KCNA Container Orchestration — 100 Questions

Question 1

Which TWO statements accurately describe Kubernetes scheduling?

Accepted Answer

The kube-scheduler is responsible for assigning pods to nodes based on resource availability and constraints.. The kube-scheduler is the default Kubernetes component that assigns pods to nodes based on resource availability, constraints, and policies. Option D is correct because node affinity, defined in the pod spec, allows a pod to specify preferred or required node selection constraints for scheduling. Option B is incorrect because tolerations do not 'allow' scheduling by themselves; rather, they indicate that a pod can tolerate a node's taint, but the scheduler still considers other factors. Option C is incorrect because a pod with no resource requests can be scheduled on any node with sufficient capacity, not necessarily the one with the most resources. Option E is incorrect because taints are applied to nodes, not pods, to repel certain pods from being scheduled.

Answer

Tolerations allow a pod to be scheduled on a node with matching taints.

Answer

A pod with no resource requests will always be scheduled on the node with the most available resources.

Answer

Taints are applied to pods to prevent them from being scheduled on certain nodes.

Question 2

Which of the following best describes a key advantage of containers over virtual machines?

Accepted Answer

Containers share the host OS kernel, resulting in lower resource overhead compared to VMs. Containers share the host operating system kernel, which means they do not need to boot a separate kernel or emulate hardware. This shared kernel model eliminates the overhead of running a full guest OS per instance, resulting in significantly lower memory and CPU consumption compared to virtual machines, which each run a complete OS stack including a separate kernel.

Answer

Containers take longer to start than VMs because they need to initialize a kernel

Answer

Containers consume more disk space than VMs because they include a full operating system

Answer

Containers have stronger isolation than VMs because each container runs its own kernel

Question 3

Which TWO statements about Docker Compose and Kubernetes are correct?

Accepted Answer

Kubernetes provides built-in auto-scaling and self-healing capabilities. Kubernetes includes built-in controllers, such as the Horizontal Pod Autoscaler (HPA) and the ReplicaSet, which automatically adjust the number of running pods based on CPU/memory metrics or custom metrics, and restart failed containers to maintain the desired state. This self-healing and auto-scaling capability is a core feature of Kubernetes, not available in Docker Compose.

Answer

Kubernetes is only used in production environments

Answer

Docker Compose and Kubernetes use the same YAML manifest format

Answer

Docker Compose supports multi-node clustering out-of-the-box

Question 4

Which THREE are benefits of using container orchestration platforms like Kubernetes?

Accepted Answer

High availability through automatic container restart and replication. Kubernetes provides high availability by automatically restarting containers that fail and replicating pods across multiple nodes. This ensures that if a container crashes, the ReplicaSet controller creates a new pod to maintain the desired number of replicas, minimizing downtime without manual intervention.

Answer

Simplified application development by eliminating the need for code changes

Answer

Elimination of the need for monitoring and logging

Question 5

Which TWO are characteristics of the microservices architecture that are supported by container orchestration?

Accepted Answer

Independent deployment of each service. Container orchestration platforms like Kubernetes enable independent deployment of each microservice. This means you can update, scale, or roll back a single service without affecting others, which is a core characteristic of microservices architecture. Orchestration tools manage this by using declarative configurations (e.g., Kubernetes Deployments) and service discovery mechanisms (e.g., DNS-based service resolution) to ensure seamless communication between independently deployed services.

Answer

Tight coupling between services to ensure performance

Answer

Monolithic codebase with centralized deployment

Answer

Use of a single, shared database for all services

Question 6

An administrator wants to ensure that a Deployment named 'webapp' always has exactly 3 replicas running across distinct nodes to improve fault tolerance. Which field in the Deployment spec should they configure?

Accepted Answer

template.spec.affinity.podAntiAffinity. `podAntiAffinity` in the `template.spec.affinity` field allows you to enforce scheduling rules that prevent multiple pods from the same Deployment from running on the same node. By configuring a `requiredDuringSchedulingIgnoredDuringExecution` pod anti-affinity rule with a topology key of `kubernetes.io/hostname`, the scheduler ensures that each of the 3 replicas is placed on a distinct node, thereby improving fault tolerance against node failures.

Answer

replicas: 3

Answer

strategy.type: Recreate

Answer

template.spec.nodeName

Question 7

Which of the following is a characteristic of immutable infrastructure?

