KCNA Kubernetes Fundamentals Practice Test 27 — 15 Questions

Question 1

A user reports that they cannot connect to a Service from within the cluster. The Service is of type ClusterIP. Running 'kubectl get endpoints service-name' shows no endpoints. What is the most likely cause?

Accepted Answer

The Service's pod selector does not match any running pods. If endpoints are empty, the Service selector does not match any pods, or the pods are not ready.

Answer

The Service is not associated with a namespace

Answer

The Service is exposed on the wrong port

Answer

The kube-proxy is not running on the node

Question 2

Which TWO of the following are valid ways to assign a pod to a specific node?

Accepted Answer

nodeSelector. Option A is correct because `nodeSelector` is a simple, built-in field in the Pod spec that matches the pod to nodes with specific labels. When you add a `nodeSelector` with a key-value pair, the scheduler only places the pod on nodes that have that exact label. This is the most straightforward way to constrain a pod to a subset of nodes.

Answer

affinity: nodeAntiAffinity

Answer

tolerations

Answer

podSelector

Question 3

Which THREE of the following are core components of a Kubernetes worker node?

Accepted Answer

container runtime. Option C is correct because a container runtime is a core component of a Kubernetes worker node. It is responsible for actually running the containers (e.g., containerd, CRI-O) and is required by the kubelet to manage pod lifecycle. Without a container runtime, the kubelet cannot start or stop containers on the node.

Answer

etcd

Answer

kube-apiserver

Question 4

Which TWO of the following statements about Kubernetes namespaces are true?

Accepted Answer

Deleting a namespace will delete all objects in it. Namespaces provide logical isolation and can be used to separate environments, but not all objects are namespaced (e.g., nodes).

Answer

Services in different namespaces cannot communicate with each other

Answer

Every Kubernetes object must be created in a namespace

Question 5

What is the primary purpose of a Kubernetes Service?

Accepted Answer

To provide a stable endpoint for accessing a set of pods. A Kubernetes Service provides a stable, virtual IP address and DNS name that acts as a consistent endpoint for accessing a set of pods, regardless of pod IP changes due to scaling, restarts, or scheduling. It decouples frontend clients from backend pods by using label selectors to route traffic, ensuring high availability and load balancing across the pod group.

Answer

To manage container image versions

Answer

To store configuration data as key-value pairs

Answer

To schedule pods onto nodes

Question 6

Which command would you use to view the logs of a container named 'web' in a pod named 'frontend' running in the 'production' namespace?

Accepted Answer

kubectl logs frontend -c web -n production. Option B is correct because the `kubectl logs` command requires the pod name as the first positional argument, and the `-c` flag specifies the container name when a pod has multiple containers. The `-n` flag sets the namespace. The correct syntax is `kubectl logs -c -n `, which matches option B exactly.

Answer

kubectl logs -c web frontend --namespace production

Answer

kubectl logs frontend -n production container web

Answer

kubectl logs frontend web --namespace production

Question 7

A Deployment named 'nginx' is failing to update. You run 'kubectl rollout status deployment nginx' and see 'Waiting for deployment "nginx" rollout to finish: 0 out of 3 new replicas have been updated...'. The pod template has an image that does not exist. What is the most likely cause?

Accepted Answer

The new image tag is incorrect or does not exist in the registry. Option D is correct because the rollout status shows that no new replicas have been created, which is a classic symptom of a container image pull failure. When the image tag specified in the pod template does not exist in the registry, the kubelet cannot pull the image, so the ReplicaSet controller cannot start new pods. This prevents the rollout from progressing past 0 out of 3 new replicas.

Answer

The cluster is out of memory

Answer

The deployment has exceeded the revision history limit

Answer

The deployment is paused

Question 8

You have a multi-container pod with containers 'app' and 'sidecar'. You need to execute a shell command inside the 'sidecar' container. Which kubectl command should you use?

Accepted Answer

kubectl exec -it mypod -c sidecar -- /bin/sh. Option D is correct because `kubectl exec` uses the `-c` flag (or `--container`) to specify a target container within a multi-container pod. The syntax `kubectl exec -it mypod -c sidecar -- /bin/sh` opens an interactive shell in the 'sidecar' container of the pod named 'mypod'. Without the `-c` flag, the command defaults to the first container in the pod's spec, which would be 'app'.

