { protocol: TCP, port: 6379 } ] } ] }

Answer

spec: { podSelector: { matchLabels: { role: db } }, ingress: [ { from: [ { namespaceSelector: { matchLabels: { name: frontend } } } ], ports: [ { protocol: TCP, port: 6379 } ] } ] }

Answer

spec: { podSelector: { matchLabels: { role: db } }, ingress: [ { from: [ { namespaceSelector: { matchLabels: { name: frontend } }, podSelector: { matchLabels: { role: api } } } ], ports: [ { protocol: TCP, port: 6379 } ] } ] }

Question 9

A delivery team's manifests are nearly identical across dev, staging, and production, differing only in replica counts, image tags, and resource limits. They want to keep one shared base and apply environment-specific changes without introducing a templating language. Which approach fits best?

Accepted Answer

Use Kustomize with a common base and per-environment overlays that patch the differing fields. A single base with per-environment overlays is exactly Kustomize's model: the base holds common resources, and each overlay patches only what differs, using plain YAML rather than templates. This keeps one source of truth while making environment deltas small, explicit, and reviewable in version control.

Answer

Store three copies of every manifest in Git and use a CI job to copy the correct directory at deploy time

Answer

Create three separate Helm charts, one per environment, and maintain them independently

Answer

Write a sed-based script that rewrites image tags and replica counts in the manifests before applying them

Question 10

A cluster administrator needs to grant a user permission to view Pods in the 'staging' namespace but not in any other namespace. Which combination of Kubernetes objects should be created?

Accepted Answer

A Role and a RoleBinding in the 'staging' namespace. To grant namespace-scoped permissions, the standard approach is to create a Role that defines the allowed verbs on Pods and a RoleBinding that binds that Role to the user within the 'staging' namespace. This ensures the user can view Pods only in that namespace, following the principle of least privilege.

Answer

A ClusterRole and a RoleBinding in the 'staging' namespace

Answer

A ClusterRole and a ClusterRoleBinding

Answer

A Role and a ClusterRoleBinding

Question 11

A developer creates a Pod with a volume of type emptyDir. The Pod writes data to the volume and then is deleted. What happens to the data?

Accepted Answer

The data is permanently deleted when the Pod is removed.. An emptyDir volume is ephemeral and scoped to the Pod. When the Pod is deleted, the volume is removed from the node, and its data is lost. To retain data beyond the Pod's lifetime, you must use a PersistentVolumeClaim backed by durable storage. This behavior is fundamental for understanding stateless versus stateful workloads.

Answer

The data remains in the container's filesystem layer and can be recovered by restarting the container.

Answer

The data persists on the node and can be reused by a new Pod if the same emptyDir name is used.

Answer

The data is automatically backed up to a PersistentVolume before deletion.

Question 12

A platform team is adopting cloud-native principles for a new microservices application. They want to ensure that each service can be independently deployed and scaled without affecting other services. Which design principle BEST supports this goal?

Accepted Answer

Loose coupling between services. Loose coupling is fundamental to cloud-native architecture because it allows each microservice to evolve, deploy, and scale independently. When services communicate through stable, well-defined interfaces and avoid shared state, teams can release changes without coordinating across the entire system. This autonomy is essential for rapid iteration and resilience in distributed environments.

Answer

Shared monolithic database for all services

Answer

Centralized orchestration of all service workflows

Answer

Synchronous request-response communication only

Question 13

A platform team wants to package a Kubernetes application — including its Deployment, Service, ConfigMap, and default configuration values — into a single versioned artifact that can be installed and rolled back as one unit. Which cloud native tool is purpose-built for this?

Accepted Answer

Helm. Helm packages the Deployment, Service, ConfigMap, and default values into a chart, renders it with values at install time, and records each install as a numbered revision. That gives the team one versioned artifact plus atomic upgrade and rollback, which the other tools either cannot do or do at a different abstraction layer.

Answer

Kustomize

Answer

Docker Compose

Answer

Terraform

Question 14

A team uses a CI pipeline that builds a container image, scans it for vulnerabilities, and then pushes it to a registry. The scan reports a critical vulnerability in a library used by the application. The team wants to prevent images with critical vulnerabilities from being deployed to production. Which approach best enforces this policy in a Kubernetes-native way?

Accepted Answer

Use an admission controller such as OPA Gatekeeper to deny Pods that reference images with critical vulnerabilities.. An admission controller like OPA Gatekeeper can intercept Pod creation requests and evaluate them against policies. By integrating with vulnerability scan results, it can deny Pods that reference images with critical vulnerabilities. This enforces the policy at the cluster level, ensuring that even if an image bypasses CI checks, it cannot be deployed. CI pipeline failure is preventive but not Kubernetes-native enforcement.

Answer

Enable Pod Security Admission with the restricted profile to block vulnerable images.

