KCNA Container Orchestration Practice Test 6 — 15 Questions

Question 1

What is the role of etcd in a Kubernetes cluster?

Accepted Answer

It stores cluster state and configuration. etcd is a distributed, consistent key-value store that serves as Kubernetes' primary datastore for all cluster state and configuration data. It stores objects like pods, services, deployments, secrets, and configmaps, and is the source of truth for the entire cluster. The Kubernetes API server is the only component that communicates directly with etcd, ensuring strong consistency via the Raft consensus protocol.

Answer

It serves as the container runtime

Answer

It provides DNS-based service discovery

Answer

It schedules pods onto nodes

Question 2

A developer wants to expose a set of pods running a web application on a stable IP address. Which Kubernetes resource should they create?

Accepted Answer

Service. A Service in Kubernetes provides a stable IP address and DNS name to expose a set of pods, abstracting away pod IP changes due to scaling or restarts. It acts as a load balancer across the pods, typically using ClusterIP (default), NodePort, or LoadBalancer types. This directly meets the requirement of exposing pods on a stable IP.

Answer

ConfigMap

Answer

Ingress

Answer

NetworkPolicy

Question 3

A pod is in CrashLoopBackOff. You check the logs and see 'Error: container process not found'. What is the most likely cause?

Accepted Answer

The container's entrypoint or command is incorrect. The container's entrypoint or command may be misconfigured, causing the container to exit immediately.

Answer

The pod has insufficient memory

Answer

The liveness probe is misconfigured

Answer

The container image is missing

Question 4

A user creates a Service of type ClusterIP with a selector matching pods labeled 'app: myapp'. However, a pod named 'myapp-pod' with label 'app: myapp' is not receiving traffic. What is a possible reason?

Accepted Answer

The pod's readiness probe is failing. A failing readiness probe causes the pod to be removed from the Service's Endpoints list, even if the pod is running and matches the selector. The kubelet checks the readiness probe periodically; if it fails, the pod is marked as not ready, and the Service controller removes its IP from the Endpoints object, preventing traffic from being forwarded to it.

Answer

The Service type should be NodePort

Answer

The pod is in a different namespace

Answer

The pod's container port is not defined

Question 5

Which TWO of the following are valid container runtimes that implement the CRI? (Choose two.)

Accepted Answer

CRI-O. CRI-O is a lightweight container runtime specifically designed to implement the Kubernetes Container Runtime Interface (CRI), allowing Kubernetes to use OCI-compliant runtimes directly without relying on Docker. It is a valid CRI implementation because it provides the gRPC-based CRI API server and manages container lifecycle using runc or Kata Containers as the underlying OCI runtime.

Answer

Kata Containers

Answer

Docker

Answer

rkt

Question 6

Which THREE of the following are benefits of using container orchestration? (Choose three.)

Accepted Answer

High availability through automated failover. Container orchestration platforms like Kubernetes implement automated failover by monitoring container health via liveness probes and rescheduling pods on healthy nodes when a node fails. This ensures that applications remain available even when underlying infrastructure components fail, which is a core benefit of orchestration.

Answer

Decomposition of applications into microservices

Answer

Simplified networking with flat network topology

Question 7

Which TWO statements about container images are correct? (Choose two.)

Accepted Answer

Each layer is identified by a unique hash. Each layer in a container image is identified by a unique content-addressable hash (typically a SHA-256 digest). This hash is computed from the layer's contents and metadata, ensuring integrity and enabling layer caching and deduplication across images. The hash is used in the image manifest (as defined by the OCI Image Specification) to reference each layer uniquely.

Answer

Images are always pulled from a private registry

Answer

Images can be modified at runtime by writing to the container layer

Answer

Images are stored on the host filesystem after being pulled

Question 8

What is the primary difference between a container and a virtual machine (VM)?

Accepted Answer

Containers share the host OS kernel, whereas VMs each have their own guest OS. The primary difference is that containers share the host operating system kernel, while each virtual machine runs its own complete guest OS. This means containers are lightweight processes with isolated user spaces, whereas VMs include a full OS stack (kernel, drivers, libraries) per instance. This architectural distinction is why containers start in seconds and have minimal overhead, while VMs require booting a guest OS and consume more resources.

