KCNA Kubernetes Fundamentals Practice Test 17 — 15 Questions

Question 1

Which two components are part of the Kubernetes worker node? (Select TWO)

Accepted Answer

kubelet. The kubelet (A) is correct because it is the primary node agent that runs on every worker node, registering the node with the API server and ensuring containers described in PodSpecs are running and healthy. The container runtime (E) is correct because the worker node needs a CRI-compliant runtime such as containerd or CRI-O to actually pull images and run containers. The kube-controller-manager (B), etcd (C), and kube-scheduler (D) are all control plane components that typically run on master nodes, not on worker nodes, so they are not part of the worker node.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 2

Which three of the following are valid methods to expose a Service to external traffic? (Select THREE)

Accepted Answer

Ingress. Ingress (A) is a valid method because it exposes HTTP/HTTPS routes from outside the cluster to Services within the cluster using an Ingress resource backed by an Ingress controller. NodePort (B) is valid because it exposes a Service on each node's IP at a static port in the 30000–32767 range, making it reachable externally via :. LoadBalancer (C) is valid because it provisions an external load balancer (e.g., via a cloud provider) that routes external traffic to the Service, typically building on NodePort and ClusterIP. ClusterIP (D) is not correct because it only exposes the Service on an internal cluster IP reachable solely within the cluster. ExternalName (E) is not correct because it merely maps a Service to an external DNS name via a CNAME record and does not expose or proxy external traffic to pods.

Answer

ClusterIP

Answer

ExternalName

Question 3

Which two of the following are Kubernetes controllers that run inside the kube-controller-manager? (Select TWO)

Accepted Answer

Replication controller. The Replication controller (B) is correct because it is a built-in controller that runs within the kube-controller-manager process, continuously reconciling the desired number of pod replicas with the actual state by creating or deleting pods. The Node controller (D) is also correct because it is another controller embedded in the kube-controller-manager, responsible for monitoring node health, applying taints like node.kubernetes.io/not-ready, and evicting pods from unreachable nodes. The kubelet (A) is not part of the kube-controller-manager; it is a node-level agent that runs on each worker node and manages pod lifecycle via the container runtime. etcd (C) is the distributed key-value store that persists cluster state, not a controller, and it runs as a separate process. The kube-scheduler (E) is a separate control-plane component that assigns pods to nodes and runs independently of the kube-controller-manager.

Answer

kubelet

Answer

etcd

Answer

kube-scheduler

Question 4

Which component is the primary entry point for all administrative tasks and API requests in a Kubernetes cluster?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative tasks and API requests. It exposes the Kubernetes API (over HTTPS), validates and processes RESTful operations (e.g., kubectl commands, pod creation), and serves as the communication gateway between internal components (e.g., etcd, scheduler, controller-manager) and external clients. Without the API server, no administrative action or resource change can be initiated in the cluster.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 5

What is the purpose of a Kubernetes Service?

Accepted Answer

To provide a stable endpoint for a set of pods. A Kubernetes Service provides a stable, virtual IP address and DNS name that acts as a consistent endpoint for accessing a set of pods, even as pods are created, destroyed, or rescheduled. This abstraction decouples clients from the ephemeral nature of pod IPs, enabling reliable communication within the cluster. Services use label selectors to dynamically route traffic to the appropriate pods, and they support multiple types (ClusterIP, NodePort, LoadBalancer) to expose applications internally or externally.

Answer

To store configuration data as key-value pairs

Answer

To manage rolling updates of container images

Answer

To schedule pods onto nodes

Question 6

A developer needs to deploy a stateless application with three replicas and ensure that updates are rolled out with zero downtime. Which Kubernetes resource is most appropriate?

Accepted Answer

Deployment. A Deployment is the correct resource because it manages a ReplicaSet to ensure the desired number of pod replicas (three) are running, and it supports rolling updates with configurable strategies (e.g., maxSurge and maxUnavailable) to achieve zero-downtime updates. Stateless applications are ideal for Deployments since pods are interchangeable and can be replaced without data loss.

Answer

StatefulSet

Answer

Job

Answer

DaemonSet

Question 7

You run 'kubectl get pods' and see a pod with status 'Pending'. Which is the most likely cause?

Accepted Answer

The scheduler cannot find a node that meets the pod's resource requirements. A pod with status 'Pending' indicates that the pod has been accepted by the cluster but is not yet running. The most common cause is that the Kubernetes scheduler cannot find a node that satisfies the pod's resource requests (CPU, memory) or other constraints (node selector, taints/tolerations, affinity rules). The scheduler continuously evaluates nodes and if none match, the pod remains in Pending state until a suitable node becomes available.

Answer

The pod's container has crashed

Answer

The container image is not found

Answer

The pod has been deleted by a controller

Question 8

Which component runs on every Kubernetes node and ensures that the containers in a pod are running?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every Kubernetes node. It receives PodSpec definitions from the API server and ensures that the containers described in those PodSpecs are running and healthy. It continuously monitors container status and takes corrective actions, such as restarting containers that have failed, making it the correct answer.

