KCNA Kubernetes Fundamentals Practice Test 29 — 15 Questions

Question 1

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster, such as ensuring the correct number of pods are running?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller processes, including the Replication Controller, which is responsible for ensuring that the desired number of pod replicas are running at all times. It continuously watches the state of the cluster via the kube-apiserver and makes adjustments to reconcile the current state with the desired state defined in the cluster's configuration.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

etcd

Question 2

A user reports that they cannot connect to a database service named 'db-service' from another pod in the same namespace. The service selector matches the database pod's labels. Which command would you run FIRST to troubleshoot the service's endpoints?

Accepted Answer

kubectl get endpoints db-service. `kubectl get endpoints db-service` directly shows whether the service has any endpoints (i.e., pod IPs) associated with it. If the endpoints list is empty, it indicates that the service's label selector is not matching any pods, which is the most common cause of connectivity failure. This is the fastest way to verify the fundamental prerequisite for service-to-pod traffic.

Answer

kubectl describe pod db-service

Answer

kubectl exec -it <some-pod> -- curl db-service

Answer

kubectl logs db-service

Question 3

A pod is stuck in 'Pending' state. Which of the following is a likely cause?

Accepted Answer

Insufficient CPU or memory resources on any available node. A pod remains in 'Pending' state when the scheduler cannot find a suitable node to run it. The most common reason is insufficient CPU or memory resources on any available node, as the scheduler checks resource requests against node allocatable resources before binding the pod. If no node meets the pod's resource requirements, the pod stays pending until resources become available.

Answer

The pod's command returned a non-zero exit code

Answer

The container image is invalid

Answer

The pod's liveness probe failed

Question 4

What is the purpose of kube-proxy on a worker node?

Accepted Answer

To implement network rules and handle service traffic routing. Kube-proxy is the component responsible for implementing network rules on each worker node, enabling service abstraction by managing IP tables or IPVS rules to route traffic to the appropriate pods. It handles service discovery and load balancing for ClusterIP, NodePort, and LoadBalancer service types, ensuring that traffic destined for a service is correctly forwarded to healthy pod endpoints.

Answer

To run the container runtime

Answer

To store cluster configuration data

Answer

To monitor pod health and restart unhealthy containers

Question 5

Which of the following is used to logically isolate resources within a Kubernetes cluster?

Accepted Answer

Namespaces. Namespaces provide logical isolation for resources. Option C is correct.

Answer

Annotations

Answer

Selectors

Answer

Labels

Question 6

Which two of the following are responsibilities of the kubelet? (Select TWO.)

Accepted Answer

Reporting the node's status to the control plane. Option A is correct because the kubelet runs on each node and periodically reports node status (including conditions, capacity, and allocatable resources) to the control plane via the API server, typically through NodeStatus updates. Option E is correct because the kubelet acts as the node agent that watches PodSpecs assigned to its node and ensures the specified containers are running and healthy, restarting them as needed via the container runtime. Option B is incorrect because implementing network rules for services is the job of kube-proxy (using iptables/IPVS), not the kubelet. Option C is incorrect because assigning pods to nodes is performed by the kube-scheduler, which selects a node based on resource availability and constraints. Option D is incorrect because storing cluster state in a key-value store is the role of etcd, the cluster's backing datastore.

Answer

Implementing network rules for services

Answer

Assigning pods to nodes based on resource availability

Answer

Storing cluster state in a key-value store

Question 7

Which three of the following are valid ways to expose a service externally in Kubernetes? (Select THREE.)

Accepted Answer

Ingress. Ingress (A) is correct because it exposes HTTP/HTTPS services externally by routing traffic through an Ingress controller to internal ClusterIP services based on host/path rules. NodePort (C) is correct because it opens a static port (default range 30000–32767) on every node's IP, forwarding external traffic to the target service. LoadBalancer (D) is correct because it provisions an external load balancer (e.g., via a cloud provider) that distributes traffic to the service, typically building on NodePort and ClusterIP. ExternalName (B) is not a way to expose a service externally; it merely creates a CNAME DNS alias to an external hostname without proxying traffic. ClusterIP (E) is incorrect because it only provides an internal virtual IP reachable within the cluster, not from outside.

