KCNA Kubernetes Fundamentals Practice Test 27 — 15 Questions

Question 1

A developer has created a Deployment with 3 replicas. The application should be reachable from other Pods within the same cluster. Which Kubernetes resource should be used to provide a stable network endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service. A Service provides a stable network endpoint (ClusterIP) that load-balances traffic across the Pod replicas, abstracting away Pod IP changes due to restarts or scaling. This allows other Pods within the cluster to reach the application reliably using the Service's DNS name, without needing to track individual Pod IPs.

Answer

Ingress

Answer

PersistentVolumeClaim

Answer

ConfigMap

Question 2

You run 'kubectl get pods' and see a Pod in the 'Pending' state. Which of the following is a likely cause?

Accepted Answer

No node meets the requested CPU or memory resources. A Pod enters the 'Pending' state when it cannot be scheduled onto a node. The most common reason is that no node in the cluster has sufficient available CPU or memory resources to satisfy the Pod's resource requests. The Kubernetes scheduler continuously evaluates nodes against Pod resource requirements, and if none match, the Pod remains unscheduled in Pending.

Answer

The application crashed due to a bug

Answer

The container image is missing

Answer

The Pod has been deleted

Question 3

A Deployment is configured with 'replicas: 4' and 'strategy.type: RollingUpdate'. You update the container image. What behavior does the Deployment exhibit?

Accepted Answer

New Pods are created before old ones are terminated, one at a time. With a RollingUpdate strategy, the Deployment controller replaces old Pods with new ones incrementally to ensure zero downtime. By default, it creates new Pods before terminating old ones (maxSurge=25%, maxUnavailable=25%), so one new Pod is created first, then one old Pod is terminated, repeating until all 4 Pods run the new image.

Answer

The Deployment creates 8 Pods total, 4 old and 4 new

Answer

All 4 Pods are deleted immediately and then 4 new Pods are created

Answer

The update is paused until manually resumed

Question 4

You need to securely store a database password for use by a Pod. Which Kubernetes resource should you use?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the value in base64 and can be mounted as a volume or injected as an environment variable into a Pod. Unlike ConfigMaps, Secrets are designed for confidential information and support optional encryption at rest when enabled in the cluster. This ensures the password is not stored in plaintext in the Pod specification or version control.

Answer

PersistentVolumeClaim

Answer

ServiceAccount

Answer

ConfigMap

Question 5

Which two of the following are valid ways to expose a set of Pods to external traffic?

Accepted Answer

Create a Service of type NodePort. Option A (Create a Service of type NodePort) is correct because a NodePort Service allocates a port on every node's IP (default range 30000-32767) and forwards external traffic to the selected Pods, making it a valid way to expose Pods externally. Option D (Create a Service of type LoadBalancer) is correct because it provisions an external load balancer (via the cloud provider) that routes traffic to the Service's endpoints, thereby exposing the Pods to external clients. Option B is incorrect because a ConfigMap stores configuration data, not network routing, and cannot expose Pods. Option C is incorrect because an Ingress resource requires a backing Service (typically ClusterIP) to route traffic to Pods; without a Service, it has no endpoints to forward to. Option E is incorrect because a ClusterIP Service only exposes Pods on an internal cluster IP, reachable only from within the cluster, not from external traffic.

Answer

Use a ConfigMap to expose the Pods

Answer

Create an Ingress resource without a Service

Answer

Create a Service of type ClusterIP

Question 6

Which two of the following are valid ways to set resource constraints on a container in a Pod spec?

Accepted Answer

Specify 'resources.limits.memory' for maximum memory. Option B is correct because the Pod spec's container definition uses the 'resources.limits' field to declare the maximum amount of a resource the container may consume, so 'resources.limits.memory' sets a hard memory ceiling that the container cannot exceed. Option D is correct because 'resources.requests.cpu' declares the minimum CPU the container is guaranteed for scheduling purposes, and the kubelet uses this value when allocating CPU shares. The other options are invalid field names: 'resources.guarantees.cpu' (A), 'resources.min.memory' (C), and 'resources.max.cpu' (E) do not exist in the Kubernetes API, which only supports 'requests' and 'limits' under 'resources'.

Answer

Specify 'resources.guarantees.cpu' for CPU guarantees

Answer

Specify 'resources.min.memory' for minimum memory

Answer

Specify 'resources.max.cpu' for CPU limits

Question 7

Which three of the following are true about etcd in Kubernetes?

Accepted Answer

etcd stores all cluster state, including Pods, ConfigMaps, and Secrets. Option A is correct because etcd is the backing store for the Kubernetes API server, persisting the entire cluster state — every object such as Pods, ConfigMaps, Secrets, Deployments, and ServiceAccounts — as serialized data under keys like /registry/pods. Option C is correct because etcd is architecturally a distributed, strongly consistent key-value store built on the Raft consensus algorithm, which guarantees linearizable reads and writes across its cluster members. Option E is correct because etcd exposes a watch API that lets clients subscribe to a key or key range and receive streaming notifications whenever those keys change, which is exactly how the Kubernetes API server drives its informers and controllers. Option B is wrong because etcd is not relational: it has no tables, schemas, joins, or SQL, only a flat hierarchical keyspace. Option D is wrong because etcd is not a message queue; it offers no publish/subscribe topics, consumer groups, or delivery guarantees like RabbitMQ or Kafka, and using it as one is an anti-pattern.

