KCNA Kubernetes Fundamentals Practice Test 18 — 15 Questions

Question 1

A Deployment is configured with 'replicas: 3'. After a node failure, only 2 pods are running. What component ensures that a new pod is scheduled to restore the desired replica count?

Accepted Answer

kube-controller-manager. The kube-controller-manager runs the ReplicaSet controller, which detects the mismatch and creates a new pod.

Answer

kube-scheduler

Answer

kubelet

Answer

kube-proxy

Question 2

A team wants to deploy a stateful application that requires each pod to have a unique, stable network identity and persistent storage that persists across rescheduling. Which Kubernetes resource is most appropriate?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it provides each pod with a unique, stable network identity (via a predictable hostname derived from the StatefulSet name and ordinal index) and dedicated persistent storage that persists across rescheduling. This is achieved through a headless Service and PersistentVolumeClaims (PVCs) that are bound to each pod's identity, ensuring that when a pod is rescheduled, it reattaches to the same storage and retains its network identity.

Answer

DaemonSet

Answer

Deployment

Answer

Job

Question 3

A Service of type ClusterIP is created to expose a set of pods. How does the Service achieve load balancing to the pods?

Accepted Answer

The kube-proxy component on each node sets up network rules to forward traffic to the pods. Kube-proxy on each node implements load balancing for ClusterIP Services by creating iptables or IPVS rules that distribute traffic from the Service's virtual IP to the backend pods. These rules use a random or round-robin selection (depending on the mode) to forward packets to healthy pods, ensuring no single pod is overwhelmed.

Answer

The API server routes traffic directly to the pods

Answer

The kubelet configures the container runtime to route traffic

Answer

Using a cloud load balancer

Question 4

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/4 nodes are available: 4 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod requires more memory than any node can allocate. The error message '0/4 nodes are available: 4 Insufficient memory' directly indicates that the pod's memory request exceeds the allocatable memory on every node in the cluster. The Kubernetes scheduler evaluates resource requests (spec.containers[].resources.requests.memory) against node capacity, and if no node can satisfy the request, the pod remains in Pending state.

Answer

All nodes have taints that the pod cannot tolerate

Answer

The pod's liveness probe is failing

Answer

The container image is not found

Question 5

Which of the following is a correct apiVersion for a Deployment in a modern Kubernetes cluster (v1.19+)?

Accepted Answer

apiVersion: apps/v1. `apps/v1` is the stable API version for Deployments in Kubernetes v1.19+, replacing the deprecated `extensions/v1beta1` and `apps/v1beta1` versions. The `apps/v1` API group provides the full set of features for Deployments, including rolling updates, rollbacks, and scaling, and is required for production clusters running v1.19 or later.

Answer

apiVersion: extensions/v1beta1

Answer

apiVersion: v1

Answer

apiVersion: apps/v1beta1

Question 6

A ClusterIP Service named 'db-service' in namespace 'prod' selects pods with label 'app: database'. A pod in the same cluster needs to reach this service using DNS. What is the fully qualified domain name (FQDN) for the service?

Accepted Answer

db-service.prod.svc.cluster.local. The correct FQDN for a Kubernetes Service follows the pattern ..svc.cluster.local. Since the 'db-service' ClusterIP Service is in the 'prod' namespace, the FQDN is 'db-service.prod.svc.cluster.local'. This allows any pod in the cluster to resolve the service's cluster IP via DNS, using the cluster domain 'cluster.local' by default.

Answer

db-service.cluster.local

Answer

db-service.svc.cluster.local

Answer

db-service.prod.cluster.local

Question 7

Which of the following is a way to provide configuration data to a pod without baking it into the container image?

Accepted Answer

Using a ConfigMap. A ConfigMap is a Kubernetes API object used to decouple configuration artifacts from container images, allowing you to inject configuration data (e.g., environment variables, command-line arguments, or configuration files) into pods without rebuilding the image. This is the standard way to provide non-sensitive configuration data to pods at runtime, as defined in the Kubernetes documentation.

Answer

Using an annotation

Answer

Using a Secret

Answer

Using a PersistentVolume

Question 8

Which TWO components are part of the Kubernetes control plane? (Choose two.)

Accepted Answer

kube-apiserver. The Kubernetes control plane consists of components that make global cluster decisions and manage cluster state, and kube-apiserver (C) is the central control plane component that exposes the Kubernetes API and is the front end through which all other components communicate. kube-controller-manager (D) is also a control plane component; it runs the built-in controllers (such as node, replication, endpoints, and service account controllers) that continuously reconcile the desired state stored in etcd with the actual cluster state. By contrast, kube-proxy (A) is a node-level component that maintains network rules (iptables/IPVS) for Service load balancing, the container runtime (B) is node software like containerd or CRI-O that actually runs containers, and kubelet (E) is the node agent that registers the node and manages pods on it — all three run on worker nodes rather than as part of the control plane.

Answer

kube-proxy

Answer

container runtime

Answer

kubelet

Question 9

Which THREE of the following are valid ways to assign a pod to a specific node? (Choose three.)

