KCNA Kubernetes Fundamentals Practice Test 22 — 15 Questions

Question 1

A developer wants to deploy a stateless web application that should maintain three running instances at all times. Which Kubernetes resource should they use?

Accepted Answer

Deployment. A Deployment is the correct resource because it manages a ReplicaSet to ensure a specified number of Pod replicas (in this case, three) are running at all times. It supports rolling updates and rollbacks, making it ideal for stateless web applications that require high availability and declarative scaling.

Answer

Job

Answer

StatefulSet

Answer

DaemonSet

Question 2

You need to inspect the logs of a container named 'app' in a pod called 'web-1'. Which kubectl command should you use?

Accepted Answer

kubectl logs web-1 -c app. The `kubectl logs` command uses the `-c` flag to specify a container within a multi-container pod. The pod name must be specified first, followed by the container flag. Option A uses the long form `--container`, which is also valid syntax, but this single-choice question expects the short flag `-c` as the standard answer. Option C incorrectly places the container name as the first argument (kubectl logs app web-1). Option D uses the `-p` flag, which is for viewing logs of a previous container instance, not for selecting a container by name.

Answer

kubectl logs web-1 --container app

Answer

kubectl logs app web-1

Answer

kubectl logs -p web-1 app

Question 3

Which Kubernetes resource provides a stable IP address and DNS name to access a set of pods?

Accepted Answer

Service. A Kubernetes Service provides a stable virtual IP address and a DNS name (e.g., my-svc.namespace.svc.cluster.local) that remains constant even as the underlying pods are created, destroyed, or scaled. This abstraction allows clients to reliably reach a set of pods without needing to track individual pod IPs, which are ephemeral. Services use label selectors to dynamically route traffic to matching pods, ensuring high availability and load balancing.

Answer

Ingress

Answer

EndpointSlice

Answer

NetworkPolicy

Question 4

A pod remains in 'Pending' state. Upon inspecting the pod with 'kubectl describe pod', you see the message '0/1 nodes are available: 1 node(s) had taint {node.kubernetes.io/disk-pressure: }, that the pod didn't tolerate'. What is the most likely cause?

Accepted Answer

The node has a disk pressure condition and the pod lacks a toleration. The message '0/1 nodes are available: 1 node(s) had taint {node.kubernetes.io/disk-pressure: }, that the pod didn't tolerate' indicates the node has a taint of 'disk-pressure' which prevents pod scheduling unless the pod has a matching toleration. Since the pod lacks this toleration, it remains in 'Pending' state. Option B correctly identifies the node's disk pressure condition and the missing toleration as the cause.

Answer

The pod is not using a ServiceAccount

Answer

The pod's resource requests exceed the node's capacity

Answer

The pod's container image does not exist

Question 5

A container in a pod has been restarted multiple times with 'CrashLoopBackOff' state. What does this indicate?

Accepted Answer

The container exits with a non-zero exit code soon after starting. The 'CrashLoopBackOff' state indicates that a container in a pod repeatedly starts, exits with a non-zero exit code, and is then restarted by the kubelet. This loop triggers an exponential backoff delay, preventing the container from staying up. The core issue is that the container process fails almost immediately after starting, not that it is resource-constrained or unresponsive.

Answer

The container is using too much memory

Answer

The container is running but not responding to health checks

Answer

The container image cannot be pulled

Question 6

In a YAML manifest for a Deployment, which field defines the number of pod replicas?

Accepted Answer

spec.replicas. In a Kubernetes Deployment manifest, the `spec.replicas` field is the correct place to define the desired number of pod replicas. This field is a top-level attribute under the Deployment's `spec` object, and the ReplicaSet controller uses this integer value to ensure the specified number of Pods are running at all times.

Answer

spec.strategy.replicas

Answer

metadata.replicas

Answer

spec.template.replicas

Question 7

A user runs 'kubectl get pods -n production' and sees no output. What is the most likely reason?

Accepted Answer

There are no pods in the 'production' namespace. `kubectl get pods -n production` returning no output typically indicates that there are no pods in the specified namespace. The command successfully connected to the API server, authenticated, and queried the namespace, but the result set is empty. This is a common scenario when a namespace exists but has no running or pending pods.

Answer

The kube-apiserver is down

Answer

The user does not have permissions to list pods

Answer

The namespace does not exist

Question 8

Which component runs on every worker node and is responsible for maintaining the lifecycle of pods?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node in a Kubernetes cluster. It is responsible for ensuring that containers are running in a Pod as expected, by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor Pods based on PodSpecs received from the API server. Without the kubelet, the node cannot manage Pod lifecycles.

Answer

container runtime

Answer

kube-scheduler

Answer

kube-proxy

Question 9

You have a ConfigMap named 'app-config' and a Secret named 'db-password'. You want to mount them into a pod. Which statement is correct?

