KCNA Kubernetes Fundamentals Practice Test 24 — 15 Questions

Question 1

You have a Pod that is running but not receiving traffic. You suspect the associated Service's selector does not match the Pod labels. Which kubectl command would you use to check the Service's selector?

Accepted Answer

kubectl describe service . Option B is correct because `kubectl describe service ` displays the service's selector field under the 'Selector' section, allowing you to directly compare it with the Pod's labels. This is the most straightforward way to verify if the selector matches the Pod labels, which is essential for traffic routing.

Answer

kubectl get endpoints <service-name>

Answer

kubectl get service <service-name> -o yaml

Answer

kubectl logs <pod-name>

Question 2

Which TWO statements correctly describe the purpose of etcd in a Kubernetes cluster?

Accepted Answer

It stores the cluster state, including all Kubernetes objects.. Option A is correct because etcd is the primary data store for all Kubernetes cluster state, including the configuration and status of every Kubernetes object (Pods, Services, Deployments, etc.). It stores this information as key-value pairs, and the Kubernetes API server is the only component that reads from and writes to etcd directly. Without etcd, the cluster would have no persistent record of its desired or current state.

Answer

It manages network rules for Pod-to-Pod communication.

Answer

It schedules Pods onto nodes based on resource availability.

Answer

It exposes the Kubernetes API for external access.

Question 3

Which TWO are valid reasons to use a Namespace in Kubernetes?

Accepted Answer

To enforce network policies that restrict traffic between Pods in different Namespaces.. Option A is correct because Kubernetes NetworkPolicies are namespace-scoped resources that can restrict ingress and egress traffic between Pods in different Namespaces. By default, all Pods can communicate across Namespaces, but applying a NetworkPolicy with a podSelector and namespaceSelector allows you to enforce isolation. Option C is correct because Namespaces provide a logical boundary for resource names, preventing naming collisions when multiple teams or projects deploy objects with the same name within the same cluster.

Answer

To reduce the number of API calls to the control plane.

Answer

To improve application performance by reducing latency.

Answer

To store environment variables for containers.

Question 4

Which THREE actions can be performed using kubectl without installing additional plugins?

Accepted Answer

Run 'kubectl edit deployment' to modify a Deployment in-place.. Option B is correct because 'kubectl edit deployment' is a built-in kubectl command that opens the Deployment's manifest in the default editor, allowing in-place modifications without any additional plugins. It directly interacts with the Kubernetes API to update the resource.

Answer

Run 'kubectl debug' to create a debugging Pod.

Answer

Run 'kubectl auth reconcile' to reconcile RBAC permissions.

Question 5

Which Kubernetes control plane component acts as the entry point for all administrative tasks and provides the REST API?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes REST API. All administrative tasks, such as creating pods, scaling deployments, and querying cluster state, are performed by sending HTTP requests to this component. It validates and processes these requests before storing the resulting state in etcd.

Answer

kube-scheduler

Answer

etcd

Answer

kube-controller-manager

Question 6

What is the smallest deployable unit in Kubernetes that you can create and manage?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model that you can create and deploy. It represents a single instance of a running process in your cluster and encapsulates one or more containers with shared storage and network resources. While containers are the actual runtime environments, Kubernetes does not manage containers directly; it manages Pods, which are the atomic unit of scheduling and lifecycle management.

Answer

Service

Answer

Container

Answer

Deployment

Question 7

Which of the following is NOT a responsibility of the kubelet on a worker node?

Accepted Answer

Assign Pods to nodes based on resource requirements. The kubelet does not perform scheduling; scheduling is done by the kube-scheduler.

Answer

Ensure containers are running as defined in the PodSpec

Answer

Report node and pod status to the API server

Answer

Execute liveness and readiness probes

Question 8

A developer has created a Deployment with 3 replicas. The application should be reachable from other Pods within the same cluster. Which Kubernetes resource should be used to provide a stable network endpoint?

Accepted Answer

Service. A Service provides a stable network endpoint (ClusterIP) that load-balances traffic across the Pod replicas, abstracting away Pod IP changes due to restarts or scaling. This allows other Pods within the cluster to reach the application reliably using the Service's DNS name, without needing to track individual Pod IPs.

