KCNA Kubernetes Fundamentals Practice Test 21 — 15 Questions

Question 1

Which three of the following are valid ways to interact with the Kubernetes API? (Select THREE.)

Accepted Answer

Using a Kubernetes client library (e.g., client-go). Option A is correct because Kubernetes provides official client libraries such as client-go (Go), client-python, and client-java that programmatically communicate with the API server via REST, allowing applications and controllers to create, read, update, and delete resources. Option D is correct because kubectl is the standard command-line tool that authenticates to the API server and translates commands like 'kubectl get pods' into REST API calls. Option E is correct because the Kubernetes API server exposes a RESTful HTTP API, so tools like curl can send authenticated requests directly to endpoints such as /api/v1/namespaces/default/pods. Option B is not a way to interact with the API; kubeadm is a bootstrap tool for initializing clusters and joining nodes, not for querying or managing API resources. Option C is incorrect because the Docker CLI manages containers on a Docker daemon and has no native interface to the Kubernetes API server.

Answer

Using the 'kubeadm' command

Answer

Using the Docker CLI

Question 2

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running controller loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller loops, which are continuous processes that watch the shared state of the cluster through the kube-apiserver and make changes to drive the current state toward the desired state. Each controller (e.g., ReplicaSet, Node, Deployment) is a separate loop that handles a specific aspect of cluster management, ensuring that the actual cluster state matches the desired configuration defined in the API objects.

Answer

etcd

Answer

kube-apiserver

Answer

kube-scheduler

Question 3

You need to run a stateless web application with three replicas, and you want to ensure that if a pod fails, it is automatically replaced. Which Kubernetes resource should you use?

Accepted Answer

Deployment. A Deployment is the correct resource because it manages a ReplicaSet to ensure the desired number of pod replicas (three) are running at all times. If a pod fails, the Deployment's controller automatically creates a replacement pod, maintaining the stateless application's availability.

Answer

DaemonSet

Answer

Job

Answer

StatefulSet

Question 4

A developer created a Deployment with 5 replicas. After applying the manifest, only 3 pods are Running; the other 2 are Pending. Which is the MOST likely cause?

Accepted Answer

The nodes do not have enough available CPU or memory to schedule the additional pods. D is correct because when a Pod remains in Pending state, it indicates that the scheduler cannot find a node that satisfies the Pod's resource requests. Since 3 Pods are already running and consuming resources, the remaining 2 Pods cannot be placed if the cluster's nodes lack sufficient allocatable CPU or memory. This is a classic resource-constrained scheduling failure, not a runtime or network issue.

Answer

The readiness probe is failing

Answer

A NetworkPolicy is blocking traffic to the pods

Answer

The container image is misspelled

Question 5

What is the primary purpose of a Kubernetes Service?

Accepted Answer

To provide a stable network endpoint for a set of pods. A Kubernetes Service provides a stable, virtual IP and DNS name that remains constant even as the underlying pods are created, destroyed, or scaled. It acts as a load balancer across a set of pods selected by labels, abstracting away the ephemeral nature of pod IPs. This enables reliable communication between components within the cluster without requiring clients to track individual pod addresses.

Answer

To implement network routing rules on each node

Answer

To manage rolling updates of applications

Answer

To store configuration data as key-value pairs

Question 6

You want to view the logs of a container named 'app' inside a pod named 'web-pod-7d4f8'. Which kubectl command should you use?

Accepted Answer

kubectl logs web-pod-7d4f8 -c app. The `kubectl logs` command is the standard way to retrieve container logs in Kubernetes. The `-c` flag specifies the container name within the pod, which is necessary when a pod contains multiple containers. Here, the container is named 'app' inside the pod 'web-pod-7d4f8', so `kubectl logs web-pod-7d4f8 -c app` correctly fetches its logs.

Answer

kubectl exec web-pod-7d4f8 -c app -- logs

Answer

kubectl log web-pod-7d4f8 --container app

Answer

kubectl logs web-pod-7d4f8 app

Question 7

A cluster administrator needs to ensure that a Deployment named 'frontend' in namespace 'web' is updated with a new image version using a rolling update strategy. The current deployment has 4 replicas. The administrator runs: kubectl set image deployment/frontend frontend=nginx:1.21 -n web. Which of the following describes the expected behavior?

Accepted Answer

The Deployment will create a new ReplicaSet and gradually replace old pods with new ones. `kubectl set image deployment/frontend frontend=nginx:1.21 -n web` updates the container image in the Deployment's pod template, triggering a rolling update. The Deployment controller creates a new ReplicaSet with the updated image and gradually scales it up while scaling down the old ReplicaSet, ensuring zero downtime and maintaining the desired replica count of 4.

Answer

All existing pods will be deleted immediately and new pods will be created with the new image

Answer

The command will fail because you cannot update a Deployment using kubectl set image

Answer

The Deployment's image will be updated, but only the container named 'app' will be affected

Question 8

Which of the following is a worker node component responsible for ensuring that containers are running in a pod as specified in the pod's spec?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each worker node. It receives PodSpecs (via the API server or a file) and ensures that the containers described in those PodSpecs are running and healthy. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers as required.

Answer

kube-scheduler

Answer

kube-proxy

Answer

etcd

Question 9

You need to create a ConfigMap from a file named 'app.properties'. Which kubectl command should you use?

