KCNA Container Orchestration Practice Test 5 — 15 Questions

Question 1

A developer creates a Deployment with replicas: 3 and strategy type: RollingUpdate with maxSurge: 1 and maxUnavailable: 1. During a rolling update, the Deployment controller creates a new ReplicaSet. After the new ReplicaSet has 2 pods ready, the node running one of the original ReplicaSet's pods fails. What is the MOST likely number of total pods running after the node failure, assuming no other actions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

2 pods running. Initially, the Deployment has 3 old pods. The rolling update starts: with maxSurge=1, the controller creates a new pod. Once it's ready, it terminates one old pod to keep desired replicas at 3. Then it creates another new pod. After the second new pod is ready, it terminates a second old pod. At this point, the new ReplicaSet has 2 ready pods, and the old ReplicaSet has only 1 pod remaining. The node running that last old pod fails, killing it. Thus, only the 2 new pods are running, giving a total of 2 pods.

Answer

4 pods running

Answer

3 pods running

Answer

1 pod running

Question 2

Which of the following is a container runtime that implements the Container Runtime Interface (CRI)?

Accepted Answer

containerd. containerd is a high-level container runtime that directly implements the Container Runtime Interface (CRI) by exposing a gRPC API that kubelet can call to manage pods and containers. It was originally extracted from Docker and is now the default runtime in many Kubernetes distributions, providing image transfer, container lifecycle management, and storage/network attachment without requiring Docker as an intermediary.

Answer

Docker

Answer

runc

Answer

kubelet

Question 3

You need to run a batch job that processes a queue of 1000 items. The job should run to completion and then terminate. Which Kubernetes resource is BEST suited for this workload?

Accepted Answer

Job. A Kubernetes Job is designed for batch processing tasks that run to completion and then terminate. It creates one or more Pods and ensures that a specified number of them successfully terminate. For a queue of 1000 items, a Job can be configured with a parallelism value and a completions count to process all items and then exit, making it the ideal resource for this workload.

Answer

DaemonSet

Answer

Deployment

Answer

StatefulSet

Question 4

A company wants to adopt immutable infrastructure for its containerized applications. Which practice BEST exemplifies immutability?

Accepted Answer

When a container fails, the orchestrator terminates it and launches a new container from the same image. Immutable infrastructure means that once a container is deployed from a specific image, it is never modified in place. When a container fails, the orchestrator (e.g., Kubernetes) terminates it and launches a new container from the same image, ensuring consistency and reproducibility. This approach eliminates configuration drift and aligns with the principle that all changes should be made by rebuilding the image, not by altering running instances.

Answer

Developers use kubectl exec to change environment variables in a running pod

Answer

A configuration management tool runs periodically to ensure containers are up-to-date

Answer

An operator logs into a running container and applies a security patch with apt-get update

Question 5

Which command correctly creates a Deployment named 'web-app' with the image 'nginx:1.21' and 3 replicas?

Accepted Answer

kubectl create deployment web-app --image=nginx:1.21 --replicas=3. `kubectl create deployment` is the imperative command specifically designed to create a Deployment resource in Kubernetes. The `--image` flag specifies the container image, and `--replicas=3` sets the desired number of pod replicas, which matches the requirement exactly.

Answer

kubectl apply deployment web-app --image=nginx:1.21 --replicas=3

Answer

kubectl run web-app --image=nginx:1.21 --replicas=3

Answer

kubectl create deployement web-app --image=nginx:1.21 --replicas=3

Question 6

What is the primary purpose of the Open Container Initiative (OCI)?

Accepted Answer

To standardize container image and runtime specifications. The Open Container Initiative (OCI) is an open governance structure that standardizes container image and runtime specifications. It ensures that any OCI-compliant image can run on any OCI-compliant runtime, promoting interoperability across the container ecosystem. This is the core purpose, not to provide a specific runtime or orchestration tool.

Answer

To provide a container runtime called Docker

Answer

To create a container orchestration platform

Answer

To define the Kubernetes Container Runtime Interface (CRI)

Question 7

You have a microservices application where Service A needs to communicate with Service B running in a different namespace ('backend'). Both namespaces have a NetworkPolicy that denies all ingress by default. You create a NetworkPolicy in the 'backend' namespace allowing ingress from pods with label 'app: frontend'. What else is needed for Service A to reach Service B?

Accepted Answer

Add a label to the 'default' namespace matching the NetworkPolicy's namespaceSelector. A NetworkPolicy with only a podSelector in an ingress rule matches pods in the same namespace only. To allow cross-namespace traffic, you must include a namespaceSelector that selects the namespace of the source pods. By adding a label to the 'default' namespace and including a namespaceSelector matching that label in the NetworkPolicy, you enable Service A's pods to be allowed. Ensure Service A's pod also has the required label 'app: frontend'. Option A is wrong: a podSelector alone only matches pods in the same namespace. Option B is wrong: egress policies are not needed for inbound traffic. Option C is too permissive and unnecessary.

