Courseiva

Kubernetes and Cloud Native Associate KCNA (KCNA) — Questions 151225

833 questions total · 12pages · All types, answers revealed

Page 2

Page 3 of 12

Page 4
151
MCQhard

A team wants to deploy a multi-cloud application that uses cloud-specific services. Which pattern is most appropriate?

A.Single-cloud vendor lock-in to reduce complexity
B.Manually managing each cloud separately without automation
C.Only using serverless functions from one provider
D.Using cloud-agnostic abstractions and infrastructure as code across providers
AnswerD

Tools like Terraform and Kubernetes enable portability across clouds.

Why this answer

Using cloud-agnostic abstractions (e.g., Kubernetes for container orchestration, Terraform for infrastructure as code) allows the team to deploy across multiple clouds while still integrating cloud-specific services via provider-agnostic interfaces or abstraction layers. This pattern reduces vendor lock-in, enables consistent deployment workflows, and supports portability without sacrificing the ability to use unique services from each cloud provider.

Exam trap

The trap here is that candidates may think 'cloud-agnostic' means avoiding all cloud-specific services, but the correct pattern allows using them through abstraction layers, not eliminating them entirely.

How to eliminate wrong answers

Option A is wrong because single-cloud vendor lock-in contradicts the requirement for a multi-cloud application; it increases dependency on one provider and reduces flexibility. Option B is wrong because manually managing each cloud separately without automation introduces high operational overhead, configuration drift, and inconsistent deployments, which is inefficient and error-prone for multi-cloud scenarios. Option C is wrong because only using serverless functions from one provider still results in vendor lock-in and does not address the need to use cloud-specific services across multiple providers in a multi-cloud architecture.

152
MCQmedium

Which kubectl command is used to create or update resources defined in a YAML file?

A.kubectl update -f file.yaml
B.kubectl create -f file.yaml
C.kubectl apply -f file.yaml
D.kubectl set -f file.yaml
AnswerC

This creates or updates resources based on the current state defined in the file.

Why this answer

`kubectl apply -f file.yaml` uses a declarative approach to create or update Kubernetes resources. It sends the YAML configuration to the API server, which compares the desired state with the current state and applies the necessary changes, storing the last-applied configuration in an annotation for future updates.

Exam trap

The trap here is that candidates confuse `kubectl create` (imperative, fails on existing resources) with `kubectl apply` (declarative, handles both create and update), or assume a non-existent `kubectl update` command exists based on other tools like `apt update`.

How to eliminate wrong answers

Option A is wrong because `kubectl update` is not a valid kubectl command; Kubernetes uses `kubectl edit`, `kubectl patch`, or `kubectl apply` to modify resources, not `update`. Option B is wrong because `kubectl create -f file.yaml` only creates new resources and will fail if the resource already exists, whereas the question asks for creating OR updating. Option D is wrong because `kubectl set -f file.yaml` is not a valid command; `kubectl set` is used to modify specific fields of live resources (e.g., `kubectl set image`), not to apply a full YAML file.

153
Multi-Selecteasy

Which TWO components are part of the Kubernetes control plane?

Select 2 answers
A.container runtime
B.kubelet
C.kube-apiserver
D.etcd
E.kube-proxy
AnswersC, D

The kube-apiserver exposes the Kubernetes API, serving as the front-end for the control plane by validating and processing RESTful requests to etcd. This satisfies the stem’s constraint of being a control-plane component, as it orchestrates cluster state changes and authentication, distinct from worker-node agents like kubelet.

Why this answer

The Kubernetes control plane manages the cluster's state and scheduling decisions. The kube-apiserver (C) is the front-end for the control plane, exposing the Kubernetes API, while etcd (D) is the distributed key-value store that holds all cluster data, including configuration and state. Both are essential control plane components.

Exam trap

CNCF often tests the misconception that kubelet or kube-proxy are control plane components because they are essential for node operation, but they actually run on worker nodes and are considered node-level services.

