KCNA Container Orchestration Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are valid reasons to use a DaemonSet instead of a Deployment? (Select 2)

Accepted Answer

You need to run exactly one pod per node for log collection. A DaemonSet ensures that exactly one pod runs on every node (or a subset of nodes) in the cluster. Option A is correct because log collection agents (e.g., Fluentd, Filebeat) must run on each node to capture all container logs, and a DaemonSet guarantees this per-node scheduling. Option B is correct because monitoring agents (e.g., Prometheus Node Exporter, Datadog agent) need to be present on every node to collect host-level metrics, and a DaemonSet is the ideal controller for this use case.

Answer

You need to ensure a pod runs on the control-plane node only

Answer

You need to run a batch job that completes and exits

Answer

You need to run a stateless web application with multiple replicas

Question 2

What is a key benefit of container orchestration platforms like Kubernetes?

Accepted Answer

Self-healing capabilities automatically restart failed containers. Kubernetes provides self-healing capabilities through controllers like ReplicaSets and Deployments, which continuously monitor the desired state of containers. If a container fails or becomes unresponsive, the control plane automatically restarts or reschedules it, ensuring high availability without manual intervention. This is a core benefit of container orchestration platforms, as it abstracts away the operational overhead of managing individual container lifecycles.

Answer

Containers are tightly coupled to the underlying hardware

Answer

Each container runs its own operating system kernel

Answer

Containers can only run on a single host

Question 3

A developer creates a Deployment with 3 replicas. After updating the pod template, they run 'kubectl rollout status deployment/my-deployment' and see that the rollout is stuck. Which command should they use to investigate the rollout history?

Accepted Answer

kubectl rollout history deployment/my-deployment. 'kubectl rollout history' is the dedicated command to view the revision history of a Deployment, including the changes made to the pod template in each revision. When a rollout is stuck, this command helps identify which revision caused the issue and allows you to roll back to a previous stable revision. The other commands provide general debugging information but do not specifically show the rollout history.

Answer

kubectl get events

Answer

kubectl describe deployment my-deployment

Answer

kubectl logs deployment/my-deployment

Question 4

A user runs 'kubectl exec -it pod1 -- /bin/sh' and gets an error: 'error: unable to upgrade connection: container not found'. The pod is running and has one container named 'app'. What is the most likely issue?

Accepted Answer

The container does not have a shell binary. The error 'unable to upgrade connection: container not found' can occur when the container image does not include the specified shell binary (/bin/sh). Although the container exists, kubectl cannot spawn a shell process because the binary is missing. Option D is incorrect because the pod has only one container (named 'app'), so the container name is unambiguous. Option A is incorrect because the pod is running. Option C is incorrect because permission errors produce a different message.

Answer

The pod is not running

Answer

The user does not have permission to exec into pods

Answer

The container name was not specified and the pod has multiple containers

Question 5

You have a Deployment running 3 replicas. You need to update the container image without downtime. Which command updates the image while performing a rolling update?

Accepted Answer

kubectl set image deployment/my-deployment nginx=nginx:1.25. `kubectl set image` triggers a rolling update on the Deployment, updating the container image gradually without downtime. Kubernetes automatically manages the rollout by creating new Pods with the new image and terminating old ones, ensuring the desired replica count is maintained throughout the process.

Answer

kubectl replace deployment my-deployment --image=nginx:1.25

Answer

kubectl scale deployment my-deployment --image=nginx:1.25

Answer

kubectl update deployment my-deployment --image=nginx:1.25

Question 6

Which two of the following are container runtimes that implement the Container Runtime Interface (CRI)? (Choose two.)

Accepted Answer

containerd. containerd is a core container runtime that implements the Container Runtime Interface (CRI), which is the Kubernetes API for integrating container runtimes. It was originally extracted from Docker and is now a graduated CNCF project, providing a stable CRI-compatible interface for managing container lifecycles.

Answer

Docker

Answer

Podman

Answer

runc

Question 7

Which THREE of the following are key benefits of container orchestration? (Choose 3)

Accepted Answer

Declarative management using desired state configuration. Declarative management using desired state configuration is a core benefit of container orchestration platforms like Kubernetes. Instead of manually issuing commands to start, stop, or scale containers, you define the desired state of your application (e.g., 'run 3 replicas of nginx:1.25') in a YAML or JSON manifest. The orchestrator's control loop continuously reconciles the actual state with this desired state, automatically making changes to achieve and maintain it.

Answer

Built-in network isolation between all containers

Answer

Automatic code compilation from source repositories

Question 8

Which TWO of the following are true about container images? (Choose 2)

Accepted Answer

Container images are immutable once created. Container images are immutable once created (B) and consist of read-only layers (D). They do not include a full OS kernel (A); they share the host kernel. While images are often stored in registries (C), this is not an inherent property of the image itself; images can exist locally without being in a registry. A Dockerfile is used to build an image but is not part of the image (E).

