KCNA Kubernetes Fundamentals Practice Test 13 — 15 Questions

Question 1

You have a Deployment that manages 3 replicas of a web application. You want to perform a rolling update with zero downtime. Which kubectl command should you use?

Accepted Answer

kubectl set image deployment/myapp mycontainer=myimage:v2. `kubectl set image deployment/myapp mycontainer=myimage:v2` triggers a rolling update on the Deployment, which by default creates a new ReplicaSet and gradually scales it up while scaling down the old ReplicaSet, ensuring zero downtime. The Deployment controller manages the update strategy (default: RollingUpdate) and maintains the desired number of replicas throughout the process.

Answer

kubectl delete pod myapp-xyz --grace-period=0

Answer

kubectl patch deployment myapp -p '{"spec":{"replicas":5}}'

Answer

kubectl rollout undo deployment/myapp

Question 2

A user reports that they can access a service by its ClusterIP but not by its DNS name from within the cluster. What is the most likely cause?

Accepted Answer

The CoreDNS pod is not running or is misconfigured. Accessing a service by ClusterIP works because it relies on iptables/IPVS rules managed by kube-proxy, which are independent of DNS. However, DNS name resolution within the cluster is handled by CoreDNS, which translates service names to ClusterIPs. If CoreDNS is not running or misconfigured, DNS queries for the service name will fail, while direct ClusterIP access remains functional. This is the most likely cause because the symptom specifically points to a DNS resolution failure.

Answer

The kube-proxy is not running on the node

Answer

The service is of type NodePort

Answer

The service selector does not match any pods

Question 3

What is the role of etcd in a Kubernetes cluster?

Accepted Answer

It stores the cluster state and configuration. etcd is a distributed, consistent key-value store that serves as Kubernetes' primary data store. It holds the entire cluster state, including all object definitions (Pods, Services, Deployments, etc.), configuration data, and secrets. The kube-apiserver is the only component that interacts directly with etcd, ensuring that all state changes go through a consistent, transactional backend. Without etcd, the cluster would have no persistent record of its desired or current state.

Answer

It manages network policies

Answer

It schedules pods onto nodes

Answer

It provides DNS resolution for services

Question 4

Which of the following is a correct YAML structure for a Service of type ClusterIP?

Accepted Answer

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
    - port: 80. It defines a Kubernetes Service of kind Service with apiVersion v1, which is the correct API group for core Service objects. The spec includes a selector to target pods with label app: myapp and a port mapping with port 80, which is the standard structure for a ClusterIP Service (the default type when type is omitted). The selector field is required to route traffic to matching pods, and the ports array correctly specifies the service port.

Answer

apiVersion: v1
kind: Pod
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
    - port: 80

Answer

apiVersion: apps/v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
    - port: 80

Answer

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  app: myapp
  ports:
    - port: 80

Question 5

You want to run a batch job that processes a queue and then terminates. Which Kubernetes resource should you use?

Accepted Answer

Job. A Kubernetes Job is designed for batch processing tasks that run to completion and then terminate. It creates one or more Pods and ensures they successfully finish executing a specific workload, making it the correct choice for processing a queue and then exiting.

Answer

Deployment

Answer

CronJob

Answer

DaemonSet

Question 6

A pod is stuck in the 'Pending' state. Which command would you use to get more details about why the pod cannot be scheduled?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` provides detailed event logs and status information, including scheduler decisions, resource constraints, and node conditions that explain why a pod remains in 'Pending' state. The 'Pending' state typically indicates the pod has not been scheduled, and `kubectl describe` surfaces the exact reason, such as insufficient CPU/memory, persistent volume claims not bound, or node selector mismatches.

Answer

kubectl logs <pod-name>

Answer

kubectl exec -it <pod-name> -- sh

Answer

kubectl get pod <pod-name> -o yaml

Question 7

Which TWO of the following are responsibilities of the kube-controller-manager? (Select 2)

Accepted Answer

Ensuring the desired number of pod replicas are running. Option A is correct because the kube-controller-manager runs the ReplicaSet controller (and Deployment controller), which continuously reconciles the actual number of pod replicas with the desired count specified in the ReplicaSet/Deployment spec. Option D is correct because the node lifecycle controller within the kube-controller-manager monitors node heartbeats and marks nodes as NotReady or evicts their pods when failures are detected. Option B is wrong because service networking rules are implemented by kube-proxy (via iptables/IPVS) on each node, not by the kube-controller-manager. Option C is wrong because cluster state is stored in etcd, the distributed key-value store. Option E is wrong because pod placement is the job of the kube-scheduler, which binds pods to nodes.

