KCNA Kubernetes Fundamentals Practice Test 32 — 15 Questions

Question 1

A developer needs a Pod to read configuration values and credentials separately, where non-sensitive settings should update without restarting the Pod and secrets should be mounted as files. Which pairing of Kubernetes objects best fits this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ConfigMap for the non-sensitive settings and Secret for the credentials, both consumed as volumes.. The requirement splits non-sensitive settings that must refresh live from credentials that must be handled securely, and the ConfigMap-plus-Secret pairing consumed as volumes satisfies both. Volume-mounted ConfigMaps update on the kubelet sync interval, while Secret volumes keep credentials out of environment dumps and allow tighter RBAC.

Answer

Secret for both the settings and the credentials, consumed via environment variables.

Answer

ConfigMap for both, with the credentials stored in a separate key and mounted as a volume.

Answer

ConfigMap for the settings and a downward API volume for the credentials.

Question 2

An administrator runs `kubectl get pods -n finance` and sees a Pod named `report-0` that is Running but not Ready. The Pod's container has a readiness probe configured with `httpGet` on path `/healthz` port 8080. Logs show the application is running and serving requests on port 8080. Which condition most likely explains why the Pod is Running but not Ready?

Accepted Answer

The readiness probe endpoint `/healthz` returns a non-2xx status code or times out, so kubelet marks the container as not ready.. Readiness probes determine whether a container should receive traffic. When the HTTP GET to `/healthz` fails or times out, kubelet marks the container not ready while leaving the process running, producing exactly the Running-but-not-Ready state. Liveness failures cause restarts, and scheduling or storage issues do not selectively block readiness in the way described.

Answer

The Pod's liveness probe has failed repeatedly and kubelet is restarting the container, which temporarily reports not ready.

Answer

The Pod has no resource requests, so the scheduler has not fully allocated CPU and the readiness gate remains closed.

Answer

The Pod is using a hostPath volume that is not writable, causing the readiness probe to fail at the filesystem level.

Question 3

A developer is troubleshooting a Pod that is stuck in the Pending state. They want to gather information to determine why the Pod has not been scheduled. Which two commands or outputs are most directly useful for this diagnosis? (Choose two.)

Accepted Answer

Run `kubectl describe pod <pod-name>` and inspect the Events section at the bottom.. For a Pending Pod, the scheduler's reasoning is exposed through events. `kubectl describe pod` surfaces FailedScheduling events with specific reasons, and `kubectl get events` with a field selector provides a filtered event timeline. Logs, exec, and top all require a running container, which does not exist before scheduling, so they cannot diagnose a Pending state. The two event-based approaches are the correct diagnostic tools.

Answer

Run `kubectl top pod <pod-name>` to check the Pod's CPU and memory usage against requests.

Answer

Run `kubectl logs <pod-name>` to read the application logs for scheduling errors.

Answer

Run `kubectl exec -it <pod-name> -- /bin/sh` to inspect the container's environment.

Question 4

A cluster administrator runs `kubectl taint nodes node1 dedicated=gpu:NoSchedule` and then creates a Pod with toleration `dedicated=gpu:NoSchedule` but no node affinity. What is the resulting behavior?

Accepted Answer

The Pod can be scheduled on node1, but it may also be scheduled on any other node that passes the scheduler's filters.. Taints repel and tolerations merely permit; a tolerating Pod is eligible for the tainted node but is not drawn to it. The scheduler still scores every feasible node, so without node affinity or a node selector the Pod can land anywhere that passes filters, which is why dedicated-node designs pair taints with attracting constraints.

Answer

The taint is removed from node1 automatically once a Pod with the matching toleration is scheduled there.

Answer

The Pod is guaranteed to run on node1 because the toleration matches the taint.

Answer

The Pod remains Pending because tolerations must be paired with node affinity to be valid.

