KCNA Kubernetes Fundamentals Practice Test 19 — 15 Questions

Question 1

Which resource type provides a stable IP address and DNS name to access a set of Pods, regardless of Pod IP changes?

Accepted Answer

Service. A Service in Kubernetes provides a stable virtual IP (ClusterIP) and a DNS name (via CoreDNS) that remains constant even as Pods are created, destroyed, or rescheduled. This decouples client access from the ephemeral nature of Pod IPs, ensuring reliable connectivity to the Pods selected by the Service's label selector.

Answer

Ingress

Answer

ConfigMap

Answer

Deployment

Question 2

You have a ConfigMap named 'app-config' with key 'database.url'. Which environment variable reference in a Pod spec injects this value correctly?

Accepted Answer

env:
  - name: DATABASE_URL
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: database.url. It uses the `configMapKeyRef` field under `valueFrom` to reference a specific key (`database.url`) from the ConfigMap named `app-config`. This is the standard Kubernetes syntax for injecting a single key from a ConfigMap as an environment variable into a Pod.

Answer

env:
  - name: DATABASE_URL
    value: "$(APP_CONFIG_DATABASE_URL)"

Answer

env:
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: app-config
        key: database.url

Answer

env:
  - name: DATABASE_URL
    valueFrom:
      configMapRef:
        name: app-config
        key: database.url

Question 3

You notice that a newly created Pod remains in 'Pending' state. Which of the following is the MOST likely cause?

Accepted Answer

There are insufficient resources available on any node to meet the Pod's requests. A Pod enters 'Pending' state when it cannot be scheduled onto a node. The most common reason is insufficient CPU, memory, or other resources on any available node to satisfy the Pod's resource requests. The Kubernetes scheduler continuously evaluates node capacity against Pod requests, and if no node can accommodate the Pod, it remains unscheduled in Pending.

Answer

The Pod manifest has a syntax error

Answer

The container image does not exist

Answer

The Service does not exist

Question 4

You create a Deployment with 'replicas: 3' and update the pod template without changing the selector. After the update, you notice that only the new Pods are running, but old Pods have been terminated. What is the default update strategy?

Accepted Answer

RollingUpdate. The default update strategy for a Deployment in Kubernetes is RollingUpdate. When you update the pod template (e.g., changing the container image), the Deployment controller creates new ReplicaSets with the updated template and gradually scales down the old ReplicaSet while scaling up the new one, ensuring zero downtime. Since only new Pods are running and old Pods have been terminated, this confirms the default behavior of a rolling update, which replaces Pods incrementally without manual intervention.

Answer

OnDelete

Answer

BlueGreen

Answer

Recreate

Question 5

Which TWO components are part of the Kubernetes control plane? (Select exactly two.)

Accepted Answer

kube-apiserver. The kube-apiserver (option D) is the central control plane component that exposes the Kubernetes API, validating and processing all REST requests and serving as the front end for the cluster's shared state in etcd. The kube-scheduler (option E) is also a control plane component, responsible for watching for newly created Pods with no assigned node and selecting an appropriate node based on resource requirements, affinity rules, and other constraints. By contrast, kube-proxy (A) runs on each node and maintains network rules for Service traffic, the kubelet (B) is a node agent that ensures containers described in PodSpecs are running, and the container runtime (C) is the software on each node that actually runs containers — all three are node components, not control plane components.

Answer

kube-proxy

Answer

kubelet

Answer

container runtime

Question 6

Which THREE of the following are valid ways to expose a Service to external traffic? (Select exactly three.)

Accepted Answer

Ingress. Ingress (A) is correct because an Ingress resource defines HTTP/HTTPS routing rules that expose Services externally through an Ingress controller acting as a layer-7 entry point. NodePort (D) is correct because it allocates a static port on every node's IP (default range 30000-32767), making the Service reachable from outside the cluster via :. LoadBalancer (E) is correct because it provisions an external load balancer (e.g., via a cloud provider) that distributes traffic to the Service from outside the cluster. ExternalName (B) is not a way to expose a Service; it merely maps a Service to an external DNS name via a CNAME record without proxying traffic. ClusterIP (C) is not externally accessible since it only assigns an internal virtual IP reachable within the cluster.

Answer

ExternalName

Answer

ClusterIP

Question 7

Which TWO of the following are correct about the 'kubectl apply' command compared to 'kubectl create'? (Select exactly two.)

Accepted Answer

kubectl apply can accept a directory of YAML files with -f. Option D is correct because 'kubectl apply -f <directory>' accepts a directory path and recursively applies all YAML/JSON manifests it contains, just like 'kubectl create -f' does. Option E is correct because 'kubectl apply' is the declarative management command: it creates the object if it does not exist and patches/updates it if it does, using the last-applied-configuration annotation to compute a three-way merge. Option A is wrong because '--save-config' is not required for apply; apply itself records the kubectl.kubernetes.io/last-applied-configuration annotation automatically (the flag is mainly used with 'kubectl create' to enable later apply). Option B is wrong because apply is specifically designed to work on existing resources, updating them in place. Option C is wrong because apply both creates new objects and updates existing ones.

