KCNA Kubernetes Fundamentals Practice Test 25 — 15 Questions

Question 1

What is the smallest deployable unit in Kubernetes that you can create and manage?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model that you can create and deploy. It represents a single instance of a running process in your cluster and encapsulates one or more containers with shared storage and network resources. While containers are the actual runtime environments, Kubernetes does not manage containers directly; it manages Pods, which are the atomic unit of scheduling and lifecycle management.

Answer

Service

Answer

Container

Answer

Deployment

Question 2

A developer has created a Deployment with 3 replicas. The application should be reachable from other Pods within the same cluster. Which Kubernetes resource should be used to provide a stable network endpoint?

Accepted Answer

Service. A Service provides a stable network endpoint (ClusterIP) that load-balances traffic across the Pod replicas, abstracting away Pod IP changes due to restarts or scaling. This allows other Pods within the cluster to reach the application reliably using the Service's DNS name, without needing to track individual Pod IPs.

Answer

Ingress

Answer

PersistentVolumeClaim

Answer

ConfigMap

Question 3

You run 'kubectl get pods' and see a Pod in the 'Pending' state. Which of the following is a likely cause?

Accepted Answer

No node meets the requested CPU or memory resources. A Pod enters the 'Pending' state when it cannot be scheduled onto a node. The most common reason is that no node in the cluster has sufficient available CPU or memory resources to satisfy the Pod's resource requests. The Kubernetes scheduler continuously evaluates nodes against Pod resource requirements, and if none match, the Pod remains unscheduled in Pending.

Answer

The application crashed due to a bug

Answer

The container image is missing

Answer

The Pod has been deleted

Question 4

A Deployment is configured with 'replicas: 4' and 'strategy.type: RollingUpdate'. You update the container image. What behavior does the Deployment exhibit?

Accepted Answer

New Pods are created before old ones are terminated, one at a time. With a RollingUpdate strategy, the Deployment controller replaces old Pods with new ones incrementally to ensure zero downtime. By default, it creates new Pods before terminating old ones (maxSurge=25%, maxUnavailable=25%), so one new Pod is created first, then one old Pod is terminated, repeating until all 4 Pods run the new image.

Answer

The Deployment creates 8 Pods total, 4 old and 4 new

Answer

All 4 Pods are deleted immediately and then 4 new Pods are created

Answer

The update is paused until manually resumed

Question 5

You need to securely store a database password for use by a Pod. Which Kubernetes resource should you use?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the value in base64 and can be mounted as a volume or injected as an environment variable into a Pod. Unlike ConfigMaps, Secrets are designed for confidential information and support optional encryption at rest when enabled in the cluster. This ensures the password is not stored in plaintext in the Pod specification or version control.

Answer

PersistentVolumeClaim

Answer

ServiceAccount

Answer

ConfigMap

Question 6

Which of the following is true about Kubernetes Namespaces?

Accepted Answer

Namespaces allow you to divide cluster resources between multiple users. Kubernetes Namespaces provide a mechanism for partitioning a single cluster into multiple virtual clusters, enabling resource quota management and access control for different users or teams. This allows administrators to divide cluster resources (e.g., CPU, memory, storage) among multiple users via ResourceQuotas and Role-Based Access Control (RBAC), ensuring isolation of resource usage without requiring separate physical clusters.

Answer

Objects in different namespaces cannot communicate with each other

Answer

Namespaces are global across all clusters

Answer

Namespaces provide network isolation by default

Question 7

A production issue arises: a Deployment with 10 replicas is updated, but the new Pods are failing health checks and being terminated. The old Pods are also being terminated. What is the most likely cause?

Accepted Answer

maxSurge and maxUnavailable are set to values that allow termination of old Pods before new ones are ready. When maxSurge and maxUnavailable are set to values that allow termination of old Pods before new ones are ready, the RollingUpdate strategy can scale down old ReplicaSets even if the new Pods are failing health checks. This happens because maxUnavailable defines the maximum number of Pods that can be unavailable during the update, and if set to a value like 1 (or a percentage), the controller will terminate old Pods to meet that threshold, even if the new Pods are not yet healthy. The result is a cascading failure where both old and new Pods are terminated, leading to a service disruption.

