KCNA Container Orchestration Practice Test 10 — 15 Questions

Question 1

What is the primary purpose of the Container Runtime Interface (CRI) in Kubernetes?

Accepted Answer

To provide a standard interface between the kubelet and container runtimes. The Container Runtime Interface (CRI) is a plugin protocol that enables the kubelet to use any OCI-compliant container runtime (e.g., containerd, CRI-O) without needing to recompile Kubernetes. It defines gRPC APIs for runtime and image service operations, abstracting the runtime implementation from the kubelet's pod lifecycle management.

Answer

To store container images in a registry

Answer

To define the format of container images

Answer

To manage container network interfaces

Question 2

You create a Service of type ClusterIP with the name 'my-service' in the 'default' namespace. What DNS name resolves to the service's cluster IP from a pod in the same namespace?

Accepted Answer

my-service.default.svc.cluster.local. Kubernetes DNS resolves a Service's ClusterIP using the fully qualified domain name (FQDN) format `..svc.cluster.local`. Since the Service 'my-service' is in the 'default' namespace, a pod in the same namespace can reach it via `my-service.default.svc.cluster.local`. The DNS query returns the ClusterIP of the Service, allowing pods to communicate with it reliably.

Answer

my-service.svc.cluster.local

Answer

my-service.default.cluster.local

Answer

my-service.cluster.local

Question 3

A pod is running but its container exits with code 137. The pod logs show 'Killed'. What is the most likely cause?

Accepted Answer

The container was OOMKilled due to memory limit. Exit code 137 (128 + 9) indicates the container was terminated by SIGKILL. Combined with 'Killed' in logs, this is the definitive signature of an OOMKill event, where the Linux kernel's Out-Of-Memory (OOM) killer terminates the container process because it exceeded its memory limit (specified in the pod's resource limits). Kubernetes enforces memory limits via cgroups, and when the container's memory usage surpasses the limit, the OOM killer sends SIGKILL, resulting in exit code 137.

Answer

The container's CPU limit was exceeded

Answer

The container's liveness probe failed

Answer

The node ran out of disk space

Question 4

Which component in Kubernetes is responsible for maintaining the desired state of the cluster?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller processes, which are control loops that watch the shared state of the cluster through the API server and make changes to move the current state toward the desired state. It is responsible for ensuring that the cluster's actual state matches the desired state defined in Kubernetes objects such as Deployments, ReplicaSets, and StatefulSets.

Answer

kube-scheduler

Answer

kube-proxy

Answer

kubelet

Question 5

A DevOps engineer wants to update a Deployment's container image from 'v1' to 'v2' with zero downtime. Which kubectl command should they use?

Accepted Answer

kubectl set image deployment/ =:v2. `kubectl set image` directly updates the container image in a Deployment's pod template, triggering a rolling update that replaces pods incrementally with zero downtime. Kubernetes Deployments manage ReplicaSets to ensure availability during the update, making this the simplest and most reliable command for a controlled image change.

Answer

kubectl rollout restart deployment/<name>

Answer

kubectl patch deployment -p '{"spec":{"template":{"spec":{"containers":[{"name":"","image":":v2"}]}}}}'

Answer

kubectl edit deployment <name>

Question 6

What is the primary benefit of containers over virtual machines?

Accepted Answer

Containers are more portable and lightweight because they share the host OS kernel. Containers are more portable and lightweight than virtual machines because they share the host OS kernel, eliminating the need for a separate guest OS per instance. This shared kernel approach reduces resource overhead (CPU, memory, and disk) and enables faster startup times, as containers only package the application and its dependencies without duplicating the operating system.

Answer

Containers provide stronger isolation than VMs

Answer

Containers use more disk space than VMs

Answer

Containers require a hypervisor to run

Question 7

You have a microservices application deployed as a set of Pods in a Kubernetes cluster. You need to ensure that Pods can discover each other using stable DNS names. Which Kubernetes resource should you create?

Accepted Answer

Service. A Service of type ClusterIP (the default) provides a stable virtual IP and DNS name (e.g., my-service.namespace.svc.cluster.local) that resolves to the Pods selected by its label selector. This allows Pods to discover each other using consistent DNS names, regardless of Pod IP changes due to scaling or restarts. The kube-dns or CoreDNS addon automatically creates DNS records for Services, enabling service discovery within the cluster.

Answer

ConfigMap

Answer

Ingress

Answer

Deployment

Question 8

A pod is stuck in the 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/3 nodes are available: 1 node had taint that the pod didn't tolerate, 2 Insufficient cpu.' What is the most likely cause?

