KCNA Kubernetes Fundamentals Practice Test 20 — 15 Questions

Question 1

Which Kubernetes object is used to logically isolate resources within a cluster, such as for separating environments like dev and prod?

Accepted Answer

Namespace. D is correct because a Namespace is the Kubernetes object designed to logically isolate resources within a single cluster. By creating separate Namespaces for environments like dev and prod, you can apply distinct policies, quotas, and access controls without needing multiple physical clusters.

Answer

ClusterRole

Answer

ResourceQuota

Answer

Node

Question 2

A Deployment is configured with 'replicas: 5' and a rolling update strategy. During an update, you notice that the number of available pods drops to 3 momentarily. Which field in the Deployment spec can be adjusted to control the minimum number of pods available during a rolling update?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. `spec.strategy.rollingUpdate.maxUnavailable` defines the maximum number (or percentage) of Pods that can be unavailable during a rolling update. With `replicas: 5`, setting `maxUnavailable: 2` would allow at most 2 Pods to be unavailable at any time, ensuring that at least 3 Pods remain available — which matches the observed drop to 3. This field directly controls the minimum number of available Pods during the update process.

Answer

spec.strategy.rollingUpdate.maxSurge

Answer

spec.minReadySeconds

Answer

spec.replicas

Question 3

You need to ensure that a pod runs on a node with SSD storage. How can you achieve this?

Accepted Answer

Use node affinity with requiredDuringSchedulingIgnoredDuringExecution. Node affinity with `requiredDuringSchedulingIgnoredDuringExecution` is the correct approach because it allows you to specify a hard constraint that the pod must be scheduled on a node with a specific label (e.g., `disk=ssd`). This ensures the pod runs only on nodes that have SSD storage, as the scheduler enforces this rule during pod placement.

Answer

Use nodeSelector with a label that matches nodes having SSDs

Answer

Use a taint on nodes without SSDs and a toleration on the pod

Answer

Use pod anti-affinity to avoid nodes without SSDs

Question 4

A Service of type ClusterIP is not resolving DNS names for pods. The pods are running and can communicate with each other via IP addresses. Which component should be checked first?

Accepted Answer

CoreDNS pods in the kube-system namespace. DNS name resolution for Services in Kubernetes is handled by CoreDNS, which runs as pods in the kube-system namespace. When a ClusterIP Service fails to resolve DNS names but pods can communicate via IP addresses, the issue is almost certainly with the DNS resolver itself, not with network connectivity or Service endpoints. CoreDNS must be checked first to ensure it is running, has correct configuration, and can query the Kubernetes API for Service records.

Answer

The kubelet on the node where the pod is running

Answer

The Service's endpoint slices

Answer

kube-proxy on the nodes

Question 5

Which TWO of the following are responsibilities of the kube-controller-manager?

Accepted Answer

Ensuring the correct number of pod replicas are running. The kube-controller-manager runs controller processes that regulate the state of the cluster. The ReplicaSet controller, which runs inside the kube-controller-manager, is responsible for ensuring that the desired number of pod replicas are running at all times, creating or deleting pods as necessary to match the specified replica count.

Answer

Assigning pods to nodes based on resource requirements

Answer

Implementing network rules for Services

Answer

Storing the cluster state

Question 6

Which THREE of the following are true about Kubernetes labels and selectors?

Accepted Answer

Set-based selectors support operators like 'In' and 'NotIn'. Kubernetes set-based selectors support operators like 'In', 'NotIn', 'Exists', and 'DoesNotExist', allowing more flexible matching than equality-based selectors. This is defined in the Kubernetes API specification for label selectors, enabling complex filtering of resources.

Answer

Labels are encrypted at rest by default

Answer

Labels are immutable after creation

Question 7

Which TWO of the following are characteristics of a Kubernetes Pod?

Accepted Answer

Pods are the smallest deployable units in Kubernetes. B is correct because Pods are the smallest and most fundamental deployable units in Kubernetes, representing a single instance of a running process in the cluster. A Pod encapsulates one or more containers, storage resources, and a unique network IP, and is the atomic unit of scheduling. This is defined in the Kubernetes core API and is a foundational concept for the KCNA exam.

Answer

Pods can only run a single container

Answer

Pods are designed to be long-lived and rarely replaced

Answer

Pods are typically replicated by a Deployment or ReplicaSet

Question 8

Which Kubernetes object provides stable network endpoints and load balancing for a set of pods?

Accepted Answer

Service. A Service is the correct Kubernetes object because it provides a stable virtual IP (ClusterIP) and DNS name that remains constant even as pods are created or destroyed. It automatically load-balances traffic across the set of pods matching its label selector using iptables or IPVS rules, ensuring reliable network endpoints for clients.

