KCNA Kubernetes Fundamentals Practice Test 30 — 15 Questions

Question 1

Which TWO of the following are valid ways to view the logs of a pod named 'my-pod'?

Accepted Answer

kubectl exec my-pod -- cat /var/log/app.log. Option B is correct because kubectl exec my-pod -- cat /var/log/app.log runs the cat command inside the container of the pod, directly reading the application log file at that path, which is a valid way to view logs when the app writes to a file rather than stdout. Option C is correct because kubectl logs my-pod retrieves the stdout/stderr output captured by the container runtime for the pod's (default) container, which is the standard Kubernetes logging mechanism. Option A is not a log-viewing method: kubectl describe pod my-pod shows metadata, status, events, and container specs, not the application's log stream. Option D is invalid syntax and semantics: kubectl run creates a new pod from an image and does not accept a 'logs' subcommand to read an existing pod's logs. Option E is wrong because kubectl attach my-pod attaches the terminal to a running container's process (stdin/stdout of PID 1), which is interactive and not a log-retrieval command.

Answer

kubectl describe pod my-pod

Answer

kubectl run my-pod -- logs

Answer

kubectl attach my-pod

Question 2

Which THREE of the following are responsibilities of the kube-controller-manager?

Accepted Answer

Creating Endpoints objects for Services. Option B is correct because the kube-controller-manager runs the endpoints controller (and endpointslice controller), which populates Endpoints/EndpointSlice objects for Services by tracking the Pods matching each Service's selector. Option C is correct because the node lifecycle controller inside the kube-controller-manager monitors Node heartbeats/status and applies taints such as node.kubernetes.io/not-ready or unreachable and evicts Pods when Nodes fail. Option D is correct because the ReplicaSet controller (and Deployment/StatefulSet controllers) run in the kube-controller-manager and reconcile the actual number of Pod replicas to the desired count. Option A is not part of the kube-controller-manager; Pod-to-Node assignment is performed by the kube-scheduler. Option E is not part of the kube-controller-manager; the Kubernetes API is served by kube-apiserver.

Answer

Assigning Pods to Nodes

Answer

Serving the Kubernetes API

Question 3

Which Kubernetes component is responsible for maintaining the desired state of the cluster by running controller loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the component that runs controller loops to regulate the state of the cluster. Each controller (e.g., Node Controller, Replication Controller) watches the shared state via the API server and makes changes to drive the actual cluster state toward the desired state defined in the control plane. This is the core mechanism for self-healing and maintaining declarative configuration.

Answer

etcd

Answer

kube-apiserver

Answer

kube-scheduler

Question 4

You have a Deployment that runs a web application. You need to expose this application externally on a fixed port using a cloud load balancer. Which Service type should you use?

Accepted Answer

LoadBalancer. A LoadBalancer Service type provisions an external cloud load balancer (e.g., AWS ELB, GCP TCP/UDP Load Balancer) that exposes the application on a fixed port (typically 80/443) and distributes traffic to the Pods. This is the correct choice because the requirement explicitly asks for a cloud load balancer with a fixed external port, which is exactly what LoadBalancer provides by integrating with the underlying cloud provider's API.

Answer

NodePort

Answer

ExternalName

Answer

ClusterIP

Question 5

Which Kubernetes command displays the current state of a pod, including its IP address, node, and container statuses?

Accepted Answer

kubectl get pod -o wide. `kubectl get pod -o wide` extends the default output to include additional columns such as the pod's IP address, the node it is scheduled on, and the container statuses (e.g., READY state). This command queries the Kubernetes API server for the pod's current state and formats the response with extra details, making it the most direct way to view the pod's IP and node assignment in a single line.

Answer

kubectl describe pod

Answer

kubectl logs pod

Answer

kubectl get pod

Question 6

When creating a Deployment, you want to ensure that only a certain number of pods run at a time across all nodes. Which field in the Deployment spec controls this?

Accepted Answer

spec.replicas. The `spec.replicas` field in a Deployment spec defines the desired number of identical Pod replicas that should be running at any given time. This field directly controls the count of Pods across all nodes in the cluster, ensuring that exactly that many Pods are maintained by the ReplicaSet controller. Option A is correct because it is the only field that sets the target Pod count.

Answer

spec.selector

Answer

spec.minReadySeconds

Answer

spec.template

Question 7

You are asked to schedule a pod on a node that has SSD storage. Which mechanism should you use to achieve this?

Accepted Answer

Add a nodeSelector with a label matching the node, e.g., disktype: ssd. NodeSelector is the built-in Kubernetes mechanism for constraining a pod to nodes with specific labels. By labeling a node with disktype=ssd and adding that same label selector to the pod spec, the scheduler will only place the pod on nodes that have that label, ensuring it lands on SSD-equipped nodes.

Answer

Use a resource request for SSD storage capacity

Answer

Set an annotation on the pod specifying the disk type

Answer

Add a toleration for a taint on SSD nodes

Question 8

Which THREE statements about Kubernetes Namespaces are correct?

Accepted Answer

Namespaces provide a way to divide cluster resources between multiple users or teams.. Option A is correct because Kubernetes Namespaces are designed as a logical partitioning mechanism that lets a single physical cluster be shared among multiple users, teams, or projects, scoping names and resource usage per group. Option D is correct because deleting a Namespace triggers cascading deletion of all namespaced objects contained in it (e.g., Pods, Services, ConfigMaps), so the namespace and its contents are removed together. Option E is correct because ResourceQuota objects are applied at the namespace scope to cap aggregate consumption of resources such as CPU, memory, and object counts within that namespace. Option B is incorrect because many resources are cluster-scoped and cannot live in a namespace, such as Nodes, PersistentVolumes, ClusterRoles, and StorageClasses. Option C is incorrect because namespaces do not enforce network isolation by default; without a NetworkPolicy, pods in different namespaces can communicate freely, so isolation must be explicitly configured.

