KCNA Container Orchestration Practice Test 8 — 15 Questions

Question 1

Your application consists of a frontend and a backend. The frontend needs to communicate with the backend using a stable DNS name. The backend is deployed as a Deployment with 3 replicas. Which Kubernetes resource should you create to provide a stable DNS name for the backend?

Accepted Answer

Service of type ClusterIP. A Service of type ClusterIP provides a stable virtual IP and DNS name (e.g., my-service.namespace.svc.cluster.local) that load-balances traffic across the backend Pods. This is the correct resource because the frontend only needs a stable DNS name for internal cluster communication, and ClusterIP is the default Service type that fulfills this requirement without exposing the backend externally.

Answer

EndpointSlice

Answer

Service of type NodePort

Answer

Ingress

Question 2

What is the OCI (Open Container Initiative) responsible for?

Accepted Answer

Defining standards for container images and runtimes. The Open Container Initiative (OCI) is a Linux Foundation project that defines open industry standards for container image formats and container runtimes. Its two main specifications are the OCI Image Spec (which standardizes the container image layout, including layers and manifests) and the OCI Runtime Spec (which defines the lifecycle and configuration for running containers). This ensures interoperability between different container tools and platforms, such as Docker, Podman, and containerd.

Answer

Hosting public container images

Answer

Providing a default container runtime for Kubernetes

Answer

Managing container orchestration

Question 3

A developer wants to run a container image locally for testing before deploying to a Kubernetes cluster. Which tool is most appropriate for this task?

Accepted Answer

Docker. Docker is a widely used tool for building and running containers locally. While Kubernetes can run containers, it is overkill for local testing of a single container.

Answer

Ansible

Answer

Kubernetes

Answer

Terraform

Question 4

Which TWO statements accurately describe the concept of immutable infrastructure in the context of container orchestration? (Select two.)

Accepted Answer

Container images are versioned and promoted through environments without modification. Option B is correct because immutable infrastructure treats container images as immutable artifacts that are versioned and promoted through environments (e.g., dev, staging, prod) without modification. This ensures consistency and reproducibility, as the same image is deployed across all stages without patching or altering it in place.

Answer

Configuration changes can be applied via SSH into the container

Answer

Containers are updated in place by executing commands inside running containers

Answer

Stateful applications require mutable infrastructure

Question 5

Which THREE of the following are valid container runtimes that can be used with Kubernetes via the Container Runtime Interface (CRI)? (Select three.)

Accepted Answer

containerd. containerd and CRI-O are both lightweight container runtimes designed for Kubernetes and implement the CRI. Kata Containers provides hardware virtualization isolation and also implements CRI. Docker is not a CRI-compliant runtime; it uses dockershim (deprecated and removed). rkt was an alternative but is not widely used and does not implement CRI directly.

Answer

rkt

Answer

Docker

Question 6

Which TWO statements correctly describe how Kubernetes handles self-healing? (Select two.)

Accepted Answer

If a node fails, the ReplicaSet controller automatically recreates the pods on healthy nodes. Option A is correct because the ReplicaSet controller monitors the cluster for node failures and, when a node becomes unhealthy, it creates replacement pods on other healthy nodes to maintain the desired replica count. This is a core self-healing mechanism in Kubernetes that operates at the controller level, independent of the kubelet.

Answer

Kubernetes automatically fixes application-level bugs by rolling back to a previous version

Answer

Kubernetes can automatically resolve OOMKilled errors by increasing memory limits

Answer

Kubernetes can automatically resolve OOMKilled errors by increasing memory limits

Question 7

Which of the following is a key benefit of container orchestration compared to running containers manually?

Accepted Answer

Automatic scaling and self-healing. Container orchestration provides automated scaling, self-healing, and declarative management, which are not available when running containers manually.

Answer

Containers use less memory

Answer

Orchestration eliminates the need for container images

Answer

Containers run faster when orchestrated

Question 8

A developer wants to deploy a stateful application that requires stable network identities and persistent storage. Which Kubernetes resource is best suited for this workload?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it is designed specifically for stateful applications that require stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage (via PersistentVolumeClaims that are retained across Pod rescheduling). Unlike Deployments, StatefulSets guarantee ordered deployment, scaling, and termination, which is essential for databases or message queues.

