KCNA Kubernetes Fundamentals Practice Test 7 — 15 Questions

Question 1

You have a multi-container pod with containers 'app' and 'sidecar'. You need to execute a shell command inside the 'sidecar' container. Which kubectl command should you use?

Accepted Answer

kubectl exec -it mypod -c sidecar -- /bin/sh. `kubectl exec` uses the `-c` flag (or `--container`) to specify a target container within a multi-container pod. The syntax `kubectl exec -it mypod -c sidecar -- /bin/sh` opens an interactive shell in the 'sidecar' container of the pod named 'mypod'. Without the `-c` flag, the command defaults to the first container in the pod's spec, which would be 'app'.

Answer

kubectl exec -it mypod -- /bin/sh

Answer

kubectl exec -it sidecar --container mypod -- /bin/sh

Answer

kubectl exec -it mypod --container sidecar -- /bin/sh

Question 2

You create a Pod with the following YAML. What will happen when you apply it?

Accepted Answer

The Pod will be created with memory limit of 128Mi and CPU limit of 500m. The YAML defines resource limits and requests using standard Kubernetes units: '128Mi' for memory (mebibytes) and '500m' for CPU (millicores). These are valid and will be applied to the container, creating the Pod with the specified limits.

Answer

The Pod will fail to create because memory and CPU are in the wrong unit

Answer

The Pod will be created without resource limits because the syntax is incorrect

Answer

The Pod will be created but requests and limits will be ignored because they are not valid for Pods

Question 3

Which of the following is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. The Pod is the smallest deployable unit in Kubernetes because it represents a single instance of a running process in the cluster and encapsulates one or more containers that share the same network namespace, storage volumes, and lifecycle. Containers are not directly scheduled onto Nodes; instead, Kubernetes always schedules and manages Pods, making the Pod the atomic unit of deployment.

Answer

Container

Answer

Node

Answer

Deployment

Question 4

Which of the following kubectl commands would you use to update a Deployment's image to 'nginx:1.21' and record the change in the rollout history?

Accepted Answer

kubectl set image deployment/nginx nginx=nginx:1.21 --record. `kubectl set image deployment/nginx nginx=nginx:1.21 --record` updates the container image of the specified deployment and, with the `--record` flag, annotates the change in the rollout history (stored in the `kubernetes.io/change-cause` annotation). This allows you to later inspect the change with `kubectl rollout history deployment/nginx`.

Answer

kubectl edit deployment nginx --image=nginx:1.21

Answer

kubectl set image deployment/nginx nginx=nginx:1.21

Answer

kubectl patch deployment nginx -p '{"spec":{"template":{"spec":{"containers":[{"name":"nginx","image":"nginx:1.21"}]}}}}' --record

Question 5

Which two of the following are true about ConfigMaps? (Select TWO.)

Accepted Answer

ConfigMaps are namespace-scoped. Option B is correct because ConfigMaps are Kubernetes API objects that live within a namespace, so they are namespace-scoped and must be referenced from the same namespace (or explicitly copied) by Pods that consume them. Option D is correct because a ConfigMap can be consumed in two primary ways: mounted into a Pod as a volume (with each key becoming a file) or injected into containers as environment variables via envFrom or valueFrom. Option A is not correct because ConfigMaps are stored unencrypted in etcd by default; encryption at rest requires configuring the API server's EncryptionConfiguration and is not automatic. Option C is not correct because ConfigMaps are designed for UTF-8 text data in the data field, while binary content belongs in the binaryData field of a Secret (or base64-encoded text in a ConfigMap, which is not the same as native binary support). Option E is not correct because sensitive configuration data should be stored in Secrets, not ConfigMaps, since ConfigMaps are not intended for confidential information.

Answer

ConfigMaps are automatically encrypted at rest

Answer

ConfigMaps can hold binary data

Answer

ConfigMaps are used to store sensitive configuration data

Question 6

What is the primary purpose of Kubernetes?

