KCNA Container Orchestration Practice Test 3 — 15 Questions

Question 1

You have a microservices application where Service A needs to communicate with Service B running in a different namespace ('backend'). Both namespaces have a NetworkPolicy that denies all ingress by default. You create a NetworkPolicy in the 'backend' namespace allowing ingress from pods with label 'app: frontend'. What else is needed for Service A to reach Service B?

Accepted Answer

Ensure Service A's pod has the label 'app: frontend' on its pod spec. Option A is correct because NetworkPolicies use pod selectors to determine which pods are allowed to send or receive traffic. By default, a NetworkPolicy that allows ingress from pods with label 'app: frontend' will only match pods in the same namespace unless a namespaceSelector is also specified. Since Service A is in a different namespace, the only way to match the ingress rule is to ensure Service A's pod carries the label 'app: frontend'. This satisfies the podSelector in the NetworkPolicy, allowing traffic from that specific pod to Service B.

Answer

Add a similar NetworkPolicy in the 'default' namespace allowing egress to the 'backend' namespace

Answer

Change the NetworkPolicy to allow all ingress traffic from any source

Answer

Add a label to the 'default' namespace matching the NetworkPolicy's namespaceSelector

Question 2

A container image is built from a Dockerfile with multiple layers. Which statement about container image layers is TRUE?

Accepted Answer

Layers are read-only and can be reused across different images. Option C is correct because container image layers are read-only and are stored in a content-addressable storage (e.g., overlayfs, aufs). These layers can be reused across different images when they share the same content hash, which is a fundamental efficiency of Docker's union filesystem. This layer sharing reduces disk usage and speeds up image pulls.

Answer

Each layer is created by a RUN instruction and can be modified after the image is built

Answer

Each layer is unique to the image and cannot be shared with other images

Answer

All layers in a container image are writable at runtime

Question 3

You need to run a stateful application that requires stable network identities and persistent storage per pod. Which Kubernetes resource is BEST suited?

Accepted Answer

StatefulSet. Option A is correct. StatefulSet is designed for stateful applications that need stable, unique network identities and persistent storage. Option B (Deployment) is for stateless apps. Option C (DaemonSet) runs on each node. Option D (Job) is for batch work.

Answer

DaemonSet

Answer

Job

Answer

Deployment

Question 4

Which TWO statements about Docker Compose and Kubernetes are correct?

Accepted Answer

Kubernetes provides built-in auto-scaling and self-healing capabilities. Options A and D are correct. Docker Compose is primarily for single-host container orchestration (A). Kubernetes provides built-in features like auto-scaling and self-healing (D). Option B is false — Kubernetes can also be used in production. Option C is false — Docker Compose does not manage a cluster; it uses a single Docker daemon. Option E is false — Docker Compose uses a compose file, not YAML manifests? Actually both use YAML, but the statement is misleading; Compose uses docker-compose.yml, Kubernetes uses YAML manifests, but they are not interchangeable.

Answer

Kubernetes is only used in production environments

Answer

Docker Compose and Kubernetes use the same YAML manifest format

Answer

Docker Compose supports multi-node clustering out-of-the-box

Question 5

Which THREE are benefits of using container orchestration platforms like Kubernetes?

Accepted Answer

High availability through automatic container restart and replication. Options A, B, and D are correct. Orchestration provides high availability (A), scaling (B), and self-healing (D). Option C is false — orchestration adds complexity, not simplicity. Option E is false — manual intervention can be reduced, but orchestration does not eliminate the need for management.

Answer

Simplified application development by eliminating the need for code changes

Answer

Elimination of the need for monitoring and logging

Question 6

Which TWO are characteristics of the microservices architecture that are supported by container orchestration?

Accepted Answer

Independent deployment of each service. Options A and D are correct. Microservices decompose an application into loosely coupled services (A) that can be deployed independently (D). Option B is false — microservices should be loose coupling. Option C is false — microservices favor decentralized data management. Option E is false — microservices are typically small, not monolithic.

