KCNA Container Orchestration Practice Test 14 — 15 Questions

Question 1

You need to deploy an application that requires exactly one pod per cluster node for logging purposes. Which Kubernetes workload resource should you use?

Accepted Answer

DaemonSet. A DaemonSet ensures that a copy of a pod runs on every node in the cluster, or on a subset of nodes if a node selector is used. This is the correct resource for deploying a logging agent that must be present on each node to collect logs from that node's containers and system components.

Answer

Job

Answer

StatefulSet

Answer

Deployment

Question 2

Which of the following correctly describes the concept of 'immutable infrastructure' in the context of container orchestration?

Accepted Answer

Infrastructure components are recreated from a known good state rather than modified. Immutable infrastructure means that once a container image is built, it is never modified; updates are done by replacing the entire container with a new image.

Answer

Configuration changes are applied via SSH into running containers

Answer

Servers are never rebooted

Answer

Container images are updated in-place by patching existing layers

Question 3

Which TWO of the following are benefits of using a container orchestration platform like Kubernetes? (Choose two.)

Accepted Answer

Self-healing by restarting failed containers. Orchestration provides automated scaling and self-healing. Manual scaling and single-node deployment are not benefits.

Answer

Inability to manage container networking

Answer

Requirement to run applications on a single node

Answer

Manual rollback of application versions

Question 4

Which THREE are valid container runtimes that implement the Kubernetes CRI? (Choose three.)

Accepted Answer

Docker (via dockershim, deprecated). containerd, CRI-O, and Docker (via dockershim, deprecated) implement CRI. rkt is discontinued and not CRI-compliant; runc is a low-level runtime, not a CRI implementation.

Answer

runc

Answer

rkt

Question 5

Which TWO statements about container images are correct? (Choose two.)

Accepted Answer

Container images can be stored in a registry like Docker Hub. Container images are built in layers and can be stored in registries. They are not immutable once built (they can be overwritten), and they include only the application and dependencies, not a full OS kernel.

Answer

Container images include a full operating system kernel

Answer

Container images are immutable once built

Answer

Container images can only be built on Linux

Question 6

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. OOMKilled indicates the container was terminated because it exceeded its memory limit. The correct resolution is to increase the memory limit (option A). Option B (increasing CPU request) does not address memory consumption. Option C (deleting the namespace) is overly destructive and unnecessary. Option D (deleting and recreating the pod) would restart the container but would immediately fail again due to the same memory limit, so it does not resolve the root cause.

Answer

Increase the CPU request for the container

Answer

Delete the namespace and redeploy all workloads

Answer

Delete and recreate the pod to clear the crash loop

Question 7

Which TWO of the following are benefits of using containers over virtual machines? (Choose 2)

Accepted Answer

Containers are more lightweight and start faster than VMs. Containers share the host OS kernel and run as isolated processes, making them lightweight and able to start in milliseconds, unlike VMs which require booting a full guest OS. This efficiency stems from container images being mere megabytes compared to gigabytes for VM images, and containers using cgroups and namespaces for resource management rather than a hypervisor.

Answer

Containers require hypervisor software to run

Answer

Containers include a full guest operating system

Answer

Containers provide stronger isolation than VMs

Question 8

Which TWO of the following are required fields when defining a container in a Kubernetes Pod spec? (Choose 2)

Accepted Answer

image. In a Kubernetes Pod spec, the `name` and `image` fields are mandatory for each container definition. The `name` field uniquely identifies the container within the Pod, and the `image` field specifies the container image to run (e.g., `nginx:1.25`). Without these two fields, the Pod creation will fail with a validation error from the Kubernetes API server.

Answer

env

Answer

resources

Answer

ports

Question 9

Which THREE of the following are true about the Open Container Initiative (OCI)? (Choose 3)

Accepted Answer

OCI defines both an image spec and a runtime spec. The OCI defines the image spec and runtime spec, ensuring interoperability between container tools. containerd is an OCI-compliant runtime. Docker images are OCI-compliant. Docker itself is not a runtime spec but a platform that uses runtimes.

Answer

Docker is an OCI runtime specification

Answer

OCI is governed by the Cloud Native Computing Foundation (CNCF)

Question 10

Which TWO of the following are characteristics of microservices architecture? (Choose 2)

Accepted Answer

Services can be deployed independently. Microservices architecture is defined by the ability to deploy each service independently without affecting other services. This independence enables teams to update, scale, and roll back individual components, which is a core principle of container orchestration platforms like Kubernetes that manage these services as separate units.

Answer

All services share the same database

Answer

The entire application is deployed as a single unit

Answer

Services are tightly coupled

Question 11

Which TWO of the following correctly describe the difference between Docker Compose and Kubernetes? (Choose 2)

Accepted Answer

Kubernetes provides built-in auto-scaling and self-healing. Docker Compose is designed for single-host container orchestration with a simple YAML file, while Kubernetes is a multi-host container orchestration platform with advanced features like auto-scaling and self-healing.

Answer

Docker Compose can manage containers across multiple hosts

Answer

Docker Compose is suitable for production-grade deployments

Answer

Both Docker Compose and Kubernetes use the same YAML format

Question 12

Which THREE of the following are true about the Container Runtime Interface (CRI)? (Choose 3)

Accepted Answer

CRI allows kubelet to communicate with different container runtimes. CRI is a plugin interface that enables kubelet to use different container runtimes without recompiling. containerd and CRI-O are CRI-compliant runtimes. Docker was deprecated as a Kubernetes runtime and is not CRI-native; it uses dockershim.

Answer

Docker natively implements the CRI

Answer

CRI is part of the Open Container Initiative (OCI)

Question 13

Which THREE of the following are core principles of immutable infrastructure? (Choose 3)

Accepted Answer

Rollbacks are performed by redeploying a previous image. Immutable infrastructure means that components are replaced, not modified. This ensures consistency, reliability, and easy rollbacks. Patching running instances is mutable.

Answer

Infrastructure is patched by applying updates to running servers

Answer

All changes are made by updating configuration files on running instances

Question 14

Which TWO of the following are true about service discovery in Kubernetes? (Choose 2)

Accepted Answer

Environment variables are injected into pods for each Service. Kubernetes provides DNS-based service discovery, where Services get DNS names resolved by CoreDNS. Services also have environment variables injected into pods. Headless Services do not provide a single IP; they return the pod IPs. Ingress is for external traffic, not internal service discovery.

Answer

Ingress resources can be used for internal service discovery

Answer

Service discovery is only available for pods on the same node

Answer

Headless Services provide a stable virtual IP for service discovery

Question 15

Which TWO of the following are true about container networking basics? (Choose 2)

Accepted Answer

Containers on the same host can communicate via a bridge network. Containers utilize network namespaces to isolate their network stack, so each container has its own network namespace (C). On the same host, containers can communicate through a bridge network, which provides connectivity via a virtual switch (B). Option A is false because containers on different nodes can communicate via overlay networks or routing. Option D is false because container networking typically requires configuration (e.g., Docker's bridge or CNI plugins). Option E is false because containers usually have their own IP addresses within the bridge network, not sharing the host's IP directly.

Answer

Containers can only communicate if they are on the same node

Answer

Container networking does not require any configuration

Answer

All containers share the host's IP address