KCNA Kubernetes Fundamentals Practice Test 16 — 15 Questions

Question 1

Which two components are part of the Kubernetes control plane? (Select two.)

Accepted Answer

etcd. etcd (A) is correct because it is the control plane's distributed key-value store that persists all cluster state and configuration data, and kube-apiserver (C) is correct because it is the control plane component that exposes the Kubernetes API and serves as the front end through which all other components communicate. The other options are node-level components, not control plane components: kube-proxy (B) maintains network rules for Service traffic on each node, kubelet (D) runs on each node to manage Pods and containers, and the container runtime (E) is the software on each node that actually runs containers.

Answer

kube-proxy

Answer

kubelet

Answer

container runtime

Question 2

Which three of the following are true about Services in Kubernetes? (Select three.)

Accepted Answer

A Service provides a stable IP address for a set of pods. Option A is correct because a Kubernetes Service is assigned a stable virtual IP (the ClusterIP) and DNS name that front a dynamic set of pod endpoints, so clients get a consistent address even as pods are created or destroyed. Option B is correct because kube-proxy programs iptables/IPVS (or the equivalent) rules so that traffic sent to the Service's ClusterIP is load balanced across the matching pods selected by the Service's label selector. Option C is correct because the default ClusterIP Service type exposes the Service only on an internal, cluster-routable virtual IP, making it reachable solely from within the cluster unless NodePort, LoadBalancer, or an Ingress is added. Option D is not correct because storing configuration data is the role of ConfigMaps and Secrets, not Services, which only handle network endpoint abstraction. Option E is not correct because Ingress provides HTTP/HTTPS layer-7 host- and path-based routing via an ingress controller, whereas a Service only offers layer-4 (or simple L7 with newer Gateway API) access to a single set of pods and cannot perform Ingress-style routing.

Answer

A Service can store configuration data for applications

Answer

A Service can replace an Ingress for HTTP routing

Question 3

Which two of the following are valid ways to expose a Pod's container port to other resources? (Select two.)

Accepted Answer

Create a Service of type ClusterIP pointing to the Pod's port. Option A is correct because a Service of type ClusterIP provides a stable virtual IP and DNS name that load-balances traffic to the Pod's target port, making the container port reachable by other resources inside the cluster. Option D is correct because an Ingress routes external HTTP/HTTPS traffic to a Service (which then forwards to the Pod's container port), thereby exposing the port to resources outside the cluster. Option B is not a valid exposure method by itself: containerPort is purely informational metadata in the Pod spec and does not publish or open the port. Option C is incorrect because hostNetwork: true makes the Pod share the node's network namespace, but it does not expose a specific container port to other resources as a Kubernetes networking construct. Option E is incorrect because kubectl port-forward is a temporary debugging tunnel from a local machine to a Pod, not a way to expose a container port to other cluster resources.

Answer

Add a containerPort field in the Pod spec

Answer

Set the pod's hostNetwork to true

Answer

Use kubectl port-forward

Question 4

Which component of the Kubernetes control plane is responsible for storing the cluster state?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as Kubernetes' primary data store, persisting all cluster state including configuration, secrets, and resource specifications. The kube-apiserver is the only component that interacts directly with etcd, ensuring consistency and providing a RESTful interface for all other components and users.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager

Question 5

Which kubectl command would you use to view detailed information about a pod named 'web-pod' in the 'default' namespace?

Accepted Answer

kubectl describe pod web-pod. The `kubectl describe pod web-pod` command retrieves detailed information about the specified pod, including its current status, events, container details, resource limits, and labels. This is the correct command for viewing comprehensive metadata and state information beyond the basic summary provided by `kubectl get`.

Answer

kubectl get pod web-pod

Answer

kubectl logs web-pod

Answer

kubectl exec web-pod -- env

Question 6

A Deployment named 'app-deploy' is configured with strategy type: RollingUpdate. You want to update the container image to a new version. What kubectl command should you use?

Accepted Answer

kubectl set image deployment/app-deploy app=new:tag. `kubectl set image` is the dedicated command for updating the container image of an existing deployment without modifying other fields. It directly modifies the deployment's pod template spec to use the new image, triggering a rolling update as defined by the deployment's strategy type.

Answer

kubectl apply -f updated-deployment.yaml

Answer

kubectl edit deployment app-deploy

Answer

kubectl patch deployment app-deploy -p '{"spec":{"template":{"spec":{"containers":[{"name":"app","image":"new:tag"}]}}}}'

Question 7

Which Kubernetes object provides a stable IP address and DNS name to access a set of pods, and can perform load balancing?

Accepted Answer

Service. A Service is the correct Kubernetes object because it provides a stable virtual IP (ClusterIP) and a DNS name (via CoreDNS) that remains constant even as pods are created or destroyed. It performs layer 4 (TCP/UDP) load balancing across the set of pods selected by its label selector, using iptables or IPVS rules to distribute traffic.

Answer

Ingress

Answer

Deployment

Answer

Pod

Question 8

A user creates a Pod with a PersistentVolumeClaim (PVC) that requests 5Gi of storage. The cluster has two PersistentVolumes (PVs): PV1 (3Gi, AccessModes: ReadWriteOnce) and PV2 (10Gi, AccessModes: ReadOnlyMany). The PVC specifies storageClassName: "" and AccessModes: ReadWriteOnce. Which PV will bind to the PVC?

