KCNA Kubernetes Fundamentals — Timed 20 Questions

Question 1

Which TWO of the following are valid ways to expose a set of pods as a network service within a Kubernetes cluster?

Accepted Answer

Create a Service of type ClusterIP.. A Service of type ClusterIP exposes a set of pods as a network service within the cluster by assigning a stable virtual IP address and DNS name. Traffic to this IP is load-balanced across the pods matching the Service's label selector, enabling internal cluster communication without external exposure. An Ingress resource does not directly expose pods, but it routes external HTTP/HTTPS traffic to an internal Service (e.g., ClusterIP or NodePort), which then forwards to the pods. Therefore, both D and E are valid ways to expose pods as a network service. In contrast, a StatefulSet manages pod identity and storage, not network exposure; an ExternalName Service provides a DNS alias but does not route traffic to pods; and a ConfigMap stores configuration data, not pod IPs.

Answer

Create a StatefulSet with pod hostnames.

Answer

Create a Service of type ExternalName.

Answer

Create a ConfigMap with pod IPs.

Question 2

Which THREE of the following are valid ways to expose a set of pods as a network service in Kubernetes?

Accepted Answer

Creating a Service of type NodePort.. A Service of type NodePort exposes the pods on a static port on each node's IP address, making the service accessible externally. This is a valid method for exposing a set of pods as a network service in Kubernetes.

Answer

Creating a headless Service (clusterIP: None).

Answer

Creating a Deployment with a label selector.

Question 3

Which Kubernetes control plane component is responsible for storing the cluster state and configuration data?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as Kubernetes' single source of truth for all cluster state and configuration data. It stores objects like Pods, Services, Deployments, and Secrets, and is the only component that holds persistent state. The kube-apiserver reads from and writes to etcd, but etcd itself is the storage backend.

Answer

kube-controller-manager

Answer

kube-apiserver

Answer

kube-scheduler

Question 4

You need to run a batch job that processes data and then exits. Which Kubernetes resource type is most appropriate for this workload?

Accepted Answer

Job. A Kubernetes Job is designed for workloads that run to completion and then exit, such as batch processing, data transformation, or one-off tasks. Unlike controllers that maintain a desired number of running Pods (like Deployments), Jobs ensure that a specified number of Pods successfully terminate, making them the correct choice for this scenario.

Answer

Deployment

Answer

DaemonSet

Answer

StatefulSet

Question 5

What is the smallest deployable unit in Kubernetes?

Accepted Answer

Pod. A Pod is the smallest and simplest unit in the Kubernetes object model, representing a single instance of a running process in the cluster. It encapsulates one or more containers, shared storage, and a unique network IP, making it the atomic unit of scheduling and deployment.

Answer

Deployment

Answer

Node

Answer

Container

Question 6

Which THREE of the following are valid use cases for Kubernetes Namespaces? (Select 3)

Accepted Answer

To enforce resource quotas and limits on the resources within the namespace. Kubernetes Namespaces provide a mechanism to partition a single cluster into multiple virtual clusters. Option A is correct because ResourceQuota objects are scoped to namespaces, allowing enforcement of resource quotas and limits. Option B is correct because namespaces can create separate environments like development, staging, and production within the same cluster. Option E is correct because namespaces facilitate multi-tenancy by separating resources for different teams or projects.

Answer

To isolate cluster-wide resources such as Nodes and PersistentVolumes

Answer

To improve performance by reducing network latency between Pods

Question 7

Which THREE of the following are valid attributes in a Kubernetes Pod specification? (Select 3)

Accepted Answer

volumes. A is correct because `volumes` is a top-level field in a Pod spec that defines storage volumes available to the Pod, which can then be mounted into containers. This field is part of the core Pod API (v1) and is essential for persistent or ephemeral storage configurations.

Answer

ports

Answer

clusterIP

Question 8

A developer wants to expose a set of pods running a web application internally within the cluster using a stable IP address. Which Kubernetes resource should they create?

Accepted Answer

Service. A Service of type ClusterIP provides a stable virtual IP address and DNS name that load-balances traffic to a set of pods, making it the correct resource for internal cluster exposure. Unlike other resources, a Service abstracts the pod IPs and ensures connectivity even if pods are rescheduled or scaled.

Answer

Ingress

Answer

ConfigMap

Answer

Deployment

Question 9

Which Kubernetes resource can be used to assign a pod to a specific node?

Accepted Answer

Node affinity rules in the pod spec. Node affinity rules in the pod spec are a set of constraints that define which nodes a pod can be scheduled on, based on node labels. This is a native Kubernetes scheduling feature that allows you to attract pods to specific nodes using required or preferred matching rules, such as `requiredDuringSchedulingIgnoredDuringExecution`. This directly answers the question of assigning a pod to a specific node.

Answer

A NetworkPolicy

Answer

A Service account

Answer

A ConfigMap

Question 10

A developer creates a Deployment with the following YAML snippet:

```yaml
apiVersion: apps/v1
kind: Deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: frontend
  template:
    metadata:
      labels:
        app: frontend
    spec:
      containers:
      - name: nginx
        image: nginx:1.21
```

What will happen if the label 'app: frontend' is omitted from the pod template's metadata?

Accepted Answer

The Deployment will fail to create because the selector and template labels mismatch. The Deployment's `spec.selector.matchLabels` must match the pod template's labels. If `app: frontend` is omitted from the template metadata, the selector (which is immutable after creation) will not match any pods, causing the Deployment controller to fail to create pods and report a `SelectorTemplateMismatch` error. Kubernetes validates this at admission time, rejecting the Deployment creation.