Answer

Configure the CI pipeline to fail the build if the scan finds critical vulnerabilities.

Answer

Use a Kubernetes NetworkPolicy to block traffic to Pods running vulnerable images.

Question 15

A platform team runs a 20-node Kubernetes cluster. They want a single Pod to run on every node so that a node-exporter agent can collect host metrics. They also want the Pod to be automatically created when a new node joins the cluster. Which workload resource should they use?

Accepted Answer

DaemonSet. A DaemonSet is the only workload controller that guarantees one Pod per eligible node and automatically schedules a Pod when a new node joins the cluster. This makes it the correct choice for node-level agents such as log collectors, metrics exporters, or storage daemons. Deployments, StatefulSets, and Jobs do not provide this per-node placement guarantee.

Answer

StatefulSet with podManagementPolicy set to Parallel

Answer

Deployment with replicas set to 20

Answer

Job with parallelism set to 20

Question 16

An operations team runs a stateless web application in a Deployment with 3 replicas. They need each Pod to be able to read application configuration from a single source, and updates to that configuration should be reflected in the running Pods without rebuilding the container image. Which Kubernetes resource should they use to store the configuration and inject it as environment variables into the Pods?

Accepted Answer

ConfigMap. ConfigMap is designed for non-sensitive configuration data and integrates directly with Pods through environment variables or mounted files. Because the team wants configuration decoupled from the container image and injected at runtime, a ConfigMap is the correct choice. The other resources serve storage, secret handling, or quota enforcement and cannot provide general application configuration to the container environment.

Answer

Secret

Answer

PersistentVolumeClaim

Answer

ResourceQuota

Question 17

A platform engineer is explaining the role of the Kubernetes API server in a cloud-native architecture. Which statement BEST describes its primary function?

Accepted Answer

It serves as the central management endpoint that validates and processes REST requests for cluster resources.. The Kubernetes API server acts as the central management endpoint for the cluster. It exposes the Kubernetes API, authenticates and authorizes requests, validates resource configurations, and persists state to etcd. Other control plane components and user tools like kubectl communicate exclusively through it, so it is the single point of interaction for cluster operations.

Answer

It schedules pods to nodes based on resource availability.

Answer

It provides a distributed key-value store for cluster state.

Answer

It monitors the health of nodes and restarts failed containers.

Question 18

A cluster administrator notices that a Pod scheduled on a node is stuck in the Pending state. The Pod requests 8 CPU cores, but the node has only 4 allocatable CPU cores. The scheduler logs show a FailedScheduling event with the message 'Insufficient cpu'. Which action will allow the Pod to be scheduled without reducing its CPU request?

Accepted Answer

Add a new node to the cluster that has at least 8 allocatable CPU cores and ensure the Pod's scheduling constraints match that node.. The scheduler filters nodes based on available allocatable resources. A Pod requesting 8 CPU cores cannot fit on a node with only 4 allocatable cores, regardless of taints or priority. Adding a node with sufficient CPU capacity and matching scheduling constraints resolves the issue without altering the Pod's request. Reducing the request would work but violates the scenario constraint.

Answer

Create a PriorityClass with a high value and assign it to the Pod to preempt other workloads.

Answer

Reduce the Pod's CPU request to 4 cores so it fits on the existing node.

Answer

Add a toleration to the Pod so it can be scheduled on a tainted node.

Question 19

A platform team is standardizing on Kubernetes-native delivery. They want to adopt practices that make releases repeatable and reduce drift between environments. Which two practices best support that goal? (Choose two.)

Accepted Answer

Package applications as versioned charts or overlays so the same artifact can be promoted across environments. Repeatable delivery depends on a single declarative source of truth and a promotable artifact. Keeping manifests and configuration in version control with reviewed pipeline changes, and packaging applications as versioned charts or overlays, together ensure the same tested revision can be promoted and that drift is detectable rather than silently accumulating.

Answer

Allow engineers to apply ad hoc kubectl edits directly to production when a fix is urgent

Answer

Rely on the cluster's current state as the source of truth and reconcile Git from the live objects when they differ

Answer

Maintain separate hand-edited manifest copies per environment and update each one independently

Question 20

A platform team runs a Kubernetes cluster where the kubelet and container runtime expose metrics on each node. The team wants to collect node-level CPU and memory metrics into Prometheus without deploying a separate exporter on every node. Which component should they configure Prometheus to scrape?

Accepted Answer

The kubelet's built-in cAdvisor endpoint. The kubelet already runs on every node and exposes cAdvisor metrics, including node and container CPU and memory usage, through its /metrics endpoint. Prometheus can scrape this endpoint directly, so no separate per-node exporter is required. Other listed components either report object state, control-plane request metrics, or logs, none of which provide the node resource metrics needed here.

Answer

kube-state-metrics

Answer

The Kubernetes API server's /metrics endpoint

Answer

The container runtime's CRI logging socket