KCNA Kubernetes Fundamentals Practice Test 9 — 15 Questions

Question 1

A cluster has a node with the taint 'node-role.kubernetes.io/control-plane:NoSchedule'. A pod must be scheduled on this node for a special workload. Which action is required?

Accepted Answer

Add a toleration to the pod spec.. A taint on a node causes the scheduler to avoid placing pods on that node unless the pod explicitly tolerates the taint. By adding a toleration in the pod spec that matches the taint key, effect, and optionally the value, the pod becomes eligible to be scheduled on the tainted node. This is the standard Kubernetes mechanism for allowing pods to run on control-plane or other specially tainted nodes.

Answer

Use a nodeSelector to select the node.

Answer

Remove the taint from the node.

Answer

Use podAffinity to attract the pod to the node.

Question 2

Which TWO statements about Kubernetes namespaces are true?

Accepted Answer

Namespaces are used to divide cluster resources between multiple users or teams.. Namespaces are a fundamental mechanism in Kubernetes for dividing cluster resources among multiple users or teams, enabling multi-tenancy and resource management through policies like Role-Based Access Control (RBAC) and ResourceQuotas. Option E is correct because ResourceQuotas are Kubernetes objects that can be applied to a namespace to enforce aggregate limits on CPU, memory, and other resources, preventing any single team from exhausting cluster capacity.

Answer

All Kubernetes objects are namespaced.

Answer

Namespaces automatically isolate services in different namespaces from communicating.

Answer

Namespaces provide network isolation between pods by default.

Question 3

Refer to the exhibit. A pod is created with the above manifest. The container runs nginx listening on port 80, but the liveness probe is configured to check port 8080. What will happen?

Accepted Answer

The liveness probe will fail, causing the container to be restarted.. The liveness probe is configured to check port 8080, but the container only listens on port 80. Since the probe will never receive a successful HTTP response from port 8080, it will fail repeatedly. According to Kubernetes behavior, after the failure threshold is reached (default: 3 failures with a 10-second interval), kubelet will restart the container to attempt to recover it. This is the intended mechanism for detecting and remediating deadlocked or unresponsive applications.

Answer

The pod will fail to start because the probe port mismatches the container port.

Answer

The liveness probe will fail, but the pod will still be marked as Ready.

Answer

The pod will run successfully because the probe is not required.

Question 4

Refer to the exhibit. A pod 'my-pod' shows repeated 'BackOff' events after the container starts. Which is the most likely cause?

Accepted Answer

The application crashes shortly after starting.. The 'BackOff' event in Kubernetes indicates that the container has started but repeatedly crashes, causing the kubelet to increase the restart delay. Option D is correct because an application that crashes shortly after starting will trigger this restart loop, as the container exits with a non-zero exit code, leading to exponential backoff.

Answer

The image 'myapp:v2' does not exist.

Answer

The container exceeds its memory limit.

Answer

The liveness probe is failing.

Question 5

A development team deploys a microservice that crashes every few minutes. The deployment uses a single replica, and the pod restarts repeatedly. Which Kubernetes feature should be enabled to ensure the service remains available during failures?

Accepted Answer

Increase the replicas in the Deployment to at least 2. Increasing the replicas to at least 2 ensures that if one pod crashes, the other replica(s) can continue serving traffic, maintaining availability. With only a single replica, the service becomes unavailable every time the pod restarts. This is the most direct way to provide redundancy and fault tolerance for a stateless microservice.

Answer

Move the deployment to a separate namespace

Answer

Store the application configuration in a ConfigMap

Answer

Add a readiness probe to the pod

Question 6

A DevOps engineer needs to expose a set of pods running an HTTP API to external clients. The pods are stateless and should be load-balanced. Which Kubernetes resource should they use?

Accepted Answer

Service of type LoadBalancer. A Service of type LoadBalancer is the correct choice because it provisions an external load balancer (e.g., an AWS ELB or Azure LB) that distributes incoming traffic across the pods, exposing the stateless HTTP API to external clients. This resource automatically assigns a public IP and handles load balancing without requiring manual proxy configuration, making it ideal for external access to stateless workloads.

Answer

StatefulSet with a headless Service

Answer

Ingress resource without a Service

Answer

Service of type ClusterIP

Question 7

An administrator notices that a pod in a Deployment is stuck in CrashLoopBackOff. The pod logs show 'Error: failed to start container: exec: "app": executable file not found in $PATH'. What is the most likely cause?

Accepted Answer

The container image does not contain the binary specified in the pod's command field. The error 'exec: "app": executable file not found in $PATH' indicates that the container image does not contain the binary or script specified in the pod's command field (e.g., `command: ["app"]`). This typically happens when the image is built without the expected executable, the command path is incorrect, or the image tag points to a different version. The container fails to start because the runtime cannot locate the entrypoint.

Answer

The image registry credentials are missing

Answer

The liveness probe is misconfigured and killing the container

Answer

The container is running as a non-root user without proper permissions

Question 8

A team uses a Deployment with 3 replicas and a RollingUpdate strategy. They update the container image. During the update, one of the new pods fails to start. What will happen by default?