154
Multi-Selectmedium

Which two of the following are valid ways to expose a set of Pods to external traffic?

Select 2 answers
A.Create a Service of type NodePort
B.Use a ConfigMap to expose the Pods
C.Create an Ingress resource without a Service
D.Create a Service of type LoadBalancer
E.Create a Service of type ClusterIP
AnswersA, D

NodePort exposes the Service on each node's IP at a static port.

Why this answer

A Service of type NodePort exposes each Pod's port on a static port (the NodePort) on every node's IP address, allowing external traffic to reach the Pods via <NodeIP>:<NodePort>. This is a valid method for exposing a set of Pods to external traffic without requiring a cloud load balancer.

Exam trap

A common misconception is that an Ingress resource can function without an underlying Service, but Ingress only provides routing and must point to a Service to reach Pods.

155
MCQhard

In the context of resiliency patterns, which pattern is designed to prevent a cascade of failures by isolating each component so that a failure in one component does not affect others?

A.Retry
B.Circuit breaker
C.Timeout
D.Bulkhead
AnswerD

Bulkhead isolates components into separate pools so that a failure in one does not affect others.

Why this answer

The bulkhead pattern isolates resources (e.g., thread pools, connections) so that a failure in one part of the system doesn't bring down other parts. Circuit breaker is for handling failures of external calls, not isolation.

156
MCQhard

A pod uses a ServiceAccount that has a RoleBinding to a Role with 'get', 'list', 'watch' on 'pods'. The pod tries to list pods in the same namespace. Will the request succeed?

A.No, because there is a deny rule for pods
B.Yes, because the Role grants 'list' on pods
C.No, because ServiceAccount cannot list pods
D.Yes, but only if the ServiceAccount also has a ClusterRoleBinding
AnswerB

The Role includes 'list' permission, and the binding applies to the same namespace.

Why this answer

In Kubernetes RBAC, permissions are additive. The Role grants 'list' on pods, so the ServiceAccount can list pods. There is no deny rule; RBAC is deny by default, but the permission is explicitly granted.

Option A is incorrect because there is no deny rule for pods. Option C is incorrect because a ServiceAccount can list pods if it has the appropriate RBAC permissions. Option D is incorrect because a ClusterRoleBinding is not required; a RoleBinding in the same namespace is sufficient.

157
Multi-Selectmedium

Which TWO statements are true about Kustomize? (Choose 2)

Select 2 answers
A.It supports patching Kubernetes resources via strategic merge patches or JSON patches.
B.It automatically handles canary traffic routing.
C.It relies on Go templating to generate Kubernetes manifests.
D.It uses a base and overlay model to manage environment-specific configurations.
E.It can be used to package and deploy Helm charts.
AnswersA, D

Correct. Kustomize supports strategic merge patches and JSON patches to customize resources.

Why this answer

Kustomize uses a base and overlay model to manage environment-specific configurations (D). It supports patching Kubernetes resources via strategic merge patches or JSON patches (A). Kustomize does not use Go templating; it is template-free.

It does not handle canary traffic routing, which is typically done by service mesh or deployment tools. It does not package or deploy Helm charts natively.

Exam trap

A common trap is confusing Kustomize's patching with templating, or assuming it handles canary routing. Also, some might think Kustomize is part of Helm, but they are separate tools.

158
MCQeasy

What is the primary purpose of a container registry in the CI/CD pipeline?

A.To store and distribute container images
B.To run unit tests on container images
C.To store application source code
D.To scan images for vulnerabilities
AnswerA

Container registries like Docker Hub, Google Container Registry, or AWS ECR store images and allow them to be pulled by Kubernetes or other systems.

Why this answer

Container registries store container images after they are built, allowing them to be pulled by Kubernetes clusters during deployment. They are the intermediary between CI and CD.

