Select Two (Multi-Select) Questions

Set resource requests for 'gpu' in the container spec.

Why wrong: GPUs are not standard resources; they are extended resources and must be requested with their specific name (e.g., nvidia.com/gpu).

Set nodeName to the name of a specific GPU node.

Why wrong: nodeName is too rigid and does not leverage node capabilities; it also does not check for GPU availability.

Add a toleration for a taint that GPU nodes have.

Why wrong: Tolerations allow scheduling on tainted nodes but do not guarantee the node has a GPU.

kubeadm upgrade node

Why wrong: This is used for upgrading worker nodes, not control plane.

kubeadm upgrade plan v1.23.0

Why wrong: 'plan' does not take a version argument; it shows available upgrades.

kubeadm upgrade diff

Why wrong: This command does not exist.

--client-cert-auth

Why wrong: This flag enables client certificate authentication, but is not a certificate file flag.

--peer-cert-file

Why wrong: This is for peer communication, not client authentication.

ClusterIP

Why wrong: ClusterIP is only reachable within the cluster.

ExternalName

Why wrong: ExternalName maps to an external DNS name, not exposing a service.

Headless

Why wrong: Headless services are used for stateful workloads; they don't expose external traffic.

kubectl delete pod -n kube-system -l k8s-app=kube-dns

Why wrong: Deleting a pod is a fix, not a debug method.

kubectl scale deployment coredns --replicas=2

Why wrong: Scaling is a fix, not debugging.

kubectl run -it --rm test --image=busybox -- nslookup kubernetes.default

Why wrong: This tests DNS resolution, not debugging CoreDNS pod itself.

kubectl cluster-info

Why wrong: Shows cluster endpoints, not events.

kubectl logs <pod-name>

Why wrong: Shows container logs, not events.

kubectl top pods

Why wrong: Shows resource usage, not events.

The application is a batch job that should run to completion

Why wrong: Job is for batch jobs.

The application needs to run on all nodes in the cluster

Why wrong: DaemonSet is for running on all nodes.

The application is stateless and can be scaled arbitrarily

Why wrong: Stateless apps are better suited for Deployments.

Use kubectl create node command from the control plane

Why wrong: There is no kubectl create node command.

Install kubelet on the worker node and it will automatically join the cluster

Why wrong: kubelet needs to be configured with a bootstrap token or kubeconfig to join.

Run kubeadm init on the worker node and then join

Why wrong: kubeadm initializes a control plane, not a worker node.

To provide a single stable IP address for the service.

Why wrong: Headless Service does not have a ClusterIP.

To expose a service externally via a cloud load balancer.

Why wrong: External exposure requires NodePort or LoadBalancer Service.

To provide load-balanced access to a set of pods.

Why wrong: Load balancing requires a ClusterIP Service.

They can block traffic at the node level.

Why wrong: Network Policies operate at the pod level, not node level.

They can modify packet contents.

Why wrong: Network Policies only allow/deny; they do not modify packets.

Store the audit policy in a ConfigMap and reference it via --audit-policy-configmap.

Why wrong: There is no such flag; the policy file is passed directly.

Restart the kubelet on the control plane node.

Why wrong: The API server is a static pod; the kubelet does not need restart.

Using the --hostname-override flag.

Why wrong: This overrides the hostname, not the IP.

Setting the --address flag in kubelet command line.

Why wrong: --address is deprecated and used for binding address, not node IP.

Setting the node-ip in the kubeadm-config ConfigMap.

Why wrong: kubeadm config is for cluster initialization, not kubelet runtime configuration.

NeverSchedule

Why wrong: Not a valid taint effect.

PreferSchedule

Why wrong: The correct name is 'PreferNoSchedule'.

Limits must be equal to requests for a Pod to be scheduled.

Why wrong: Limits can be greater than or equal to requests.

CPU limits guarantee the Pod will get that amount of CPU.

Why wrong: CPU is compressible; limits throttle, not guarantee.

Adding a toleration for a taint on the node.

Why wrong: Tolerations allow scheduling on tainted nodes, but do not select based on labels.

Setting spec.nodeName to a node's name.

Why wrong: This schedules on a specific node, not based on a label.

Using spec.affinity.podAffinity with requiredDuringScheduling.

Why wrong: Pod affinity is for co-location with other Pods.

etcdctl endpoint health

Why wrong: Checks health of etcd endpoints, not part of restore.

etcdctl snapshot save backup.db

Why wrong: This command saves a snapshot, not restores.

etcdctl snapshot status snapshot.db

Why wrong: Shows snapshot status, does not restore.

Use a toleration for a taint that exists only on nodes in the zone

Why wrong: Tolerations allow scheduling on tainted nodes, but do not guarantee selection of a specific zone.

Use pod affinity to attract pods to nodes in that zone

Why wrong: Pod affinity is for scheduling pods relative to other pods.

Set spec.nodeName to the name of a node in the zone

Why wrong: This bypasses scheduling and assigns a specific node, but it is not a method for zone-based selection; it's a direct assignment.

DaemonSets are used for stateless applications that require multiple replicas.

Why wrong: DaemonSets run one Pod per Node, not multiple replicas arbitrarily.

DaemonSets ignore taints and tolerations by default.

Why wrong: DaemonSets respect taints and tolerations; a Pod will not run on a Node unless it tolerates the taint.

DaemonSets have a desired replica count that can be scaled independently.

Why wrong: DaemonSets automatically scale based on matching nodes; there is no manual replica count.

DaemonSets can be scaled down by reducing the number of replicas

Why wrong: DaemonSets do not have a replicas field; they run on all nodes matching the selector.

A DaemonSet can be used to run a batch job that completes

Why wrong: DaemonSet pods run continuously; Jobs are for batch tasks.

The database pods can accept traffic on any port from pods with label 'app: api'.

Why wrong: The rule only allows traffic on port 5432.

Pods in other namespaces with label 'app: api' cannot reach the database pods.

Why wrong: NetworkPolicy by default only applies within the same namespace; cross-namespace traffic is blocked unless explicitly allowed.

Pods from the same namespace but without matching labels can still access the database pods.

Why wrong: The policy is namespace-scoped; pods without matching labels are not allowed unless explicitly allowed.