KCNA Kubernetes Fundamentals Practice Test 5 — 15 Questions

Question 1

Which Kubernetes control plane component is the entry point for all REST API requests?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all REST API requests. It validates and processes API calls (e.g., via kubectl, client libraries, or internal components) before persisting state to etcd or triggering other controllers. No other component directly exposes an API endpoint for external or internal management operations.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

etcd

Question 2

A user runs 'kubectl get pods -n default' but receives an error: 'Error from server (Forbidden): pods is forbidden: User cannot list resource pods in API group'. What is the most likely cause?

Accepted Answer

The user lacks RBAC permissions to list pods. The error message 'Error from server (Forbidden): pods is forbidden: User cannot list resource pods in API group' directly indicates that the Kubernetes RBAC (Role-Based Access Control) system has denied the request. The user's current context in their kubeconfig does not have a Role or ClusterRole binding that grants the 'list' verb on 'pods' in the 'v1' API group (core group). This is a standard authorization failure, not a connectivity or resource existence issue.

Answer

The pod does not exist in the namespace

Answer

The user's kubeconfig file is corrupted

Answer

The API server is down

Question 3

A team wants to deploy a stateful application that requires each pod to have a unique, stable network identity and persistent storage that persists across rescheduling. Which Kubernetes resource is most appropriate?

Accepted Answer

StatefulSet. StatefulSet is the correct choice because it provides each pod with a unique, stable network identity (via a predictable hostname derived from the StatefulSet name and ordinal index) and dedicated persistent storage that persists across rescheduling. This is achieved through a headless Service and PersistentVolumeClaims (PVCs) that are bound to each pod's identity, ensuring that when a pod is rescheduled, it reattaches to the same storage and retains its network identity.

Answer

DaemonSet

Answer

Deployment

Answer

Job

Question 4

A user wants to view the logs from a container named 'app' inside a multi-container pod named 'web'. Which kubectl command should be used?

Accepted Answer

kubectl logs web -c app. 'kubectl logs web -c app' retrieves logs from the 'app' container inside the multi-container pod 'web'. The -c (or --container) flag selects the container. Option B and D reverse or misplace the arguments — kubectl logs takes the pod name first with the container specified via a flag, not positionally. Option C is invalid because 'kubectl get logs' is not a kubectl command; logs is a top-level kubectl verb, not a resource that can be retrieved with get.

Answer

kubectl logs app web

Answer

kubectl get logs web -c app

Answer

kubectl logs web app

Question 5

Which TWO components are part of the Kubernetes control plane? (Choose two.)

Accepted Answer

kube-apiserver. The Kubernetes control plane is responsible for maintaining the desired state of the cluster and making global decisions. The kube-apiserver (C) exposes the Kubernetes API, acting as the front-end for the control plane and validating/processing RESTful requests. The kube-controller-manager (D) runs controller processes that regulate the state of the cluster, such as the node controller and replication controller.

Answer

kube-proxy

Answer

container runtime

Answer

kubelet

Question 6

Which Kubernetes component is the primary entry point for all administrative tasks and exposes the REST API?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole component that exposes the Kubernetes REST API. All administrative tasks—whether performed via kubectl, the Kubernetes dashboard, or direct API calls—must go through the API server, which validates and processes requests before storing state in etcd. Without the API server, no other component (scheduler, controller-manager, etc.) can interact with the cluster state.

Answer

kube-controller-manager

Answer

etcd

Answer

kube-scheduler

Question 7

You have a Deployment named 'web-app' running three replicas. You need to scale it to five replicas. Which kubectl command accomplishes this?

Accepted Answer

kubectl scale deployment web-app --replicas=5. The correct command to change the number of replicas in a Deployment is `kubectl scale deployment web-app --replicas=5`. This directly instructs the Kubernetes API to update the Deployment's `.spec.replicas` field, causing the ReplicaSet controller to adjust the number of Pods to match the desired count.

Answer

kubectl set deployment web-app replicas=5

Answer

kubectl patch deployment web-app -p '{"replicas":5}'

Answer

kubectl update deployment web-app --replicas=5

Question 8

You notice that a newly created Pod remains in 'Pending' state. Which of the following is the MOST likely cause?