Answer

Ingress

Answer

PersistentVolumeClaim

Answer

ConfigMap

Question 9

You run 'kubectl get pods' and see a Pod in the 'Pending' state. Which of the following is a likely cause?

Accepted Answer

No node meets the requested CPU or memory resources. Pending often indicates that the scheduler cannot find a node that meets the Pod's resource requests or other constraints.

Answer

The application crashed due to a bug

Answer

The container image is missing

Answer

The Pod has been deleted

Question 10

Which kubectl command would you use to view the logs of a container named 'web' inside a Pod named 'app-12345'?

Accepted Answer

kubectl logs app-12345 -c web. Option A is correct because `kubectl logs app-12345 -c web` explicitly specifies the container name 'web' within the Pod 'app-12345' using the `-c` flag. This is the standard syntax for viewing logs of a specific container in a multi-container Pod, as the `kubectl logs` command defaults to the first container if `-c` is omitted.

Answer

kubectl logs -p web app-12345

Answer

kubectl logs app-12345 --container=web

Answer

kubectl logs web app-12345

Question 11

A Deployment is configured with 'replicas: 4' and 'strategy.type: RollingUpdate'. You update the container image. What behavior does the Deployment exhibit?

Accepted Answer

New Pods are created before old ones are terminated, one at a time. With a RollingUpdate strategy, the Deployment controller replaces old Pods with new ones incrementally to ensure zero downtime. By default, it creates new Pods before terminating old ones (maxSurge=25%, maxUnavailable=25%), so one new Pod is created first, then one old Pod is terminated, repeating until all 4 Pods run the new image.

Answer

The Deployment creates 8 Pods total, 4 old and 4 new

Answer

All 4 Pods are deleted immediately and then 4 new Pods are created

Answer

The update is paused until manually resumed

Question 12

You need to securely store a database password for use by a Pod. Which Kubernetes resource should you use?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the value in base64 and can be mounted as a volume or injected as an environment variable into a Pod. Unlike ConfigMaps, Secrets are designed for confidential information and support optional encryption at rest when enabled in the cluster. This ensures the password is not stored in plaintext in the Pod specification or version control.

Answer

PersistentVolumeClaim

Answer

ServiceAccount

Answer

ConfigMap

Question 13

Which of the following is true about Kubernetes Namespaces?

Accepted Answer

Namespaces allow you to divide cluster resources between multiple users. Namespaces provide a logical separation of resources within a cluster, allowing multiple teams or projects to coexist.

Answer

Objects in different namespaces cannot communicate with each other

Answer

Namespaces are global across all clusters

Answer

Namespaces provide network isolation by default

Question 14

A production issue arises: a Deployment with 10 replicas is updated, but the new Pods are failing health checks and being terminated. The old Pods are also being terminated. What is the most likely cause?

Accepted Answer

maxSurge and maxUnavailable are set to values that allow termination of old Pods before new ones are ready. If minReadySeconds or maxSurge/maxUnavailable are set incorrectly, the rollout can progress despite failures. The most common cause is that the Deployment's 'progressDeadlineSeconds' may be exceeded, but the question implies both old and new are being terminated. The correct answer is that maxSurge and maxUnavailable are misconfigured, causing the rollout to continue even when new Pods are unhealthy.

Answer

The Deployment's 'paused' field is set to true

Answer

The Deployment's 'revisionHistoryLimit' is set to 1

Answer

The RollingUpdate strategy has maxSurge=0 and maxUnavailable=0

Question 15

You apply the following YAML:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-deploy
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: nginx
        image: nginx:1.21

But the Deployment never creates any Pods. Which field is missing or incorrect?

Accepted Answer

The field 'spec.selector' is missing, which is required for Deployment. The Deployment YAML is syntactically correct and valid, but it will never create Pods because the `spec.selector` field is missing. In Kubernetes, a Deployment requires a `spec.selector` to identify which Pods it manages; without it, the Deployment controller cannot match the Pod template to a ReplicaSet, so no Pods are created. The provided YAML has `selector` under `spec`, but it is not the required `spec.selector` — the field is present but incorrectly placed or missing entirely in the context of the Deployment spec.

Answer

The 'replicas' field is set to 0

Answer

The 'containers' field is misspelled as 'container'

Answer

The 'apiVersion' should be 'v1'