KCNA Kubernetes Fundamentals Practice Test 8 — 15 Questions

Question 1

A cluster administrator needs to allow Pods in the 'frontend' namespace to communicate with Pods in the 'backend' namespace on TCP port 8080, while denying all other ingress to the backend namespace. The cluster uses a CNI plugin that enforces NetworkPolicy. Which NetworkPolicy configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A NetworkPolicy in the backend namespace with podSelector matching backend Pods and an ingress rule allowing from namespaceSelector matching frontend and port 8080.. NetworkPolicy must be placed in the namespace of the Pods it selects, and the ingress from clause uses namespaceSelector to allow traffic from Pods in another namespace. Selecting backend Pods with a policy that permits frontend traffic on TCP 8080, while allowing no other ingress, implements the least-privilege requirement. The other options either target the wrong namespace, use podSelector incorrectly across namespaces, or allow overly broad sources.

Answer

A NetworkPolicy in the default namespace with podSelector matching all Pods and an ingress rule allowing from ipBlock 0.0.0.0/0 on port 8080.

Answer

A NetworkPolicy in the backend namespace with podSelector matching backend Pods and an ingress rule allowing from podSelector matching frontend Pods and port 8080.

Answer

A NetworkPolicy in the frontend namespace with podSelector matching frontend Pods and an egress rule allowing to namespaceSelector matching backend and port 8080.

Question 2

A cluster administrator is reviewing the components of the Kubernetes control plane. Which two of the following are core control plane components? (Choose two.)

Accepted Answer

kube-apiserver. The core control plane components include kube-apiserver, kube-scheduler, kube-controller-manager, and etcd. Among the options, kube-apiserver and kube-scheduler are explicitly control plane components. kubelet and kube-proxy are node components, and etcd is the backing store, not typically classified as a control plane component in the same category.

Answer

kubelet

Answer

kube-proxy

Answer

etcd

Question 3

A Kubernetes administrator is troubleshooting a Pod that is stuck in `Pending` state. The Pod's events show `0/3 nodes are available: 3 Insufficient cpu`. The administrator wants to resolve this by adjusting the Pod's resource requests. Which two actions would directly address the root cause? (Choose two.)

Accepted Answer

Add more nodes to the cluster that have sufficient allocatable CPU for the Pod's request.. The Pending state is caused by insufficient CPU on all nodes to satisfy the Pod's CPU request. The scheduler uses requests to filter nodes. Reducing the request lowers the bar so an existing node can accommodate it, and adding a node with enough allocatable CPU provides a new feasible target. Both actions directly fix the root cause. Limits and nodeSelector do not change the fundamental mismatch between request and available capacity.

Answer

Set a nodeSelector to target a node with more CPU.

Answer

Increase the Pod's CPU limit to allow it to use more CPU.

Answer

Remove the CPU limit from the Pod's container spec.

Question 4

A team runs a StatefulSet named `db` with 3 replicas in the `data` namespace. They need to connect to the third pod directly for a maintenance task. Which DNS name correctly resolves to that specific pod?

Accepted Answer

db-2.db.data.svc.cluster.local. StatefulSets give each pod a stable, ordinal identity. When a headless Service governs the set, CoreDNS creates a DNS record for each pod in the form pod-name.service-name.namespace.svc.cluster.local. For the third replica of the db StatefulSet in the data namespace, that is db-2.db.data.svc.cluster.local, which is the correct way to address one specific pod.

Answer

db-2.data.svc.cluster.local

Answer

db-2.data.pod.cluster.local

Answer

db.data.svc.cluster.local

Question 5

A developer is preparing a Namespace for a new application. They want to ensure that Pods created in this Namespace are automatically assigned to a specific node pool labeled `workload=backend` and that no other workloads can run on that node pool. Which two Kubernetes features should they configure? (Choose two.)

Accepted Answer

A taint of dedicated=backend:NoSchedule on the nodes in the target node pool.. Dedicated node pools require both attraction and repulsion. nodeAffinity or nodeSelector attracts the intended Pods to nodes with workload=backend, while a NoSchedule taint on those nodes repels Pods that lack the matching toleration. ResourceQuota, PodDisruptionBudget, and NetworkPolicy address resource fairness, availability during disruptions, and network traffic respectively, none of which control scheduling placement.

Answer

A ResourceQuota limiting the number of Pods in the Namespace.

Answer

A PodDisruptionBudget for the application's Pods.

Answer

A NetworkPolicy restricting ingress to the application's Pods.

Question 6

A developer needs to inspect the labels and annotations of a running pod named `api-7f9c` in the `prod` namespace, and also wants to find all pods in that namespace that carry the label `tier=backend`. Which two commands accomplish these goals? (Choose two.)

Accepted Answer

kubectl get pod api-7f9c -n prod --show-labels. Labels are the queryable metadata used by selectors, while annotations hold non-identifying metadata. The --show-labels flag on kubectl get reveals a pod's labels, and the -l flag filters a list by label selector. Together, kubectl get pod api-7f9c -n prod --show-labels and kubectl get pods -n prod -l tier=backend let the developer inspect one pod's labels and find all pods with a given label.

Answer

kubectl describe pod api-7f9c -n prod --show-labels

Answer

kubectl annotate pod api-7f9c -n prod --list

Answer

kubectl get pods -n prod --field-selector tier=backend

Question 7

A platform engineer needs to run a batch job that must complete exactly once and then terminate. The job requires a stable network identity so that other services can reach it by a fixed DNS name while it is running. Which Kubernetes resource should be used?

Accepted Answer

StatefulSet. StatefulSet is designed for applications that require stable, unique network identifiers and ordered deployment. It uses a headless Service to give each Pod a consistent DNS name, which allows other services to reach it reliably. Job, DaemonSet, and CronJob do not offer this stable network identity, making StatefulSet the only suitable choice for this scenario.