Question 5

An operations team runs a stateless web application in a Deployment with 3 replicas. They need each Pod to be able to read application configuration from a single source, and updates to that configuration should be reflected in the running Pods without rebuilding the container image. Which Kubernetes resource should they use to store the configuration and inject it as environment variables into the Pods?

Accepted Answer

ConfigMap. ConfigMap is designed for non-sensitive configuration data and integrates directly with Pods through environment variables or mounted files. Because the team wants configuration decoupled from the container image and injected at runtime, a ConfigMap is the correct choice. The other resources serve storage, secret handling, or quota enforcement and cannot provide general application configuration to the container environment.

Answer

Secret

Answer

PersistentVolumeClaim

Answer

ResourceQuota

Question 6

A cluster administrator wants to allow a Pod to access the Kubernetes API to list Pods in its own namespace. Which authentication and authorization mechanism should be used to grant the Pod the necessary permissions?

Accepted Answer

Create a ServiceAccount, bind it to a Role with a RoleBinding, and use the ServiceAccount token in the Pod.. ServiceAccounts are the standard way to provide an identity for Pods. Combined with RBAC, you can create a Role with the necessary permissions and bind it to the ServiceAccount using a RoleBinding. The Pod automatically receives a token that it can use to authenticate to the API server.

Answer

Configure the Pod to use client certificate authentication with a certificate signed by the cluster CA.

Answer

Set the Pod's hostNetwork to true and use the node's kubelet credentials.

Answer

Use a static token file on the API server and mount it into the Pod.

Question 7

You are writing a Pod manifest and need to ensure the container always pulls the newest image from the registry, even if an image with the same tag already exists on the node. Which imagePullPolicy should you set?

Accepted Answer

Always. The imagePullPolicy field controls whether the kubelet consults the node's local image cache or the registry. Always is the only policy that unconditionally pulls on every container start, which is what guarantees fresh content when a mutable tag is reused. IfNotPresent and Never both allow a stale cached image to run, and Latest is not a recognized policy value.

Answer

Latest

Answer

Never

Answer

IfNotPresent

Question 8

A platform engineer is preparing a new cluster and wants each worker node to run a copy of a log-forwarding agent that must also run on control-plane nodes. Which Kubernetes workload resource should be used?

Accepted Answer

DaemonSet. A DaemonSet is the only workload controller that guarantees a Pod on every eligible node, which is exactly what a per-node log-forwarding agent requires. Deployments, StatefulSets, and CronJobs do not provide per-node placement semantics, so they cannot meet the requirement of running the agent on every worker and control-plane node.

Answer

StatefulSet with podManagementPolicy: Parallel

Answer

Deployment with replicas equal to the number of nodes

Answer

CronJob with a schedule of every minute

Question 9

A platform engineer is troubleshooting a Pod that is stuck in Pending. The engineer suspects the scheduler cannot place it. Which two commands are appropriate to gather evidence about why the Pod has not been scheduled? (Choose two.)

Accepted Answer

`kubectl get events --field-selector involvedObject.name=<pod-name>` to filter cluster events for that Pod.. The scheduler reports its reasoning through Events, so inspecting kubectl describe pod output and filtering cluster events for the Pod both expose FailedScheduling causes like insufficient resources, taints, or affinity mismatches. Commands that require a running container, rely on previous logs, or delete the Pod do not reveal why scheduling failed and are unsuitable for this diagnosis.

Answer

`kubectl delete pod <pod-name> --force --grace-period=0` to trigger rescheduling and observe the outcome.

Answer

`kubectl exec -it <pod-name> -- /bin/sh` to inspect the container's runtime logs.

Answer

`kubectl logs <pod-name> --previous` to view logs from the prior container instance.

Question 10

A platform engineer wants to restrict a Pod so that it runs only on nodes that have the label disktype=ssd. The engineer adds a nodeSelector field to the Pod specification. Which statement best describes the effect of nodeSelector in this scenario?

