KCNA Kubernetes Fundamentals Practice Test 10 — 15 Questions

Question 1

An application running in a Kubernetes cluster needs to securely access a third-party API. The API key must be stored in the cluster and mounted into the Pod as an environment variable. Which is the best practice?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Secret with the API key and use envFrom or valueFrom in the Pod spec.. Kubernetes Secrets are specifically designed to store sensitive data like API keys, and using `envFrom` or `valueFrom` in the Pod spec injects the Secret value as an environment variable without exposing it in the Pod definition. This approach follows the principle of least privilege and avoids hardcoding secrets in images or plaintext ConfigMaps.

Answer

Store the API key in a ConfigMap and reference it in the Pod spec.

Answer

Embed the API key directly in the container image.

Answer

Store the API key in a Pod annotation and read it with kubectl.

Question 2

A Pod has a container that needs to write logs to a file. The administrator wants the logs to persist even if the container restarts. What is the simplest solution?

Accepted Answer

Use an emptyDir volume and mount it at the log path.. An emptyDir volume provides a simple, ephemeral storage solution that persists across container restarts within the same Pod. When a container crashes and is restarted by the kubelet, the emptyDir volume's contents remain intact, allowing log files to survive container restarts without requiring external storage or complex configuration.

Answer

Use a PersistentVolumeClaim for each container.

Answer

Use a hostPath volume to write logs directly to the node filesystem.

Answer

Store logs in a ConfigMap.

Question 3

A team is designing a Kubernetes cluster for a production workload that requires high availability. They have three worker nodes in different availability zones. Which statement about scheduling Pods is correct?

Accepted Answer

Define a Pod topology spread constraint with topologyKey: topology.kubernetes.io/zone.. A Pod topology spread constraint with `topologyKey: topology.kubernetes.io/zone` explicitly instructs the scheduler to distribute Pods evenly across the specified failure domains (availability zones). This ensures that if one zone fails, the remaining zones still have running Pods, achieving high availability for the production workload.

Answer

Use nodeSelector to assign Pods to nodes in different zones.

Answer

Add tolerations for the zone taint.

Answer

Use podAntiAffinity with a requiredDuringSchedulingIgnoredDuringExecution rule.

Question 4

Drag and drop the steps to set up a Kubernetes cluster using kubeadm into the correct order.

Accepted Answer

Install container runtime and Kubernetes tools, then run kubeadm init on the control plane, then install a pod network plugin, then run kubeadm join on worker nodes.. First install runtime and Kubernetes tools, then init control plane, add network plugin, and join workers.

Answer

Install container runtime and Kubernetes tools, then install a pod network plugin, then run kubeadm init on the control plane, then run kubeadm join on worker nodes.

Answer

Run kubeadm init on the control plane, then install container runtime and Kubernetes tools, then install a pod network plugin, then run kubeadm join on worker nodes.

Answer

Install container runtime and Kubernetes tools, then run kubeadm init on the control plane, then run kubeadm join on worker nodes, then install a pod network plugin.

Question 5

Drag and drop the steps to create a Kubernetes Namespace and deploy an application into it into the correct order.

Accepted Answer

Create the namespace using 'kubectl create namespace my-namespace', then deploy the application using 'kubectl apply -f deployment.yaml -n my-namespace', then verify the deployment using 'kubectl get pods -n my-namespace'.. First create namespace, then deploy resources specifying that namespace, and verify.

Answer

Deploy the application using 'kubectl apply -f deployment.yaml' without specifying a namespace, then create the namespace using 'kubectl create namespace my-namespace', then verify using 'kubectl get pods'.

Answer

Verify the deployment using 'kubectl get pods', then create the namespace using 'kubectl create namespace my-namespace', then deploy the application using 'kubectl apply -f deployment.yaml -n my-namespace'.

Answer

Create the namespace using 'kubectl create namespace my-namespace', then verify using 'kubectl get pods -n my-namespace', then deploy the application using 'kubectl apply -f deployment.yaml -n my-namespace'.

Question 6

Match each Kubernetes scheduler concept to its description.

Accepted Answer

NodeAffinity: Constraints on which nodes a pod can be scheduled based on node labels.. NodeAffinity and NodeSelector both use node labels but differ in expressiveness. PodAffinity schedules relative to other pods. Taints/Tolerations control which pods can be placed on nodes. Common confusion: swapping NodeAffinity with PodAffinity or Taints/Tolerations.

Answer

NodeAffinity: Ensures pods are scheduled together with other pods on the same node.

Answer

PodAffinity: Repels pods from nodes unless they have a specific label.

Question 7

Match each cloud native concept to its definition.

Accepted Answer

Microservices: An architectural style that structures an application as a collection of loosely coupled services.. The correct matches are: Microservices with loosely coupled services, Service Mesh with service-to-service communication, Serverless with cloud provider managing resources, and Orchestration with automated management. Common confusions include swapping definitions between Microservices and Service Mesh, or between Serverless and Orchestration.

Answer

Microservices: A dedicated infrastructure layer for handling service-to-service communication.

