KCNA Container Orchestration Practice Test 7 — 15 Questions

Question 1

Which Kubernetes resource can be used to define network policies that control traffic between pods?

Accepted Answer

NetworkPolicy. NetworkPolicy is a Kubernetes resource that defines how groups of pods are allowed to communicate with each other and other network endpoints. It works by specifying ingress and egress rules using pod selectors, namespace selectors, and IP blocks, and is enforced by a network plugin (CNI) that supports it, such as Calico or Cilium.

Answer

Service

Answer

PodSecurityPolicy

Answer

Ingress

Question 2

What is the concept of 'immutable infrastructure' as applied to Kubernetes?

Accepted Answer

Pods are replaced with new versions rather than being modified. Immutable infrastructure in Kubernetes means that instead of modifying running Pods or their containers (e.g., patching a binary or updating a config file in place), you replace the entire Pod with a new version. This is enforced by Kubernetes' declarative model: when you update a Deployment's Pod template, the controller creates new Pods with the new image and terminates the old ones. This ensures consistency, repeatability, and eliminates configuration drift, as every change results in a fresh, identical instance from the same image.

Answer

Configuration is stored in environment variables only

Answer

Containers are rebuilt from the same base image every time

Answer

Infrastructure components are never replaced; they are updated in place

Question 3

Which component of Kubernetes is responsible for maintaining the desired state of the cluster?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller processes, which are responsible for regulating the state of the cluster. It continuously watches the current state via the kube-apiserver and takes corrective actions to match the desired state defined in the cluster's control loop, such as ensuring the correct number of pods are running.

Answer

kube-scheduler

Answer

kubelet

Answer

kube-apiserver

Question 4

Which TWO of the following are benefits of using a container orchestration platform like Kubernetes? (Select 2)

Accepted Answer

Self-healing of failed containers. Kubernetes includes a built-in controller loop that continuously monitors the desired state of workloads. If a container or pod fails, the ReplicaSet or StatefulSet controller automatically replaces it by rescheduling a new pod, ensuring application availability without manual intervention.

Answer

Manual deployment of containers to servers

Answer

Requirement for a hypervisor on every node

Answer

Static infrastructure that never changes

Question 5

Which THREE of the following are true about the Open Container Initiative (OCI)? (Select 3)

Accepted Answer

OCI defines the container image format specification. The Open Container Initiative (OCI) defines the Image Specification, which standardizes the format and content of container images. This ensures that any OCI-compliant image can be run by any OCI-compliant runtime, enabling interoperability across different container platforms.

Answer

OCI is governed solely by Docker Inc.

Answer

OCI only applies to Linux containers

Question 6

Which TWO of the following are characteristics of a microservices architecture? (Select 2)

Accepted Answer

Independent deployment of services. Microservices architecture is designed to allow each service to be developed, tested, and deployed independently without affecting other services. This independence is achieved through well-defined APIs and versioning strategies, enabling continuous delivery and rapid iteration. In Kubernetes, for example, each microservice can be packaged as a separate container and deployed via its own Deployment resource, allowing updates to one service without downtime for the entire application.

Answer

Tight coupling between services

Answer

Monolithic codebase

Answer

Shared database for all services

Question 7

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is failing with an 'OOMKilled' status, which indicates that the container's memory usage exceeded its configured memory limit. Increasing the memory limit in the pod's container resource specification allows the container to use more memory without being terminated by the Out-Of-Memory (OOM) killer, resolving the crash loop. This is the most direct and appropriate action to address the resource exhaustion.

Answer

Delete and recreate the pod to clear the crash loop

Answer

Increase the CPU request for the container

Answer

Delete the namespace and redeploy all workloads

Question 8

A developer wants to deploy a stateful application that requires stable network identities and persistent storage per pod instance. Which Kubernetes resource is most appropriate?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it is specifically designed for stateful applications that require stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage per pod instance (via PersistentVolumeClaims that are not shared across replicas). Unlike Deployments, StatefulSet maintains a sticky identity for each pod, ensuring that on rescheduling, the pod retains its name, network identity, and bound storage.

Answer

DaemonSet

Answer

Job

Answer

Deployment

Question 9

Which component is responsible for running containers in a Kubernetes node and implements the Container Runtime Interface (CRI)?

