KCNA Kubernetes Fundamentals Practice Test 28 — 15 Questions

Question 1

You run 'kubectl get pods' and see a pod in 'Pending' state for over 5 minutes. You describe the pod and see '0/1 nodes are available: 1 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's memory request is larger than any node's allocatable memory. The '0/1 nodes are available: 1 Insufficient memory' message indicates that the Kubernetes scheduler could not place the pod because no node has enough allocatable memory to satisfy the pod's memory request. Option B is correct because the pod's memory request exceeds the available memory on any node, causing the pod to remain in Pending state indefinitely until sufficient resources become available.

Answer

The container image is too large

Answer

The pod has a liveness probe that is failing

Answer

The kubelet on the node is not running

Question 2

Which TWO of the following are valid uses of Kubernetes Namespaces? (Select 2)

Accepted Answer

Enforcing network policies per namespace. Option B is correct because Kubernetes NetworkPolicy objects are namespaced resources, so network policies are defined and applied per namespace to control ingress and egress traffic for the pods within that namespace. Option C is correct because namespaces provide logical partitioning of cluster resources, allowing teams to run dev, staging, and prod workloads in the same physical cluster with separate names, quotas, and access controls. Option A is not correct because CPU and memory limits are set on Pods/Containers (via resources.requests/limits) or enforced cluster-wide per namespace using ResourceQuota and LimitRange objects, not as a namespace-level setting itself. Option D is not correct because namespaces do not isolate node resources; node-level isolation is achieved through taints, tolerations, node affinity, or separate node pools. Option E is not correct because namespaces do not provide authentication; RBAC handles authorization, while authentication is performed by the API server via tokens, certificates, or external identity providers, with RoleBindings scoped to a namespace.

Answer

Setting CPU and memory limits at the namespace level

Answer

Isolating node resources for different workloads

Answer

Enabling RBAC authentication for users in a namespace

Question 3

Which TWO of the following are responsibilities of the kubelet? (Select 2)

Accepted Answer

Registering the node with the cluster and reporting node status. Option A is correct because the kubelet is the node agent that registers its node with the API server (via a Node object) and continuously reports node status, including conditions and capacity, through the node status heartbeat mechanism. Option B is correct because the kubelet watches for PodSpecs assigned to its node and ensures the described containers are started and running, performing liveness, readiness, and startup probes to maintain container health. Option C is incorrect because pod scheduling is the responsibility of the kube-scheduler, which selects nodes based on resource availability and constraints, not the kubelet. Option D is incorrect because Service iptables/IPVS rules are programmed by kube-proxy, not the kubelet. Option E is incorrect because cluster configuration data is stored in etcd, the cluster's key-value datastore, not managed by the kubelet.

Answer

Scheduling pods onto nodes based on resource availability

Answer

Creating and managing network iptables rules for Services

Answer

Storing cluster configuration data

Question 4

Which Kubernetes component is responsible for maintaining the desired state of the cluster by running controllers?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller processes, which are control loops that watch the shared state of the cluster through the kube-apiserver and make changes to drive the current state toward the desired state. It bundles together controllers such as the Node Controller, Replication Controller, and Endpoint Controller, each responsible for specific aspects of cluster state management.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

etcd

Question 5

Which kubectl command would you use to view the detailed state of a pod named 'web-pod' in the 'default' namespace?

Accepted Answer

kubectl describe pod web-pod. `kubectl describe pod web-pod` retrieves a detailed, multi-section view of the pod's current state, including events, conditions, container statuses, and resource usage. This command is specifically designed for deep inspection of a Kubernetes resource, unlike `kubectl get` which shows a summary, or `kubectl logs` which shows container output.

Answer

kubectl logs web-pod

Answer

kubectl get pod web-pod

Answer

kubectl exec web-pod -- /bin/sh

Question 6

Which Kubernetes object is used to store non-confidential configuration data that can be consumed by pods?

Accepted Answer

ConfigMap. ConfigMap is the correct Kubernetes object for storing non-confidential configuration data, such as environment variables, command-line arguments, or configuration files, that can be consumed by pods. Unlike Secrets, ConfigMaps store data in plain text and are designed for configuration that does not require encryption, making them ideal for application settings that are not sensitive.

Answer

ServiceAccount

Answer

Secret

Answer

PersistentVolume

Question 7

You want to expose a set of pods running on node port 30080 to external traffic. Which Service type should you use?

Accepted Answer

NodePort. (NodePort) is correct because a NodePort service exposes the application on a static port (30080) on each node's IP address, making it accessible from outside the cluster via <NodeIP>:30080. This is the appropriate choice when you need to expose pods to external traffic using a specific port number without requiring a cloud load balancer.

Answer

ExternalName

Answer

LoadBalancer

Answer

ClusterIP

Question 8

What is the purpose of a liveness probe in a Kubernetes pod?

Accepted Answer

To check if the application is still running; if not, restart the container. A liveness probe in Kubernetes is used to determine if a container is still running and healthy. If the probe fails, the kubelet kills the container and restarts it based on the pod's restart policy. This ensures that applications that have entered a deadlock or hung state are automatically recovered without manual intervention.

Answer

To check if the pod is scheduled on a node

Answer

To check if the container has started successfully

Answer

To check if the application is ready to serve traffic

Question 9

You create a Deployment with replicas: 3. You then scale the Deployment to 5 replicas. What is the order of operations that the Deployment controller follows?