Answer

Serverless: The automated configuration, coordination, and management of computer systems.

Question 8

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff with an OOMKilled message, which means the container was terminated by the Linux kernel's Out-Of-Memory (OOM) killer because it exceeded its memory limit. Increasing the memory limit in the container's resource specification allows the container to use more memory before being killed, directly addressing the root cause.

Answer

Delete the namespace and redeploy all workloads

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Question 9

What is the primary purpose of a Kubernetes Service object?

Accepted Answer

To provide a stable IP address and DNS name for a set of Pods. The primary purpose of a Kubernetes Service object is to provide a stable network endpoint (a fixed IP address and DNS name) that abstracts and load-balances traffic across a dynamic set of Pods. Pods are ephemeral and can be rescheduled with new IP addresses, so the Service ensures clients can reliably reach the application without needing to track individual Pod IPs.

Answer

To store configuration data that can be consumed by Pods

Answer

To manage rolling updates and rollbacks for Pods

Answer

To persist data beyond the lifecycle of a Pod

Question 10

You have a Deployment named 'web-app' with 3 replicas. You need to scale it to 5 replicas. Which kubectl command should you use?

Accepted Answer

kubectl scale deployment web-app --replicas=5. The `kubectl scale` command is the correct way to adjust the replica count of an existing Deployment. It directly modifies the `spec.replicas` field in the Deployment's desired state, instructing the ReplicaSet controller to create or delete Pods to match the new count. Option B uses the correct syntax `kubectl scale deployment web-app --replicas=5` to achieve this.

Answer

kubectl create deployment web-app --replicas=5

Answer

kubectl edit deployment web-app --replicas=5

Answer

kubectl describe deployment web-app

Question 11

A pod is stuck in 'Pending' state. Which of the following is NOT a common cause for a pod to remain Pending?

Accepted Answer

The container runtime is not functioning on the node. A non-functioning container runtime on a node typically results in pod states like CrashLoopBackOff or Error, not prolonged 'Pending' state. Pending state occurs when a pod cannot be scheduled. Insufficient resources (A), node selector mismatch (B), and unbound PVCs (D) are common causes of scheduling failures that keep a pod in Pending. Container runtime issues affect pod execution after scheduling, not the scheduling process itself. Therefore, C is NOT a common cause for a pod to remain Pending.

Answer

Insufficient CPU or memory resources available in the cluster

Answer

The node selector in the pod spec does not match any node labels

Answer

The pod's PVC is not yet bound to a PV

Question 12

You deploy a new version of your application by updating the container image in the Deployment manifest. The rollout seems to be progressing, but after a few minutes you notice that the new Pods are failing and the old Pods are still running. What is the most likely reason?

Accepted Answer

The new Pods are failing readiness probes, so the Deployment pauses the rollout and keeps the old replicas. When a new Pod fails its readiness probe, the Deployment controller considers the new ReplicaSet unhealthy and pauses the rollout. The controller keeps the old ReplicaSet running to maintain the desired number of available replicas, preventing traffic disruption until the new Pods pass their probes or the rollout is manually resumed.

Answer

The Deployment was created with 'kubectl create deployment' instead of 'kubectl apply'

Answer

The new Pods are not receiving traffic because the Service selector doesn't match

Answer

The Deployment's update strategy is set to 'Recreate'

Question 13

Which component is responsible for ensuring that containers are running as specified in a Pod's specification on a node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each node in a Kubernetes cluster. It is responsible for ensuring that containers described in Pod specifications (PodSpecs) are running and healthy. The kubelet watches for Pod assignments from the API server, creates or terminates containers via the container runtime, and continuously reports the node and Pod status back to the control plane.

Answer

Container runtime

Answer

kube-proxy

Answer

kube-scheduler

Question 14

You need to store a database password securely and expose it to a Pod as an environment variable. Which Kubernetes resource should you use?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the value in base64 and can be injected into a Pod as an environment variable. Unlike ConfigMaps, Secrets are designed for confidential information and support optional encryption at rest when etcd is configured accordingly.

Answer

Service

Answer

PersistentVolumeClaim

Answer

ConfigMap

Question 15

You have a Deployment with image: myapp:v1. You update the image to myapp:v2 using 'kubectl set image deployment/myapp myapp=myapp:v2'. The rollout status shows 'Waiting for rollout to finish: 0 out of 3 new replicas have been updated...'. What is the most likely cause of this behavior?

Accepted Answer

The new image myapp:v2 does not exist or cannot be pulled from the registry. The rollout is stuck waiting for new replicas to become ready, which typically happens when the container image cannot be pulled. The message '0 out of 3 new replicas have been updated' indicates that the ReplicaSet is attempting to create Pods with the new image, but the Pods are failing to start. The most common cause is that the image tag 'myapp:v2' does not exist in the registry or cannot be accessed due to authentication or network issues, preventing the kubelet from pulling it.

Answer

The command syntax is incorrect; you should use 'kubectl set image deployment/myapp myapp:v2'

Answer

The new Pods are crashing due to a missing command

Answer

The Deployment's update strategy is set to 'Recreate'