KCNA Kubernetes Fundamentals Practice Test 14 — 15 Questions

Question 1

Which component of the Kubernetes control plane is responsible for storing the cluster state?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as Kubernetes' primary data store, persisting all cluster state including configuration, secrets, and resource specifications. The kube-apiserver is the only component that interacts directly with etcd, ensuring consistency and providing a RESTful interface for all other components and users.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager

Question 2

Which kubectl command would you use to view detailed information about a pod named 'web-pod' in the 'default' namespace?

Accepted Answer

kubectl describe pod web-pod. The `kubectl describe pod web-pod` command retrieves detailed information about the specified pod, including its current status, events, container details, resource limits, and labels. This is the correct command for viewing comprehensive metadata and state information beyond the basic summary provided by `kubectl get`.

Answer

kubectl get pod web-pod

Answer

kubectl logs web-pod

Answer

kubectl exec web-pod -- env

Question 3

Which Kubernetes object provides a stable IP address and DNS name to access a set of pods, and can perform load balancing?

Accepted Answer

Service. A Service is the correct Kubernetes object because it provides a stable virtual IP (ClusterIP) and a DNS name (via CoreDNS) that remains constant even as pods are created or destroyed. It performs layer 4 (TCP/UDP) load balancing across the set of pods selected by its label selector, using iptables or IPVS rules to distribute traffic.

Answer

Ingress

Answer

Deployment

Answer

Pod

Question 4

What is the primary purpose of a liveness probe in a container?

Accepted Answer

To check if the container is still alive; restart if not. The primary purpose of a liveness probe is to determine whether a container is still running and healthy. If the probe fails, the kubelet kills the container and restarts it according to the pod's restart policy, ensuring self-healing. This is distinct from readiness probes, which control traffic routing, and resource checks, which are handled by metrics servers or cAdvisor.

Answer

To check resource usage like CPU and memory

Answer

To check if the container is ready to serve traffic

Answer

To check if the pod is scheduled on the correct node

Question 5

You need to provide configuration data as environment variables to a pod, but the data is not sensitive. Which object should you use?

Accepted Answer

ConfigMap. A ConfigMap is the correct Kubernetes object for providing non-sensitive configuration data as environment variables to a pod. ConfigMaps are designed to decouple configuration artifacts from image content to keep containers portable, and they support injection via environment variables, command-line arguments, or volume mounts. Unlike Secrets, ConfigMaps store data in plaintext (base64-encoded only for transport) and are intended for data that does not require encryption at rest or in transit.

Answer

Secret

Answer

ServiceAccount

Answer

PersistentVolume

Question 6

A pod in the 'default' namespace has the following YAML snippet:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
What is the effect of the fsGroup field?

Accepted Answer

It sets the group ID for any volumes mounted into the pod.. The `fsGroup` field in a Pod's security context sets the group ID (GID) that will be used for ownership of any volumes mounted into the pod. When a volume is mounted, Kubernetes recursively changes the group ownership of the volume's files to the specified GID (2000 in this case) and makes them readable and writable by that group. This ensures that processes running in the container, which may have a different primary group (3000 from `runAsGroup`), can still access the volume files if they are members of the fsGroup.

Answer

It restricts the pod to run only on nodes with that group ID.

Answer

It defines the group ID for the pod's service account.

Answer

It sets the group ID for the container's main process.

Question 7

Which kubectl command is used to see the logs of a container in a pod?

Accepted Answer

kubectl logs . `kubectl logs ` is the dedicated command to retrieve and display the logs from the default container in a specified pod. This command directly accesses the container's stdout and stderr streams, which are captured by the container runtime (e.g., containerd or CRI-O) and stored by the kubelet, making it the standard and simplest way to view application logs.

Answer

kubectl attach <pod-name>

Answer

kubectl exec <pod-name> -- cat /var/log/app.log

Answer

kubectl describe pod <pod-name>

Question 8

A user runs 'kubectl create deployment my-deploy --image=nginx' and then wants to scale the deployment to 5 replicas. Which command should they use?

Accepted Answer

kubectl scale deployment my-deploy --replicas=5. `kubectl scale` is the dedicated imperative command to change the replica count of a deployment. It directly updates the `spec.replicas` field in the deployment's desired state, and the deployment controller then adjusts the ReplicaSet and Pods accordingly. This is the simplest and most direct way to scale a deployment without modifying a YAML file or using an editor.

