KCNA Kubernetes Fundamentals Practice Test 8 — 15 Questions

Question 1

A pod is stuck in 'Pending' state. Which of the following is the MOST likely cause?

Accepted Answer

There are no nodes with enough resources to run the pod. A pod remains in 'Pending' state when it cannot be scheduled onto a node. The most common reason is insufficient resources (CPU, memory, or ephemeral storage) on any available node to satisfy the pod's resource requests. The Kubernetes scheduler continuously evaluates node conditions and resource availability; if no node meets the pod's requirements, the pod stays unscheduled and pending.

Answer

The pod has been deleted

Answer

The container image is invalid

Answer

The pod's liveness probe is failing

Question 2

Which three of the following are valid ways to expose a service externally in Kubernetes? (Select THREE.)

Accepted Answer

Ingress. Ingress is correct because it provides HTTP/HTTPS-based external access to services using host-based or path-based routing rules, typically via an Ingress controller (e.g., NGINX, Traefik). It exposes a service externally by defining rules that map external traffic to internal ClusterIP services, making it a valid method for external exposure.

Answer

ExternalName

Answer

ClusterIP

Question 3

Which Kubernetes command displays the current state of a pod, including its IP address, node, and container statuses?

Accepted Answer

kubectl get pod -o wide. `kubectl get pod -o wide` extends the default output to include additional columns such as the pod's IP address, the node it is scheduled on, and the container statuses (e.g., READY state). This command queries the Kubernetes API server for the pod's current state and formats the response with extra details, making it the most direct way to view the pod's IP and node assignment in a single line.

Answer

kubectl describe pod

Answer

kubectl logs pod

Answer

kubectl get pod

Question 4

Which THREE statements about Kubernetes Namespaces are correct?

Accepted Answer

Namespaces provide a way to divide cluster resources between multiple users or teams.. Namespaces partition cluster resources into virtual sub-clusters, enabling multi-tenancy and resource isolation for different teams or users. Option D is correct because when a namespace is deleted, Kubernetes automatically removes all resources (e.g., Pods, Services) that belong to that namespace. Option E is incorrect: while resource quotas can be applied to namespaces, they are an optional feature and not an inherent property; the statement is misleading because quotas must be explicitly configured and do not limit all resource types (e.g., node resources).

Answer

All Kubernetes resources must be created within a namespace.

Answer

Namespaces provide network isolation by default.

Question 5

Which THREE statements about Kubernetes Pods are correct?

Accepted Answer

A Pod is the smallest deployable unit in Kubernetes.. A Pod is the smallest and most basic deployable unit in Kubernetes, representing a single instance of a running process. Option C is correct because a Pod is scheduled on a single node and cannot span multiple nodes; this is a fundamental property of Pods. Option D is incorrect because, although containers within a Pod share the same network namespace, the statement itself is not uniquely correct in the context of the question's requirement for two statements; moreover, sharing the network namespace does not imply sharing of other resources such as the process namespace. Options A and E are false as containers in a Pod can communicate via localhost, and Pods themselves are not resilient without controllers.

Answer

Containers within a Pod cannot communicate with each other without using Services.

Answer

Pods are the most resilient unit in Kubernetes and automatically recover from failures.

Question 6

A developer deploys a pod that continuously restarts. 'kubectl describe pod' shows the container exits with code 137. What is the most likely cause?

Accepted Answer

The container is exceeding its memory limit and being OOM-killed.. Exit code 137 (128 + 9) indicates the container was killed by SIGKILL. In Kubernetes, this most commonly occurs when the container exceeds its memory limit, triggering the OOM (Out-Of-Memory) killer. The kubelet enforces the resource limits specified in the pod spec, and when memory usage surpasses the limit, the kernel terminates the process with SIGKILL, resulting in exit code 137.

Answer

The liveness probe is failing and restarting the container.

Answer

The init container is failing and blocking the main container.

Answer

The pod is hitting a resource quota limit at the namespace level.

Question 7

An application requires a unique identifier per replica, stored in an environment variable. Which Kubernetes resource should be used to inject this identifier into each pod without manual updates?

Accepted Answer

StatefulSet with an environment variable derived from the pod name.. A StatefulSet provides stable, unique network identities and ordered pod naming (e.g., pod-0, pod-1). The pod name can be exposed as an environment variable using the Downward API or Kubernetes hostname field, giving each replica a unique identifier without manual updates. Deployments create identical pods with no ordering, DaemonSets run one pod per node, and Jobs are for batch processing, so only a StatefulSet meets the requirement.

Answer

Deployment with pod anti-affinity to schedule each pod on a different node.

Answer

DaemonSet with a node name environment variable.

Answer

Job with a completion index environment variable.

Question 8

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/4 nodes are available: 4 node(s) had taint {node.kubernetes.io/unreachable: }, that the pod didn't tolerate.' What is the most likely cause?

Accepted Answer

All nodes are unreachable or have been cordoned.. The taint `node.kubernetes.io/unreachable` is automatically added by the node controller when a node becomes unreachable (e.g., network failure, kubelet stops heartbeating). The error shows all 4 nodes have this taint and the pod has no matching toleration, meaning the scheduler cannot place the pod. This directly indicates all nodes are unreachable or have been cordoned (which also adds the `node.kubernetes.io/unschedulable` taint, but here the specific taint is `unreachable`).

