KCNA Kubernetes Fundamentals Practice Test 17 — 15 Questions

Question 1

Which Kubernetes component is the primary entry point for all administrative tasks and API requests?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative tasks and API requests. It validates and processes RESTful API calls (using JSON/YAML over HTTP/HTTPS) before persisting state to etcd or delegating work to other controllers. Without the API server, no kubectl command, automation script, or internal component can interact with the cluster.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 2

What is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. The Pod is the smallest and simplest unit in the Kubernetes object model. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. Deployments manage ReplicaSets, which in turn manage Pods, but the Pod itself is the atomic deployable unit.

Answer

Deployment

Answer

Node

Answer

Container

Question 3

A Deployment manages ReplicaSets. What is the primary benefit of using a Deployment over directly managing ReplicaSets?

Accepted Answer

Deployments support rolling updates and rollbacks. The primary benefit of using a Deployment over directly managing ReplicaSets is that Deployments provide declarative updates for Pods and ReplicaSets, including built-in support for rolling updates and rollbacks. This allows you to update the desired state (e.g., a new container image version) and have the Deployment controller automatically orchestrate the transition, while also enabling you to revert to a previous revision if the update fails. Directly managing ReplicaSets would require manual steps to scale down old ReplicaSets and scale up new ones, and it lacks the automated revision history and rollback capabilities that Deployments offer.

Answer

Deployments can expose services externally

Answer

Deployments automatically configure DNS

Answer

Deployments provide persistent storage

Question 4

You have a Pod with a container that needs to read sensitive data such as a database password. Which Kubernetes resource should you use to store this data?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the data in base64 and is designed to be consumed by Pods via environment variables or volume mounts. Unlike ConfigMaps, Secrets are intended for confidential information and can be encrypted at rest using etcd encryption providers or KMS.

Answer

PersistentVolume

Answer

ServiceAccount

Answer

ConfigMap

Question 5

A Pod is stuck in Pending state. Which of the following is the MOST likely cause?

Accepted Answer

No node has enough resources to run the Pod. A Pod stuck in Pending state means the scheduler cannot place it on a node. The most common reason is insufficient resources (CPU, memory, or ephemeral storage) on any available node, causing the scheduler to leave the Pod unscheduled. This is indicated by the Pod's status remaining Pending and typically confirmed via `kubectl describe pod` showing events like '0/1 nodes are available: 1 Insufficient cpu'.

Answer

The Pod's container is crashing

Answer

The container image has a typo

Answer

The Pod's liveness probe is failing

Question 6

Which component on a worker node is responsible for enforcing the network rules and implementing Service abstractions?

Accepted Answer

kube-proxy. kube-proxy is the component on each worker node that implements Service abstractions by maintaining network rules (iptables, IPVS, or userspace) that allow traffic to reach Pods from inside or outside the cluster. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates the node's packet filtering rules to forward traffic to the correct backend Pods, handling load balancing and session affinity.

Answer

kubelet

Answer

container runtime

Answer

kube-scheduler

Question 7

You need to update a running Deployment to use a new container image. Which kubectl command should you use?

Accepted Answer

kubectl set image deployment/ =. `kubectl set image` is the dedicated command for updating the container image of a running Deployment without modifying the entire manifest. It directly updates the Deployment's pod template spec, triggering a rolling update to replace pods with the new image.

Answer

kubectl replace -f deployment.yaml

Answer

kubectl edit deployment <name>

Answer

kubectl patch deployment -p '{"spec":{"template":{"spec":{"containers":[{"name":"","image":""}]}}}}'

Question 8

A Service of type ClusterIP is created. What is the default behavior of this Service?

Accepted Answer

It exposes the Service on a cluster-internal IP. A ClusterIP Service is the default Kubernetes Service type, which assigns a virtual IP address reachable only within the cluster. Traffic sent to this IP is load-balanced across the Pods selected by the Service's label selector, using iptables or IPVS rules. No external access is provided unless an Ingress or other mechanism is explicitly configured.