Answer

kubectl exec -it mypod -- /bin/sh

Answer

kubectl exec -it sidecar --container mypod -- /bin/sh

Answer

kubectl exec -it mypod --container sidecar -- /bin/sh

Question 9

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster, such as ensuring the correct number of pods are running?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, including the Replication Controller, which is responsible for ensuring that the desired number of pod replicas are running at all times. It continuously watches the state of the cluster via the kube-apiserver and makes adjustments to reconcile the current state with the desired state defined in the cluster's configuration.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

etcd

Question 10

You create a Pod with the following YAML. What will happen when you apply it?

Accepted Answer

The Pod will be created with memory limit of 128Mi and CPU limit of 500m. Option B is correct because the YAML defines resource limits and requests using standard Kubernetes units: '128Mi' for memory (mebibytes) and '500m' for CPU (millicores). These are valid and will be applied to the container, creating the Pod with the specified limits.

Answer

The Pod will fail to create because memory and CPU are in the wrong unit

Answer

The Pod will be created without resource limits because the syntax is incorrect

Answer

The Pod will be created but requests and limits will be ignored because they are not valid for Pods

Question 11

A user reports that they cannot connect to a database service named 'db-service' from another pod in the same namespace. The service selector matches the database pod's labels. Which command would you run FIRST to troubleshoot the service's endpoints?

Accepted Answer

kubectl get endpoints db-service. Option B is correct because `kubectl get endpoints db-service` directly shows whether the service has any endpoints (i.e., pod IPs) associated with it. If the endpoints list is empty, it indicates that the service's label selector is not matching any pods, which is the most common cause of connectivity failure. This is the fastest way to verify the fundamental prerequisite for service-to-pod traffic.

Answer

kubectl describe pod db-service

Answer

kubectl exec -it <some-pod> -- curl db-service

Answer

kubectl logs db-service

Question 12

Which of the following is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. The Pod is the smallest deployable unit in Kubernetes because it represents a single instance of a running process in the cluster and encapsulates one or more containers that share the same network namespace, storage volumes, and lifecycle. Containers are not directly scheduled onto Nodes; instead, Kubernetes always schedules and manages Pods, making the Pod the atomic unit of deployment.

Answer

Container

Answer

Node

Answer

Deployment

Question 13

A pod is stuck in 'Pending' state. Which of the following is a likely cause?

Accepted Answer

Insufficient CPU or memory resources on any available node. Pending means the scheduler cannot place the pod. Insufficient resources on nodes is a common cause. Option D is correct.

Answer

The pod's command returned a non-zero exit code

Answer

The container image is invalid

Answer

The pod's liveness probe failed

Question 14

Which of the following kubectl commands would you use to update a Deployment's image to 'nginx:1.21' and record the change in the rollout history?

Accepted Answer

kubectl set image deployment/nginx nginx=nginx:1.21 --record. Option C is correct because `kubectl set image deployment/nginx nginx=nginx:1.21 --record` updates the container image of the specified deployment and, with the `--record` flag, annotates the change in the rollout history (stored in the `kubernetes.io/change-cause` annotation). This allows you to later inspect the change with `kubectl rollout history deployment/nginx`.

Answer

kubectl edit deployment nginx --image=nginx:1.21

Answer

kubectl set image deployment/nginx nginx=nginx:1.21

Answer

kubectl patch deployment nginx -p '{"spec":{"template":{"spec":{"containers":[{"name":"nginx","image":"nginx:1.21"}]}}}}' --record

Question 15

What is the purpose of kube-proxy on a worker node?

Accepted Answer

To implement network rules and handle service traffic routing. Option C is correct because kube-proxy is the component responsible for implementing network rules on each worker node, enabling service abstraction by managing IP tables or IPVS rules to route traffic to the appropriate pods. It handles service discovery and load balancing for ClusterIP, NodePort, and LoadBalancer service types, ensuring that traffic destined for a service is correctly forwarded to healthy pod endpoints.

Answer

To run the container runtime

Answer

To store cluster configuration data

Answer

To monitor pod health and restart unhealthy containers