KCNA Kubernetes Fundamentals Practice Test 19 — 15 Questions

Question 1

Which TWO of the following are valid ways to expose a Deployment as a Service?

Accepted Answer

Run 'kubectl expose deployment my-deployment --port=80 --target-port=8080'. 'kubectl expose deployment my-deployment --port=80 --target-port=8080' creates a Service object that selects pods based on the labels automatically assigned to the Deployment's pods. This command generates a ClusterIP Service by default, mapping port 80 on the Service to port 8080 on the pods, which is a standard and valid method to expose a Deployment.

Answer

Edit the Deployment and set 'spec.serviceName'

Answer

Run 'kubectl run my-deployment --image=nginx --expose'

Answer

Add a 'service' section to the Deployment's YAML manifest

Question 2

Which THREE of the following are true about Kubernetes Namespaces?

Accepted Answer

NetworkPolicy can be used to control traffic between pods in different namespaces. B is correct because NetworkPolicy resources can define ingress and egress rules that allow or deny traffic between pods based on labels, and these rules can explicitly target pods in other namespaces using the namespaceSelector field. This enables fine-grained network segmentation across namespace boundaries, which is a common requirement for multi-tenant clusters.

Answer

PersistentVolumes are namespaced

Answer

Nodes are namespaced resources

Question 3

Which Kubernetes resource provides a stable IP address and DNS name to access a set of pods?

Accepted Answer

Service. A Kubernetes Service provides a stable virtual IP address and a DNS name (e.g., my-svc.namespace.svc.cluster.local) that remains constant even as the underlying pods are created, destroyed, or scaled. This abstraction allows clients to reliably reach a set of pods without needing to track individual pod IPs, which are ephemeral. Services use label selectors to dynamically route traffic to matching pods, ensuring high availability and load balancing.

Answer

Ingress

Answer

EndpointSlice

Answer

NetworkPolicy

Question 4

You want to update a Deployment's container image from 'nginx:1.20' to 'nginx:1.21' and record the change. Which kubectl command should you use?

Accepted Answer

kubectl set image deployment/nginx nginx=nginx:1.21 --record. The `kubectl set image` command directly updates the container image of a specified deployment, and the `--record` flag annotates the change in the rollout history, allowing you to track the change for auditing or rollback purposes. This is the most efficient way to update the image and record the change without editing the full deployment manifest or reapplying a file.

Answer

kubectl edit deployment nginx

Answer

kubectl apply -f deployment.yaml

Answer

kubectl set image deployment/nginx nginx=nginx:1.21

Question 5

In a YAML manifest for a Deployment, which field defines the number of pod replicas?

Accepted Answer

spec.replicas. In a Kubernetes Deployment manifest, the `spec.replicas` field is the correct place to define the desired number of pod replicas. This field is a top-level attribute under the Deployment's `spec` object, and the ReplicaSet controller uses this integer value to ensure the specified number of Pods are running at all times.

Answer

spec.strategy.replicas

Answer

metadata.replicas

Answer

spec.template.replicas

Question 6

You have a ConfigMap named 'app-config' and a Secret named 'db-password'. You want to mount them into a pod. Which statement is correct?

Accepted Answer

Both ConfigMaps and Secrets can be mounted as volumes. Both ConfigMaps and Secrets are Kubernetes API objects designed to decouple configuration data from container images. They can be mounted as volumes into pods, allowing files to be created in the container's filesystem with the data from the ConfigMap or Secret. This is a core feature for managing configuration and sensitive data in Kubernetes.

Answer

Secrets can be mounted as volumes, but ConfigMaps cannot

Answer

ConfigMaps can be mounted as volumes, but Secrets cannot

Answer

ConfigMaps and Secrets can only be exposed as environment variables

Question 7

Which TWO of the following are Kubernetes control plane components?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes API. It validates and processes RESTful requests (using JSON/YAML over HTTP/HTTPS) that create, update, or delete cluster resources, and it is the only component that communicates directly with etcd. Without the API server, no control plane operations can be performed.

Answer

container runtime

Answer

kube-proxy

Answer

kubelet

Question 8

Which TWO of the following are valid ways to expose environment variables from a ConfigMap to a pod?