Answer

It exposes the Service externally via a cloud load balancer

Answer

It exposes the Service on a static port on each node

Answer

It routes traffic to Pods based on external DNS names

Question 9

You have a Deployment that manages 3 replicas. You want to perform a rolling update with a maximum of 2 Pods unavailable during the update. Which field should you set in the Deployment spec?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. The `maxUnavailable` field in `spec.strategy.rollingUpdate.maxUnavailable` specifies the maximum number of Pods that can be unavailable during a rolling update. Setting it to 2 allows up to 2 Pods to be taken down at a time, ensuring that at least 1 Pod remains available (since the Deployment has 3 replicas). This field directly controls the availability tolerance during the update process.

Answer

spec.minReadySeconds

Answer

spec.strategy.rollingUpdate.maxSurge

Answer

spec.replicas

Question 10

You run 'kubectl logs my-pod' and see: "Error from server (BadRequest): container "my-container" in pod "my-pod" is waiting to start: PodInitializing". What does this mean?

Accepted Answer

The Pod is in the process of initializing and logs are not yet available. The error 'PodInitializing' indicates that the pod's init containers are still running or the main container is waiting for init containers to complete. During this phase, the container has not started, so logs are not yet available. Option D correctly identifies that the pod is initializing and logs cannot be retrieved until the container enters the 'Running' state.

Answer

The container is running but producing no output

Answer

The container runtime is failing to start the container

Answer

The container has crashed and is restarting

Question 11

You have a Pod that needs to run a one-time batch job to completion. Which resource type should you use?

Accepted Answer

Job. A Job resource is designed for running a finite task to completion, such as a batch job or a one-time computation. Unlike controllers that maintain a desired number of replicas indefinitely, a Job creates one or more Pods and tracks their successful termination. Once the specified number of completions is reached, the Job is considered finished and no further Pods are created.

Answer

StatefulSet

Answer

DaemonSet

Answer

Deployment

Question 12

Which TWO statements about Namespaces are correct?

Accepted Answer

Namespaces provide a way to divide cluster resources among multiple users. Namespaces in Kubernetes provide a mechanism for partitioning a single cluster into multiple virtual clusters, enabling resource quota management and access control for different users or teams. This allows administrators to divide cluster resources (like CPU, memory, and storage) among multiple users via ResourceQuotas and LimitRanges, without requiring separate physical clusters.

Answer

Namespaces act as a strong security boundary by default

Answer

Every resource must be created in a namespace

Answer

Resources in different namespaces cannot communicate with each other

Question 13

Which Kubernetes control plane component is the primary entry point for all administrative tasks and serves the Kubernetes API?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative operations. It exposes the Kubernetes REST API, validates and processes requests (including authentication, authorization, and admission control), and updates the corresponding objects in etcd. Without the API server, no kubectl command, automation, or internal component communication can occur.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

etcd

Question 14

You create a Deployment with 'replicas: 3' and update the pod template to use a new image. After the rollout, you notice that the new ReplicaSet has 3 pods but they are all failing with 'CrashLoopBackOff'. You want to rollback to the previous working revision. Which command should you run?

Accepted Answer

kubectl rollout undo deployment/my-deployment. `kubectl rollout undo deployment/my-deployment` reverts the Deployment to the previous revision, which is the standard Kubernetes method to roll back a failed rollout. This command restores the pod template from the last working ReplicaSet, effectively undoing the change that caused the CrashLoopBackOff.

Answer

kubectl set image deployment/my-deployment nginx=nginx:1.21

Answer

kubectl delete deployment/my-deployment --cascade=false

Answer

kubectl rollout pause deployment/my-deployment

Question 15

A pod is running but you need to view the contents of a file '/var/log/app.log' inside the container to debug an issue. Which kubectl command allows you to do this without modifying the pod?

Accepted Answer

kubectl exec pod-name -- cat /var/log/app.log. `kubectl exec pod-name -- cat /var/log/app.log` runs the `cat` command inside the container without modifying the pod or its state. This allows you to view the file contents directly from the container's filesystem, which is essential for debugging when the application logs are not written to stdout/stderr and thus not accessible via `kubectl logs`.

Answer

kubectl logs pod-name -c container-name --tail=100

Answer

kubectl cp pod-name:/var/log/app.log -

Answer

kubectl attach pod-name