Accepted Answer

kubectl create configmap my-config --from-file=app.properties. `kubectl create configmap` with the `--from-file` flag creates a ConfigMap from a file, using the filename as the key and its content as the value. This is the standard way to import a properties file into a ConfigMap in Kubernetes.

Answer

kubectl create configmap my-config --from-literal=app.properties

Answer

kubectl create configmap my-config --file=app.properties

Answer

kubectl create configmap my-config --from-env-file=app.properties

Question 10

A pod has resource requests: cpu: 250m, memory: 512Mi and limits: cpu: 500m, memory: 1Gi. If the container tries to use 600m CPU and 700Mi memory, what will happen?

Accepted Answer

The container will be throttled for CPU, but will not be killed because memory is within limits. CPU is a compressible resource: exceeding the CPU limit (500m) causes throttling, not termination. Memory is a non-compressible resource, and since the container's memory usage (700Mi) is below its limit (1Gi), it will not be killed. The container will be CPU-throttled but allowed to continue running.

Answer

The container will be allowed to use the extra resources because limits are only soft constraints

Answer

The container will be throttled for CPU and may be terminated if it continues to exceed the limit

Answer

The container will be killed immediately because it exceeded its CPU limit

Question 11

Which component of the control plane is the only one that directly interacts with etcd?

Accepted Answer

kube-apiserver. The kube-apiserver is the only component of the Kubernetes control plane that directly interacts with etcd. It acts as the front-end for the control plane, exposing the Kubernetes API, and all reads and writes to the cluster's state stored in etcd must go through the API server. Other components like the kube-controller-manager and kube-scheduler only communicate with etcd indirectly via the kube-apiserver, never directly.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kubelet

Question 12

You have a Namespace 'team-a' and you want to see all Pods in that namespace, including those that are not ready. Which command should you use?

Accepted Answer

kubectl get pods -n team-a. `kubectl get pods -n team-a` retrieves all Pods in the specified namespace, regardless of their readiness or status. By default, `kubectl get pods` shows all Pods, including those that are not ready, and the `-n` flag targets the namespace. No additional filters are needed to include non-ready Pods.

Answer

kubectl get pods -n team-a -l app=myapp

Answer

kubectl get pods --namespace=team-a --field-selector=status.phase!=Running

Answer

kubectl get pods --all-namespaces

Question 13

Which TWO components are part of the Kubernetes control plane?

Accepted Answer

etcd. etcd (C) is correct because it is the control plane's distributed key-value store that persistently holds all cluster state and configuration data, which the API server reads and writes. kube-apiserver (D) is correct because it is the central control plane component that exposes the Kubernetes API, validates and processes REST requests, and is the front end through which all other components communicate. The other options are node-level components, not control plane components: kube-proxy (A) implements Service networking rules on each node, kubelet (B) runs on each node and manages Pods/containers via the container runtime, and the container runtime (E) is the node software (e.g., containerd, CRI-O) that actually runs containers.

Answer

kube-proxy

Answer

kubelet

Answer

container runtime

Question 14

Which TWO of the following are valid ways to expose a Deployment as a Service?

Accepted Answer

Run 'kubectl expose deployment my-deployment --port=80 --target-port=8080'. Option A is correct because 'kubectl expose deployment my-deployment --port=80 --target-port=8080' is the imperative command that creates a Service of type ClusterIP (by default) targeting the Deployment's pods, with the Service port 80 forwarding to container port 8080. Option E is correct because a Service is decoupled from the Deployment and selects its backing pods via 'spec.selector' matching the Deployment's pod template labels (e.g., app=my-deployment), so authoring a Service YAML with the correct selector is a valid declarative way to expose the Deployment. Option B is incorrect because 'spec.serviceName' is not a valid Deployment field; the closest concept, 'serviceName', belongs to StatefulSet's spec and is used for headless Service governance, not for exposing a Deployment. Option C is incorrect because 'kubectl run' creates a new Pod (or with newer versions a Pod), not a Deployment, and '--expose' would expose that newly created resource rather than an existing Deployment. Option D is incorrect because a Deployment's manifest has no 'service' section; Services are separate API objects (kind: Service) and cannot be embedded in a Deployment spec.

Answer

Edit the Deployment and set 'spec.serviceName'

Answer

Run 'kubectl run my-deployment --image=nginx --expose'

Answer

Add a 'service' section to the Deployment's YAML manifest

Question 15

Which THREE of the following are true about Kubernetes Namespaces?

Accepted Answer

NetworkPolicy can be used to control traffic between pods in different namespaces. Option B is correct because NetworkPolicy objects are namespaced and their podSelector rules can reference other namespaces via namespaceSelector, allowing administrators to permit or deny ingress/egress traffic between pods in different namespaces. Option D is correct because ResourceQuota is a namespaced object that caps aggregate resource consumption (e.g., requests.cpu, limits.memory, count/pods) within a single namespace. Option E is correct because namespaces provide logical isolation for namespaced resources such as Pods, Services, Deployments, and ConfigMaps, enabling separate environments or teams to coexist in one cluster. Option A is incorrect because PersistentVolumes are cluster-scoped resources, not namespaced (only PersistentVolumeClaims are namespaced). Option C is incorrect because Nodes are cluster-scoped resources, not namespaced.

Answer

PersistentVolumes are namespaced

Answer

Nodes are namespaced resources