KCNA Kubernetes Fundamentals Practice Test 33 — 15 Questions

Question 1

A team wants to run a database Pod that must be scheduled onto a node with an SSD and must not be evicted when the node comes under memory pressure. Which combination of fields should be configured in the Pod spec?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

nodeAffinity with a disk-type match and resource requests equal to limits for memory. Node placement is expressed through nodeSelector or nodeAffinity, and protection from kubelet eviction under resource pressure comes from the Pod's QoS class. Setting memory requests equal to limits yields Guaranteed QoS, which is evicted last. Taints, tolerations, PriorityClass, and PodDisruptionBudgets address different concerns and do not provide the required placement plus eviction resistance together.

Answer

A taint on the database Pod and a matching toleration on the SSD nodes

Answer

nodeSelector with a disk-type label and a PriorityClass with a high value

Answer

A PodDisruptionBudget with minAvailable set to one and an emptyDir volume

Question 2

A cluster administrator is configuring a Pod to use a ConfigMap for environment variables. Which two methods can be used to expose ConfigMap data as environment variables in a container? (Choose two.)

Accepted Answer

Using envFrom with a ConfigMap reference. The two correct methods are using envFrom to expose all keys from a ConfigMap as environment variables, and using env with valueFrom.configMapKeyRef to expose a specific key. These are the standard ways to inject ConfigMap data as environment variables. Mounting as a volume provides files, not environment variables, and the downward API and Secrets are unrelated to ConfigMap data exposure.

Answer

Using a Secret with the same name as the ConfigMap

Answer

Using a downward API to reference the ConfigMap

Answer

Mounting the ConfigMap as a volume

Question 3

A cluster administrator needs to grant a user permission to view Pods in the 'staging' namespace but not in any other namespace. Which combination of Kubernetes objects should be created?

Accepted Answer

A Role and a RoleBinding in the 'staging' namespace. To grant namespace-scoped permissions, the standard approach is to create a Role that defines the allowed verbs on Pods and a RoleBinding that binds that Role to the user within the 'staging' namespace. This ensures the user can view Pods only in that namespace, following the principle of least privilege.

Answer

A ClusterRole and a RoleBinding in the 'staging' namespace

Answer

A ClusterRole and a ClusterRoleBinding

Answer

A Role and a ClusterRoleBinding

Question 4

A platform engineer is troubleshooting a Pod stuck in the Pending state and wants to identify scheduling-related causes. Which two commands or outputs are most useful for diagnosing why the scheduler cannot place the Pod? (Choose two.)

Accepted Answer

kubectl get events --field-selector involvedObject.name=<pod-name>. Scheduling failures are reported as events on the Pod object. Both kubectl describe pod and a field-selector-filtered kubectl get events expose FailedScheduling messages that name the blocking predicate, such as insufficient resources or an unsatisfied node affinity. Node listings and container logs or exec sessions cannot reveal scheduler decisions for a Pod that has never been bound to a node.

Answer

kubectl get nodes and review the STATUS and Allocatable columns

Answer

kubectl exec -it <pod-name> -- /bin/sh to inspect the node from inside

Answer

kubectl logs <pod-name> to read the container startup output

Question 5

A developer creates a Pod with two containers. The first container writes logs every 30 seconds to a shared volume. The second container reads those logs. After deployment, the second container fails to start because it cannot find the log file. The Pod spec uses an emptyDir volume mounted at /var/logs in both containers. What is the most likely cause?

Accepted Answer

The second container starts before the first container writes any logs, and it exits because the file does not exist.. Containers within a Pod start simultaneously without guaranteed ordering. When one container depends on a file created by another, the reader may start first and fail. This race condition is best solved by using an init container that waits for the file, or by making the reader container resilient to the file's absence.

Answer

emptyDir volumes are not shared between containers in the same Pod; each container gets its own isolated volume.

Answer

The Pod's restartPolicy is set to Never, so the second container will not restart after failing.

Answer

The second container lacks the necessary permissions to read files written by the first container.

Question 6

A user wants to check the resource usage of Pods in a cluster. Which command should be used to display CPU and memory usage for all Pods in the default namespace?

Accepted Answer

kubectl top pods. The correct command is kubectl top pods, which retrieves CPU and memory usage metrics from the Metrics Server. This command is specifically designed for viewing resource consumption. The other options are either invalid commands or provide different types of information, such as configuration details or logs, but not live resource usage.

Answer

kubectl get pods --show-metrics

Answer

kubectl logs --metrics

Answer

kubectl describe pods

Question 7

A developer is troubleshooting a Pod that is stuck in the Pending state. Which two commands can help identify the reason for the scheduling failure? (Choose two.)

Accepted Answer

kubectl get events --field-selector involvedObject.name=<pod-name>. When a Pod is Pending, the scheduler has not placed it on a node. The describe command and filtered events both surface scheduler events that state the reason, such as insufficient resources or taints. Logs, exec, and top require a running container and are not useful for a Pod that has never started.

Answer

kubectl exec -it <pod-name> -- /bin/sh

Answer

kubectl top pod <pod-name>

Answer

kubectl logs <pod-name>

Question 8

A cluster administrator needs to grant a CI/CD service account permission to create and delete Pods only within the staging namespace, while denying access in all other namespaces. Which Kubernetes authorization mechanism should be used?