Accepted Answer

The Pod is scheduled only onto nodes whose labels match all specified key-value pairs.. nodeSelector is a hard constraint that filters the node set to those containing all specified labels. The scheduler binds the Pod only to a matching node; otherwise the Pod remains Pending. This makes it suitable for simple placement requirements such as selecting SSD-backed nodes. The other descriptions confuse nodeSelector with soft preferences, kubelet behavior, or label existence checks, all of which are inaccurate.

Answer

The Pod is scheduled only onto nodes that have at least one label, regardless of the label value.

Answer

The Pod is scheduled onto any node, but nodes without the label are given lower priority.

Answer

The Pod can run on any node, but the kubelet on unlabeled nodes refuses to start the container.

Question 11

An operator needs a workload that runs exactly one Pod on every node in the cluster, including nodes added later, to collect host-level logs. Which Kubernetes resource should be used?

Accepted Answer

A DaemonSet. Per-node agents such as log shippers, node exporters, and CNI components are implemented as DaemonSets. The DaemonSet controller creates one Pod per eligible node and reacts to cluster membership changes by adding Pods on new nodes, which no replica-count-based controller can guarantee. Deployments, StatefulSets, and Jobs lack that node-scoped placement semantics.

Answer

A Job with a high parallelism value

Answer

A StatefulSet with podManagementPolicy set to Parallel

Answer

A Deployment with replicas equal to the node count

Question 12

A developer creates a Pod with a container that writes logs to a file in an emptyDir volume. The Pod is then deleted, and a new Pod is created with the same emptyDir volume definition. What happens to the data in the emptyDir volume?

Accepted Answer

The data is lost because emptyDir volumes are deleted when the Pod is deleted.. emptyDir volumes are ephemeral and are deleted when the Pod is deleted. They are designed for temporary storage that is shared among containers in a Pod or used as a scratch space. When the Pod is removed, the data is lost, and a new Pod will have a fresh emptyDir volume. This behavior is consistent regardless of whether the new Pod is scheduled to the same node or not.

Answer

The data is preserved because emptyDir volumes persist across Pod deletions.

Answer

The data is preserved if the emptyDir volume is mounted with a persistentVolumeClaim.

Answer

The data is preserved if the new Pod is scheduled to the same node.

Question 13

A developer creates a Pod with a container that writes data to /var/log/app.log inside the container. The Pod is deleted and recreated, and the log file is gone. Which Kubernetes volume type would preserve the log file across Pod restarts on the same node?

Accepted Answer

hostPath. hostPath mounts a node-local directory into the Pod, so data written there survives Pod deletion and is available when a new Pod is scheduled to the same node. emptyDir is ephemeral and tied to the Pod, while configMap and secret are read-only configuration mechanisms, not persistent storage for application logs.

Answer

configMap

Answer

secret

Answer

emptyDir

Question 14

A developer needs to run a one-off batch job that processes a dataset and then exits. The job must run to completion exactly once per execution and should be retried automatically if the container fails. Which Kubernetes workload resource is designed for this requirement?

Accepted Answer

A Job. A Job is the workload controller for finite tasks: it creates Pods, waits for successful completion, and retries failures up to backoffLimit. Deployments, DaemonSets, and StatefulSets are all designed for continuous operation and will keep Pods running or recreate them, so none provide the run-once-then-finish behavior the developer needs.

Answer

A DaemonSet

Answer

A StatefulSet

Answer

A Deployment

Question 15

A team wants to run a batch job that must complete successfully exactly once and then stop. The job processes a queue and should not be restarted after successful completion. Which Kubernetes resource is most appropriate for this requirement?

Accepted Answer

Job. Job is the controller designed for run-to-completion workloads. It tracks successful Pod completions and stops creating new Pods once the required count is reached. Deployments, DaemonSets, and StatefulSets all maintain long-running Pods and would not naturally terminate after a single successful execution, making them inappropriate for this batch processing requirement.

Answer

DaemonSet

Answer

StatefulSet

Answer

Deployment