Answer

The Deployment's 'paused' field is set to true

Answer

The Deployment's 'revisionHistoryLimit' is set to 1

Answer

The RollingUpdate strategy has maxSurge=0 and maxUnavailable=0

Question 8

You have a Service of type ClusterIP named 'my-svc' in the 'default' namespace. A Pod in the same cluster wants to reach this Service using DNS. What is the fully qualified domain name (FQDN) that resolves to the Service's cluster IP?

Accepted Answer

my-svc.default.svc.cluster.local. The standard DNS naming convention for a Kubernetes Service is `..svc.cluster.local`. This FQDN resolves to the ClusterIP of the Service, allowing Pods to discover and communicate with the Service using DNS. The `svc` subdomain is a fixed part of the cluster domain, and `cluster.local` is the default cluster domain suffix.

Answer

my-svc.default.cluster.local

Answer

default.my-svc.svc.cluster.local

Answer

my-svc.svc.default.cluster.local

Question 9

Which two of the following are valid ways to expose a set of Pods to external traffic?

Accepted Answer

Create a Service of type NodePort. A Service of type NodePort exposes each Pod's port on a static port (the NodePort) on every node's IP address, allowing external traffic to reach the Pods via :. This is a valid method for exposing a set of Pods to external traffic without requiring a cloud load balancer.

Answer

Use a ConfigMap to expose the Pods

Answer

Create an Ingress resource without a Service

Answer

Create a Service of type ClusterIP

Question 10

Which two of the following are valid ways to set resource constraints on a container in a Pod spec?

Accepted Answer

Specify 'resources.limits.memory' for maximum memory. 'resources.limits.memory' is the valid Kubernetes field to set the maximum amount of memory a container can use. When a container exceeds this limit, it may be terminated or OOM-killed by the kubelet. This is a core concept in Kubernetes resource management for ensuring predictable application behavior.

Answer

Specify 'resources.guarantees.cpu' for CPU guarantees

Answer

Specify 'resources.min.memory' for minimum memory

Answer

Specify 'resources.max.cpu' for CPU limits

Question 11

Which three of the following are true about etcd in Kubernetes?

Accepted Answer

etcd stores all cluster state, including Pods, ConfigMaps, and Secrets. Etcd is the primary datastore for Kubernetes, storing all cluster state including objects like Pods, ConfigMaps, and Secrets. This ensures that the Kubernetes API server has a consistent, authoritative source of truth for the entire cluster.

Answer

etcd is a relational database

Answer

etcd can be used as a message queue

Question 12

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running reconciliation loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, each of which watches the current state of the cluster via the kube-apiserver and makes changes to drive the actual state toward the desired state defined in etcd. This reconciliation loop pattern is fundamental to Kubernetes' self-healing behavior, ensuring that resources like deployments, replica sets, and nodes match their specifications.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 13

Which kubectl command would you use to view detailed information about a specific pod, including events and container status?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` provides a comprehensive view of a pod's metadata, spec, status, conditions, container resource usage, and a chronological list of events (e.g., scheduling, pulling images, container restarts). This command aggregates information from the Kubernetes API server, including the pod's current state and lifecycle events, which is essential for debugging pod failures or unexpected behavior.

Answer

kubectl explain pod

Answer

kubectl get pod <pod-name>

Answer

kubectl logs pod <pod-name>

Question 14

You have a Deployment named 'web-app' that manages 3 replicas. You need to update the container image from version 1.0 to 2.0 with zero downtime. Which Kubernetes feature is designed to handle this automatically when you update the Deployment's pod template?

Accepted Answer

Rolling update strategy in the Deployment. A Deployment's default update strategy is 'RollingUpdate', which automatically replaces old Pods with new ones in a controlled manner, ensuring zero downtime by incrementally scaling down old replicas and scaling up new replicas. When you update the container image in the Deployment's pod template, Kubernetes triggers a rolling update that maintains the desired number of replicas throughout the process.

Answer

ReplicationController

Answer

DaemonSet

Answer

StatefulSet's onDelete strategy

Question 15

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' status indicates the pod's container was terminated by the Linux kernel Out-of-Memory (OOM) killer because it exceeded its configured memory limit. Since the pod ran successfully for days, this suggests a gradual memory leak or increased workload demand. Increasing the memory limit in the pod's container resource specification allows the container to use more memory before being killed, directly addressing the root cause.

Answer

Increase the CPU request for the container

Answer

Delete the namespace and redeploy all workloads

Answer

Delete and recreate the pod to clear the crash loop