Accepted Answer

It updates the existing ReplicaSet's replica count to 5, and the ReplicaSet creates the new pods. When you scale a Deployment, the Deployment controller updates the replica count on the existing ReplicaSet that matches the pod template. The ReplicaSet controller then observes the desired count and creates the additional pods to reach the new target. This ensures that the Deployment's rollout history and rollback capabilities remain intact.

Answer

It creates a new ReplicaSet with 5 replicas and deletes the old one

Answer

It directly creates 2 new pods without using a ReplicaSet

Answer

It creates 2 new pods immediately without modifying the existing ReplicaSet

Question 10

A developer wants to inject environment variables into a pod from a ConfigMap named 'app-config'. Which YAML snippet correctly mounts all key-value pairs from the ConfigMap as environment variables?

Accepted Answer

envFrom:
  - configMapRef:
      name: app-config. `envFrom` with a `configMapRef` injects all key-value pairs from the ConfigMap named 'app-config' as environment variables into the container. This is the standard Kubernetes method for bulk injection of ConfigMap data into environment variables, as opposed to selecting individual keys.

Answer

env:
  - name: CONFIG
    value: "$(CONFIGMAP)"

Answer

volumes:
  - name: config
    configMap:
      name: app-config
    volumeMounts:
      - name: config
        mountPath: /etc/config

Answer

env:
  - name: CONFIG
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: config.yaml

Question 11

You have a Deployment with the following rollout strategy: rollingUpdate: maxSurge: 1, maxUnavailable: 0. What behavior does this configuration enforce?

Accepted Answer

The rollout will create one additional pod before terminating the old pod, ensuring zero downtime. The rolling update strategy `maxSurge: 1, maxUnavailable: 0` ensures that during the rollout, one additional pod is created above the desired replica count before any existing pod is terminated. This guarantees that the total number of available pods never drops below the desired count, achieving zero downtime. The `maxUnavailable: 0` setting prevents any pod from being taken down until a new one is ready, while `maxSurge: 1` allows one extra pod to be created temporarily.

Answer

The rollout will terminate all old pods at once and then create new ones

Answer

The rollout will create all new pods first, then delete all old pods

Answer

The rollout will terminate one old pod before creating a new one

Question 12

A user reports that they cannot connect to a Service from within the cluster. The Service is of type ClusterIP. Running 'kubectl get endpoints service-name' shows no endpoints. What is the most likely cause?

Accepted Answer

The Service's pod selector does not match any running pods. A ClusterIP Service with no endpoints almost always means its label selector does not match any running pods. The endpoints controller populates the Endpoints object by matching the Service's selector against pod labels; if no pods match, the list is empty and traffic cannot be routed. This is the most common cause of the reported symptom.

Answer

The Service is not associated with a namespace

Answer

The Service is exposed on the wrong port

Answer

The kube-proxy is not running on the node

Question 13

Which TWO of the following are valid ways to assign a pod to a specific node?

Accepted Answer

nodeSelector. Option A (nodeSelector) is correct because it is a field in the pod spec that matches against node labels, causing the scheduler to place the pod only on nodes carrying the specified label key/value pairs. Option D (nodeName) is correct because setting spec.nodeName bypasses the scheduler entirely and directly binds the pod to the named node, which is a valid (if low-level) way to assign a pod to a specific node. Option B (affinity: nodeAntiAffinity) is incorrect because node anti-affinity repels pods from nodes matching certain labels rather than assigning a pod to a specific node. Option C (tolerations) is incorrect because tolerations only allow a pod to be scheduled onto nodes with matching taints; they do not target a specific node. Option E (podSelector) is incorrect because podSelector is used in resources like NetworkPolicy, PodDisruptionBudget, and topology spread constraints to select pods, not to assign a pod to a node.

Answer

affinity: nodeAntiAffinity

Answer

tolerations

Answer

podSelector

Question 14

Which THREE of the following are core components of a Kubernetes worker node?

Accepted Answer

container runtime. The three core components of a Kubernetes worker node are the container runtime (C), kube-proxy (D), and kubelet (E). The container runtime (C) is required because it is the software (e.g., containerd, CRI-O) that actually pulls images and runs containers on the node. kubelet (E) is the primary node agent that registers the node with the control plane and manages Pods and their containers via the CRI. kube-proxy (D) implements the Service networking rules on the node, maintaining iptables/IPVS rules so that Service VIPs and load balancing work for Pods. Options A (etcd) and B (kube-apiserver) are not worker node components; they are control plane components, with etcd being the cluster's key-value datastore and kube-apiserver being the API front end.

Answer

etcd

Answer

kube-apiserver

Question 15

Which command would you use to view the logs of a container named 'web' in a pod named 'frontend' running in the 'production' namespace?

Accepted Answer

kubectl logs frontend -c web -n production. The `kubectl logs` command requires the pod name as the first positional argument, and the `-c` flag specifies the container name when a pod has multiple containers. The `-n` flag sets the namespace. The correct syntax is `kubectl logs -c -n `, which matches option B exactly.

Answer

kubectl logs -c web frontend --namespace production

Answer

kubectl logs frontend -n production container web

Answer

kubectl logs frontend web --namespace production