Answer

ExternalName

Answer

ClusterIP

Question 8

Which THREE of the following are valid ways to create a Kubernetes resource using kubectl?

Accepted Answer

kubectl run nginx --image=nginx. Option B (kubectl run nginx --image=nginx) is correct because kubectl run creates a new resource (historically a Pod, and in newer versions a Pod via the run command) directly from the command line using the specified container image. Option D (kubectl create -f pod.yaml) is correct because kubectl create is an imperative command that builds a resource from a manifest file, here a Pod defined in pod.yaml. Option E (kubectl apply -f deployment.yaml) is correct because kubectl apply declaratively creates or updates the resource defined in deployment.yaml, making it a valid way to create a Kubernetes resource. Option A (kubectl exec -it pod-name -- /bin/bash) is incorrect because exec opens an interactive shell inside an existing container and does not create any resource. Option C (kubectl logs pod-name) is incorrect because logs only retrieves container log output from an existing Pod and has no resource-creation capability.

Answer

kubectl exec -it pod-name -- /bin/bash

Answer

kubectl logs pod-name

Question 9

A pod is stuck in Pending state. Which THREE of the following are possible causes?

Accepted Answer

The pod specifies a nodeSelector that does not match any node. Option A is correct because the scheduler filters nodes using the pod's nodeSelector (and node affinity); if no node carries matching labels, the pod cannot be placed and remains Pending. Option C is correct because the scheduler only assigns a pod to a node whose allocatable resources can satisfy the pod's resource requests; insufficient CPU/memory leaves the pod unschedulable in Pending. Option E is correct because a pod referencing an unbound PersistentVolumeClaim cannot be scheduled until the PVC is bound to a PersistentVolume, so it stays Pending. Option B is not a scheduling cause: a nonexistent image leads to ImagePullBackOff/ErrImagePull after the pod has been scheduled to a node, so the pod is not Pending. Option D is also not a scheduling cause: a failing liveness probe only occurs after the container is running, causing restarts (CrashLoopBackOff), not a Pending phase.

Answer

The container image does not exist

Answer

The pod has a liveness probe that is failing

Question 10

Which TWO resources can be used to store configuration data separately from container images?

Accepted Answer

Secret. ConfigMap (E) is correct because it is the Kubernetes API object designed to hold non-confidential configuration data as key-value pairs, which pods can consume via environment variables, command-line arguments, or mounted volumes, keeping that data out of the container image. Secret (C) is correct because it serves the analogous purpose for sensitive configuration data such as passwords, tokens, and certificates, storing them base64-encoded and injecting them into pods separately from the image. Both objects decouple configuration from the image, so the same image can be reused across environments with different settings. Service (A) is incorrect because it provides stable network access and load balancing to a set of pods, not configuration storage. PersistentVolume (B) is incorrect because it supplies durable block or file storage for application data, not configuration key-value data. Deployment (D) is incorrect because it manages the desired state and rollout of replicated pods, not configuration content.

Answer

Service

Answer

PersistentVolume

Answer

Deployment

Question 11

Which TWO components run on every worker node in a Kubernetes cluster?

Accepted Answer

kubelet. kubelet (B) is correct because it is the primary node agent that runs on every worker node, registering the node with the API server and managing pod lifecycles by ensuring containers described in PodSpecs are running and healthy. kube-proxy (D) is also correct because it runs on every worker node to maintain network rules (via iptables, IPVS, or nftables) that implement Kubernetes Service abstraction and enable pod-to-pod and external communication. In contrast, kube-scheduler (A), etcd (C), and kube-apiserver (E) are control plane components that typically run on master/control-plane nodes, not on every worker node, so they do not belong in this answer.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 12

An administrator wants to perform a rolling update of a Deployment. Which TWO actions will achieve this?

