KCNA Kubernetes Fundamentals Practice Test 26 — 15 Questions

Question 1

Which Kubernetes resource provides stable network endpoints for a set of pods, enabling service discovery and load balancing?

Accepted Answer

Service. A Service is the correct Kubernetes resource because it provides a stable virtual IP (ClusterIP) and DNS name that persists independently of pod lifecycles, enabling reliable service discovery and client-side load balancing across a set of pods selected by labels. This abstraction decouples clients from ephemeral pod IPs, ensuring traffic is routed to healthy pods via kube-proxy and iptables/IPVS rules.

Answer

NetworkPolicy

Answer

Ingress

Answer

EndpointSlice

Question 2

You want to deploy a stateless web application that should maintain 5 running instances at all times. You need to support rolling updates and rollbacks. Which Kubernetes resource is most appropriate?

Accepted Answer

Deployment. A Deployment is the correct choice because it is designed to manage stateless applications with a desired replica count (5 instances), supports rolling updates to update pods gradually without downtime, and enables rollbacks to a previous revision if an update fails. Deployments internally create ReplicaSets to manage pod scaling and versioning, making them ideal for stateless workloads requiring high availability and update flexibility.

Answer

DaemonSet

Answer

ReplicaSet

Answer

StatefulSet

Question 3

A user reports that their application's DNS resolution is failing for a Service named 'my-service' in the same namespace. They are able to reach the Service by its cluster IP. Which of the following is the most likely cause?

Accepted Answer

The CoreDNS pod is not running or misconfigured. DNS resolution for a Service in the same namespace relies on CoreDNS, which is the cluster DNS provider in Kubernetes. If CoreDNS is not running or misconfigured, DNS queries for the Service name (e.g., 'my-service') will fail, even though the Service is reachable via its cluster IP. The user's ability to reach the Service by IP confirms that kube-proxy and networking are functional, isolating the issue to DNS resolution.

Answer

The application container is using an incorrect DNS policy

Answer

The kube-proxy is misconfigured on the node

Answer

The Service is of type ExternalName

Question 4

Which component runs on every worker node and is responsible for ensuring that containers are running in a pod as specified in the PodSpec?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node in a Kubernetes cluster. It is responsible for ensuring that containers described in a PodSpec are running and healthy, by interacting with the container runtime (e.g., containerd, CRI-O) to create, start, and monitor pods. The kubelet does not manage containers that were not created by Kubernetes.

Answer

container runtime

Answer

kube-proxy

Answer

kube-scheduler

Question 5

You have a Kubernetes cluster with multiple namespaces. You need to allow communication only from pods with label 'app: frontend' to pods with label 'app: backend' in the same namespace. Which resource should you use?

Accepted Answer

NetworkPolicy. NetworkPolicy is a Kubernetes resource that controls ingress and egress traffic between pods based on labels, namespaces, or IP blocks. By defining a NetworkPolicy with a podSelector matching 'app: backend' and an ingress rule that allows traffic only from pods with label 'app: frontend', you can restrict communication to only those pods in the same namespace. This is the correct approach because NetworkPolicy operates at Layer 3/4 (and optionally Layer 7 with Cilium) to enforce network segmentation.

Answer

RBAC Role

Answer

PodSecurityPolicy

Answer

Service

Question 6

You run 'kubectl get pods' and see a pod in 'Pending' state for over 5 minutes. You describe the pod and see '0/1 nodes are available: 1 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's memory request is larger than any node's allocatable memory. The '0/1 nodes are available: 1 Insufficient memory' message indicates that the Kubernetes scheduler could not place the pod because no node has enough allocatable memory to satisfy the pod's memory request. Option B is correct because the pod's memory request exceeds the available memory on any node, causing the pod to remain in Pending state indefinitely until sufficient resources become available.

Answer

The container image is too large

Answer

The pod has a liveness probe that is failing

Answer

The kubelet on the node is not running

Question 7

You have a Deployment that uses a ConfigMap for configuration. You update the ConfigMap with new data. However, the pods in the Deployment continue to use the old configuration. What is the most likely reason?

Accepted Answer

The ConfigMap is mounted as a volume, and the pods have not been restarted. When a ConfigMap is mounted as a volume in a Pod, updates to the ConfigMap are automatically propagated to the mounted files, but the running process inside the container does not automatically reload the configuration. The Pod must be restarted (e.g., by rolling update or manual deletion) for the application to read the new values. This is the most common reason for stale configuration in a Deployment.

