KCNA Cloud Native Application Delivery Practice Test 2 — 15 Questions

Question 1

Which TWO statements are true about Kubernetes Deployments?

Accepted Answer

Deployments support rolling updates and rollbacks.. Deployments inherently support rolling updates and rollbacks through their declarative update strategy. When you change the pod template in a Deployment, it creates a new ReplicaSet and gradually scales it up while scaling down the old ReplicaSet, ensuring zero-downtime updates. If the update fails, you can roll back to a previous revision using `kubectl rollout undo`, which reverts the Deployment to a prior ReplicaSet state.

Answer

Deployments are the recommended controller for stateful applications.

Answer

Deployments can expose applications externally via a built-in load balancer.

Answer

Deployments are used to run a pod on every node in the cluster.

Question 2

A financial services company runs a critical trading application on Kubernetes. The application is deployed as a Deployment with 3 replicas. Each pod exposes metrics on port 8080 and uses a ConfigMap to load configuration. Recently, after a configuration change via a ConfigMap update, two of the three pods started crashing with an out-of-memory (OOM) error, while the third pod continues to run fine. The team verified that the ConfigMap was updated correctly and that the application code did not change. The pods have resource limits set: memory limit of 512Mi and request of 256Mi. The application's memory usage before the change was around 200Mi. The new configuration increases the in-memory cache size. The team suspects the issue is related to the configuration change. What is the best course of action?

Accepted Answer

Increase the memory limit in the Deployment manifest to a higher value, such as 1Gi, and perform a rolling update.. The OOM errors are directly caused by the increased memory usage from the larger in-memory cache, which exceeds the current 512Mi memory limit. Increasing the limit to 1Gi accommodates the new cache size while preserving resource boundaries, and a rolling update applies the change without downtime. This aligns with Kubernetes best practices of setting realistic resource limits based on application requirements.

Answer

Scale the Deployment to 5 replicas to distribute the memory load.

Answer

Remove the memory limit from the container spec to allow unlimited memory usage.

Answer

Revert the ConfigMap to the previous configuration and monitor memory usage.

Question 3

A team is deploying a microservice application on Kubernetes. They want to ensure that during rolling updates, the new version of the service receives traffic only after the readiness probe succeeds. However, they observe that the old pods are terminated before the new pods are ready, causing a brief downtime. Which configuration change should they make to the Deployment to prevent this?

Accepted Answer

Set spec.strategy.rollingUpdate.maxSurge=1 and maxUnavailable=0. Setting spec.strategy.rollingUpdate.maxSurge=1 and maxUnavailable=0 ensures that during a rolling update, new pods are created before old pods are terminated. This prevents downtime by maintaining the desired number of available pods at all times. Option B is incorrect because maxSurge=0 prevents creating new pods before terminating old ones, which can cause downtime if old pods are removed before new ones are ready. Option A is incorrect because minReadySeconds controls how long a pod must be ready before being considered available, not the order of creation/termination. Option C is incorrect because a liveness probe is for restarting unhealthy pods, not for controlling rollout behavior.

Answer

Set spec.strategy.rollingUpdate.minReadySeconds to 0

Answer

Set spec.strategy.rollingUpdate.maxSurge=0 and maxUnavailable=1

Answer

Add a liveness probe to the container spec

Question 4

A DevOps team uses Helm to manage Kubernetes applications. They want to ensure that sensitive data (e.g., database passwords) is not stored in plaintext in the Helm chart or in the cluster's ConfigMaps/Secrets. Which TWO practices should they adopt? (Choose two.)

Accepted Answer

Use an external secrets operator (e.g., AWS Secrets Manager, HashiCorp Vault) to inject secrets at runtime. Using an external secrets operator (e.g., AWS Secrets Manager, HashiCorp Vault) allows secrets to be injected directly into Pods at runtime without ever storing them in the Helm chart or as Kubernetes Secrets in plaintext. This approach leverages the Kubernetes CSI (Container Storage Interface) or a sidecar pattern to mount secrets from an external store, ensuring sensitive data never resides in the cluster's etcd or version control.

Answer

Store secrets in a separate Git repository with restricted access

Answer

Store secrets as Kubernetes Secrets and reference them in the chart values

Answer

Use Helm's built-in encryption for values files

Question 5

Refer to the exhibit. The deployment above is created, but the pods are not receiving traffic from the associated Service. The Service selector matches 'app: web'. The Service endpoints list is empty. What is the most likely cause?

Accepted Answer

The readiness probe endpoint /health does not exist in the nginx container. A readiness probe that fails (e.g., the /health endpoint does not exist in the nginx container) will cause the pod to be marked as not ready. Kubernetes removes pods with failing readiness probes from the Service's endpoints list, resulting in an empty endpoints list even though the Service selector matches the pod labels. This is a common misconfiguration where the probe endpoint is not actually served by the container.

Answer

The Service selector does not match the pod labels

Answer

The containerPort is set to 80, but the Service targetPort is 8080

Answer

The nginx:1.21 image is not available in the container registry

Question 6

Drag and drop the steps to create a Kubernetes deployment using kubectl into the correct order.

Accepted Answer

Create a YAML definition file, then run kubectl apply, then verify the deployment, then check pods, then expose the deployment as a service.. First, define the deployment in a YAML file, then apply it, verify creation, check pods, and optionally expose it as a service.

Answer

Create a YAML definition file, then verify the deployment, then run kubectl apply, then check pods, then expose the deployment as a service.

Answer

Run kubectl apply, then create a YAML definition file, then verify the deployment, then expose the deployment as a service, then check pods.