Accepted Answer

To orchestrate containers across a cluster. Kubernetes is a container orchestration platform designed to automate the deployment, scaling, and management of containerized applications across a cluster of nodes. Its primary purpose is to abstract the underlying infrastructure and provide a declarative way to run and manage containers, ensuring desired state and self-healing. This directly corresponds to orchestrating containers across a cluster, not compiling code, running VMs, or managing physical servers.

Answer

To compile source code

Answer

To run virtual machines

Answer

To manage physical servers

Question 7

Which TWO components are part of the Kubernetes control plane?

Accepted Answer

kube-apiserver. The kube-apiserver (option C) is a core control-plane component: it exposes the Kubernetes API, validates and processes REST requests, and is the central communication hub that all other components (including kubelets and controllers) talk to. etcd (option D) is the control plane's consistent, highly-available key-value store that persists all cluster state and objects, making it an essential control-plane component. The container runtime (option A) is node-level software (e.g., containerd or CRI-O) that actually runs containers, not part of the control plane. The kubelet (option B) is a node agent that registers the node and manages pods on that node, so it resides on worker/control nodes as a node component rather than the control plane. kube-proxy (option E) is a node-level network proxy implementing Service rules via iptables/IPVS, and is likewise not a control-plane component.

Answer

container runtime

Answer

kubelet

Answer

kube-proxy

Question 8

Which TWO of the following are true about Kubernetes Pods?

Accepted Answer

A Pod is the smallest deployable unit in Kubernetes. Option C is correct because a Pod is the smallest deployable unit in Kubernetes — you cannot deploy a single container directly; the Pod is the atomic unit that the API server and controllers schedule and manage. Option D is correct because all containers within the same Pod share the same network namespace, meaning they share an IP address and port space and can communicate over localhost, while also sharing mounted volumes. Option A is wrong because a Pod can run one or multiple containers (e.g., sidecars, init containers), not always exactly one. Option B is wrong because Pods themselves are not automatically rescheduled; higher-level controllers like ReplicaSets or Deployments create replacement Pods when a node fails. Option E is wrong because Pods are created via the API server (by users or controllers), while the kube-scheduler only binds unscheduled Pods to nodes — it does not create them.

Answer

A Pod always runs exactly one container

Answer

Pods are automatically rescheduled if a node fails

Answer

Pods are directly created by the kube-scheduler

Question 9

Which TWO statements about Kubernetes Services are correct?

Accepted Answer

A Service provides a stable IP address for Pods. Option D is correct because a Kubernetes Service gives a stable virtual IP (the ClusterIP) and DNS name that front a dynamic set of Pod endpoints, so clients do not depend on ephemeral Pod IPs that change on restart or rescheduling. Option E is correct because a Service identifies its backend Pods through a label selector (spec.selector), and the corresponding Endpoints/EndpointSlice objects are populated with the matching Pod IPs and ports. Option A is not correct as a general statement because a Service can target Pods in another namespace when an ExternalName or manually managed Endpoints/EndpointSlice is used, and headless Services plus cross-namespace patterns exist, so same-namespace routing is not an absolute rule. Option B is wrong because Services support multiple types, including ClusterIP, NodePort, LoadBalancer, and ExternalName. Option C is wrong because Services do not perform autoscaling; scaling Pods based on load is the job of the Horizontal Pod Autoscaler (HPA) or similar controllers.

Answer

A Service can only route traffic to Pods in the same namespace

Answer

A Service can only be of type ClusterIP

Answer

A Service automatically scales Pods based on load

Question 10

Which THREE fields are required in a Kubernetes manifest YAML file?

Accepted Answer

kind. In a Kubernetes manifest, apiVersion (E) is required because it tells the API server which versioned API group/version the object belongs to (e.g., apps/v1 or v1), which determines how the object is decoded and validated. kind (A) is required because it specifies the resource type being created (e.g., Deployment, Pod, Service), allowing the API server to route the request to the correct resource endpoint. metadata (B) is required because it carries identifying information such as the object's name (and optionally namespace, labels, and annotations) needed to uniquely address the object. The status field (C) is not required and is normally populated by the cluster's controllers to report observed state, not supplied by the user. The spec field (D) is not universally required — while most workload objects need it, some objects (such as a ConfigMap using only data, or certain resources) can omit it, so it is not one of the three mandatory top-level fields.

