KCNA Kubernetes Fundamentals Practice Test 5 — 15 Questions

Question 1

Two pods, 'app-v1' and 'app-v2', both have a label 'app: myapp'. A Service 'my-service' has a selector 'app: myapp'. How many endpoints will the Service initially have?

Accepted Answer

2. The Service's selector 'app: myapp' matches both pods 'app-v1' and 'app-v2', which both carry the label 'app: myapp'. The Service controller automatically creates endpoints for all pods matching the selector, regardless of their readiness state, unless a headless service or custom endpoint logic is involved. Initially, both pods are considered ready by default (unless a readiness probe fails), so the Service will have two endpoints.

Answer

1

Answer

0

Answer

Depends on pod readiness

Question 2

A developer deploys a CronJob that runs a batch job every 5 minutes. After a while, they notice that the job fails with 'DeadlineExceeded' and the pod is stuck in 'PodInitializing' state. What is the most likely reason?

Accepted Answer

A pre-existing InitContainer is failing or stuck. The 'PodInitializing' state indicates that the pod is stuck before its main containers can start, which is typically caused by an InitContainer that is failing or hanging. Since the job fails with 'DeadlineExceeded', the pod's activeDeadlineSeconds (or the CronJob's startingDeadlineSeconds) has been reached while the InitContainer is still running, preventing the main container from executing. This is the most likely reason because InitContainers run sequentially to completion before any main containers start, and a stuck InitContainer blocks the entire pod lifecycle.

Answer

The CronJob schedule is misconfigured

Answer

The container runtime is not installed on the node

Answer

The job's backoffLimit is set too low

Question 3

Which TWO of the following are functions of the kube-controller-manager?

Accepted Answer

Running the node controller to monitor node health. The kube-controller-manager runs the built-in control loops that reconcile cluster state with desired state, and one of these is the node controller, which monitors node health and marks nodes NotReady or evicts pods when nodes fail — so option D is correct. It also runs the ReplicaSet controller (part of the workload controllers), which ensures the desired number of pod replicas exist by creating or deleting pods — so option E is correct. Option A is wrong because serving the Kubernetes API is the job of kube-apiserver, not kube-controller-manager. Option B is wrong because implementing network rules for Services is handled by kube-proxy (via iptables/IPVS) on each node. Option C is wrong because scheduling pods to nodes is performed by kube-scheduler, not kube-controller-manager.

Answer

Serving the Kubernetes API

Answer

Implementing network rules for Services

Answer

Scheduling pods to nodes

Question 4

Which THREE of the following are valid ways to expose a set of pods as a network service in Kubernetes?

Accepted Answer

ClusterIP. ClusterIP (A) is correct because it is the default Service type that exposes pods on an internal virtual IP reachable only within the cluster, providing stable service discovery and load balancing. NodePort (B) is correct because it exposes the Service on each node's IP at a static port in the 30000–32767 range, making pods reachable from outside the cluster. LoadBalancer (C) is correct because it builds on NodePort and provisions an external load balancer (e.g., via a cloud provider) to expose the Service to external clients. Ingress (D) is not a Service type; it is an API object that routes HTTP/HTTPS traffic to Services and requires an Ingress controller, so it does not itself expose pods as a network service. ExternalName (E) is a Service type but it maps a Service to an external DNS name via a CNAME record and does not expose any pods.

Answer

Ingress

Answer

ExternalName

Question 5

Which TWO of the following are valid reasons that a PersistentVolumeClaim (PVC) may remain in 'Pending' state?

Accepted Answer

No PersistentVolume exists that matches the PVC's storage class and size requirements. Option B is correct because a PVC stays Pending when the control plane cannot find or bind a PersistentVolume that satisfies its requested storage class and capacity (and other selectors), so no matching PV means no binding. Option C is correct because if the PVC references a StorageClass that does not exist, the storage class cannot be resolved and no provisioner is invoked, leaving the claim unbound and Pending. Option A is not a cause of Pending for the PVC itself, since PVC binding is independent of whether a consuming pod is scheduled. Option D is not a valid reason in this form, because an unsupported access mode typically surfaces as a provisioning or binding failure rather than a generic Pending state caused by the access mode alone. Option E is not one of the two expected answers here, because a missing or misconfigured dynamic provisioner is usually a consequence of an invalid or absent StorageClass rather than a standalone valid reason in this question's intended set.

Answer

The pod that references the PVC is not scheduled yet

Answer

The PVC's access mode is 'ReadWriteMany' but the underlying storage only supports 'ReadWriteOnce'

Answer

The cluster's dynamic provisioner is unavailable or misconfigured

Question 6

What is the primary purpose of a Kubernetes Service?

Accepted Answer

To provide a stable network endpoint for a set of Pods. A Kubernetes Service provides a stable virtual IP (ClusterIP) and DNS name that load-balances traffic to a dynamic set of Pods. Pods are ephemeral, so their IPs change; a Service abstracts this by selecting Pods via labels and maintaining a consistent endpoint. This enables reliable communication between components.

Answer

To manage rolling updates of Pods

Answer

To schedule Pods onto Nodes

Answer

To store configuration data for Pods

Question 7

Which component of the Kubernetes control plane is responsible for storing the cluster state?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as Kubernetes' single source of truth for cluster state, including all object definitions, configurations, and statuses. The control plane components (kube-apiserver, scheduler, controller-manager) are stateless and rely on etcd to persist and retrieve cluster data. Without etcd, the cluster cannot recover its state after a restart.