Accepted Answer

Both ConfigMaps and Secrets can be mounted as volumes. Both ConfigMaps and Secrets are Kubernetes API objects designed to decouple configuration data from container images. They can be mounted as volumes into pods, allowing files to be created in the container's filesystem with the data from the ConfigMap or Secret. This is a core feature for managing configuration and sensitive data in Kubernetes.

Answer

Secrets can be mounted as volumes, but ConfigMaps cannot

Answer

ConfigMaps can be mounted as volumes, but Secrets cannot

Answer

ConfigMaps and Secrets can only be exposed as environment variables

Question 10

Which TWO of the following are Kubernetes control plane components?

Accepted Answer

kube-apiserver. kube-apiserver (A) is correct because it is the central control plane component that exposes the Kubernetes API, validating and processing all REST requests and serving as the front end of the control plane. etcd (C) is correct because it is the consistent, highly-available key-value store that persists all cluster state and is a core control plane component. The container runtime (B) is not a control plane component; it runs on each node as part of the kubelet's node-level machinery to execute containers. kube-proxy (D) is a node-level networking component that maintains network rules for Service traffic, not a control plane component. kubelet (E) is the node agent that manages pods on a worker node, so it is also not part of the control plane.

Answer

container runtime

Answer

kube-proxy

Answer

kubelet

Question 11

Which TWO of the following are true about Kubernetes Pods?

Accepted Answer

A pod is the smallest deployable unit in Kubernetes. Option B is correct because the Pod is the smallest deployable unit in Kubernetes — you cannot deploy a bare container directly; the kubelet schedules and runs Pods, and every workload object (Deployment, StatefulSet, Job, etc.) ultimately creates Pods. Option C is correct because containers within a single Pod share the same network namespace, meaning they share one IP address and can communicate over localhost, and they can also share volumes for data exchange. Option A is wrong because containers in a Pod can share volumes and, when configured, share process namespace; filesystem isolation is not guaranteed across all containers. Option D is wrong because Pods are ephemeral by design — they are terminated, deleted, or replaced (e.g., by a ReplicaSet) and are not intended to be long-lived. Option E is wrong because the Pod, not each container, is assigned a single IP address; all containers in the Pod share that one IP.

Answer

Containers in a pod always have isolated filesystems

Answer

Pods are designed to be long-lived and never terminated

Answer

Each container in a pod gets its own IP address

Question 12

What is the primary purpose of the Kubernetes control plane component 'kube-apiserver'?

Accepted Answer

Expose the Kubernetes REST API and act as the entry point for all administrative tasks. The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes REST API. It validates and processes all administrative requests (e.g., creating pods, scaling deployments) and is the only component that directly interacts with the etcd datastore. This makes it the central entry point for all cluster management tasks, aligning with option D. Other options are incorrect: A describes the kubelet, B describes the kube-scheduler, and C describes etcd.

Answer

Run container runtime operations on nodes

Answer

Schedule pods onto nodes

Answer

Store cluster state and configuration

Question 13

Which command is used to view detailed information about a specific pod, including events and conditions?

Accepted Answer

kubectl describe pod. The `kubectl describe pod` command retrieves detailed information about a specific pod, including its current state, metadata, labels, annotations, container details, resource limits, and a chronological list of events and conditions (e.g., PodScheduled, Initialized, Ready, ContainersReady). This makes it the correct tool for viewing comprehensive pod status and lifecycle events.

Answer

kubectl logs pod

Answer

kubectl exec pod

Answer

kubectl get pod

Question 14

A Deployment named 'myapp' is managing a ReplicaSet. You need to update the application image to version 2.0. What is the recommended approach?

Accepted Answer

Update the Deployment's pod template image to version 2.0. The recommended approach to update a Deployment's application image is to modify the pod template in the Deployment specification. The Deployment controller then automatically performs a rolling update, creating a new ReplicaSet with the updated image and gradually scaling down the old ReplicaSet, ensuring zero-downtime updates and maintaining desired replica count.

Answer

Scale down the Deployment to 0 replicas, then scale up with the new image

Answer

Delete the existing ReplicaSet and create a new one with the updated image

Answer

Directly update the pods in the ReplicaSet by using 'kubectl edit pod'

Question 15

You have a pod that needs to securely access a database password. Which Kubernetes resource should you use to store the password?

Accepted Answer

Secret. A Kubernetes Secret is specifically designed to store sensitive data, such as database passwords, in a base64-encoded format. Secrets can be mounted as volumes or exposed as environment variables in a pod, ensuring the password is not stored in plaintext in the pod specification or container image.

Answer

ServiceAccount

Answer

ConfigMap

Answer

PersistentVolume