Accepted Answer

Infrastructure components are never changed after deployment; they are replaced. Immutable infrastructure means that once a component (e.g., a server, container, or VM) is deployed, it is never modified. If an update is needed, the entire component is replaced with a new version. This eliminates configuration drift and ensures consistency across environments, which is a core principle in container orchestration with Kubernetes.

Answer

Infrastructure is version-controlled using Git

Answer

Servers are updated in-place with configuration management tools

Answer

Containers are used to ensure portability

Question 8

A pod named 'web-app' is not able to resolve the hostname 'db-service' from another namespace 'data'. The 'db-service' Service exists in the 'data' namespace. What is the most likely cause?

Accepted Answer

The pod is trying to resolve 'db-service' without the namespace suffix. By default, Kubernetes DNS resolves service names only within the same namespace. To resolve a service from another namespace, the pod must use the fully qualified domain name (FQDN) in the format '..svc.cluster.local'. Without the namespace suffix, the DNS query for 'db-service' fails because it is not found in the pod's own namespace.

Answer

The Service 'db-service' is not exposed on a port

Answer

The pod's DNS policy is set to 'None'

Answer

The pod's container image lacks DNS utilities

Question 9

What is the primary purpose of a container orchestration platform like Kubernetes?

Accepted Answer

To automate the deployment, scaling, and management of containerized applications. Kubernetes is a container orchestration platform designed to automate the deployment, scaling, and management of containerized applications across clusters of hosts. It handles scheduling, load balancing, self-healing, and rolling updates, which are beyond the scope of a single container runtime.

Answer

To provide a lightweight runtime for running a single container

Answer

To manage virtual machines and their hypervisors

Answer

To compile source code into container images

Question 10

You have a microservices application with a frontend service that needs to communicate with a backend service running in a different namespace ('backend-ns'). The default namespace for the frontend is 'frontend-ns'. What DNS name should the frontend use to reach the backend service named 'backend-svc'?

Accepted Answer

backend-svc.backend-ns.svc.cluster.local. In Kubernetes, DNS names for services follow the pattern `..svc.cluster.local`. Since the backend service 'backend-svc' is in the 'backend-ns' namespace, the correct DNS name is `backend-svc.backend-ns.svc.cluster.local`. This allows the frontend in 'frontend-ns' to resolve the backend service across namespaces.

Answer

backend-svc.frontend-ns.svc.cluster.local

Answer

backend-svc.backend-ns.cluster.local

Answer

backend-svc

Question 11

You have a multi-container pod with a main application container and a sidecar container that handles log shipping. The sidecar container should start before the main container and stop after the main container finishes. Which pod configuration should you use?

Accepted Answer

Kubernetes does not natively guarantee startup and shutdown order among containers in a pod. Kubernetes does not provide any built-in mechanism to control the startup or shutdown order of regular containers within the same pod. All containers in a pod start simultaneously in parallel and terminate independently when the pod is deleted. The only ordering guarantee is that init containers run to completion sequentially before any regular containers start, but they cannot be used for sidecar-style log shipping that must remain running alongside the main container.

Answer

Define the sidecar as an init container

Answer

Use the 'startupOrder' field in the pod spec

Answer

Set the sidecar container's command to a script that waits for the main container's port to become available before starting

Question 12

You run the command 'kubectl get pods -n default' and see no pods listed. However, you are sure there should be pods. What is the most likely cause?

Accepted Answer

The current kubectl context is connected to a different cluster. `kubectl` uses the current context defined in the kubeconfig file to determine which cluster and namespace to communicate with. If the context points to a different cluster (e.g., a test or staging cluster), the `kubectl get pods -n default` command will query that cluster's API server, which may have no pods in the `default` namespace, even though the intended cluster has pods. This is a common misconfiguration when working with multiple clusters.

Answer

All pods are in the 'kube-system' namespace

Answer

The kube-apiserver is down

Answer

The pods are in the 'Pending' state and not listed

Question 13

Which THREE of the following are benefits of using a container orchestration platform like Kubernetes? (Select three.)

Accepted Answer

Declarative management: specify desired state and let the system converge. Kubernetes uses a declarative management model where you define the desired state of your application (e.g., number of replicas, resource limits) in a YAML or JSON manifest, and the control plane continuously works to converge the actual state to that desired state. This is a core principle of Kubernetes, implemented via controllers like the ReplicaSet controller, which ensures the system is always self-healing and consistent without manual intervention.

