KCNA Container Orchestration Practice Test 11 — 15 Questions

Question 1

You need to ensure that a set of pods in a Deployment can be reached by other pods using a stable IP address and DNS name. Which Kubernetes object should you use?

Accepted Answer

Service. A Service provides a stable IP address and DNS name for a set of pods, abstracting the underlying pod IPs that can change due to scaling or failures. By default, a Service uses a cluster-internal virtual IP and DNS record (e.g., ..svc.cluster.local) that other pods can resolve, ensuring reliable connectivity without needing to track individual pod IPs.

Answer

NetworkPolicy

Answer

Ingress

Answer

ConfigMap

Question 2

A Kubernetes cluster has two nodes: control-plane and worker. The worker node runs several pods. The control-plane node becomes unreachable. What is the immediate impact on the pods running on the worker node?

Accepted Answer

Pods continue running, but new pods cannot be scheduled. When the control-plane node becomes unreachable, the kube-controller-manager cannot communicate with the kubelet on the worker node, so it stops performing scheduling and reconciliation. However, the kubelet on the worker node continues to run existing pods based on the last known desired state stored locally, and the pods themselves are managed by the container runtime (e.g., containerd) independently of the control-plane. Therefore, pods continue running normally, but no new pods can be scheduled because the scheduler, which runs on the control-plane, is unavailable.

Answer

All pods are immediately terminated

Answer

Pods are rescheduled to the control-plane node

Answer

The worker node is automatically cordoned

Question 3

What is the purpose of a readiness probe in a Kubernetes pod?

Accepted Answer

To determine if the container is ready to accept traffic. A readiness probe in Kubernetes determines whether a container within a pod is ready to start accepting traffic. If the probe fails, the pod is removed from the Service's endpoints, ensuring that only healthy containers receive requests. This is distinct from liveness probes, which restart containers, and startup probes, which delay other probes until initialization completes.

Answer

To measure resource usage of the container

Answer

To restart the container when it becomes unresponsive

Answer

To check if the container is still running

Question 4

You are writing a Deployment YAML (apps/v1) for a stateless web application. The application should have 3 replicas and use rolling updates with maxSurge=1 and maxUnavailable=0. Which field should you set under spec.strategy?

Accepted Answer

type: RollingUpdate with rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }. The Deployment's `spec.strategy.type` must be set to `RollingUpdate` to enable a controlled, incremental update of pods. The `rollingUpdate` field then allows you to specify `maxSurge: 1` (one extra pod above the desired count during update) and `maxUnavailable: 0` (ensure all existing pods remain available during the update), which is the exact configuration for a zero-downtime rolling update with a single surge pod.

Answer

type: Recreate

Answer

type: Canary

Answer

type: OnDelete

Question 5

You run 'kubectl get pods' and see that a pod named 'web-frontend' is in 'Pending' state for more than 5 minutes. What is the most likely cause?

Accepted Answer

There are insufficient resources on any node to schedule the pod. A pod stuck in 'Pending' state for an extended period typically indicates that the scheduler cannot find a suitable node to run the pod. The most common reason is insufficient resources (CPU, memory, or ephemeral storage) on any available node, causing the scheduler to leave the pod unscheduled. This is confirmed by running 'kubectl describe pod web-frontend' and checking the 'Events' section for 'FailedScheduling' messages.

Answer

The container image does not exist

Answer

The pod's readiness probe is failing

Answer

The pod's liveness probe is failing

Question 6

Which of the following is a benefit of container orchestration?

Accepted Answer

Self-healing of failed containers. Container orchestration platforms like Kubernetes provide self-healing capabilities by automatically restarting failed containers, rescheduling them on healthy nodes, and replacing or terminating containers that fail health checks. This ensures that the desired state of the application is maintained without manual intervention, which is a core benefit of orchestration.

Answer

Elimination of all security vulnerabilities

Answer

Manual scaling of applications

Answer

Guaranteed zero downtime

Question 7

You are asked to deploy a Kubernetes service that exposes a set of pods internally within the cluster only. The service should not be accessible from outside the cluster. Which Service type should you choose?

Accepted Answer

ClusterIP. ClusterIP is the default Kubernetes Service type that exposes the service on a cluster-internal IP address. This makes the service reachable only from within the cluster, which is exactly what is required for internal-only communication between pods. No external traffic can reach a ClusterIP service unless an ingress controller or proxy is explicitly configured.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer

Question 8

Which of the following describes the Open Container Initiative (OCI) image specification?