159
MCQmedium

An application is instrumented with OpenTelemetry to export traces to Jaeger. The team notices that some traces are incomplete. What is the most likely cause?

A.Context propagation is not correctly implemented
B.Span attributes are missing
C.Sampling rate is too high
D.Jaeger database is full
AnswerA

Missing context propagation breaks trace continuity.

Why this answer

Incomplete traces often occur when context propagation is not implemented correctly, causing spans to be disconnected.

160
MCQmedium

A user wants to run a one-time batch job that runs to completion. Which Kubernetes resource should they use?

A.Job
B.StatefulSet
C.DaemonSet
D.Deployment
AnswerA

Job is correct for one-time batch jobs.

Why this answer

A Kubernetes Job is the correct resource for a one-time batch job that runs to completion. Unlike controllers designed for long-running processes, a Job creates one or more Pods and ensures they successfully terminate, making it ideal for finite tasks like data processing or backups.

Exam trap

A common pitfall is assuming that a Deployment can handle batch jobs because it manages Pods, but Deployments enforce a desired replica count and restart policies that keep Pods running indefinitely, making them unsuitable for tasks that must terminate successfully after completing their work.

How to eliminate wrong answers

Option B (StatefulSet) is wrong because it manages stateful applications with persistent identities and stable storage, designed for long-running workloads like databases, not one-time batch jobs. Option C (DaemonSet) is wrong because it ensures a Pod runs on every node in the cluster, intended for cluster-wide services like logging agents, not finite tasks. Option D (Deployment) is wrong because it manages stateless, long-running applications with rolling updates and scaling, aiming for continuous availability, not job completion.

161
Multi-Selectmedium

Which TWO components are part of the Kubernetes control plane? (Select exactly two.)

Select 2 answers
A.kube-proxy
B.kubelet
C.container runtime
D.kube-apiserver
E.kube-scheduler
AnswersD, E

API server is a control plane component.

Why this answer

The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes API for all cluster operations. The kube-scheduler is responsible for assigning newly created pods to nodes based on resource availability and policy constraints. Both are essential control plane components that manage cluster state and scheduling decisions.

Exam trap

CNCF often tests the distinction between control plane and worker node components, and the trap here is that candidates confuse kube-proxy or kubelet (which run on every node) with control plane components because they are essential for cluster operation, but they are not part of the control plane itself.

162
MCQhard

A Kubernetes cluster has multiple worker nodes. You create a Pod without any node selector. The scheduler places the pod on a node, but the pod remains in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What does this indicate?

A.The node has a taint that the pod does not tolerate
B.The pod has a resource request that exceeds the node's capacity
C.The node is cordoned and should be uncordoned
D.The node is out of disk space
AnswerA

The error explicitly states the node had a taint that the pod didn't tolerate.

Why this answer

The error message explicitly states that one node had a taint (`node-role.kubernetes.io/master`) that the pod did not tolerate. Taints and tolerations are a Kubernetes mechanism that allows nodes to repel pods unless the pod has a matching toleration. Since the pod was created without any tolerations, the scheduler could not place it on the tainted node, leaving it in 'Pending' state.

Exam trap

The trap here is that candidates may confuse taints with resource constraints or node cordoning, but the specific error message 'node had taint ... that the pod didn't tolerate' directly points to a toleration mismatch, not a capacity or cordon issue.

How to eliminate wrong answers

Option B is wrong because the error message does not mention resource requests or insufficient capacity; it specifically cites a taint issue. Option C is wrong because a cordoned node would show a different message (e.g., 'node is cordoned') and the pod would not be scheduled at all, but here the scheduler attempted placement on a tainted node. Option D is wrong because disk pressure would be reported as a different condition (e.g., 'NodeHasDiskPressure') and would not produce the taint-related error shown.

163
MCQhard

A user reports that their application's DNS resolution is failing for a Service named 'my-service' in the same namespace. They are able to reach the Service by its cluster IP. Which of the following is the most likely cause?

