KCNA Kubernetes Fundamentals Practice Test 2 — 15 Questions

Question 1

Which resource provides stable network endpoints to a set of pods, regardless of pod IP changes?

Accepted Answer

Service. A Service provides a stable virtual IP and DNS name that remains constant even as pods are created, destroyed, or rescheduled. It uses label selectors to dynamically route traffic to the backing pods, abstracting away their individual IP changes. This is the core mechanism for reliable network endpoints in Kubernetes.

Answer

ConfigMap

Answer

Deployment

Answer

Ingress

Question 2

A pod in the 'default' namespace cannot reach a pod in the 'backend' namespace by service name 'db-service'. Both namespaces exist and the service is running. What is the most likely cause?

Accepted Answer

The pod is using the wrong service name format for cross-namespace access. D is correct because in Kubernetes, a pod in one namespace cannot reach a service in another namespace using just the service name (e.g., 'db-service'). Cross-namespace service discovery requires the fully qualified DNS name in the format ..svc.cluster.local (e.g., 'db-service.backend.svc.cluster.local'). Using only the service name resolves within the same namespace, causing the connection to fail.

Answer

The pod does not have network policy allowing cross-namespace traffic

Answer

The service is not exposed on a port

Answer

The kube-proxy is not running

Question 3

Which kubectl command is used to apply a manifest file to create or update resources?

Accepted Answer

kubectl apply -f manifest.yaml. `kubectl apply -f manifest.yaml` is the declarative management command that creates or updates resources by applying a configuration manifest. It uses a three-way merge algorithm to compute the changes needed to reconcile the desired state in the manifest with the current state in the cluster, making it suitable for both initial creation and subsequent updates.

Answer

kubectl update -f manifest.yaml

Answer

kubectl run -f manifest.yaml

Answer

kubectl create -f manifest.yaml

Question 4

A Deployment is configured with 'strategy.type: RollingUpdate' and 'strategy.rollingUpdate.maxUnavailable: 0'. What is the effect during a rolling update?

Accepted Answer

No pod will be terminated until a new pod is ready. Setting `maxUnavailable: 0` means the Deployment controller will not terminate any existing pod until a new pod is fully ready. This ensures zero disruption to the application during the rolling update, as the controller waits for the new pod to pass its readiness probe before scaling down the old ReplicaSet.

Answer

The update will fail because maxUnavailable must be at least 1

Answer

The update will not proceed until at least one new pod is ready

Answer

The update will proceed without any downtime

Question 5

What is the role of kube-scheduler in Kubernetes?

Accepted Answer

To assign pods to nodes. The kube-scheduler is responsible for selecting an optimal node for newly created pods that have not yet been assigned to a node. It evaluates constraints such as resource requirements, affinity/anti-affinity rules, and data locality, then binds the pod to the chosen node via the Kubernetes API. This makes option A correct because scheduling is the scheduler's primary and defining function.

Answer

To run container health checks

Answer

To store cluster configuration

Answer

To provide network rules for services

Question 6

You have a YAML manifest for a Deployment with 'apiVersion: extensions/v1beta1'. When you run 'kubectl apply -f manifest.yaml', you get an error. What is the most likely cause?

Accepted Answer

The apiVersion is deprecated and not supported. `extensions/v1beta1` was deprecated starting in Kubernetes 1.16 and removed entirely in Kubernetes 1.22. Running `kubectl apply` against a manifest with this apiVersion will result in an error because the API group and version are no longer recognized by the API server. The correct apiVersion for Deployments is `apps/v1`, which is the stable and currently supported version.

Answer

The namespace does not exist

Answer

The YAML syntax is invalid

Answer

The 'kind' field is misspelled

Question 7

Which TWO components are part of the Kubernetes worker node?

Accepted Answer

kube-proxy. (kube-proxy) is correct because it is a network component that runs on each worker node, maintaining network rules (e.g., iptables or IPVS) to enable communication to Pods across the cluster. Option E (kubelet) is correct because it is the primary node agent that runs on every worker node, responsible for managing Pods and their containers as defined by the control plane.

Answer

kube-apiserver

Answer

etcd

Answer

kube-scheduler

Question 8

What is the primary purpose of the kube-scheduler in a Kubernetes cluster?