Answer

kube-proxy

Answer

kube-scheduler

Answer

container runtime

Question 9

You want to view the logs of a running pod named 'my-pod'. Which kubectl command should you use?

Accepted Answer

kubectl logs my-pod. The `kubectl logs my-pod` command is the correct way to retrieve the standard output and standard error logs from a running pod in Kubernetes. It directly fetches the container logs from the kubelet, which are stored on the node and rotated by the container runtime (e.g., containerd or CRI-O). This is the dedicated command for log inspection, as defined in the Kubernetes CLI documentation.

Answer

kubectl exec my-pod -- cat /var/log/container.log

Answer

kubectl get pod my-pod -o yaml

Answer

kubectl describe pod my-pod

Question 10

Which Kubernetes object can be used to store sensitive data, such as passwords or API keys, and inject them into pods?

Accepted Answer

Secret. A Secret is the dedicated Kubernetes object for storing sensitive data like passwords, API keys, and tokens. Secrets store data as base64-encoded strings and can be injected into pods as environment variables or mounted as volumes, with optional encryption at rest via etcd or KMS.

Answer

PersistentVolume

Answer

ServiceAccount

Answer

ConfigMap

Question 11

Which of the following is true about Kubernetes Namespaces?

Accepted Answer

Namespaces are used to logically isolate resources like pods and services. Kubernetes Namespaces provide a mechanism to logically isolate resources such as Pods, Services, and Deployments within a single cluster. They enable multi-tenancy by partitioning cluster resources among multiple users or teams, each operating within their own virtual cluster. This logical isolation does not include network segmentation by default, but it allows for resource quota enforcement and access control via RBAC.

Answer

Namespaces can be nested

Answer

Namespaces are required for all resources

Answer

Namespaces provide network isolation by default

Question 12

Which two statements correctly describe etcd in a Kubernetes cluster?

Accepted Answer

It is a key-value store that holds cluster configuration and state. Option A is correct because etcd is the distributed, consistent key-value store that persists all Kubernetes cluster data, including configuration, object definitions, and cluster state, making it the single source of truth for the control plane. Option E is correct because etcd is a critical component: losing its data can render the cluster unrecoverable, so regular backups (e.g., via etcdctl snapshot save) are essential for disaster recovery. Option B is wrong because etcd typically runs only on control plane nodes (or as an external cluster), not on every worker node. Option C is wrong because network rules for Services are handled by kube-proxy (and CNI plugins), not etcd. Option D is wrong because the Kubernetes API is implemented by the kube-apiserver, which reads from and writes to etcd rather than etcd implementing the API itself.

Answer

It runs on every worker node

Answer

It manages network rules for Services

Answer

It implements the Kubernetes API

Question 13

Which three components are part of the Kubernetes control plane?

Accepted Answer

kube-controller-manager. The Kubernetes control plane consists of the components that make global cluster decisions and expose the cluster API. Option D, kube-apiserver, is correct because it is the front end of the control plane, serving the Kubernetes API over HTTPS and persisting cluster state in etcd. Option C, kube-scheduler, is correct because it watches for newly created Pods with no assigned node and selects a node for them based on resource requirements, affinity, and taints/tolerations. Option A, kube-controller-manager, is correct because it runs the built-in controller loops (such as node, replication, endpoints, and service account controllers) that drive the cluster toward its desired state. Option B, kube-proxy, is not part of the control plane; it is a node-level component that maintains network rules (iptables/IPVS) for Service load balancing. Option E, kubelet, is also not part of the control plane; it is the node agent that registers the node and manages Pod containers via the container runtime.

Answer

kube-proxy

Answer

kubelet

Question 14

Which Kubernetes control plane component is the entry point for all REST API requests?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all REST API requests. It validates and processes API calls (e.g., via kubectl, client libraries, or internal components) before persisting state to etcd or triggering other controllers. No other component directly exposes an API endpoint for external or internal management operations.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

etcd

Question 15

A user runs 'kubectl get pods -n default' but receives an error: 'Error from server (Forbidden): pods is forbidden: User cannot list resource pods in API group'. What is the most likely cause?

Accepted Answer

The user lacks RBAC permissions to list pods. The error message 'Error from server (Forbidden): pods is forbidden: User cannot list resource pods in API group' directly indicates that the Kubernetes RBAC (Role-Based Access Control) system has denied the request. The user's current context in their kubeconfig does not have a Role or ClusterRole binding that grants the 'list' verb on 'pods' in the 'v1' API group (core group). This is a standard authorization failure, not a connectivity or resource existence issue.

Answer

The pod does not exist in the namespace

Answer

The user's kubeconfig file is corrupted

Answer

The API server is down