Answer

Container images include a full operating system kernel

Answer

Container images are stored in a container registry

Answer

Container images are built using a Dockerfile

Question 9

A team deploys a microservice that requires sticky sessions. The service runs on Kubernetes with multiple replicas. Which Kubernetes resource should be used to ensure requests from a client are consistently routed to the same pod?

Accepted Answer

Service with sessionAffinity: ClientIP. Setting `sessionAffinity: ClientIP` on a Kubernetes Service ensures that all requests from the same client IP are routed to the same Pod. This is the standard Kubernetes mechanism for implementing sticky sessions without requiring changes to the application or ingress layer.

Answer

Headless Service

Answer

Ingress with default settings

Answer

Deployment with hostNetwork: true

Question 10

A Kubernetes cluster is experiencing network latency. The team suspects that the number of services and endpoints is causing iptables performance degradation. Which CNI plugin or network policy approach is most likely to improve performance?

Accepted Answer

Use an eBPF-based CNI plugin like Cilium. C is correct because eBPF-based CNI plugins like Cilium bypass the traditional iptables chains entirely, using a kernel-level BPF (Berkeley Packet Filter) program to handle service load balancing and network policy enforcement. This eliminates the O(n) scaling issue of iptables rules with the number of services and endpoints, significantly reducing latency in large clusters.

Answer

Switch to Flannel with host-gw backend

Answer

Use Calico with iptables mode

Answer

Apply a default-deny NetworkPolicy

Question 11

A developer wants to ensure that a pod runs only on nodes with SSDs. Which mechanism should be used?

Accepted Answer

Add a nodeSelector with disktype: ssd. `nodeSelector` is a simple and direct mechanism in Kubernetes to constrain a pod to run only on nodes that have a specific label, such as `disktype=ssd`. By labeling nodes with SSDs and adding the corresponding `nodeSelector` in the pod spec, the scheduler ensures the pod is placed exclusively on those nodes. This approach is straightforward and does not require complex scheduling constraints or resource management.

Answer

Apply a taint to nodes without SSDs and add tolerations to the pod

Answer

Use pod anti-affinity

Answer

Define a ResourceQuota

Question 12

An application running in a Kubernetes pod needs to access a database that is deployed on a VM outside the cluster. The database IP is stable. Which is the best way to expose the database to the pod?

Accepted Answer

Create a Service of type ExternalName pointing to the database hostname. A Service of type ExternalName provides a DNS-based abstraction for external resources, mapping a Kubernetes service name to an external DNS name (the database hostname). This allows the pod to access the database via a stable in-cluster DNS name without needing to manage IP changes or network policies for external endpoints. It is the simplest and most Kubernetes-native way to expose a stable external IP to a pod.

Answer

Expose the database via Ingress

Answer

Use a Headless Service

Answer

Create an EndpointSlice manually with the pod IP

Question 13

A team notices that a ReplicaSet is not creating the desired number of pods. The ReplicaSet YAML is correctly configured with replicas: 3. The cluster has sufficient resources. What is the most likely cause?

Accepted Answer

The pod template references an invalid image pull secret. An invalid image pull secret in the pod template prevents the kubelet from authenticating with the container registry, causing the pod creation to fail. The ReplicaSet controller attempts to create pods, but the scheduler cannot pull the image, so the pods remain in a pending or ImagePullBackOff state, never reaching the desired count of 3.

Answer

The ReplicaSet is paused

Answer

The nodeSelector does not match any node

Answer

A ResourceQuota in the namespace limits the number of pods

Question 14

Which TWO of the following are valid ways to expose a set of pods as a network service in Kubernetes?

Accepted Answer

Service of type NodePort. A Service of type NodePort exposes a set of pods on a static port on each node's IP address, making the service accessible from outside the cluster. This is a valid Kubernetes resource for exposing pods as a network service, as it creates a mapping from a node port to the ClusterIP and then to the target pods.

Answer

NetworkPolicy

Answer

Ingress resource

Answer

Deployment with replicas

Question 15

Which THREE of the following are correct statements about Kubernetes Deployments?

Accepted Answer

A Deployment manages ReplicaSets. A Deployment manages ReplicaSets, which in turn manage Pods. This is the core abstraction: the Deployment controller creates and updates ReplicaSets to achieve the desired state, and each ReplicaSet ensures a specified number of Pod replicas are running. This layered architecture enables features like rolling updates and rollbacks without the Deployment directly interacting with individual Pods.

Answer

Deployments support canary deployments natively

Answer

A Deployment directly manages Pods