Answer

The ConfigMap data is immutable and cannot be updated

Answer

The ConfigMap is referenced by a different name in the pod spec

Answer

The Deployment's update strategy is set to Recreate

Question 8

Which TWO of the following are valid uses of Kubernetes Namespaces? (Select 2)

Accepted Answer

Enforcing network policies per namespace. Kubernetes NetworkPolicies are namespace-scoped resources that allow you to define ingress and egress traffic rules for pods within a specific namespace. By applying a NetworkPolicy to a namespace, you can isolate workloads from each other, controlling which pods can communicate based on labels and ports, which is a fundamental use of namespaces for security and segmentation.

Answer

Setting CPU and memory limits at the namespace level

Answer

Isolating node resources for different workloads

Answer

Enabling RBAC authentication for users in a namespace

Question 9

Which THREE of the following are valid reasons to use a StatefulSet instead of a Deployment? (Select 3)

Accepted Answer

You need stable, unique network identifiers (e.g., pod hostnames) that persist across reschedules. StatefulSets provide stable, unique network identifiers (e.g., pod hostnames) that persist across reschedules because each pod gets a fixed ordinal index (e.g., pod-0, pod-1) and a corresponding DNS name (e.g., pod-0.statefulset.namespace.svc.cluster.local). This is essential for applications like databases (e.g., Cassandra, ZooKeeper) that rely on consistent peer discovery and identity, which Deployments cannot guarantee since they assign random pod names and IPs.

Answer

You only need a single instance of the application

Answer

You need to deploy a stateless web application with multiple replicas

Question 10

Which Kubernetes component is responsible for maintaining the desired state of the cluster by running controllers?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller processes, which are control loops that watch the shared state of the cluster through the kube-apiserver and make changes to drive the current state toward the desired state. It bundles together controllers such as the Node Controller, Replication Controller, and Endpoint Controller, each responsible for specific aspects of cluster state management.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

etcd

Question 11

What is the primary purpose of a Kubernetes Service?

Accepted Answer

To expose a set of pods as a network service with a stable endpoint. A Kubernetes Service provides a stable network endpoint (IP address and DNS name) to access a set of pods, which are ephemeral and can be rescheduled with different IPs. It acts as an abstraction layer, enabling load-balanced traffic to the pods via kube-proxy and iptables/IPVS rules. This is the core purpose of a Service, as defined in the Kubernetes API.

Answer

To provide persistent storage for pods

Answer

To store configuration data for pods

Answer

To manage rolling updates of applications

Question 12

Which kubectl command would you use to view the detailed state of a pod named 'web-pod' in the 'default' namespace?

Accepted Answer

kubectl describe pod web-pod. `kubectl describe pod web-pod` retrieves a detailed, multi-section view of the pod's current state, including events, conditions, container statuses, and resource usage. This command is specifically designed for deep inspection of a Kubernetes resource, unlike `kubectl get` which shows a summary, or `kubectl logs` which shows container output.

Answer

kubectl logs web-pod

Answer

kubectl get pod web-pod

Answer

kubectl exec web-pod -- /bin/sh

Question 13

You have a Deployment named 'frontend' with 3 replicas. You want to perform a rolling update to a new container image. Which command should you use?

Accepted Answer

kubectl set image deployment/frontend container1=nginx:1.20. The `kubectl set image` command is the correct way to perform a rolling update on a Deployment. It directly updates the container image in the pod template, triggering a rolling update where the ReplicaSet gradually replaces old pods with new ones, ensuring zero downtime. Option A specifies the exact container name and new image, which matches the required syntax for a targeted update.

Answer

kubectl replace deployment frontend --image=nginx:1.20

Answer

kubectl edit deployment frontend --image=nginx:1.20

Answer

kubectl update deployment frontend --image=v2

Question 14

Which Kubernetes object is used to store non-confidential configuration data that can be consumed by pods?

Accepted Answer

ConfigMap. ConfigMap is the correct Kubernetes object for storing non-confidential configuration data, such as environment variables, command-line arguments, or configuration files, that can be consumed by pods. Unlike Secrets, ConfigMaps store data in plain text and are designed for configuration that does not require encryption, making them ideal for application settings that are not sensitive.

Answer

ServiceAccount

Answer

Secret

Answer

PersistentVolume

Question 15

You want to expose a set of pods running on node port 30080 to external traffic. Which Service type should you use?

Accepted Answer

NodePort. (NodePort) is correct because a NodePort service exposes the application on a static port (30080) on each node's IP address, making it accessible from outside the cluster via <NodeIP>:30080. This is the appropriate choice when you need to expose pods to external traffic using a specific port number without requiring a cloud load balancer.

Answer

ExternalName

Answer

LoadBalancer

Answer

ClusterIP