Answer

Deployment

Answer

DaemonSet

Answer

Job

Question 9

A Kubernetes cluster has a single control plane node and two worker nodes. The control plane node fails. What is the immediate impact on the workloads running on the worker nodes?

Accepted Answer

Existing workloads continue running, but no new pods can be scheduled. Option B is correct because in Kubernetes, the control plane is responsible for scheduling new pods and maintaining desired state via the API server, controller manager, and scheduler. When the control plane fails, the kubelets on worker nodes continue to run existing pods based on their local state, but the scheduler cannot assign new pods to nodes, and the API server is unavailable for updates or scaling operations.

Answer

All workloads will stop immediately

Answer

The kubelet on worker nodes will restart all pods

Answer

Workloads will be automatically migrated to another cluster

Question 10

An administrator wants to ensure that a pod only runs on nodes that have a specific GPU. Which mechanism should be used to achieve this?

Accepted Answer

Node affinity with requiredDuringSchedulingIgnoredDuringExecution. Node affinity allows you to constrain which nodes a pod can be scheduled on based on node labels, such as labeling nodes with 'gpu: true' and using requiredDuringSchedulingIgnoredDuringExecution.

Answer

Tolerations and taints

Answer

Pod anti-affinity

Answer

ResourceQuota

Question 11

Which statement accurately describes a key difference between containers and virtual machines?

Accepted Answer

Containers share the host OS kernel, while virtual machines include a full guest OS. Containers share the host OS kernel and are lightweight, while VMs include a full guest OS and hypervisor, making them heavier.

Answer

Virtual machines share the host kernel, while containers have their own kernel

Answer

Both containers and virtual machines require a hypervisor

Answer

Containers include a full guest operating system

Question 12

A pod spec includes a liveness probe that runs 'cat /tmp/healthy'. The probe is configured with initialDelaySeconds: 10, periodSeconds: 5. At what point does the kubelet first execute the probe?

Accepted Answer

10 seconds after the container starts. The kubelet first executes the liveness probe 10 seconds after the container starts because `initialDelaySeconds: 10` tells the kubelet to wait that long before initiating the first probe. The `periodSeconds: 5` only defines the interval between subsequent probes, not the initial delay. This ensures the container has time to start and create the `/tmp/healthy` file before being checked.

Answer

Immediately after the pod is created

Answer

Only when the container is unhealthy

Answer

5 seconds after the container starts

Question 13

An application requires that a pod must not be scheduled on the same node as another pod from the same Deployment. Which configuration should be used?

Accepted Answer

Pod anti-affinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname. Pod anti-affinity with a requiredDuringSchedulingIgnoredDuringExecution rule and a topologyKey of 'kubernetes.io/hostname' ensures that pods are not co-located on the same node.

Answer

Node affinity with requiredDuringSchedulingIgnoredDuringExecution

Answer

Pod affinity with a preferredDuringSchedulingIgnoredDuringExecution

Answer

Taints and tolerations

Question 14

What is the primary purpose of the Container Runtime Interface (CRI) in Kubernetes?

Accepted Answer

To provide a standard interface between the kubelet and container runtimes. The Container Runtime Interface (CRI) is a plugin protocol that enables the kubelet to use any OCI-compliant container runtime (e.g., containerd, CRI-O) without needing to recompile Kubernetes. It defines gRPC APIs for runtime and image service operations, abstracting the runtime implementation from the kubelet's pod lifecycle management.

Answer

To store container images in a registry

Answer

To define the format of container images

Answer

To manage container network interfaces

Question 15

You create a Service of type ClusterIP with the name 'my-service' in the 'default' namespace. What DNS name resolves to the service's cluster IP from a pod in the same namespace?

Accepted Answer

my-service.default.svc.cluster.local. Option A is correct because Kubernetes DNS resolves a Service's ClusterIP using the fully qualified domain name (FQDN) format `..svc.cluster.local`. Since the Service 'my-service' is in the 'default' namespace, a pod in the same namespace can reach it via `my-service.default.svc.cluster.local`. The DNS query returns the ClusterIP of the Service, allowing pods to communicate with it reliably.

Answer

my-service.svc.cluster.local

Answer

my-service.default.cluster.local

Answer

my-service.cluster.local