Answer

etcd is a relational database

Answer

etcd can be used as a message queue

Question 8

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running reconciliation loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, each of which watches the current state of the cluster via the kube-apiserver and makes changes to drive the actual state toward the desired state defined in etcd. This reconciliation loop pattern is fundamental to Kubernetes' self-healing behavior, ensuring that resources like deployments, replica sets, and nodes match their specifications.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 9

Which kubectl command would you use to view detailed information about a specific pod, including events and container status?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` provides a comprehensive view of a pod's metadata, spec, status, conditions, container resource usage, and a chronological list of events (e.g., scheduling, pulling images, container restarts). This command aggregates information from the Kubernetes API server, including the pod's current state and lifecycle events, which is essential for debugging pod failures or unexpected behavior.

Answer

kubectl explain pod

Answer

kubectl get pod <pod-name>

Answer

kubectl logs pod <pod-name>

Question 10

You have a Deployment named 'web-app' that manages 3 replicas. You need to update the container image from version 1.0 to 2.0 with zero downtime. Which Kubernetes feature is designed to handle this automatically when you update the Deployment's pod template?

Accepted Answer

Rolling update strategy in the Deployment. A Deployment's default update strategy is 'RollingUpdate', which automatically replaces old Pods with new ones in a controlled manner, ensuring zero downtime by incrementally scaling down old replicas and scaling up new replicas. When you update the container image in the Deployment's pod template, Kubernetes triggers a rolling update that maintains the desired number of replicas throughout the process.

Answer

ReplicationController

Answer

DaemonSet

Answer

StatefulSet's onDelete strategy

Question 11

Which Kubernetes resource provides stable network endpoints for a set of pods, enabling service discovery and load balancing?

Accepted Answer

Service. A Service is the correct Kubernetes resource because it provides a stable virtual IP (ClusterIP) and DNS name that persists independently of pod lifecycles, enabling reliable service discovery and client-side load balancing across a set of pods selected by labels. This abstraction decouples clients from ephemeral pod IPs, ensuring traffic is routed to healthy pods via kube-proxy and iptables/IPVS rules.

Answer

NetworkPolicy

Answer

Ingress

Answer

EndpointSlice

Question 12

You want to deploy a stateless web application that should maintain 5 running instances at all times. You need to support rolling updates and rollbacks. Which Kubernetes resource is most appropriate?

Accepted Answer

Deployment. A Deployment is the correct choice because it is designed to manage stateless applications with a desired replica count (5 instances), supports rolling updates to update pods gradually without downtime, and enables rollbacks to a previous revision if an update fails. Deployments internally create ReplicaSets to manage pod scaling and versioning, making them ideal for stateless workloads requiring high availability and update flexibility.

Answer

DaemonSet

Answer

ReplicaSet

Answer

StatefulSet

Question 13

Which component runs on every worker node and is responsible for ensuring that containers are running in a pod as specified in the PodSpec?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node in a Kubernetes cluster. It is responsible for ensuring that containers described in a PodSpec are running and healthy, by interacting with the container runtime (e.g., containerd, CRI-O) to create, start, and monitor pods. The kubelet does not manage containers that were not created by Kubernetes.

Answer

container runtime

Answer

kube-proxy

Answer

kube-scheduler

Question 14

Which Kubernetes primitive is the smallest and simplest unit in the Kubernetes object model that you can create or deploy?

Accepted Answer

Pod. B is correct because a Pod is the smallest and simplest unit in the Kubernetes object model. It represents a single instance of a running process in a cluster and can contain one or more containers that share the same network namespace, storage volumes, and lifecycle. You create and deploy Pods directly, while higher-level controllers like ReplicaSets and Deployments manage Pods as their fundamental building block.

Answer

ReplicaSet

Answer

Deployment

Answer

Container

Question 15

You have a Kubernetes cluster with multiple namespaces. You need to allow communication only from pods with label 'app: frontend' to pods with label 'app: backend' in the same namespace. Which resource should you use?

Accepted Answer

NetworkPolicy. NetworkPolicy is a Kubernetes resource that controls ingress and egress traffic between pods based on labels, namespaces, or IP blocks. By defining a NetworkPolicy with a podSelector matching 'app: backend' and an ingress rule that allows traffic only from pods with label 'app: frontend', you can restrict communication to only those pods in the same namespace. This is the correct approach because NetworkPolicy operates at Layer 3/4 (and optionally Layer 7 with Cilium) to enforce network segmentation.

Answer

RBAC Role

Answer

PodSecurityPolicy

Answer

Service