Accepted Answer

Assigning pods to nodes. The kube-scheduler is the Kubernetes control plane component responsible for selecting an optimal node for newly created pods that have not yet been assigned to a node. It evaluates constraints such as resource requirements, affinity/anti-affinity rules, and data locality, then binds the pod to the chosen node via the Kubernetes API. This makes assigning pods to nodes its primary and defining purpose.

Answer

Running container runtime operations

Answer

Storing the cluster state

Answer

Exposing the Kubernetes API

Question 9

What is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod [CORRECT]. The Pod is the smallest and simplest unit in the Kubernetes object model. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. Deployments manage ReplicaSets, which in turn manage Pods, but the Pod itself is the atomic deployable unit.

Answer

Deployment [wrong]

Answer

Container [wrong]

Answer

Node [wrong]

Question 10

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff due to OOMKilled, meaning the container exceeded its memory limit and was terminated by the Linux kernel's Out-Of-Memory (OOM) killer. Increasing the memory limit in the pod's container resource specification allows the container to allocate more memory without being killed, resolving the crash loop. This directly addresses the root cause—insufficient memory limit—without affecting other resources or requiring full redeployment.

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Question 11

Which component is responsible for ensuring that the containers in a pod are running as specified?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each worker node. It receives PodSpec definitions from the API server (directly or via the kube-controller-manager) and ensures that the containers described in those PodSpecs are actually running and healthy. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and restart containers as needed, continuously reconciling the actual state with the desired state.

Answer

kube-apiserver

Answer

kube-controller-manager

Answer

kube-proxy

Question 12

You have a Deployment that manages 3 replicas of a web application. You want to perform a rolling update with zero downtime. Which kubectl command should you use?

Accepted Answer

kubectl set image deployment/myapp mycontainer=myimage:v2. `kubectl set image deployment/myapp mycontainer=myimage:v2` triggers a rolling update on the Deployment, which by default creates a new ReplicaSet and gradually scales it up while scaling down the old ReplicaSet, ensuring zero downtime. The Deployment controller manages the update strategy (default: RollingUpdate) and maintains the desired number of replicas throughout the process.

Answer

kubectl delete pod myapp-xyz --grace-period=0

Answer

kubectl patch deployment myapp -p '{"spec":{"replicas":5}}'

Answer

kubectl rollout undo deployment/myapp

Question 13

A user reports that they can access a service by its ClusterIP but not by its DNS name from within the cluster. What is the most likely cause?

Accepted Answer

The CoreDNS pod is not running or is misconfigured. Accessing a service by ClusterIP works because it relies on iptables/IPVS rules managed by kube-proxy, which are independent of DNS. However, DNS name resolution within the cluster is handled by CoreDNS, which translates service names to ClusterIPs. If CoreDNS is not running or misconfigured, DNS queries for the service name will fail, while direct ClusterIP access remains functional. This is the most likely cause because the symptom specifically points to a DNS resolution failure.

Answer

The kube-proxy is not running on the node

Answer

The service is of type NodePort

Answer

The service selector does not match any pods

Question 14

What is the role of etcd in a Kubernetes cluster?

Accepted Answer

It stores the cluster state and configuration. etcd is a distributed, consistent key-value store that serves as Kubernetes' primary data store. It holds the entire cluster state, including all object definitions (Pods, Services, Deployments, etc.), configuration data, and secrets. The kube-apiserver is the only component that interacts directly with etcd, ensuring that all state changes go through a consistent, transactional backend. Without etcd, the cluster would have no persistent record of its desired or current state.

Answer

It manages network policies

Answer

It schedules pods onto nodes

Answer

It provides DNS resolution for services

Question 15

Which of the following is a correct YAML structure for a Service of type ClusterIP?

Accepted Answer

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
    - port: 80. It defines a Kubernetes Service of kind Service with apiVersion v1, which is the correct API group for core Service objects. The spec includes a selector to target pods with label app: myapp and a port mapping with port 80, which is the standard structure for a ClusterIP Service (the default type when type is omitted). The selector field is required to route traffic to matching pods, and the ports array correctly specifies the service port.

Answer

apiVersion: v1
kind: Pod
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
    - port: 80

Answer

apiVersion: apps/v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
    - port: 80

Answer

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  app: myapp
  ports:
    - port: 80