Answer

Implementing service networking rules

Answer

Storing the cluster state

Answer

Scheduling pods onto nodes

Question 8

Which THREE of the following are valid ways to pass configuration data to a container in a pod? (Select 3)

Accepted Answer

Setting environment variables directly in the pod spec. Option C is correct because the pod spec allows you to define environment variables directly under the container's env field, which Kubernetes injects into the container process at startup. Option D is correct because a ConfigMap can be mounted as a volume, making its key-value pairs available as files inside the container's filesystem. Option E is correct because a Secret can be exposed as an environment variable using env or envFrom with valueFrom.secretKeyRef or secretRef, delivering sensitive configuration data to the container. Option A is not a valid runtime configuration method because container images are immutable after deployment and cannot be modified in place. Option B is not a configuration-passing mechanism; a PersistentVolumeClaim provides persistent storage, not structured configuration data.

Answer

Modifying the container image after deployment

Answer

Using a PersistentVolumeClaim to store configuration

Question 9

Which TWO statements are true about Kubernetes namespaces? (Select 2)

Accepted Answer

Resource quotas can be applied to a namespace to limit resource usage. Option C is correct because ResourceQuota objects are applied at the namespace level to cap aggregate resource consumption (e.g., requests.cpu, limits.memory, pods) for all workloads within that namespace. Option D is correct because namespaces are the standard Kubernetes mechanism for logical multi-tenancy, allowing teams to isolate dev, staging, and prod workloads with separate RBAC, quotas, and naming scopes. Option A is wrong because several resources are cluster-scoped rather than namespaced, such as Node, PersistentVolume, ClusterRole, and Namespace itself. Option B is wrong because namespaces do not enforce network isolation by default; that requires NetworkPolicy objects (and a CNI plugin that supports them). Option E is wrong because deleting a namespace cascades to its namespaced resources only, not cluster-scoped resources, which persist independently.

Answer

All Kubernetes resources are namespaced

Answer

Namespaces provide network isolation by default

Answer

Deleting a namespace automatically deletes all resources in it, including cluster-scoped resources

Question 10

Which component is the primary entry point for all administrative tasks and API requests in a Kubernetes control plane?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the only component that directly interacts with etcd. All administrative tasks (via kubectl), API requests from pods, and internal control plane components (scheduler, controller-manager) must pass through the kube-apiserver, which validates and processes them before persisting state or triggering actions.

Answer

etcd

Answer

kube-scheduler

Answer

kube-controller-manager

Question 11

What is the smallest deployable unit in Kubernetes that can be created, scheduled, and managed?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model that can be created, scheduled, and managed. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. While containers are the underlying runtime, Kubernetes does not schedule containers directly; it schedules Pods as the atomic unit of deployment.

Answer

Deployment

Answer

Node

Answer

Container

Question 12

A Pod has been in 'Pending' state for an unusual amount of time. Which of the following is a likely cause?

Accepted Answer

The cluster does not have enough resources to schedule the Pod. A Pod stuck in 'Pending' state indicates that the Pod has been accepted by the API server but has not been scheduled to a node. The most common cause is insufficient cluster resources (CPU, memory, or ephemeral storage) across all nodes, preventing the scheduler from finding a suitable node that meets the Pod's resource requests. The scheduler continuously evaluates nodes using predicates and priorities, and if no node passes the predicates (e.g., NodeResourcesFit), the Pod remains Pending.

Answer

The container image is invalid

Answer

The Pod's liveness probe is failing

Answer

The Service pointing to the Pod is misconfigured

Question 13

Which Kubernetes object provides stable network endpoints and load balancing for a set of Pods?

Accepted Answer

Service. A Service is the Kubernetes abstraction that defines a logical set of Pods and a policy for accessing them, providing a stable IP address and DNS name that remains constant even as Pods are created or destroyed. Services use label selectors to identify target Pods and perform Layer 4 (TCP/UDP) load balancing across them, either via iptables, IPVS, or eBPF rules in kube-proxy.

Answer

NetworkPolicy

Answer

Deployment

Answer

Ingress

Question 14

A developer wants to run a stateless web application with 5 replicas and ensure that when a new version is released, Pods are updated one by one with no downtime. Which Kubernetes resource is best suited?

Accepted Answer

Deployment. A Deployment is the correct resource because it is designed for managing stateless, replicated applications with declarative updates. It supports rolling updates (configurable via `strategy.type: RollingUpdate`), which update Pods one by one, ensuring zero downtime by gradually replacing old Pods with new ones while maintaining the desired replica count.

Answer

Job

Answer

DaemonSet

Answer

StatefulSet

Question 15

You have a web application that needs to read configuration from a file and also access a database password. Which combination of resources should you use to manage these configurations securely?

Accepted Answer

Use ConfigMap for configuration file and Secret for database password. ConfigMap is designed for storing non-confidential configuration data like configuration files, while Secret is specifically for sensitive data such as database passwords. Secrets are base64-encoded and can be encrypted at rest using etcd encryption or KMS, providing a security boundary that ConfigMaps lack. This combination follows Kubernetes best practices for separating configuration from secrets.

Answer

Use ConfigMap for both

Answer

Use PersistentVolume for configuration and environment variables for the password

Answer

Use Secret for both