Accepted Answer

Setting the 'nodeName' field in the pod spec. Option A is correct because setting the 'nodeName' field directly in the pod spec bypasses the scheduler and binds the pod to that exact node by name. Option B is correct because 'nodeAffinity' rules under 'affinity' let the scheduler place the pod on nodes matching label expressions, including required and preferred constraints. Option C is correct because 'nodeSelector' matches node labels and constrains the scheduler to only nodes carrying the specified labels. Option D is not a placement mechanism; a ServiceAccount provides an identity for pods to authenticate to the API server, not to select a node. Option E is invalid because 'clusterName' is not a pod spec field used for node assignment and has no scheduling effect.

Answer

Using a ServiceAccount

Answer

Setting the 'clusterName' field

Question 10

Which TWO of the following are benefits of using a Deployment over managing ReplicaSets directly? (Choose two.)

Accepted Answer

Declarative scaling. Option B (Declarative scaling) is correct because a Deployment declares the desired replica count in its spec (spec.replicas), and the Deployment controller continuously reconciles the actual number of pods to match that declared state, so scaling is expressed declaratively rather than by manually editing a ReplicaSet. Option D (Automatic rolling updates and rollbacks) is correct because Deployments manage ReplicaSets under the hood to perform rolling updates via spec.strategy (RollingUpdate with maxSurge/maxUnavailable) and preserve revision history (spec.revisionHistoryLimit) so that kubectl rollout undo can roll back to a previous ReplicaSet. Option A is incorrect because stateful workloads requiring stable identities and persistent per-pod storage are handled by StatefulSets, not Deployments. Option C is incorrect because pod IP addresses are a function of the cluster network (e.g., CNI-assigned IPs) and are not a Deployment-specific benefit; direct pod access is generally discouraged in favor of Services. Option E is incorrect because running one pod on every node is the purpose of a DaemonSet, not a Deployment.

Answer

Support for stateful workloads

Answer

Direct access to pod IP addresses

Answer

Ability to run a pod on every node

Question 11

Which Kubernetes component is the primary entry point for all administrative tasks and exposes the REST API?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole component that exposes the Kubernetes REST API. All administrative tasks—whether performed via kubectl, the Kubernetes dashboard, or direct API calls—must go through the API server, which validates and processes requests before storing state in etcd. Without the API server, no other component (scheduler, controller-manager, etc.) can interact with the cluster state.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 12

What is the primary purpose of a Namespace in Kubernetes?

Accepted Answer

To isolate resources and provide a scope for names. Namespaces in Kubernetes provide a mechanism for isolating groups of resources within a single cluster. They create separate scopes for resource names, meaning that resource names (like Pods or Services) only need to be unique within a Namespace, not across the entire cluster. This allows multiple teams or projects to share a cluster without naming conflicts, and it also enables cluster administrators to apply policies (like ResourceQuotas) and network policies at the Namespace level.

Answer

To set resource quotas for the entire cluster

Answer

To define network policies for pods

Answer

To manage node affinity rules

Question 13

A Deployment manages ReplicaSets and supports rolling updates. You want to change the container image of a Deployment without downtime. What is the recommended approach?

Accepted Answer

Edit the Deployment's pod template spec to use the new image; the Deployment will automatically perform a rolling update. Editing the Deployment's pod template spec triggers an automatic rolling update, which is the recommended approach for zero-downtime updates. The Deployment controller creates a new ReplicaSet with the updated image and gradually scales it up while scaling down the old ReplicaSet, ensuring that a minimum number of pods remain available throughout the process.

Answer

Use kubectl expose to update the image on the service

Answer

Delete the existing Deployment and create a new one with the updated image

Answer

Manually delete all pods one by one; they will be recreated with the new image by the ReplicaSet

Question 14

Which component runs on every worker node and ensures that containers are running in a Pod as specified in the Pod manifest?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node in a Kubernetes cluster. It receives Pod specifications (Pod manifests) from the API server, either directly or via the kube-apiserver, and ensures that the containers described in those manifests are running and healthy. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers as needed.

Answer

kube-controller-manager

Answer

container runtime

Answer

kube-proxy

Question 15

You have a Pod with a container that runs a web server. The Pod has a memory request of 256Mi and a memory limit of 512Mi. The container attempts to allocate 600Mi of memory. What happens?

Accepted Answer

The container is killed by the OOM killer, and the Pod enters CrashLoopBackOff. When a container's memory usage exceeds its memory limit (512Mi), the Linux Out-Of-Memory (OOM) killer terminates the container process. Kubernetes then restarts the container based on the Pod's restart policy, but because the container immediately tries to allocate 600Mi again, it is repeatedly killed, resulting in a CrashLoopBackOff state. Memory limits are hard constraints enforced by the kernel via cgroups, not soft limits.

Answer

The memory limit is automatically increased to 600Mi

Answer

The Pod is evicted from the node

Answer

The container is allowed to use up to 600Mi because the limit is a soft constraint