833 questions total · 12pages · All types, answers revealed
Page 12 of 12
A DevOps team wants to collect and forward logs from all nodes in a Kubernetes cluster to a centralized logging backend. Which component is specifically designed for lightweight log collection and forwarding?
Fluent Bit is lightweight and designed for log collection.
Why this answer
Fluent Bit is a lightweight log processor and forwarder, ideal for Kubernetes nodes.
You want to update a Deployment's container image to v2 and perform a rolling update using the simplest imperative command. Which kubectl command achieves this?
`kubectl set image` directly updates the container image for a specific container and initiates a rolling update; adding `--record` annotates the change for rollback history.
Why this answer
The `kubectl set image` command is the standard imperative way to update a container image in a Deployment, and it automatically triggers a rolling update. Option A is invalid; `kubectl update` is not a real command. Option B, `kubectl replace`, requires a full YAML file and is a declarative replacement operation, not a simple image update command.
Option C, `kubectl patch`, can be used but is overly complex and error-prone for a simple image update. The question asks for the simplest imperative command, making D the best answer.
Exam trap
A common pitfall is assuming that `kubectl update` is a valid command (it is not) or that `kubectl patch` is the simplest approach. While `kubectl patch` can update the image, it is not the simplest or most direct imperative command for this task.
How to eliminate wrong answers
Option A is wrong because `kubectl update` is not a valid kubectl command; the correct imperative command for updating a Deployment's image is `kubectl set image`. Option B is wrong because `kubectl replace -f updated-deployment.yaml` performs a full replacement of the Deployment object, which is a declarative approach that does not inherently trigger a rolling update; it replaces the entire resource definition, potentially causing downtime if not managed carefully. Option C is wrong because while `kubectl patch` can update the container image, it requires a complex JSON patch and does not automatically trigger a rolling update unless the patch modifies the pod template spec; however, it is less straightforward and not the recommended imperative command for this specific task.
Which of the following best describes the purpose of the CNCF (Cloud Native Computing Foundation)?
The CNCF is a vendor-neutral home for many cloud native projects, fostering their growth and adoption.
Why this answer
The CNCF is a vendor-neutral foundation that hosts and fosters cloud native projects like Kubernetes, Prometheus, and Envoy, promoting cloud native technologies and practices.
A Service of type ClusterIP is created to expose a set of pods. How does the Service achieve load balancing to the pods?
kube-proxy handles the implementation of ClusterIP Services.
Why this answer
Kube-proxy on each node implements load balancing for ClusterIP Services by creating iptables or IPVS rules that distribute traffic from the Service's virtual IP to the backend pods. These rules use a random or round-robin selection (depending on the mode) to forward packets to healthy pods, ensuring no single pod is overwhelmed.
Exam trap
A common trap is confusing the control-plane role of the API server with the data-plane role of kube-proxy. The API server does not handle data-plane traffic for Services.
How to eliminate wrong answers
Option A is wrong because the API server does not handle data-plane traffic; it only manages the control plane and stores Service definitions in etcd, while actual packet forwarding is done by kube-proxy. Option C is wrong because kubelet is responsible for managing pod lifecycle and container runtime configuration, not for setting up network routing rules for Services. Option D is wrong because a cloud load balancer is used for Services of type LoadBalancer, not ClusterIP, which is an internal virtual IP only reachable within the cluster.
A team is deploying a new microservice that processes sensitive user data. They want to ensure that secrets such as database passwords are not exposed in the container image or environment variables. Which approach should they use?
Secrets are designed for sensitive data; volume mounts reduce exposure.
Why this answer
Kubernetes Secrets are designed specifically to store sensitive data like database passwords. Mounting the Secret as a volume ensures the secret data is available to the pod as files, without being exposed in environment variables (which can be leaked via logs or `kubectl describe`) or embedded in the container image. This approach follows security best practices for handling sensitive information in cloud-native applications.
Exam trap
CNCF often tests the misconception that ConfigMaps are suitable for secrets because they can store key-value pairs, but the trap is that ConfigMaps store data in plaintext and are not designed for sensitive information, whereas Secrets provide base64 encoding and optional encryption at rest.
How to eliminate wrong answers
Option A is wrong because embedding secrets directly in a Docker image makes them part of the image layers, which can be inspected by anyone with access to the image registry, violating the principle of least privilege. Option B is wrong because ConfigMaps are intended for non-sensitive configuration data; storing secrets in a ConfigMap leaves them unencrypted and accessible via `kubectl get configmap`, which is a security risk. Option D is wrong because PersistentVolumeClaims are used for persistent storage of application data, not for storing secrets; they lack the encryption and access control features provided by Kubernetes Secrets.
Which two of the following are Kubernetes controllers that run inside the kube-controller-manager? (Select TWO)
Ensures correct number of pod replicas.
Why this answer
The kube-controller-manager is a control plane component that runs controller processes to regulate the state of the cluster. The Replication controller (option B) is a legacy controller that ensures a specified number of pod replicas are running at all times, and the Node controller (option D) is responsible for monitoring the health of nodes and managing node lifecycle events. Both are built-in controllers that run inside the kube-controller-manager binary.
Exam trap
The exam often tests the distinction between control plane components (kube-controller-manager, kube-scheduler, etcd) and node agents (kubelet). Many candidates mistakenly think kubelet is a controller because it manages pods locally, but it runs on each node as a separate binary, not inside the kube-controller-manager.
A pod is in CrashLoopBackOff. You check the logs and see 'Error: container process not found'. What is the most likely cause?
If the entrypoint doesn't exist or fails, the container exits, causing CrashLoopBackOff.
Why this answer
The container's entrypoint or command may be misconfigured, causing the container to exit immediately.
Which TWO of the following are valid methods for exposing a Service externally?
LoadBalancer provisions an external load balancer.
Why this answer
(LoadBalancer) is correct because it provisions an external load balancer (e.g., AWS ELB, GCP TCP LB) that assigns a public IP address to the Service, making it accessible from outside the cluster. Option E (NodePort) is correct because it exposes the Service on a static port (30000–32767) on every Node's IP, allowing external traffic to reach the Service via `<NodeIP>:<NodePort>`. Both are valid Service types in Kubernetes for external exposure.
Exam trap
The trap here is that candidates often confuse Ingress as a Service type or think ExternalName provides external access, when in fact Ingress is a separate resource and ExternalName is purely a DNS alias with no proxying or port exposure.
Page 12 of 12
Practice KCNA by domain
Target a specific domain to shore up weak areas.