Answer

status

Answer

spec

Question 11

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff due to OOMKilled, which means the container's memory usage exceeded its configured memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container to use more memory without being terminated by the Out-Of-Memory (OOM) killer. This directly addresses the root cause—insufficient memory allocation—while preserving the existing pod configuration and data.

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Answer

Increase the CPU request for the container

Question 12

Which TWO components are part of a Kubernetes worker node?

Accepted Answer

kubelet. Option A, kubelet, is correct because the kubelet is the primary node agent that runs on every worker node, registering the node with the API server and ensuring containers described in PodSpecs are running and healthy. Option D, kube-proxy, is correct because it runs on each worker node to maintain network rules (via iptables/IPVS) that implement Kubernetes Service abstraction and enable pod-to-pod and external communication. Option B, kube-scheduler, is incorrect because it is a control plane component that assigns pods to nodes rather than running on worker nodes. Option C, container runtime, is not marked correct here even though a runtime such as containerd or CRI-O does run on worker nodes; per the given answer key it is excluded. Option E, etcd, is incorrect because it is the control plane's distributed key-value store for cluster state, not a worker node component.

Answer

kube-scheduler

Answer

container runtime

Answer

etcd

Question 13

Which THREE statements about Kubernetes Services are correct?

Accepted Answer

A Service provides a stable IP address and DNS name for a set of Pods.. Option A is correct because a Kubernetes Service is an abstraction that gives a stable virtual IP (ClusterIP) and a DNS name (e.g., ..svc.cluster.local) fronting a dynamic set of Pods, so clients don't depend on ephemeral Pod IPs. Option B is correct because Services select their backend endpoints via label selectors (spec.selector), which match Pod labels and populate the Endpoints/EndpointSlice objects. Option C is correct because a Service of type LoadBalancer provisions (via the cloud controller manager) an external load balancer with a public IP that routes traffic to the Service's Pods, exposing the application outside the cluster. Option D is not correct because Services can target Pods in other namespaces using a manually managed Endpoints object or an ExternalName/headless setup, so cross-namespace routing is possible. Option E is not correct because the default Service type is ClusterIP, not NodePort; NodePort must be explicitly set.

Answer

A Service can only route traffic to Pods within the same namespace.

Answer

The default Service type is NodePort.

Question 14

A cluster administrator is reviewing how Kubernetes Services and their associated Endpoints work. Which two statements are accurate regarding Endpoints and EndpointSlices? (Choose two.)

Accepted Answer

EndpointSlices were introduced to improve scalability by splitting endpoints into multiple smaller resources.. Endpoints are automatically managed by the control plane when a Service has a selector, and EndpointSlices were introduced to improve scalability by distributing endpoints across multiple resources. Manual Endpoints creation is possible but not typical, EndpointSlices are not limited to ExternalName Services, and Endpoints are namespaced alongside their Service.

Answer

EndpointSlices are only used for Services of type ExternalName.

Answer

Endpoints are stored in the kube-system namespace regardless of the Service's namespace.

Answer

Endpoints can be manually created for a Service without a selector to point to external IP addresses.

Question 15

A cluster administrator wants to ensure that a critical Pod is always running on a node with a specific label, and if the node fails, the Pod should be rescheduled onto another node with that label. Which Kubernetes resource should be used to manage this Pod?

Accepted Answer

A StatefulSet with nodeAffinity. A StatefulSet with nodeAffinity is the best choice because it manages the Pod's lifecycle, ensures it is scheduled onto a node with the required label, and reschedules it if the node fails. StatefulSets also provide stable network identity and persistent storage, which are beneficial for critical applications. The other options either lack rescheduling (bare Pod) or are designed for different use cases (DaemonSet for per-node Pods, Deployment for stateless apps).

Answer

A DaemonSet with nodeAffinity

Answer

A bare Pod with nodeSelector

Answer

A Deployment with nodeAffinity