Answer

Create a YAML definition file, then run kubectl apply, then expose the deployment as a service, then check pods, then verify the deployment.

Question 7

Drag and drop the steps to troubleshoot a Pod stuck in CrashLoopBackOff into the correct order.

Accepted Answer

1. Use kubectl describe pod to check events, 2. Use kubectl logs to see application errors, 3. Check resource constraints (CPU/memory limits), 4. Verify image name and command in the pod spec, 5. Fix the issue and redeploy.. Start with describe for events, then logs for errors, check resources, verify image/command, then fix and redeploy.

Answer

1. Use kubectl logs to see application errors, 2. Use kubectl describe pod to check events, 3. Verify image name and command in the pod spec, 4. Check resource constraints (CPU/memory limits), 5. Fix the issue and redeploy.

Answer

1. Check resource constraints (CPU/memory limits), 2. Use kubectl describe pod to check events, 3. Use kubectl logs to see application errors, 4. Verify image name and command in the pod spec, 5. Fix the issue and redeploy.

Answer

1. Fix the issue and redeploy, 2. Use kubectl describe pod to check events, 3. Use kubectl logs to see application errors, 4. Check resource constraints (CPU/memory limits), 5. Verify image name and command in the pod spec.

Question 8

Drag and drop the steps to create a ConfigMap from a file in Kubernetes into the correct order.

Accepted Answer

Prepare the file, then create the ConfigMap, then verify it, then describe it, then use it in a Pod.. The correct sequence to create a ConfigMap from a file in Kubernetes is: first prepare the configuration file, then create the ConfigMap using kubectl create configmap, next verify the ConfigMap with kubectl get configmaps, then optionally describe it with kubectl describe configmap, and finally use it in a Pod as environment variables or volume mounts. This order ensures the ConfigMap is available and correctly configured before consumption.

Answer

Prepare the file, then create the ConfigMap, then describe it, then verify it, then use it in a Pod.

Answer

Prepare the file, then create the ConfigMap, then use it in a Pod, then verify it, then describe it.

Answer

Create the ConfigMap, then prepare the file, then verify it, then describe it, then use it in a Pod.

Question 9

Drag and drop the steps to scale a Kubernetes Deployment horizontally into the correct order.

Accepted Answer

Run `kubectl scale` deployment, then check pods are created, then verify deployment status, then monitor rollout, then adjust resources if needed.. Scale command, check pods, verify deployment, monitor rollout, and adjust resources if needed.

Answer

Check pods are created, then run `kubectl scale` deployment, then verify deployment status, then monitor rollout, then adjust resources if needed.

Answer

Run `kubectl scale` deployment, then verify deployment status, then check pods are created, then monitor rollout, then adjust resources if needed.

Answer

Monitor rollout, then run `kubectl scale` deployment, then check pods are created, then verify deployment status, then adjust resources if needed.

Question 10

Match each Kubernetes resource to its primary purpose.

Accepted Answer

Pod: The smallest and simplest Kubernetes object, representing a set of running containers.. Pods are the smallest deployable units; Services provide stable networking to Pods; Deployments manage Pod lifecycle. Common confusions involve swapping Pod with Service, Service with ConfigMap, and Deployment with storage resources.

Answer

Pod: A method to expose a set of Pods as a network service.

Answer

Service: A resource that stores non-sensitive configuration data.

Answer

Deployment: A storage abstraction that provides persistent storage to Pods.

Question 11

Match each CNCF project to its primary function.

Accepted Answer

Kubernetes: Container orchestration. The correct matches are: Kubernetes → Container orchestration, Envoy → Service proxy, Fluentd → Log collection. Common confusions include mixing Prometheus (monitoring) with Fluentd (logging) and CoreDNS (DNS) with Prometheus.

Answer

Prometheus: Log collection

Answer

CoreDNS: Monitoring and alerting

Question 12

Match each Kubernetes networking concept to its description.

Accepted Answer

ClusterIP: Exposes the Service on a cluster-internal IP. Only reachable from within the cluster.. Common confusions arise between ClusterIP (internal-only) and NodePort (node-level external access), and between LoadBalancer (cloud-integrated external LB) and Ingress (HTTP routing with rules).

Answer

ClusterIP: Exposes the Service on each Node's IP at a static port.

Answer

NodePort: Exposes the Service on a cluster-internal IP.

Question 13

Match each Kubernetes storage concept to its description.

Accepted Answer

PersistentVolume: A piece of storage in the cluster provisioned by an administrator.. The correct matches are: PersistentVolume is a cluster storage resource, PersistentVolumeClaim is a user request for storage, and StorageClass defines storage classes. Two common confusions are swapping PV and PVC definitions.

Answer

PersistentVolume: A request for storage by a user that binds to a PersistentVolume.

Answer

PersistentVolumeClaim: A piece of storage in the cluster provisioned by an administrator.

Question 14

A development team wants to implement GitOps for their Kubernetes deployments using ArgoCD. Which ArgoCD component is responsible for monitoring the Git repository for changes and syncing the desired state to the cluster?

Accepted Answer

Application Controller. The Application Controller in ArgoCD is the component that continuously monitors the Git repository and compares the desired state (in Git) with the live state (in the cluster). It triggers sync operations when differences are detected.

Answer

Repo Server

Answer

API Server

Answer

Redis Server

Question 15

What is the primary purpose of a container registry in the CI/CD pipeline?

Accepted Answer

To store and distribute container images. Container registries store container images after they are built, allowing them to be pulled by Kubernetes clusters during deployment. They are the intermediary between CI and CD.

Answer

To run unit tests on container images

Answer

To store application source code

Answer

To scan images for vulnerabilities