Accepted Answer

A standard for container images and runtimes. The Open Container Initiative (OCI) image specification defines a standard format for container images, ensuring that any OCI-compliant image can be run by any OCI-compliant runtime (e.g., runc, crun). This specification covers the image manifest, filesystem layers, and configuration, enabling interoperability across different container platforms like Docker, Podman, and containerd. Option A is correct because the OCI specifically standardizes both the image format and the runtime behavior, not higher-level orchestration or infrastructure concerns.

Answer

A specification for container orchestration

Answer

A specification for container storage

Answer

A specification for container networking

Question 9

Which TWO of the following are benefits of using a container orchestration platform like Kubernetes? (Select 2)

Accepted Answer

Automated scaling based on demand. Kubernetes includes a Horizontal Pod Autoscaler (HPA) that automatically adjusts the number of pod replicas based on observed CPU, memory, or custom metrics. This enables applications to scale out during traffic spikes and scale in during low demand, improving resource utilization and responsiveness without manual intervention.

Answer

Single-node deployment for simplicity

Answer

Manual scaling of applications

Answer

Elimination of all application bugs

Question 10

Which THREE of the following are characteristics of a microservices architecture? (Select 3)

Accepted Answer

Loose coupling between services. Microservices architecture emphasizes loose coupling, where each service communicates via well-defined APIs (e.g., REST, gRPC) and does not share internal implementation details. This allows services to evolve independently without affecting others, which is a core principle of the architecture.

Answer

Services share the same database schema

Answer

All services are packaged in a single monolithic deployment

Question 11

Which component is responsible for running containers on a Kubernetes node?

Accepted Answer

Container runtime (e.g., containerd). The container runtime (e.g., containerd) is the component responsible for actually running containers on a Kubernetes node. It pulls container images, manages container lifecycles, and handles low-level operations such as starting and stopping containers via the CRI (Container Runtime Interface). Without a container runtime, the kubelet cannot launch or manage any containers on the node.

Answer

etcd

Answer

kube-scheduler

Answer

kubelet

Question 12

Which Open Container Initiative (OCI) specification defines the format of container images?

Accepted Answer

Image Spec. The OCI Image Spec defines the format and content of container images, including the manifest, configuration, and layers. This ensures that any OCI-compliant runtime can run images built by any OCI-compliant tool, enabling interoperability across different container platforms.

Answer

Runtime Spec

Answer

Container Runtime Interface (CRI)

Answer

Dockerfile specification

Question 13

A developer wants to deploy a stateless web application that should scale to 5 replicas. Each replica must be identical and should be automatically replaced if it fails. Which Kubernetes resource should be used?

Accepted Answer

Deployment. A Deployment is the correct resource because it manages a ReplicaSet to ensure the desired number of identical, stateless pod replicas (5) are running. It provides declarative updates, self-healing (automatic replacement of failed pods), and scaling capabilities, which directly match the requirement for a stateless web application.

Answer

StatefulSet

Answer

DaemonSet

Answer

ReplicationController

Question 14

A pod is in the 'Pending' state. Which of the following is a likely cause?

Accepted Answer

No node has sufficient resources to run the pod. A pod enters the 'Pending' state when it has been accepted by the API server but cannot be scheduled onto a node. The most common cause is insufficient cluster resources (CPU, memory, or ephemeral storage) on any available node to satisfy the pod's resource requests. The Kubernetes scheduler continuously evaluates node resource availability and will leave the pod in Pending until a suitable node is found or the request times out.

Answer

The liveness probe is failing

Answer

The container image is not found in the registry

Answer

The container exited with OOMKilled

Question 15

An administrator runs 'kubectl get pods' and sees that a pod named 'app-pod' is in 'CrashLoopBackOff'. They run 'kubectl logs app-pod' and see a segmentation fault error. What is the most likely cause?

Accepted Answer

The application code has a bug. A segmentation fault (segfault) is a specific error caused by a program attempting to access memory it does not have permission to access, typically due to a bug in the application code (e.g., null pointer dereference, buffer overflow). Since the container starts but then crashes repeatedly (CrashLoopBackOff), the segfault indicates the application itself is failing, not the infrastructure or configuration. This is the most direct cause of the pod entering CrashLoopBackOff.

Answer

The node is out of memory

Answer

The container has a configuration error

Answer

The readiness probe is misconfigured