Answer

kube-scheduler

Answer

kube-apiserver

Answer

kube-controller-manager

Question 8

A Deployment is rolling out a new version. The rollout has stalled, and 'kubectl rollout status deployment/myapp' shows 'Waiting for deployment rollout to finish: 2 out of 5 new replicas have been updated...'. The Deployment's spec.strategy.rollingUpdate.maxUnavailable is set to 25% and maxSurge is 25%. What is the maximum number of Pods that could be unavailable during this rollout?

Accepted Answer

2. With maxUnavailable=25% and maxSurge=25%, the maximum number of unavailable Pods during a rolling update is calculated as the ceiling of 25% of the desired replicas (5), which is 2. This means up to 2 Pods can be unavailable at any time, ensuring the rollout can proceed while maintaining availability.

Answer

1

Answer

3

Answer

0

Question 9

A developer reports that a Pod cannot reach another Service in the same namespace via its DNS name. The Service name is 'api'. What is the correct DNS query for a Pod to resolve this Service?

Accepted Answer

api. When a Pod and a Service are in the same namespace, Kubernetes DNS resolves the Service using just the Service name (e.g., 'api'). The DNS search domain configured in the Pod's resolv.conf (e.g., <namespace>.svc.cluster.local) appends the namespace and cluster suffix automatically, so a short query like 'api' resolves correctly without needing the full FQDN.

Answer

api.svc.cluster.local

Answer

api.namespace.svc.cluster.local

Answer

api.default.svc.cluster.local

Question 10

Which two of the following are valid ways to expose a Deployment externally to the internet? (Select TWO)

Accepted Answer

Create a Service of type LoadBalancer. Option C (Service of type LoadBalancer) is correct because it provisions an external load balancer (via the cloud provider's controller) that assigns a public IP and routes internet traffic to the Deployment's pods. Option E (Service of type NodePort) is correct because it opens a static port on every node's IP, allowing external clients to reach the Service via :. Option A (ClusterIP) is incorrect because it only exposes the Service on an internal cluster IP reachable within the cluster. Option B (Ingress) is not marked correct here since an Ingress resource alone requires an Ingress controller and typically an underlying externally reachable Service to actually expose traffic. Option D (Headless Service) is incorrect because setting clusterIP: None returns pod IPs directly for internal discovery and provides no external exposure.

Answer

Create a Service of type ClusterIP

Answer

Create an Ingress resource

Answer

Create a Headless Service

Question 11

What is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. A Pod is the smallest deployable unit in Kubernetes because it encapsulates one or more containers that share the same network namespace, storage volumes, and lifecycle. While containers are the runtime processes, Kubernetes schedules and manages Pods as atomic units, meaning you cannot deploy a container directly without a Pod wrapper.

Answer

Node

Answer

Container

Answer

Deployment

Question 12

A user wants to ensure that a Deployment undergoes a rolling update with zero downtime, and that new Pods are fully ready before old Pods are terminated. Which field in the Deployment spec controls this behavior?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable and maxSurge. `spec.strategy.rollingUpdate.maxUnavailable` and `maxSurge` control how many Pods can be unavailable and how many can be created above the desired count during a rolling update. Setting `maxUnavailable=0` ensures no old Pods are terminated until new Pods are fully ready, achieving zero-downtime updates. `maxSurge` allows extra Pods to be created before old ones are removed, enabling a controlled rollout.

Answer

spec.minReadySeconds

Answer

spec.replicas

Answer

spec.template.spec.containers[].resources

Question 13

You have a Pod that is running but not receiving traffic. You suspect the associated Service's selector does not match the Pod labels. Which kubectl command would you use to check the Service's selector?

Accepted Answer

kubectl describe service . `kubectl describe service ` displays the service's selector field under the 'Selector' section, allowing you to directly compare it with the Pod's labels. This is the most straightforward way to verify if the selector matches the Pod labels, which is essential for traffic routing.

Answer

kubectl get endpoints <service-name>

Answer

kubectl get service <service-name> -o yaml

Answer

kubectl logs <pod-name>

Question 14

Which THREE actions can be performed using kubectl without installing additional plugins?

Accepted Answer

Run 'kubectl edit deployment' to modify a Deployment in-place.. Option B is correct because 'kubectl edit deployment' is a built-in subcommand that opens the Deployment's manifest in an editor and applies the changes in-place via the API server. Option D is correct because 'kubectl cp' is a native subcommand that copies files between a local filesystem and a container (or vice versa) using tar over the exec/streaming mechanism. Option E is correct because 'kubectl logs' is a core built-in subcommand that retrieves container logs from a Pod via the kubelet's log endpoint. Option A is not correct because 'kubectl debug' is provided by the kubectl-debug plugin, not by the default kubectl binary. Option C is not correct because 'kubectl auth reconcile' is not a standard kubectl subcommand; RBAC reconciliation is typically done with tools like 'kubectl auth can-i' for checks or external tooling, not this command.

Answer

Run 'kubectl debug' to create a debugging Pod.

Answer

Run 'kubectl auth reconcile' to reconcile RBAC permissions.

Question 15

Which of the following is NOT a responsibility of the kubelet on a worker node?

Accepted Answer

Assign Pods to nodes based on resource requirements. Assigning Pods to nodes is the responsibility of the kube-scheduler, not the kubelet. The kubelet only runs on worker nodes and executes tasks related to managing the lifecycle of Pods assigned to that specific node by the scheduler.

Answer

Ensure containers are running as defined in the PodSpec

Answer

Report node and pod status to the API server

Answer

Execute liveness and readiness probes