Answer

All nodes have disk pressure.

Answer

The pod has a toleration that matches the taint.

Answer

The nodes do not have enough CPU or memory.

Question 9

A team wants to minimize downtime during a Deployment rollout. Which strategy ensures that new pods are created before old pods are terminated?

Accepted Answer

Set strategy type to 'RollingUpdate' with maxSurge=1, maxUnavailable=0.. Setting `maxSurge=1` and `maxUnavailable=0` in a RollingUpdate strategy ensures that one additional pod is created above the desired replica count before any existing pod is terminated. This guarantees zero downtime by maintaining full capacity during the rollout, as new pods become ready before old ones are removed.

Answer

Set strategy type to 'Recreate'.

Answer

Set strategy type to 'RollingUpdate' with maxSurge=0, maxUnavailable=1.

Answer

Set strategy type to 'RollingUpdate' with maxSurge=1, maxUnavailable=1.

Question 10

A pod in a ReplicaSet is failing with 'CrashLoopBackOff'. 'kubectl logs pod' shows 'Error: listen tcp :8080: bind: address already in use'. What is the most likely cause?

Accepted Answer

The container's process is not terminating quickly enough on SIGTERM, causing a port conflict on restart.. The error 'address already in use' on port 8080 indicates that when the container restarts, the previous process is still holding the port. This typically happens when the application does not handle SIGTERM properly and does not shut down within the terminationGracePeriodSeconds (default 30s), so the old process lingers while the new one tries to bind to the same port, causing a CrashLoopBackOff.

Answer

The readiness probe is misconfigured.

Answer

The container image is missing the application binary.

Answer

The pod is using hostPort and two pods on the same node conflict.

Question 11

Which THREE of the following are required for a Kubernetes pod to be considered healthy and ready to serve traffic?

Accepted Answer

The startup probe has succeeded.. A startup probe must succeed before the kubelet considers the container started. Until the startup probe succeeds, the readiness and liveness probes are not active, so the pod cannot be marked healthy or ready. This is defined in the Kubernetes API for startup probes, which delay the start of other probes until the application has initialized.

Answer

The pod has at least one endpoint in its Service's endpoints list.

Answer

The liveness probe has succeeded.

Question 12

A team notices that a pod remains in 'CrashLoopBackOff' state after deployment. The application logs show 'Error: unable to bind to port 8080'. What is the most likely cause?

Accepted Answer

The container's port is already in use on the host node.. The error 'unable to bind to port 8080' indicates that the container process cannot open port 8080 for listening. The most likely cause is that another process on the host node is already using port 8080, preventing the container from binding to it. This is a classic port conflict scenario, where the host's network namespace has a port already allocated, and the container (even with its own network namespace) may be using host networking or the port is mapped from the host.

Answer

The pod's resource limits are too low.

Answer

An environment variable has a typo in the Deployment spec.

Answer

The readiness probe is misconfigured.

Question 13

A DevOps engineer wants to ensure that a critical application pod is rescheduled on a different node if its current node fails. The pod should be scheduled with a preference for nodes in a specific availability zone but can run elsewhere if needed. Which scheduling mechanism should be used?

Accepted Answer

Use a Deployment with a preferred nodeAffinity rule.. A Deployment with a preferred nodeAffinity rule is correct because it allows the pod to be rescheduled on a different node if the current node fails, while expressing a preference for nodes in a specific availability zone. The 'preferred' (soft) rule ensures scheduling flexibility—the pod can run elsewhere if no zone-matching nodes are available—which aligns with the requirement for high availability without strict zone constraints.

Answer

Use a StatefulSet with podAntiAffinity.

Answer

Run a static pod defined in the kubelet configuration.

Answer

Create a DaemonSet with a nodeSelector for the zone.

Question 14

A developer creates a pod that needs to securely access a database password stored in the cluster. Which Kubernetes resource should be used to inject the password as an environment variable?

Accepted Answer

Secret. A Secret is the correct Kubernetes resource for injecting sensitive data like a database password into a Pod as an environment variable. Secrets store base64-encoded data and are designed specifically for confidential information, unlike ConfigMaps which store non-sensitive configuration. When mounted as environment variables, Secrets ensure the password is not exposed in plaintext in the Pod specification or image layers.

Answer

ServiceAccount

Answer

ConfigMap

Answer

PersistentVolumeClaim

Question 15

An administrator runs 'kubectl get pods' and sees that a pod is in 'Pending' state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taints that the pod didn't tolerate, 3 nodes had insufficient memory'. What is the most likely issue?

Accepted Answer

The pod's resource requests exceed available memory on three nodes.. The scheduler event explicitly states '3 nodes had insufficient memory', which directly indicates that the pod's resource requests (specifically memory) exceed the available allocatable memory on those three nodes. The fourth node is unavailable due to taints, leaving zero schedulable nodes, hence the 'Pending' state.

Answer

The node with the taint has a toleration mismatch.

Answer

The pod's image pull is failing.

Answer

The pod was evicted due to resource pressure.