Accepted Answer

A Role and RoleBinding in the staging namespace. Role-based access control scopes permissions either cluster-wide or to a namespace. A Role paired with a RoleBinding in staging grants the service account permission to act on Pods only in that namespace. A ClusterRoleBinding would widen access to every namespace, while NetworkPolicy and PodSecurityPolicy address network filtering and Pod security admission respectively, not API authorization.

Answer

A PodSecurityPolicy scoped to the staging namespace

Answer

A NetworkPolicy with a namespaceSelector targeting staging

Answer

A ClusterRole and ClusterRoleBinding

Question 9

A cluster administrator wants to ensure that a specific Pod always runs on a node with an SSD. The node has the label disktype=ssd. Which Kubernetes feature should the administrator use?

Accepted Answer

nodeSelector. nodeSelector is the simplest way to constrain a Pod to nodes with specific labels. By specifying a label like disktype=ssd, the scheduler only considers nodes that have that label. This directly satisfies the requirement of running on an SSD node.

Answer

Pod affinity

Answer

Taints and tolerations

Answer

Resource requests and limits

Question 10

A user wants to run a one-time batch task that processes a dataset and then exits. The task should not be restarted if it completes successfully. Which Kubernetes resource is most appropriate?

Accepted Answer

Job. A Job is the Kubernetes resource designed for batch workloads that run to completion. It tracks successful Pod completions and does not restart Pods that exit with success. Deployments, StatefulSets, and DaemonSets are all intended for long-running services and do not provide the same completion guarantees.

Answer

Deployment

Answer

StatefulSet

Answer

DaemonSet

Question 11

A platform team runs a StatefulSet named `db` with three replicas in the `prod` namespace. An operator must connect directly to the third Pod's network identity for a manual data repair. Which stable DNS name resolves to that specific Pod?

Accepted Answer

db-2.db.prod.svc.cluster.local. StatefulSet members are addressed by stable, ordinal-based hostnames backed by a headless Service. A three-replica set produces ordinals 0 through 2, so the third Pod is db-2 under the Service and namespace. That per-Pod DNS record survives rescheduling, giving operators a dependable target for direct maintenance work.

Answer

db.db.prod.svc.cluster.local

Answer

db-3.db.prod.svc.cluster.local

Answer

db.prod.pod.cluster.local

Question 12

An administrator needs to run a stateful database in Kubernetes that requires a stable network identity, persistent storage that survives pod rescheduling, and ordered deployment and scaling. Which Kubernetes resource should be used to meet these requirements?

Accepted Answer

StatefulSet. StatefulSet is the only workload resource that provides stable network identities, persistent storage per replica, and ordered deployment and scaling. Deployments, DaemonSets, and ReplicaSets are designed for stateless or node-wide workloads and do not offer these guarantees. For a stateful database, StatefulSet is the correct and standard Kubernetes solution.

Answer

ReplicaSet

Answer

Deployment

Answer

DaemonSet

Question 13

A developer creates a Pod with a single container that writes data to /data. The Pod spec includes a volume of type hostPath with path /mnt/data. After the Pod is deleted, the developer notices that the data persists on the node. What is the primary reason for this behavior?

Accepted Answer

hostPath volumes are not deleted when the Pod is deleted; they persist on the node's filesystem.. hostPath volumes directly mount a node's filesystem path into a Pod. Data written to that path is stored on the node and remains there even after the Pod is deleted. This is why the data persists, as the node's directory is not automatically cleaned up by Kubernetes.

Answer

The Pod's restartPolicy is set to Always, which causes the volume to be recreated after deletion.

Answer

The volume is backed by a PersistentVolume that retains data even after the Pod is deleted.

Answer

The kubelet caches volume data in memory and writes it back to the hostPath after Pod deletion.

Question 14

A developer is troubleshooting a Pod that remains in the Pending state and never gets scheduled. The developer suspects the issue is related to node selection constraints. Which two kubectl commands can help identify why the Pod cannot be scheduled? (Choose two.)

Accepted Answer

kubectl describe pod <pod-name>. A Pending Pod has not been scheduled, so diagnostics must come from the control plane rather than the container. kubectl describe pod surfaces scheduler Events and status conditions, and kubectl get events filtered by the Pod name provides the same FailedScheduling reasons in a focused list. Commands that require a running container or metrics pipeline cannot function before scheduling occurs.

Answer

kubectl logs <pod-name>

Answer

kubectl exec -it <pod-name> -- /bin/sh

Answer

kubectl top pod <pod-name>

Question 15

A cluster administrator needs to run a log-forwarding agent on every node, including nodes added later, without manually scheduling a Pod per node. Which workload object should be used?

Accepted Answer

A DaemonSet. Node-wide agents need exactly one instance per node with automatic coverage of newly joined nodes. A DaemonSet is purpose-built for that pattern, scheduling a Pod onto each eligible node as the cluster changes. Deployments, Jobs, and StatefulSets all lack the one-per-node guarantee, so they cannot satisfy the requirement reliably.

Answer

A Deployment with a high replica count

Answer

A Job with parallelism set to the node count

Answer

A StatefulSet with podManagementPolicy set to Parallel