Accepted Answer

The update pauses, keeping the remaining old replicas running. By default, a Deployment with a RollingUpdate strategy uses a `maxUnavailable` of 25% and a `maxSurge` of 25%. When a new pod fails to start (e.g., CrashLoopBackOff or ImagePullBackOff), the ReplicaSet controller will not create additional new pods beyond the surge limit, and the update will effectively pause because the new ReplicaSet cannot reach its desired replica count. The old ReplicaSet remains running with its existing pods, ensuring availability is maintained.

Answer

The entire update is rolled back and all old pods are deleted

Answer

The Deployment automatically rolls back to the previous image

Answer

The failed pod is terminated and not retried

Question 9

A company wants to ensure that a database pod runs on a node with SSD storage. How should this be achieved?

Accepted Answer

Label SSD nodes with 'disk=ssd' and add a nodeSelector to the pod. NodeSelector is a field in the Pod spec that constrains which nodes the Pod can be scheduled on, based on node labels. By labeling nodes with SSD storage as 'disk=ssd' and adding a nodeSelector with that label to the Pod, Kubernetes will only schedule the Pod on nodes that have the matching label, ensuring it runs on SSD storage.

Answer

Set a resource request for local SSD storage in the pod spec

Answer

Use pod anti-affinity to avoid non-SSD nodes

Answer

Add a taint to nodes without SSDs and a toleration to the pod

Question 10

Which TWO statements about Kubernetes Services are correct?

Accepted Answer

The default Service type is ClusterIP. The default Service type in Kubernetes is ClusterIP, which exposes the Service on a cluster-internal IP address. This means the Service is only reachable from within the cluster, providing a stable internal endpoint for pod-to-pod communication without external exposure.

Answer

A Service can expose only one container port

Answer

A Service can only route traffic to pods on the same node as the Service

Answer

A Service of type NodePort exposes the service only on the node where the pod is running

Question 11

Which THREE are valid ways to provide configuration data to a pod in Kubernetes?

Accepted Answer

Mount a ConfigMap as a volume. A ConfigMap is a Kubernetes API object designed to store non-confidential configuration data in key-value pairs. Mounting a ConfigMap as a volume makes its data available as files in the pod's filesystem, allowing applications to read configuration without hardcoding it into the container image or pod spec. This approach decouples configuration from containerized applications, following the principle of immutable infrastructure.

Answer

Use an init container to write configuration to a shared volume

Answer

Hardcode environment variables in the pod spec that contain sensitive data

Question 12

A StatefulSet named 'web' with 3 replicas is deployed in the 'production' namespace. The first two pods are running, but the third pod 'web-2' is pending with the error shown. What is the most likely cause?

Accepted Answer

The pod anti-affinity rule prevents more than one pod per node, and there are only 3 nodes. The error indicates that the third pod 'web-2' is pending due to a scheduling conflict. Pod anti-affinity rules, when configured with a 'requiredDuringSchedulingIgnoredDuringExecution' policy, prevent more than one pod from the same StatefulSet from being scheduled on the same node. With only 3 nodes available and the first two pods already occupying distinct nodes, the third pod cannot be placed, causing it to remain pending.

Answer

The StatefulSet requires a headless Service that does not exist

Answer

The pod has a resource request that cannot be satisfied by any node

Answer

There are not enough nodes in the cluster to schedule the third pod

Question 13

A team observes that a Pod is stuck in CrashLoopBackOff. The Pod runs a single container with an entrypoint that exits with non-zero code after a few seconds. The team wants to inspect the container's logs to understand why it is crashing. Which command should they use?

Accepted Answer

kubectl logs --previous. The `kubectl logs --previous` command retrieves the logs from the previous instance of a crashed container. Since the Pod is in CrashLoopBackOff, the current container has already exited, and the `--previous` flag accesses the logs of the last terminated container, which contains the crash output (e.g., the non-zero exit code and error messages). This is the direct way to see why the entrypoint failed.

Answer

kubectl get pods

Answer

kubectl describe pod <pod-name>

Answer

kubectl exec -it <pod-name> -- sh

Question 14

Refer to the exhibit. The nginx Pod is created, but the Pod never becomes Ready. The container starts and runs. What is the most likely reason?

Accepted Answer

The liveness probe is failing because /healthz endpoint does not exist, causing the container to restart.. The liveness probe is configured to check the /healthz endpoint, but the default nginx container does not serve a /healthz endpoint. This causes the liveness probe to fail, and Kubernetes restarts the container according to the probe's failure threshold. Since the container keeps restarting, it never reaches the Ready state, even though the container starts and runs initially.

Answer

The nginx:latest image does not exist.

Answer

The containerPort is not matching the actual port nginx listens on.

Answer

The readiness probe is failing because the root path is not returning 200.

Question 15

A developer wants to run a one-time batch job that processes a queue and then terminates. Which Kubernetes resource should they use?

Accepted Answer

Job. A Kubernetes Job is designed for finite, batch-oriented tasks that run to completion, such as processing a queue and then terminating. Unlike controllers that maintain a desired state (like Deployments or StatefulSets), a Job creates one or more Pods and ensures they successfully exit, making it the correct choice for a one-time batch job.

Answer

StatefulSet

Answer

Deployment

Answer

DaemonSet