Accepted Answer

Neither PV will bind; the PVC will remain pending.. The PVC specifies storageClassName: "", which means it requires a PV with the same empty storage class (i.e., a statically provisioned PV without a StorageClass). PV1 has 3Gi capacity, which is less than the requested 5Gi, so it fails capacity matching. PV2 has ReadOnlyMany access mode, which does not match the PVC's ReadWriteOnce. Since neither PV satisfies all binding criteria (capacity, access modes, and storage class), the PVC remains Pending.

Answer

PV2 will bind because it has sufficient capacity.

Answer

PV1 will bind because it has matching AccessModes.

Answer

Both PVs will bind to satisfy the request.

Question 9

You have a Deployment that must run exactly one replica on each node in the cluster for logging purposes. Which Kubernetes resource should you use?

Accepted Answer

DaemonSet. A DaemonSet ensures that exactly one replica of a Pod runs on every node in the cluster, including when nodes are added or removed. This makes it the ideal resource for cluster-wide logging, monitoring, or other node-level agents that must be present on each node.

Answer

Job

Answer

Deployment

Answer

StatefulSet

Question 10

What is the primary purpose of a liveness probe in a container?

Accepted Answer

To check if the container is still alive; restart if not. The primary purpose of a liveness probe is to determine whether a container is still running and healthy. If the probe fails, the kubelet kills the container and restarts it according to the pod's restart policy, ensuring self-healing. This is distinct from readiness probes, which control traffic routing, and resource checks, which are handled by metrics servers or cAdvisor.

Answer

To check resource usage like CPU and memory

Answer

To check if the container is ready to serve traffic

Answer

To check if the pod is scheduled on the correct node

Question 11

You need to provide configuration data as environment variables to a pod, but the data is not sensitive. Which object should you use?

Accepted Answer

ConfigMap. A ConfigMap is the correct Kubernetes object for providing non-sensitive configuration data as environment variables to a pod. ConfigMaps are designed to decouple configuration artifacts from image content to keep containers portable, and they support injection via environment variables, command-line arguments, or volume mounts. Unlike Secrets, ConfigMaps store data in plaintext (base64-encoded only for transport) and are intended for data that does not require encryption at rest or in transit.

Answer

Secret

Answer

ServiceAccount

Answer

PersistentVolume

Question 12

A pod in the 'default' namespace has the following YAML snippet:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
What is the effect of the fsGroup field?

Accepted Answer

It sets the group ID for any volumes mounted into the pod.. The `fsGroup` field in a Pod's security context sets the group ID (GID) that will be used for ownership of any volumes mounted into the pod. When a volume is mounted, Kubernetes recursively changes the group ownership of the volume's files to the specified GID (2000 in this case) and makes them readable and writable by that group. This ensures that processes running in the container, which may have a different primary group (3000 from `runAsGroup`), can still access the volume files if they are members of the fsGroup.

Answer

It restricts the pod to run only on nodes with that group ID.

Answer

It defines the group ID for the pod's service account.

Answer

It sets the group ID for the container's main process.

Question 13

Which kubectl command is used to see the logs of a container in a pod?

Accepted Answer

kubectl logs . `kubectl logs ` is the dedicated command to retrieve and display the logs from the default container in a specified pod. This command directly accesses the container's stdout and stderr streams, which are captured by the container runtime (e.g., containerd or CRI-O) and stored by the kubelet, making it the standard and simplest way to view application logs.

Answer

kubectl attach <pod-name>

Answer

kubectl exec <pod-name> -- cat /var/log/app.log

Answer

kubectl describe pod <pod-name>

Question 14

A user runs 'kubectl create deployment my-deploy --image=nginx' and then wants to scale the deployment to 5 replicas. Which command should they use?

Accepted Answer

kubectl scale deployment my-deploy --replicas=5. `kubectl scale` is the dedicated imperative command to change the replica count of a deployment. It directly updates the `spec.replicas` field in the deployment's desired state, and the deployment controller then adjusts the ReplicaSet and Pods accordingly. This is the simplest and most direct way to scale a deployment without modifying a YAML file or using an editor.

Answer

kubectl apply -f deployment.yaml with replicas: 5

Answer

kubectl edit deployment my-deploy and change replicas to 5

Answer

kubectl patch deployment my-deploy -p '{"spec":{"replicas":5}}'

Question 15

You create a Service of type NodePort with nodePort: 30080. The cluster's nodes have IP addresses 10.0.0.1 and 10.0.0.2. From outside the cluster, which address and port can you use to access the Service?

Accepted Answer

10.0.0.1:30080. A NodePort service exposes the same port (nodePort: 30080) on every node in the cluster. From outside the cluster, you can reach the service using the IP address of any node (e.g., 10.0.0.1) combined with the nodePort (30080). The kube-proxy on that node will forward traffic to the service's ClusterIP and then to the selected pods.

Answer

10.0.0.1:80

Answer

ClusterIP:80

Answer

10.0.0.2:8080