Answer

Built-in image building and registry

Answer

Faster application startup times

Question 14

Which TWO of the following are valid ways to expose a set of pods as a network service in Kubernetes? (Select two.)

Accepted Answer

Creating an Ingress resource. An Ingress resource provides HTTP/HTTPS routing rules to expose services externally, typically using a load balancer or reverse proxy like NGINX or HAProxy. It allows you to define host-based or path-based routing to different Services, making it a valid way to expose a set of pods as a network service. Option E is correct because a Service of type ClusterIP exposes the pods on a cluster-internal IP, which is a valid way to expose them as a network service within the cluster.

Answer

Creating a Deployment with a label selector

Answer

Creating a PersistentVolumeClaim

Answer

Assigning a public IP directly to a Pod

Question 15

Which component in Kubernetes is responsible for managing the lifecycle of pods and ensuring the desired number of replicas are running?

Accepted Answer

ReplicaSet. The ReplicaSet (option D) is the Kubernetes controller that ensures a specified number of pod replicas are running at any given time. It manages pod lifecycle by creating or deleting pods to match the desired replica count defined in its spec, and it is the fundamental building block for higher-level controllers like Deployments.

Answer

Kube-proxy

Answer

Kubelet

Answer

Controller Manager

Question 16

What is the purpose of a readiness probe in a Kubernetes pod?

Accepted Answer

To check if the container is ready to accept traffic. A readiness probe in Kubernetes determines whether a container is ready to start accepting traffic. If the probe fails, the container is removed from the Service's endpoints, ensuring no traffic is routed to an unready pod. This is distinct from a liveness probe, which checks if the container is alive and should be restarted.

Answer

To check if the container is alive and restart it if not

Answer

To verify the container's CPU and memory usage

Answer

To ensure the container can write to persistent storage

Question 17

A container image built using a Dockerfile with multiple layers is stored in a registry. When a node pulls this image, which statement about layers is true?

Accepted Answer

Layers that are already cached on the node are reused and only new layers are downloaded. Container images are composed of read-only layers, each representing a set of filesystem changes. When a node pulls an image, the container runtime (e.g., containerd or CRI-O) checks its local layer cache against the manifest's layer digests (SHA256 hashes). Layers already present locally are reused, and only missing layers are downloaded from the registry, which optimizes bandwidth and storage.

Answer

Layers are merged into a single layer before download

Answer

All layers must be downloaded each time the image is pulled

Answer

Only the topmost layer is downloaded; lower layers are streamed from the registry

Question 18

A developer wants to run a container image locally for testing before deploying to a Kubernetes cluster. Which tool is most appropriate for this task?

Accepted Answer

Docker. Docker is the most appropriate tool for running a container image locally because it is a container runtime that directly executes containers on a local machine using the OCI (Open Container Initiative) image specification. Unlike Kubernetes, which is designed for orchestrating containers across a cluster, Docker provides a simple `docker run` command to spin up a container from an image for testing purposes.

Answer

Ansible

Answer

Kubernetes

Answer

Terraform

Question 19

Which THREE of the following are valid container runtimes that can be used with Kubernetes via the Container Runtime Interface (CRI)? (Select three.)

Accepted Answer

containerd. B is correct because containerd is a core container runtime that implements the CRI (Container Runtime Interface) directly via its built-in CRI plugin. It was extracted from Docker and is now the default runtime in many Kubernetes distributions, handling image management, container lifecycle, and execution without requiring an external shim.

Answer

rkt

Answer

Docker

Question 20

An administrator wants to ensure that a pod only runs on nodes that have a specific GPU. Which mechanism should be used to achieve this?

Accepted Answer

Node affinity with requiredDuringSchedulingIgnoredDuringExecution. Node affinity with `requiredDuringSchedulingIgnoredDuringExecution` is the correct mechanism because it allows you to specify hard constraints that a pod must be scheduled on a node with a specific label (e.g., `gpu-type: nvidia-tesla`). This ensures the pod is only placed on nodes that have the required GPU hardware, as the scheduler will enforce the rule during scheduling and ignore it after the pod is running.

Answer

Tolerations and taints

Answer

Pod anti-affinity

Answer

ResourceQuota