Answer

Job

Answer

DaemonSet

Answer

CronJob

Question 8

A developer is configuring a Pod to use a ConfigMap and a Secret. Which two methods can be used to make the data available to the Pod? (Choose two.)

Accepted Answer

Use environment variables to inject the data from the ConfigMap and Secret.. ConfigMaps and Secrets can be consumed by Pods either as volumes or as environment variables. Mounting as volumes allows for automatic updates and file-based access, while environment variables provide simple injection but are static. The other methods are not standard or recommended for injecting this data.

Answer

Reference the ConfigMap and Secret in the Pod's command and args fields.

Answer

Use the kubectl exec command to copy the data into the Pod at runtime.

Answer

Use a downward API to expose the ConfigMap and Secret data.

Question 9

A developer deploys a pod that continuously restarts. 'kubectl describe pod' shows the container exits with code 137. What is the most likely cause?

Accepted Answer

The container is exceeding its memory limit and being OOM-killed.. Exit code 137 (128 + 9) indicates the container was killed by SIGKILL. In Kubernetes, this most commonly occurs when the container exceeds its memory limit, triggering the OOM (Out-Of-Memory) killer. The kubelet enforces the resource limits specified in the pod spec, and when memory usage surpasses the limit, the kernel terminates the process with SIGKILL, resulting in exit code 137.

Answer

The liveness probe is failing and restarting the container.

Answer

The init container is failing and blocking the main container.

Answer

The pod is hitting a resource quota limit at the namespace level.

Question 10

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/4 nodes are available: 4 node(s) had taint {node.kubernetes.io/unreachable: }, that the pod didn't tolerate.' What is the most likely cause?

Accepted Answer

All nodes are unreachable or have been cordoned.. The taint `node.kubernetes.io/unreachable` is automatically added by the node controller when a node becomes unreachable (e.g., network failure, kubelet stops heartbeating). The error shows all 4 nodes have this taint and the pod has no matching toleration, meaning the scheduler cannot place the pod. This directly indicates all nodes are unreachable or have been cordoned (which also adds the `node.kubernetes.io/unschedulable` taint, but here the specific taint is `unreachable`).

Answer

All nodes have disk pressure.

Answer

The pod has a toleration that matches the taint.

Answer

The nodes do not have enough CPU or memory.

Question 11

A team wants to minimize downtime during a Deployment rollout. Which strategy ensures that new pods are created before old pods are terminated?

Accepted Answer

Set strategy type to 'RollingUpdate' with maxSurge=1, maxUnavailable=0.. Setting `maxSurge=1` and `maxUnavailable=0` in a RollingUpdate strategy ensures that one additional pod is created above the desired replica count before any existing pod is terminated. This guarantees zero downtime by maintaining full capacity during the rollout, as new pods become ready before old ones are removed.

Answer

Set strategy type to 'Recreate'.

Answer

Set strategy type to 'RollingUpdate' with maxSurge=0, maxUnavailable=1.

Answer

Set strategy type to 'RollingUpdate' with maxSurge=1, maxUnavailable=1.

Question 12

A developer creates a pod that needs to securely access a database password stored in the cluster. Which Kubernetes resource should be used to inject the password as an environment variable?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for injecting sensitive data like a database password into a Pod as an environment variable. Secrets store base64-encoded data and are designed specifically for confidential information, unlike ConfigMaps which store non-sensitive configuration. When mounted as environment variables, Secrets ensure the password is not exposed in plaintext in the Pod specification or image layers.

Answer

ServiceAccount

Answer

ConfigMap

Answer

PersistentVolumeClaim

Question 13

An administrator runs 'kubectl get pods' and sees that a pod is in 'Pending' state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taints that the pod didn't tolerate, 3 nodes had insufficient memory'. What is the most likely issue?

Accepted Answer

The pod's resource requests exceed available memory on three nodes.. The scheduler event explicitly states '3 nodes had insufficient memory', which directly indicates that the pod's resource requests (specifically memory) exceed the available allocatable memory on those three nodes. The fourth node is unavailable due to taints, leaving zero schedulable nodes, hence the 'Pending' state.

Answer

The node with the taint has a toleration mismatch.

Answer

The pod's image pull is failing.

Answer

The pod was evicted due to resource pressure.

Question 14

A cluster has a node with the taint 'node-role.kubernetes.io/control-plane:NoSchedule'. A pod must be scheduled on this node for a special workload. Which action is required?

Accepted Answer

Add a toleration to the pod spec.. A taint on a node causes the scheduler to avoid placing pods on that node unless the pod explicitly tolerates the taint. By adding a toleration in the pod spec that matches the taint key, effect, and optionally the value, the pod becomes eligible to be scheduled on the tainted node. This is the standard Kubernetes mechanism for allowing pods to run on control-plane or other specially tainted nodes.

Answer

Use a nodeSelector to select the node.

Answer

Remove the taint from the node.

Answer

Use podAffinity to attract the pod to the node.

Question 15

Which TWO statements about Kubernetes namespaces are true?

Accepted Answer

Namespaces are used to divide cluster resources between multiple users or teams.. Namespaces are a fundamental mechanism in Kubernetes for dividing cluster resources among multiple users or teams, enabling multi-tenancy and resource management through policies like Role-Based Access Control (RBAC) and ResourceQuotas. Option E is correct because ResourceQuotas are Kubernetes objects that can be applied to a namespace to enforce aggregate limits on CPU, memory, and other resources, preventing any single team from exhausting cluster capacity.

Answer

All Kubernetes objects are namespaced.

Answer

Namespaces automatically isolate services in different namespaces from communicating.

Answer

Namespaces provide network isolation between pods by default.