Accepted Answer

The pod's resource requests exceed available node capacity and a node taint is not tolerated. The pod is in 'Pending' state because the scheduler cannot find a node that meets its requirements. The event '0/3 nodes are available: 1 node had taint that the pod didn't tolerate, 2 Insufficient cpu' directly indicates that the pod's resource requests exceed the available CPU on two nodes, and the remaining node has a taint that the pod does not tolerate. This matches option B: the pod's resource requests exceed available node capacity and a node taint is not tolerated.

Answer

The pod's liveness probe is failing

Answer

The pod's container runtime is not installed

Answer

The pod's image pull secret is missing

Question 9

Which component is responsible for managing the lifecycle of containers on a Kubernetes node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each Kubernetes node. It is responsible for ensuring that containers are running in a Pod as expected by interacting with the container runtime (e.g., Docker, containerd) to manage the container lifecycle—starting, stopping, and monitoring containers based on PodSpecs received from the API server.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 10

You need to deploy a batch job that processes a queue and runs to completion. The job should run exactly once and create exactly one pod per work item, but some items may fail. Which Kubernetes resource is best suited?

Accepted Answer

Job. A Kubernetes Job is the correct resource for batch processing tasks that run to completion, such as processing a queue where each work item corresponds to a pod. By configuring the `.spec.completions` and `.spec.parallelism` fields, you can ensure exactly one pod per work item and control concurrency. The Job automatically retries failed pods (up to a configurable limit) without restarting the entire batch, making it ideal for handling some failures. In contrast, a Deployment (A) is for long-running, continuously available services; a CronJob (C) is for scheduled recurring jobs; and a DaemonSet (D) runs a pod on every node for infrastructure tasks. Therefore, Job (B) is the best fit.

Answer

Deployment

Answer

CronJob

Answer

DaemonSet

Question 11

You have a Deployment with three replicas. You want to update the container image but ensure that only one pod is updated at a time, and the update proceeds only if the new pod becomes healthy. Which update strategy should you configure?

Accepted Answer

RollingUpdate with maxSurge=1 and maxUnavailable=0. A RollingUpdate strategy with maxSurge=1 and maxUnavailable=0 ensures that exactly one new pod is created before any old pod is terminated, and the update only proceeds when the new pod passes its readiness probe (i.e., becomes healthy). This guarantees that at all times during the update, the desired number of replicas (3) are available, and only one pod is updated at a time, matching the requirement.

Answer

RollingUpdate with maxSurge=3 and maxUnavailable=1

Answer

Canary deployment via Ingress

Answer

Recreate strategy

Question 12

You are troubleshooting a service that is not accessible from within the cluster. The service has a label selector that matches the pods. You run 'kubectl get endpoints myservice' and see that the ENDPOINTS column is empty. What is the most likely cause?

Accepted Answer

The service's label selector does not match any pods. The ENDPOINTS column being empty for a service indicates that the service's label selector does not match any running pods. Kubernetes uses the label selector to dynamically populate the endpoints list; if no pods match, the service has no backends to forward traffic to, making it inaccessible from within the cluster.

Answer

The kube-proxy is not running

Answer

The service is in a different namespace

Answer

The service type is LoadBalancer and no external load balancer is provisioned

Question 13

Which of the following best describes immutable infrastructure?

Accepted Answer

Infrastructure components that are replaced rather than changed after deployment. Immutable infrastructure is a pattern where components (servers, containers, etc.) are never modified after deployment. Instead, any change requires building a new instance from a golden image or template and replacing the old one. This eliminates configuration drift and ensures consistency, which is a core principle in container orchestration with tools like Kubernetes, where Pods are replaced rather than patched in place.

Answer

Servers that are updated in-place with configuration management tools

Answer

Infrastructure that is version-controlled and deployed using blue/green deployments

Answer

Infrastructure that uses only read-only file systems

Question 14

Which THREE of the following are key characteristics of microservices architecture?

Accepted Answer

Independent deployment of services. Microservices architecture mandates that each service can be independently deployed, updated, and scaled without affecting other services. This is achieved through separate deployment pipelines, containerization (e.g., Docker), and orchestration platforms like Kubernetes that manage service lifecycles independently. Independent deployment enables continuous delivery and reduces the blast radius of changes.

Answer

Single monolithic codebase

Answer

Shared database schema across services

Question 15

Which component implements the Container Runtime Interface (CRI) to manage container lifecycle in Kubernetes?

Accepted Answer

CRI-O. Both containerd and CRI-O are high-level container runtimes that implement the Container Runtime Interface (CRI) to manage the full lifecycle of containers (create, start, stop, delete) in Kubernetes. They communicate directly with the kubelet via the CRI protocol (gRPC) and handle image management, container execution, and resource isolation using low-level runtimes like runc. In contrast, the kubelet is the agent that calls the CRI but does not implement it itself, and Docker does not directly implement the CRI; it uses containerd internally and previously required the dockershim adapter.

Answer

kubelet

Answer

Docker