Answer

Tight coupling between services to ensure performance

Answer

Monolithic codebase with centralized deployment

Answer

Use of a single, shared database for all services

Question 7

Which of the following is a key benefit of using containers over virtual machines?

Accepted Answer

Containers share the host OS kernel. Containers share the host operating system kernel, which makes them lightweight and fast to start compared to virtual machines. Each container runs as an isolated user-space process on the same kernel, avoiding the overhead of a separate guest OS per instance. This shared-kernel architecture is a fundamental design principle of containerization technologies like Docker and containerd.

Answer

Each container runs its own operating system

Answer

Containers provide stronger isolation than VMs

Answer

Containers require hypervisor to run

Question 8

What is the purpose of the Container Runtime Interface (CRI) in Kubernetes?

Accepted Answer

To allow kubelet to use different container runtimes. CRI is a plugin interface that enables kubelet to use different container runtimes without needing to recompile.

Answer

To manage persistent storage for containers

Answer

To provide a network plugin interface for pods

Answer

To define a standard for container images

Question 9

Which Kubernetes resource is used to run a batch job that runs to completion?

Accepted Answer

Job. Jobs are designed for batch processing and run pods until successful completion.

Answer

DaemonSet

Answer

StatefulSet

Answer

Deployment

Question 10

A user wants to ensure that a pod is automatically restarted if its main process crashes. Which Kubernetes controller should they use?

Accepted Answer

Deployment. A Deployment is the correct controller because it manages a ReplicaSet, which ensures a specified number of pod replicas are running at all times. If the main process in a pod crashes, the ReplicaSet detects the pod failure (via the kubelet's liveness probe or the pod's phase becoming 'Failed') and automatically creates a new pod to replace it, thereby restarting the application. This self-healing behavior is a core feature of Deployments, making them ideal for stateless applications that need continuous availability.

Answer

Job

Answer

DaemonSet

Answer

CronJob

Question 11

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event '0/4 nodes are available: 4 Insufficient cpu'. What is the most likely cause?

Accepted Answer

None of the nodes have enough CPU resources to satisfy the pod's request. The scheduler cannot place the pod because no node has enough available CPU to meet the pod's request.

Answer

The pod has exceeded its memory limit

Answer

The pod's image pull is failing

Answer

The pod's liveness probe is failing

Question 12

Which command would you use to view the logs of a specific container in a multi-container pod?

Accepted Answer

kubectl logs mypod -c mycontainer. The -c flag specifies the container name within the pod.

Answer

kubectl logs mycontainer -p mypod

Answer

kubectl logs mypod --container mycontainer

Answer

kubectl logs mypod mycontainer

Question 13

What is the role of etcd in a Kubernetes cluster?

Accepted Answer

It stores cluster state and configuration. etcd is a distributed, consistent key-value store that serves as Kubernetes' primary datastore for all cluster state and configuration data. It stores objects like pods, services, deployments, secrets, and configmaps, and is the source of truth for the entire cluster. The Kubernetes API server is the only component that communicates directly with etcd, ensuring strong consistency via the Raft consensus protocol.

Answer

It serves as the container runtime

Answer

It provides DNS-based service discovery

Answer

It schedules pods onto nodes

Question 14

A developer wants to expose a set of pods running a web application on a stable IP address. Which Kubernetes resource should they create?

Accepted Answer

Service. A Service provides a stable IP and DNS name to access a set of pods.

Answer

ConfigMap

Answer

Ingress

Answer

NetworkPolicy

Question 15

A pod is in CrashLoopBackOff. You check the logs and see 'Error: container process not found'. What is the most likely cause?

Accepted Answer

The container's entrypoint or command is incorrect. The container's entrypoint or command may be misconfigured, causing the container to exit immediately.

Answer

The pod has insufficient memory

Answer

The liveness probe is misconfigured

Answer

The container image is missing