Accepted Answer

There are insufficient resources available on any node to meet the Pod's requests. A Pod enters 'Pending' state when it cannot be scheduled onto a node. The most common reason is insufficient CPU, memory, or other resources on any available node to satisfy the Pod's resource requests. The Kubernetes scheduler continuously evaluates node capacity against Pod requests, and if no node can accommodate the Pod, it remains unscheduled in Pending.

Answer

The Pod manifest has a syntax error

Answer

The container image does not exist

Answer

The Service does not exist

Question 9

Which TWO of the following are correct about the 'kubectl apply' command compared to 'kubectl create'? (Select exactly two.)

Accepted Answer

kubectl apply can accept a directory of YAML files with -f. `kubectl apply -f <directory>` accepts a directory of YAML files and applies all resource definitions within it, making it a convenient way to manage multiple resources declaratively. This is a key feature of `kubectl apply`, which processes each file in the directory and sends the configurations to the Kubernetes API server for creation or update.

Answer

kubectl apply requires the --save-config flag to record the last-applied-configuration annotation

Answer

kubectl apply cannot be used on resources that already exist

Answer

kubectl apply can create objects but not update them

Question 10

Which command is used to view detailed information about a specific pod?

Accepted Answer

kubectl describe pod. The `kubectl describe pod` command retrieves detailed information about a specific pod, including its current state, events, labels, annotations, container details, resource limits, and volume mounts. This is the standard Kubernetes command for inspecting the full configuration and lifecycle of a pod object, as opposed to the summary view provided by `kubectl get pod`.

Answer

kubectl exec pod -- /bin/sh

Answer

kubectl logs pod

Answer

kubectl get pod

Question 11

Which TWO of the following are responsibilities of the kubelet on a worker node?

Accepted Answer

Ensuring containers are running as specified in the PodSpec. The kubelet is the primary node agent that runs on each worker node. Its core responsibilities include ensuring that containers are running and healthy as defined by the PodSpec (Option D) and registering the node with the control plane (Option E). It does not store cluster state (that's the role of etcd), schedule Pods (that's the scheduler's job), or implement network rules (that's kube-proxy).

Answer

Storing cluster state in etcd

Answer

Scheduling Pods onto the node

Answer

Implementing network rules for Services

Question 12

Which TWO of the following are valid ways to expose a Service to external traffic?

Accepted Answer

LoadBalancer. The question asks for three correct options, but only two service types directly expose a Service to external traffic: NodePort and LoadBalancer. The other options (ExternalName, Headless, ClusterIP) are not designed for external access. Therefore, the correct answer is only two—candidates should be aware of this nuance.

Answer

ExternalName

Answer

Headless

Answer

ClusterIP

Question 13

Which component runs on every worker node and is responsible for ensuring that containers are running in a pod according to the pod specification?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node in a Kubernetes cluster. It registers the node with the API server, watches for PodSpecs assigned to its node, and ensures the containers described in those PodSpecs are running and healthy. It does this by interacting with the container runtime to create, start, and stop containers as needed, and it reports the node and pod status back to the control plane.

Answer

kube-scheduler

Answer

container runtime

Answer

kube-proxy

Question 14

What is the smallest deployable unit in Kubernetes that can be created, scheduled, and managed?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model. It represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. Pods are the atomic unit of scheduling, meaning the Kubernetes scheduler places entire Pods onto Nodes, not individual containers.

Answer

Node

Answer

Deployment

Answer

Container

Question 15

You have a Deployment defined with replicas: 3. You run 'kubectl scale deployment my-deployment --replicas=5'. What happens?

Accepted Answer

The Deployment is updated to have 5 replicas, and the ReplicaSet creates 2 additional pods.. `kubectl scale` directly updates the `.spec.replicas` field of the Deployment, which in turn instructs the existing ReplicaSet to adjust its pod count. The ReplicaSet controller then creates 2 additional Pods to reach the desired 5 replicas, without recreating existing Pods or triggering a rollout.

Answer

The Deployment is updated to have 5 replicas, but existing pods are recreated to match.

Answer

The command fails because you cannot scale a Deployment directly.

Answer

The Deployment rolls out a new version with 5 replicas.