Answer

kubectl apply -f deployment.yaml with replicas: 5

Answer

kubectl edit deployment my-deploy and change replicas to 5

Answer

kubectl patch deployment my-deploy -p '{"spec":{"replicas":5}}'

Question 9

You create a Service of type NodePort with nodePort: 30080. The cluster's nodes have IP addresses 10.0.0.1 and 10.0.0.2. From outside the cluster, which address and port can you use to access the Service?

Accepted Answer

10.0.0.1:30080. A NodePort service exposes the same port (nodePort: 30080) on every node in the cluster. From outside the cluster, you can reach the service using the IP address of any node (e.g., 10.0.0.1) combined with the nodePort (30080). The kube-proxy on that node will forward traffic to the service's ClusterIP and then to the selected pods.

Answer

10.0.0.1:80

Answer

ClusterIP:80

Answer

10.0.0.2:8080

Question 10

Which three of the following are valid methods to expose a Service to external traffic? (Select THREE)

Accepted Answer

Ingress. Ingress is correct because it provides HTTP/HTTPS routing rules to expose services externally, typically using a reverse proxy like NGINX or HAProxy. It operates at Layer 7 and can route traffic based on hostnames or paths to different services within the cluster, making it a valid method for external exposure.

Answer

ClusterIP

Answer

ExternalName

Question 11

Which two of the following are Kubernetes controllers that run inside the kube-controller-manager? (Select TWO)

Accepted Answer

Replication controller. The kube-controller-manager is a control plane component that runs controller processes to regulate the state of the cluster. The Replication controller (option B) is a legacy controller that ensures a specified number of pod replicas are running at all times, and the Node controller (option D) is responsible for monitoring the health of nodes and managing node lifecycle events. Both are built-in controllers that run inside the kube-controller-manager binary.

Answer

kubelet

Answer

etcd

Answer

kube-scheduler

Question 12

Which component is the primary entry point for all administrative tasks and API requests in a Kubernetes cluster?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative tasks and API requests. It exposes the Kubernetes API (over HTTPS), validates and processes RESTful operations (e.g., kubectl commands, pod creation), and serves as the communication gateway between internal components (e.g., etcd, scheduler, controller-manager) and external clients. Without the API server, no administrative action or resource change can be initiated in the cluster.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 13

What is the purpose of a Kubernetes Service?

Accepted Answer

To provide a stable endpoint for a set of pods. A Kubernetes Service provides a stable, virtual IP address and DNS name that acts as a consistent endpoint for accessing a set of pods, even as pods are created, destroyed, or rescheduled. This abstraction decouples clients from the ephemeral nature of pod IPs, enabling reliable communication within the cluster. Services use label selectors to dynamically route traffic to the appropriate pods, and they support multiple types (ClusterIP, NodePort, LoadBalancer) to expose applications internally or externally.

Answer

To store configuration data as key-value pairs

Answer

To manage rolling updates of container images

Answer

To schedule pods onto nodes

Question 14

A developer needs to deploy a stateless application with three replicas and ensure that updates are rolled out with zero downtime. Which Kubernetes resource is most appropriate?

Accepted Answer

Deployment. A Deployment is the correct resource because it manages a ReplicaSet to ensure the desired number of pod replicas (three) are running, and it supports rolling updates with configurable strategies (e.g., maxSurge and maxUnavailable) to achieve zero-downtime updates. Stateless applications are ideal for Deployments since pods are interchangeable and can be replaced without data loss.

Answer

StatefulSet

Answer

Job

Answer

DaemonSet

Question 15

You run 'kubectl get pods' and see a pod with status 'Pending'. Which is the most likely cause?

Accepted Answer

The scheduler cannot find a node that meets the pod's resource requirements. A pod with status 'Pending' indicates that the pod has been accepted by the cluster but is not yet running. The most common cause is that the Kubernetes scheduler cannot find a node that satisfies the pod's resource requests (CPU, memory) or other constraints (node selector, taints/tolerations, affinity rules). The scheduler continuously evaluates nodes and if none match, the pod remains in Pending state until a suitable node becomes available.

Answer

The pod's container has crashed

Answer

The container image is not found

Answer

The pod has been deleted by a controller