Accepted Answer

env.valueFrom.configMapKeyRef. Environment variables from a ConfigMap can be exposed to a pod using envFrom to inject all key-value pairs as environment variables, or using env.valueFrom.configMapKeyRef to inject a specific key as an environment variable. Using volumes and volumeMounts mounts the ConfigMap as files in the filesystem, not as environment variables. Option B (env.value) is for static values, not references. Option C (secretKeyRef) is for Secrets, not ConfigMaps.

Answer

volumes and volumeMounts

Answer

env.value

Answer

env.valueFrom.secretKeyRef

Question 9

Which TWO of the following are true about Kubernetes Pods?

Accepted Answer

A pod is the smallest deployable unit in Kubernetes. A Pod is the smallest and most fundamental deployable unit in Kubernetes. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. You cannot deploy a container directly; you must always wrap it in a Pod.

Answer

Containers in a pod always have isolated filesystems

Answer

Pods are designed to be long-lived and never terminated

Answer

Each container in a pod gets its own IP address

Question 10

Which command is used to view detailed information about a specific pod, including events and conditions?

Accepted Answer

kubectl describe pod. The `kubectl describe pod` command retrieves detailed information about a specific pod, including its current state, metadata, labels, annotations, container details, resource limits, and a chronological list of events and conditions (e.g., PodScheduled, Initialized, Ready, ContainersReady). This makes it the correct tool for viewing comprehensive pod status and lifecycle events.

Answer

kubectl logs pod

Answer

kubectl exec pod

Answer

kubectl get pod

Question 11

A Deployment named 'myapp' is managing a ReplicaSet. You need to update the application image to version 2.0. What is the recommended approach?

Accepted Answer

Update the Deployment's pod template image to version 2.0. The recommended approach to update a Deployment's application image is to modify the pod template in the Deployment specification. The Deployment controller then automatically performs a rolling update, creating a new ReplicaSet with the updated image and gradually scaling down the old ReplicaSet, ensuring zero-downtime updates and maintaining desired replica count.

Answer

Scale down the Deployment to 0 replicas, then scale up with the new image

Answer

Delete the existing ReplicaSet and create a new one with the updated image

Answer

Directly update the pods in the ReplicaSet by using 'kubectl edit pod'

Question 12

You have a pod that needs to securely access a database password. Which Kubernetes resource should you use to store the password?

Accepted Answer

Secret. A Kubernetes Secret is specifically designed to store sensitive data, such as database passwords, in a base64-encoded format. Secrets can be mounted as volumes or exposed as environment variables in a pod, ensuring the password is not stored in plaintext in the pod specification or container image.

Answer

ServiceAccount

Answer

ConfigMap

Answer

PersistentVolume

Question 13

Which component runs on every node and is responsible for maintaining network rules that allow communication to Pods from network endpoints?

Accepted Answer

kube-proxy. B is correct because kube-proxy is the component that runs on every node in a Kubernetes cluster and is responsible for maintaining network rules (e.g., iptables, IPVS, or userspace proxy) that allow network communication to Pods from network endpoints, both inside and outside the cluster. It implements the Kubernetes Service concept by managing the mapping of Service IPs to backend Pod IPs and performing load balancing.

Answer

kube-controller-manager

Answer

container runtime

Answer

kubelet

Question 14

A pod is in 'Pending' state for a long time. What is the most likely cause?

Accepted Answer

The scheduler cannot find a node that satisfies the pod's resource requests or constraints. A pod remains in 'Pending' state when it has been accepted by the API server but cannot be scheduled onto a node. The most common cause is that the scheduler cannot find a node that meets the pod's resource requests (CPU/memory) or constraints (node selectors, affinity rules, taints/tolerations). Until a suitable node is found, the pod stays in Pending, waiting for scheduling.

Answer

The pod's container has crashed

Answer

The pod's service endpoint is misconfigured

Answer

The container image is invalid

Question 15

You have two pods in different namespaces that need to communicate using a stable IP address. Which Kubernetes object provides a stable endpoint for a set of pods?

Accepted Answer

Service. A Kubernetes Service provides a stable IP address and DNS name that remains constant regardless of pod restarts or rescheduling, enabling reliable communication between pods in different namespaces. Unlike pods, which have ephemeral IPs, a Service selects a set of pods via label selectors and load-balances traffic to them, ensuring a stable endpoint across namespace boundaries.

Answer

ConfigMap

Answer

Ingress

Answer

Deployment