Accepted Answer

containerd. containerd is the correct answer because it is the container runtime that directly manages container lifecycle operations (create, start, stop, delete) on a Kubernetes node and implements the Container Runtime Interface (CRI), which is the gRPC-based protocol that kubelet uses to interact with container runtimes. Kubernetes requires a CRI-compliant runtime, and containerd is a graduated CNCF project that fulfills this role by exposing the CRI API via its `cri` plugin.

Answer

kubelet

Answer

etcd

Answer

kube-proxy

Question 10

An administrator wants to ensure that a specific pod only runs on nodes that have solid-state drives (SSDs). Nodes with SSDs are labeled with 'disktype=ssd'. Which pod specification field should be used?

Accepted Answer

nodeSelector. The `nodeSelector` field in a Pod spec is the simplest and most direct way to constrain a Pod to nodes with specific labels. By setting `nodeSelector: { disktype: ssd }`, the scheduler will only place the Pod on nodes that have the label `disktype=ssd`, which matches the administrator's requirement exactly. This field is a hard constraint that does not support complex expressions, but it is ideal for straightforward label-based node selection.

Answer

container resource limits

Answer

tolerations

Answer

nodeAffinity

Question 11

What is a key benefit of using containers over virtual machines for application deployment?

Accepted Answer

Containers are more lightweight and start faster than VMs. Containers share the host OS kernel and run as isolated processes, requiring no separate guest OS per instance. This makes them significantly more lightweight and faster to start than VMs, which must boot a full guest OS. For application deployment, this translates to higher density, lower resource overhead, and near-instant startup times.

Answer

Containers can only run on Linux

Answer

Containers require a hypervisor to run

Answer

Containers provide stronger isolation than VMs

Question 12

A Kubernetes cluster has a Service named 'my-svc' in the 'default' namespace. Which command would correctly expose this service as an external endpoint using a cloud load balancer?

Accepted Answer

kubectl expose service my-svc --type=LoadBalancer --name=my-svc-lb. `kubectl expose service my-svc --type=LoadBalancer --name=my-svc-lb` creates a new Service of type LoadBalancer that inherits the selector and port configuration from the existing 'my-svc' Service, which provisions a cloud load balancer (e.g., AWS ELB, GCP TCP/UDP LB) to expose it externally. The `--type=LoadBalancer` flag is essential to request a cloud load balancer, and `--name` specifies the new Service's name to avoid overwriting the original.

Answer

kubectl expose deployment my-svc --type=LoadBalancer --name=my-svc-lb

Answer

kubectl expose service my-svc --name=my-svc-lb

Answer

kubectl expose service my-svc --port=80 --target-port=8080

Question 13

What is the purpose of a readiness probe in a Kubernetes pod?

Accepted Answer

To determine if the container is ready to serve traffic. A readiness probe in Kubernetes determines whether a container inside a pod is ready to start accepting traffic. If the probe fails, the pod is removed from the Service's endpoints, preventing traffic from being routed to an unready container. This is distinct from a liveness probe, which checks if the container is healthy and should be restarted.

Answer

To check if the pod has been scheduled on a node

Answer

To measure the CPU and memory usage of the container

Answer

To determine if the container is healthy and should be restarted

Question 14

Which of the following is a key principle of microservices architecture?

Accepted Answer

Loose coupling and independent deployability. Microservices architecture emphasizes breaking an application into small, independently deployable services that communicate over well-defined APIs. The correct answer is C: Loose coupling and independent deployability are key principles. Option A (shared database) contradicts the principle of service autonomy. Option B (tight coupling) is the opposite of what microservices aim for. Option D (monolithic codebase) is what microservices avoid.

Answer

Shared database schema for all services

Answer

Tight coupling between services

Answer

Building a large, monolithic codebase

Question 15

Which TWO of the following are characteristics of immutable infrastructure? (Select two.)

Accepted Answer

Servers are never modified after they are deployed. Immutable infrastructure means that once a server or container is deployed, it is never modified in place. If a change is needed, a new image is built and deployed, and the old instance is destroyed. This ensures consistency and eliminates configuration drift, which is a core principle of immutable deployments in Kubernetes and cloud-native environments.

Answer

Containers are used exclusively

Answer

Infrastructure is version-controlled and tested

Answer

Configuration updates are applied directly to running servers