Accepted Answer

Run 'kubectl set image deployment/myapp myapp=myapp:v2'. Option A is correct because 'kubectl set image deployment/myapp myapp=myapp:v2' updates the container image in the Deployment's Pod template, which triggers the Deployment controller to perform a rolling update by creating a new ReplicaSet and gradually replacing old Pods while maintaining availability. Option E is also correct because editing the Deployment YAML to change the image version and running 'kubectl apply -f deployment.yaml' updates the Pod template spec, causing the same rolling update behavior managed by the Deployment controller. Option B is incorrect because scaling to zero replicas causes downtime and does not perform a rolling update; scaling back up simply creates new Pods without the controlled surge/unavailable semantics of a rollout. Option C is incorrect because deleting and recreating the Deployment destroys the existing rollout history and causes an outage rather than a rolling update. Option D is incorrect because 'kubectl rollout undo' reverts to a previous revision, which is a rollback, not a rolling update to a new image version.

Answer

Run 'kubectl scale deployment myapp --replicas=0' then 'kubectl scale deployment myapp --replicas=5'

Answer

Run 'kubectl delete deployment' and then 'kubectl create deployment' with the new image

Answer

Run 'kubectl rollout undo deployment/myapp'

Question 13

Which THREE statements about Labels and Selectors are correct?

Accepted Answer

Services use selectors to determine which Pods receive traffic. Option A is correct because a Service's spec.selector matches Pod labels, and the kube-proxy/EndpointSlice machinery routes traffic only to Pods whose labels satisfy that selector. Option B is correct because a Deployment (and ReplicaSet) uses spec.selector.matchLabels/matchExpressions to determine which Pods it owns and manages, ensuring it only adopts Pods matching those labels. Option C is correct because labels are arbitrary key/value metadata designed for organizing objects and for grouping/selecting subsets via label selectors (equality- and set-based). Option D is incorrect because label keys must be unique per object, but labels are not required to be unique across a namespace—many objects can share the same labels. Option E is incorrect because annotations are non-identifying metadata and cannot be used with selectors for selection; only labels are queryable by selectors.

Answer

Labels must be unique within a namespace

Answer

Annotations are used for identification and selection

Question 14

Which TWO of the following are characteristics of a Namespace in Kubernetes?

Accepted Answer

Resource names must be unique within a namespace, but can be reused across namespaces. Option D is correct because a Kubernetes Namespace partitions a single physical cluster into multiple virtual clusters, letting teams or projects share the same underlying nodes and control plane while keeping their objects logically separated. Option C is correct because object names (for namespaced resources such as Pods, Services, and Deployments) must be unique within a given namespace, yet the same name can be reused in a different namespace since the namespace scopes the name. Option A is wrong because many Kubernetes objects are cluster-scoped and do not live in a namespace, such as Nodes, PersistentVolumes, StorageClasses, and ClusterRoles. Option B is wrong because namespaces do not provide network isolation by default; Pods in different namespaces can communicate freely unless a NetworkPolicy is applied. Option E is wrong because although deleting a namespace typically garbage-collects its contents, that is a consequence of deletion rather than a defining characteristic of a namespace, and it is not one of the two marked correct answers.

Answer

Namespaces are required for all Kubernetes objects

Answer

Namespaces provide network isolation by default

Answer

Deleting a namespace deletes all objects inside it

Question 15

A user reports that a web application is not accessible via its Service. The Service is of type ClusterIP. Which TWO steps should be taken to troubleshoot?

Accepted Answer

Verify that the kube-proxy is running on the node. Option A is correct because ClusterIP Services rely on kube-proxy running on each node to program iptables/IPVS rules that translate the virtual ClusterIP into the backing Pod IPs, so if kube-proxy is down, traffic to the Service will fail. Option D is correct because a ClusterIP Service with no endpoints (empty Endpoints object) means the selector doesn't match any ready Pods, which is the most common cause of an unreachable Service; 'kubectl get endpoints <service>' quickly reveals this. Option B is not the right focus because a broken container runtime would affect Pod scheduling/status broadly, not specifically Service routing, and would typically show up as Pod failures rather than a Service-only issue. Option C is not appropriate because if the kube-apiserver were down, kubectl commands and cluster-wide operations would fail, not just one web application's Service. Option E is not appropriate because restarting all nodes is a disruptive, non-diagnostic action that does not isolate the root cause and is not a troubleshooting step.

Answer

Check that the container runtime is working

Answer

Check the kube-apiserver status

Answer

Restart all nodes in the cluster