Answer

Deployment

Answer

ConfigMap

Answer

Pod

Question 9

Which control plane component is responsible for assigning pods to nodes?

Accepted Answer

kube-scheduler. The kube-scheduler is the control plane component responsible for assigning pods to nodes. It watches for newly created pods that have no node assignment and selects an optimal node for each pod based on resource requirements, constraints, policies, and data locality. The scheduler does not actually run the pod; it updates the pod's `nodeName` field via the API server, which then triggers the kubelet on the chosen node to launch the pod.

Answer

etcd

Answer

kube-apiserver

Answer

kube-controller-manager

Question 10

A developer deploys a pod with the following resource specification:
```yaml
resources:
  requests:
    memory: "256Mi"
  limits:
    memory: "512Mi"
```
The pod is killed with OOMKilled. What is the most likely cause?

Accepted Answer

The container exceeded the memory limit of 512Mi. The OOMKilled exit code indicates the container was terminated by the Linux kernel's Out-Of-Memory (OOM) killer because it attempted to use more memory than its configured limit of 512Mi. Kubernetes enforces memory limits using cgroups; when the container exceeds the limit, the kernel kills the process, resulting in the OOMKilled status.

Answer

The container exceeded the memory request of 256Mi

Answer

The node ran out of memory

Answer

The CPU limit was too low

Question 11

You need to expose a set of pods running in the 'dev' namespace internally within the cluster on a stable IP. All pods have the label 'app: web'. Which kubectl command should you use?

Accepted Answer

kubectl expose deployment web --port=80 --target-port=8080 --name=web-service -n dev. It exposes the existing deployment named 'web' (which manages pods with label 'app: web') as a ClusterIP service, providing a stable internal IP and DNS name within the cluster. The `--port=80` sets the service port, and `--target-port=8080` maps to the container port, ensuring traffic reaches the pods correctly in the 'dev' namespace.

Answer

kubectl create service clusterip web --tcp=80:8080 -n dev

Answer

kubectl run web --image=nginx --port=80 -n dev

Answer

kubectl expose pod web --port=80 --target-port=8080 --name=web-service -n dev

Question 12

A Deployment is created with `replicas: 3`. After applying the manifest, only 2 pods are running and one is in Pending state. What is the most likely reason?

Accepted Answer

There are insufficient resources on the nodes. When a Pod remains in Pending state, it means the scheduler cannot find a node that satisfies the Pod's resource requirements (CPU, memory, or other constraints). Since two Pods are running successfully, the Deployment configuration (image, name, selector) is valid, and the issue is that the cluster lacks sufficient capacity to schedule the third replica. The scheduler continuously evaluates node resources and will leave the Pod pending until resources become available or the request is adjusted.

Answer

The Service selector does not match

Answer

The Deployment name is misspelled

Answer

The container image is invalid

Question 13

An application requires that configuration data be mounted as a file inside the container. The data may change at runtime, and the application should automatically read the updated values without restarting. Which approach should be used?

Accepted Answer

Use a ConfigMap mounted as a volume without subPath. Mounting a ConfigMap as a volume (without subPath) creates a symlink-based mount that automatically updates when the ConfigMap changes. The kubelet periodically syncs the ConfigMap data and updates the symlinks, allowing the application to read the new values without a restart. This satisfies the requirement for runtime configuration updates without container restart.

Answer

Store the configuration in a Secret and mount it using subPath

Answer

Use a PersistentVolumeClaim to store the configuration

Answer

Store the configuration in an environment variable from a ConfigMap

Question 14

Which of the following is NOT a responsibility of the kubelet on a worker node?

Accepted Answer

Implementing network rules for Services. The kubelet is the primary node agent that runs on each worker node, responsible for ensuring containers are running in a Pod as specified by the PodSpec. It performs liveness and readiness probes, starts and stops containers, and reports node and pod status to the control plane. Implementing network rules for Services, such as iptables or IPVS rules, is the responsibility of the kube-proxy, not the kubelet.

Answer

Performing liveness and readiness probes

Answer

Starting and stopping containers based on PodSpecs

Answer

Reporting node and pod status to the control plane

Question 15

What is the primary purpose of the `kubectl apply` command?

Accepted Answer

To create or update resources from a manifest. The `kubectl apply` command uses a declarative approach to manage Kubernetes resources. It sends a PATCH request to the API server, which compares the desired state in the provided manifest (YAML/JSON) with the current state of the resource in the cluster. If the resource does not exist, it creates it; if it does exist, it updates only the fields specified in the manifest, preserving any fields not mentioned.

Answer

To view resource details

Answer

To delete resources

Answer

To execute commands inside a container