Answer

The Deployment will create pods with a random label

Answer

The pods will be created but will not be part of the Deployment

Answer

The pods will be created but will not have networking

Question 11

Which command is used to view the logs of a pod named 'web-pod'?

Accepted Answer

kubectl logs web-pod. The correct command to view logs from a pod in Kubernetes is 'kubectl logs web-pod'. This command retrieves the current stdout/stderr output from the primary container in the specified pod, which is the standard method for accessing container logs without entering the pod.

Answer

kubectl describe pod web-pod

Answer

kubectl get logs web-pod

Answer

kubectl exec web-pod -- logs

Question 12

A pod has both resource requests and limits defined. The container is using more CPU than the request but less than the limit. What will happen?

Accepted Answer

The container will continue to run normally. When a container's CPU usage exceeds its request but stays below its limit, Kubernetes treats the container as running within its allowed range. The request guarantees baseline resources, while the limit caps usage; as long as usage is below the limit, no throttling or eviction occurs. The container continues to run normally because CPU limits are enforced via CFS quotas only when usage reaches the limit, and requests are used for scheduling and QoS classification.

Answer

The container will be evicted from the node

Answer

The container will be throttled

Answer

The container will be terminated

Question 13

Which two components are part of the Kubernetes worker node? (Choose two.)

Accepted Answer

kube-proxy. kube-proxy is a network proxy that runs on each worker node, implementing part of the Kubernetes Service concept. It maintains network rules (e.g., iptables or IPVS) that allow network communication to Pods from inside or outside the cluster, handling load balancing for Services.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 14

Which component of the Kubernetes control plane stores the cluster state?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as the single source of truth for the entire Kubernetes cluster. It stores all cluster state data, including configuration, secrets, and the desired state of every object (Pods, Deployments, Services, etc.). The kube-apiserver is the only component that directly communicates with etcd, ensuring that all state changes go through a consistent, versioned API.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kube-apiserver

Question 15

A developer creates a Deployment with 'replicas: 3'. After applying the manifest, only 2 pods are running. Which command would help identify why the third pod was not created?

Accepted Answer

kubectl describe deployment my-deployment. `kubectl describe deployment my-deployment` provides a detailed status of the Deployment, including the ReplicaSet events, pod template, and any conditions (e.g., `Available`, `Progressing`) that explain why the desired 3 replicas are not met. It surfaces errors like insufficient resources, failed scheduling, or image pull failures that prevent the third pod from being created.

Answer

kubectl logs deployment/my-deployment

Answer

kubectl get pods -o wide

Answer

kubectl get events --all-namespaces

Question 16

Which resource provides stable network endpoints to a set of pods, regardless of pod IP changes?

Accepted Answer

Service. A Service provides a stable virtual IP and DNS name that remains constant even as pods are created, destroyed, or rescheduled. It uses label selectors to dynamically route traffic to the backing pods, abstracting away their individual IP changes. This is the core mechanism for reliable network endpoints in Kubernetes.

Answer

ConfigMap

Answer

Deployment

Answer

Ingress

Question 17

A pod in the 'default' namespace cannot reach a pod in the 'backend' namespace by service name 'db-service'. Both namespaces exist and the service is running. What is the most likely cause?

Accepted Answer

The pod is using the wrong service name format for cross-namespace access. D is correct because in Kubernetes, a pod in one namespace cannot reach a service in another namespace using just the service name (e.g., 'db-service'). Cross-namespace service discovery requires the fully qualified DNS name in the format ..svc.cluster.local (e.g., 'db-service.backend.svc.cluster.local'). Using only the service name resolves within the same namespace, causing the connection to fail.

Answer

The pod does not have network policy allowing cross-namespace traffic

Answer

The service is not exposed on a port

Answer

The kube-proxy is not running

Question 18

Which kubectl command is used to apply a manifest file to create or update resources?

Accepted Answer

kubectl apply -f manifest.yaml. `kubectl apply -f manifest.yaml` is the declarative management command that creates or updates resources by applying a configuration manifest. It uses a three-way merge algorithm to compute the changes needed to reconcile the desired state in the manifest with the current state in the cluster, making it suitable for both initial creation and subsequent updates.

Answer

kubectl update -f manifest.yaml

Answer

kubectl run -f manifest.yaml

Answer

kubectl create -f manifest.yaml

Question 19

A Deployment is configured with 'strategy.type: RollingUpdate' and 'strategy.rollingUpdate.maxUnavailable: 0'. What is the effect during a rolling update?

Accepted Answer

No pod will be terminated until a new pod is ready. Setting `maxUnavailable: 0` means the Deployment controller will not terminate any existing pod until a new pod is fully ready. This ensures zero disruption to the application during the rolling update, as the controller waits for the new pod to pass its readiness probe before scaling down the old ReplicaSet.

Answer

The update will fail because maxUnavailable must be at least 1

Answer

The update will not proceed until at least one new pod is ready

Answer

The update will proceed without any downtime

Question 20

What is the role of kube-scheduler in Kubernetes?

Accepted Answer

To assign pods to nodes. The kube-scheduler is responsible for selecting an optimal node for newly created pods that have not yet been assigned to a node. It evaluates constraints such as resource requirements, affinity/anti-affinity rules, and data locality, then binds the pod to the chosen node via the Kubernetes API. This makes option A correct because scheduling is the scheduler's primary and defining function.

Answer

To run container health checks

Answer

To store cluster configuration

Answer

To provide network rules for services