Answer

kubectl apply requires the --save-config flag to record the last-applied-configuration annotation

Answer

kubectl apply cannot be used on resources that already exist

Answer

kubectl apply can create objects but not update them

Question 8

Which Kubernetes component is the primary entry point for all administrative tasks and API requests?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative tasks and API requests. It validates and processes RESTful API calls (using JSON/YAML over HTTP/HTTPS) before persisting state to etcd or delegating work to other controllers. Without the API server, no kubectl command, automation script, or internal component can interact with the cluster.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 9

Which command is used to view detailed information about a specific pod?

Accepted Answer

kubectl describe pod. The `kubectl describe pod` command retrieves detailed information about a specific pod, including its current state, events, labels, annotations, container details, resource limits, and volume mounts. This is the standard Kubernetes command for inspecting the full configuration and lifecycle of a pod object, as opposed to the summary view provided by `kubectl get pod`.

Answer

kubectl exec pod -- /bin/sh

Answer

kubectl logs pod

Answer

kubectl get pod

Question 10

A Deployment manages ReplicaSets. What is the primary benefit of using a Deployment over directly managing ReplicaSets?

Accepted Answer

Deployments support rolling updates and rollbacks. The primary benefit of using a Deployment over directly managing ReplicaSets is that Deployments provide declarative updates for Pods and ReplicaSets, including built-in support for rolling updates and rollbacks. This allows you to update the desired state (e.g., a new container image version) and have the Deployment controller automatically orchestrate the transition, while also enabling you to revert to a previous revision if the update fails. Directly managing ReplicaSets would require manual steps to scale down old ReplicaSets and scale up new ones, and it lacks the automated revision history and rollback capabilities that Deployments offer.

Answer

Deployments can expose services externally

Answer

Deployments automatically configure DNS

Answer

Deployments provide persistent storage

Question 11

You have a Pod with a container that needs to read sensitive data such as a database password. Which Kubernetes resource should you use to store this data?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the data in base64 and is designed to be consumed by Pods via environment variables or volume mounts. Unlike ConfigMaps, Secrets are intended for confidential information and can be encrypted at rest using etcd encryption providers or KMS.

Answer

PersistentVolume

Answer

ServiceAccount

Answer

ConfigMap

Question 12

A Pod is stuck in Pending state. Which of the following is the MOST likely cause?

Accepted Answer

No node has enough resources to run the Pod. A Pod stuck in Pending state means the scheduler cannot place it on a node. The most common reason is insufficient resources (CPU, memory, or ephemeral storage) on any available node, causing the scheduler to leave the Pod unscheduled. This is indicated by the Pod's status remaining Pending and typically confirmed via `kubectl describe pod` showing events like '0/1 nodes are available: 1 Insufficient cpu'.

Answer

The Pod's container is crashing

Answer

The container image has a typo

Answer

The Pod's liveness probe is failing

Question 13

Which component on a worker node is responsible for enforcing the network rules and implementing Service abstractions?

Accepted Answer

kube-proxy. kube-proxy is the component on each worker node that implements Service abstractions by maintaining network rules (iptables, IPVS, or userspace) that allow traffic to reach Pods from inside or outside the cluster. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates the node's packet filtering rules to forward traffic to the correct backend Pods, handling load balancing and session affinity.

Answer

kubelet

Answer

container runtime

Answer

kube-scheduler

Question 14

A Service of type ClusterIP is created. What is the default behavior of this Service?

Accepted Answer

It exposes the Service on a cluster-internal IP. A ClusterIP Service is the default Kubernetes Service type, which assigns a virtual IP address reachable only within the cluster. Traffic sent to this IP is load-balanced across the Pods selected by the Service's label selector, using iptables or IPVS rules. No external access is provided unless an Ingress or other mechanism is explicitly configured.

Answer

It exposes the Service externally via a cloud load balancer

Answer

It exposes the Service on a static port on each node

Answer

It routes traffic to Pods based on external DNS names

Question 15

You have a Deployment that manages 3 replicas. You want to perform a rolling update with a maximum of 2 Pods unavailable during the update. Which field should you set in the Deployment spec?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. The `maxUnavailable` field in `spec.strategy.rollingUpdate.maxUnavailable` specifies the maximum number of Pods that can be unavailable during a rolling update. Setting it to 2 allows up to 2 Pods to be taken down at a time, ensuring that at least 1 Pod remains available (since the Deployment has 3 replicas). This field directly controls the availability tolerance during the update process.

Answer

spec.minReadySeconds

Answer

spec.strategy.rollingUpdate.maxSurge

Answer

spec.replicas