Answer

All Kubernetes resources must be created within a namespace.

Answer

Namespaces provide network isolation by default.

Question 9

Which THREE statements about Kubernetes Pods are correct?

Accepted Answer

A Pod is the smallest deployable unit in Kubernetes.. Option B is correct because the Pod is the smallest deployable unit in Kubernetes — you cannot schedule or deploy individual containers directly; the Pod is the atomic unit the scheduler places on a node. Option C is correct because a Pod is always scheduled as a whole onto a single node; its containers are co-located and cannot be spread across multiple nodes. Option D is correct because a Pod can contain multiple containers that share the same network namespace, meaning they share an IP address and port space and can communicate over localhost. Option A is incorrect because containers within the same Pod share the network namespace and can communicate directly via localhost without any Service. Option E is incorrect because Pods are ephemeral and not self-healing; if a Pod fails, it is the higher-level controller (such as a Deployment or ReplicaSet) that creates a replacement, not the Pod itself.

Answer

Containers within a Pod cannot communicate with each other without using Services.

Answer

Pods are the most resilient unit in Kubernetes and automatically recover from failures.

Question 10

Which THREE of the following are valid options for the 'kubectl get' command to display output in different formats?

Accepted Answer

-o wide. Option B (-o wide) is correct because the -o wide output format extends the default table with additional columns such as node name, IP addresses, and nominated node, which is a documented kubectl output format. Option C (-o json) is correct because kubectl supports -o json to serialize the resource as a JSON object, useful for scripting and parsing with tools like jq. Option D (-o yaml) is correct because -o yaml renders the resource as YAML, another officially supported output format for kubectl get. The unmarked options do not belong: -o verbose is not a valid output format (verbose logging is controlled by -v/--v), and --describe is not an output format but a separate kubectl subcommand (kubectl describe) that shows detailed human-readable information.

Answer

-o verbose

Answer

--describe

Question 11

Which THREE of the following are valid fields in a Kubernetes Deployment spec (apps/v1)?

Accepted Answer

replicas. In an apps/v1 Deployment spec, the correct top-level fields include A. replicas, which declares the desired number of Pod replicas the ReplicaSet managed by the Deployment should maintain; B. template, which is the required PodTemplateSpec describing the Pods to be created; and C. selector, which is the required LabelSelector that must match the labels in the template and determines which Pods the Deployment manages. Options D and E are not valid Deployment spec fields: containers belongs inside the Pod template's spec (spec.template.spec.containers), not directly under the Deployment spec, and nodeName is a Pod-level scheduling field under spec.template.spec, not a Deployment spec field.

Answer

containers

Answer

nodeName

Question 12

A cluster administrator needs to run a node-level log collector that must read files from /var/log on every node in the cluster, including nodes added later. The collector does not need to run on control plane nodes. Which Kubernetes resource should be used?

Accepted Answer

DaemonSet. A DaemonSet is the correct resource because it schedules exactly one Pod on each node that matches its node selector or affinity rules, and it automatically adds Pods to new nodes as they join the cluster. This makes it ideal for node-level agents such as log collectors, monitoring daemons, and network plugins that must run everywhere.

Answer

Job with parallelism set to the node count

Answer

StatefulSet with podAntiAffinity

Answer

Deployment with replicas equal to the number of nodes

Question 13

A team is designing a Kubernetes architecture for a new application. They need to understand which components are part of the control plane and which run on worker nodes. Which TWO of the following components run on every worker node in a standard Kubernetes cluster? (Choose two.)

Accepted Answer

kube-proxy. kubelet and kube-proxy are the two components that run on every worker node. kubelet manages Pods on the node, and kube-proxy handles Service networking. The scheduler, etcd, and controller manager are control plane components.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

etcd

Question 14

A developer creates a Pod with the following YAML snippet:

spec:
  containers:
  - name: web
    image: nginx
    ports:
    - containerPort: 80

The Pod is running, but the developer cannot reach it from another Pod in the same namespace using the Pod's IP address. Which command should the developer run first to verify that the container process is listening on port 80?

Accepted Answer

kubectl exec -it <pod-name> -- netstat -tuln. The correct first step is to check listening sockets inside the container. Because the Pod is running but unreachable, the issue could be the application not listening on the expected port. Using kubectl exec with netstat (or ss) inside the container provides direct evidence of whether the process is bound to port 80, guiding further troubleshooting.

Answer

kubectl describe pod <pod-name>

Answer

kubectl logs <pod-name>

Answer

kubectl get pod <pod-name> -o yaml

Question 15

A platform engineer is designing a multi-tenant cluster and must ensure that Pods in different namespaces cannot communicate with each other by default, while allowing specific traffic within each namespace. Which two Kubernetes features are required to achieve this? (Choose two.)

Accepted Answer

A CNI plugin that supports NetworkPolicy enforcement. To achieve default-deny between namespaces, you need a NetworkPolicy that denies all ingress in each namespace and a CNI plugin that enforces NetworkPolicy. Without the policy, traffic is allowed by default; without a supporting CNI, the policy has no effect. Together they provide the required isolation and allow specific traffic via additional allow policies.

Answer

Service mesh with mTLS enabled

Answer

ResourceQuota per namespace

Answer

PodSecurityPolicy restricted to the namespace