Answer

Ensure Service A's pod has the label 'app: frontend' on its pod spec

Answer

Add a similar NetworkPolicy in the 'default' namespace allowing egress to the 'backend' namespace

Answer

Change the NetworkPolicy to allow all ingress traffic from any source

Question 8

A container image is built from a Dockerfile with multiple layers. Which statement about container image layers is TRUE?

Accepted Answer

Layers are read-only and can be reused across different images. Container image layers are read-only and are stored in a content-addressable storage (e.g., overlayfs, aufs). These layers can be reused across different images when they share the same content hash, which is a fundamental efficiency of Docker's union filesystem. This layer sharing reduces disk usage and speeds up image pulls.

Answer

Each layer is created by a RUN instruction and can be modified after the image is built

Answer

Each layer is unique to the image and cannot be shared with other images

Answer

All layers in a container image are writable at runtime

Question 9

You need to run a stateful application that requires stable network identities and persistent storage per pod. Which Kubernetes resource is BEST suited?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it is specifically designed for stateful applications that require stable, unique network identifiers (e.g., pod names like `web-0`, `web-1`) and persistent storage that persists across pod rescheduling. Each pod in a StatefulSet gets a dedicated PersistentVolumeClaim, and the ordinal index ensures consistent identity, which is critical for databases like Cassandra or MySQL.

Answer

DaemonSet

Answer

Job

Answer

Deployment

Question 10

Which of the following is a key benefit of using containers over virtual machines?

Accepted Answer

Containers share the host OS kernel. Containers share the host operating system kernel, which makes them lightweight and fast to start compared to virtual machines. Each container runs as an isolated user-space process on the same kernel, avoiding the overhead of a separate guest OS per instance. This shared-kernel architecture is a fundamental design principle of containerization technologies like Docker and containerd.

Answer

Each container runs its own operating system

Answer

Containers provide stronger isolation than VMs

Answer

Containers require hypervisor to run

Question 11

What is the purpose of the Container Runtime Interface (CRI) in Kubernetes?

Accepted Answer

To allow kubelet to use different container runtimes. The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a variety of container runtimes without needing to recompile the Kubernetes source code. By defining a standard API (gRPC-based) for runtime operations like pulling images and managing containers, CRI decouples Kubernetes from specific runtime implementations such as containerd, CRI-O, or Docker (via dockershim). This abstraction allows cluster administrators to choose the most suitable runtime for their environment while maintaining compatibility with the Kubernetes control plane.

Answer

To manage persistent storage for containers

Answer

To provide a network plugin interface for pods

Answer

To define a standard for container images

Question 12

Which Kubernetes resource is used to run a batch job that runs to completion?

Accepted Answer

Job. A Kubernetes Job is specifically designed to run a finite task to completion, creating one or more Pods and ensuring they successfully terminate. Unlike controllers that maintain a desired state of running Pods, a Job tracks the number of successful completions and stops when the specified parallelism or completions count is reached.

Answer

DaemonSet

Answer

StatefulSet

Answer

Deployment

Question 13

A user wants to ensure that a pod is automatically restarted if its main process crashes. Which Kubernetes controller should they use?

Accepted Answer

Deployment. A Deployment is the correct controller because it manages a ReplicaSet, which ensures a specified number of pod replicas are running at all times. If the main process in a pod crashes, the ReplicaSet detects the pod failure (via the kubelet's liveness probe or the pod's phase becoming 'Failed') and automatically creates a new pod to replace it, thereby restarting the application. This self-healing behavior is a core feature of Deployments, making them ideal for stateless applications that need continuous availability.

Answer

Job

Answer

DaemonSet

Answer

CronJob

Question 14

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event '0/4 nodes are available: 4 Insufficient cpu'. What is the most likely cause?

Accepted Answer

None of the nodes have enough CPU resources to satisfy the pod's request. The '0/4 nodes are available: 4 Insufficient cpu' event directly indicates that the Kubernetes scheduler attempted to place the pod on each of the four nodes but found that none had enough allocatable CPU capacity to satisfy the pod's CPU request (specified in the container's `resources.requests.cpu`). This causes the pod to remain in 'Pending' state because the scheduler cannot find a feasible node.

Answer

The pod has exceeded its memory limit

Answer

The pod's image pull is failing

Answer

The pod's liveness probe is failing

Question 15

Which command would you use to view the logs of a specific container in a multi-container pod, using the short flag?

Accepted Answer

kubectl logs mypod -c mycontainer. The command `kubectl logs mypod -c mycontainer` uses the short flag `-c` to specify the container name in a multi-container pod. The long form `--container` also works, but the exam may specifically expect the short flag syntax. Option A uses `-p` which retrieves logs from a previous instance. Option D provides the container name as a positional argument, which is incorrect.

Answer

kubectl logs mycontainer -p mypod

Answer

kubectl logs mypod --container mycontainer

Answer

kubectl logs mypod mycontainer