Answer

Containers are slower to start than VMs

Answer

Containers require a hypervisor to run

Answer

Containers virtualize hardware, while VMs virtualize the operating system

Question 9

Which Kubernetes resource is best suited for running a batch processing job that must complete successfully exactly once?

Accepted Answer

Job. A Kubernetes Job is designed specifically for batch processing tasks that need to run to completion exactly once. It creates one or more Pods and ensures that a specified number of them successfully terminate, making it ideal for workloads like data processing or backups that must finish without retries or restarts.

Answer

DaemonSet

Answer

Deployment

Answer

CronJob

Question 10

What is the Container Runtime Interface (CRI)?

Accepted Answer

An API between kubelet and container runtime. The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a variety of container runtimes without needing to recompile the kubelet. It defines a gRPC API (protocol buffers) for the kubelet to communicate with the container runtime, covering operations like pod lifecycle management and image management. Option D correctly identifies this as the API between the kubelet and the container runtime.

Answer

A tool for building container images

Answer

A standard for container runtime logs

Answer

A specification for container images

Question 11

Which of the following is a benefit of container orchestration?

Accepted Answer

Self-healing of failed containers. Container orchestration platforms like Kubernetes provide self-healing capabilities by automatically restarting failed containers, rescheduling them on healthy nodes, and replacing or terminating containers that fail health checks. This ensures high availability and reduces manual intervention, which is a core benefit of orchestration.

Answer

Requires a hypervisor for each container

Answer

Manual scaling of containers

Answer

Static infrastructure with no changes

Question 12

A Deployment manages 3 replicas of a pod. During a rolling update, one of the new pods enters CrashLoopBackOff. What happens next?

Accepted Answer

The Deployment pauses the rollout and waits for manual intervention. By default, a Deployment's rolling update strategy has a `progressDeadlineSeconds` setting (default 600 seconds) and a `maxUnavailable`/`maxSurge` configuration. When a new pod enters CrashLoopBackOff, the Deployment's controller detects that the update is not making progress (the new ReplicaSet cannot reach the desired replica count with healthy pods). After the progress deadline expires, the Deployment marks the rollout as failed and pauses the update, requiring manual intervention (e.g., `kubectl rollout undo` or fixing the pod template). This behavior is governed by the Deployment controller's reconciliation loop and the `Progressing` condition.

Answer

The Deployment deletes all pods and recreates them

Answer

The Deployment automatically reverts to the previous ReplicaSet

Answer

The Deployment continues the rollout, ignoring the failure

Question 13

Which of the following is a valid use case for a DaemonSet?

Accepted Answer

Running a logging agent on every node. A DaemonSet ensures that a copy of a pod runs on all (or a subset of) nodes in the cluster. This is ideal for infrastructure pods like logging agents (e.g., Fluentd), monitoring agents (e.g., Prometheus Node Exporter), or kube-proxy, which must be present on every node to collect logs or enforce network rules. Option D directly matches this use case.

Answer

Running a batch job that must complete once

Answer

Running a stateless web application with multiple replicas

Answer

Running a stateful application with persistent storage

Question 14

What is the purpose of a readiness probe in a Kubernetes pod?

Accepted Answer

To signal that the pod is ready to accept traffic. A readiness probe in Kubernetes determines whether a container inside a pod is ready to start accepting traffic. If the probe fails, the pod is removed from the Service's endpoints, ensuring that only healthy pods receive requests. This is distinct from liveness probes, which check if the container is alive and should be restarted.

Answer

To determine if the pod should be terminated

Answer

To check if the pod is alive and restart it if not

Answer

To measure CPU usage of the container

Question 15

A developer wants to run a containerized application locally for development. Which tool is most appropriate?

Accepted Answer

Docker Compose. Docker Compose is the most appropriate tool for running a containerized application locally during development because it allows you to define and manage multi-container applications using a simple YAML file. It handles container lifecycle, networking, and volume mounts with a single `docker compose up` command, making it ideal for local development workflows where rapid iteration and simplicity are key.

Answer

CRI-O

Answer

containerd

Answer

Kubernetes