A.The application container is using an incorrect DNS policy
B.The kube-proxy is misconfigured on the node
C.The CoreDNS pod is not running or misconfigured
D.The Service is of type ExternalName
AnswerC

CoreDNS is responsible for DNS resolution for Services. If CoreDNS is down or misconfigured, DNS queries for Services will fail.

Why this answer

DNS resolution for a Service in the same namespace relies on CoreDNS, which is the cluster DNS provider in Kubernetes. If CoreDNS is not running or misconfigured, DNS queries for the Service name (e.g., 'my-service') will fail, even though the Service is reachable via its cluster IP. The user's ability to reach the Service by IP confirms that kube-proxy and networking are functional, isolating the issue to DNS resolution.

Exam trap

CNCF often tests the distinction between DNS resolution and Service reachability, trapping candidates who assume that a DNS failure must be caused by the application's DNS policy rather than the cluster DNS service itself.

How to eliminate wrong answers

Option A is wrong because an incorrect DNS policy (e.g., ClusterFirstWithHostNet or None) would affect how the container resolves names, but it would not cause a complete failure for a Service in the same namespace if CoreDNS is healthy; the user can still reach the Service by IP, indicating the DNS policy is not the primary issue. Option B is wrong because kube-proxy is responsible for implementing Service IP-to-Pod routing via iptables or IPVS; since the user can reach the Service by its cluster IP, kube-proxy is functioning correctly. Option D is wrong because a Service of type ExternalName returns a CNAME record, not a cluster IP; the user can reach the Service by its cluster IP, so the Service cannot be of type ExternalName.

164
MCQhard

An application is deployed across multiple cloud providers (AWS and GCP) to avoid vendor lock-in. This is an example of which pattern?

A.Public cloud
B.Federated cloud
C.Hybrid cloud
D.Multi-cloud
AnswerD

Multi-cloud involves using multiple public cloud providers.

Why this answer

Multi-cloud refers to using services from multiple cloud providers simultaneously.

165
MCQmedium

A Service of type ClusterIP is created. What is the default behavior of this Service?

A.It exposes the Service externally via a cloud load balancer
B.It exposes the Service on a static port on each node
C.It routes traffic to Pods based on external DNS names
D.It exposes the Service on a cluster-internal IP
AnswerD

ClusterIP is the default and provides internal connectivity only.

Why this answer

A ClusterIP Service is the default Kubernetes Service type, which assigns a virtual IP address reachable only within the cluster. Traffic sent to this IP is load-balanced across the Pods selected by the Service's label selector, using iptables or IPVS rules. No external access is provided unless an Ingress or other mechanism is explicitly configured.

Exam trap

The trap here is that candidates often confuse the default Service type (ClusterIP) with NodePort or LoadBalancer, assuming a Service must be externally accessible by default, but Kubernetes intentionally isolates ClusterIP Services to internal cluster traffic only.

How to eliminate wrong answers

Option A is wrong because exposing a Service externally via a cloud load balancer is the behavior of a Service of type LoadBalancer, not ClusterIP. Option B is wrong because exposing the Service on a static port on each node is the behavior of a Service of type NodePort, which opens a high-port on every node's IP. Option C is wrong because routing traffic based on external DNS names is not a native Service behavior; DNS-based routing is typically handled by an Ingress controller or external DNS integration, not by a ClusterIP Service.

166
MCQmedium

What type of Prometheus metric is best suited to count the total number of HTTP requests received by a service?

A.Histogram
B.Gauge
C.Summary
D.Counter
AnswerD

Counter is a cumulative metric that increases monotonically, suitable for counting requests.

Why this answer

A counter is a cumulative metric that can only increase or be reset to zero, ideal for counting events like requests.

167
MCQmedium

Which tool is specifically designed for log aggregation and is built by Grafana Labs as a lightweight, cost-effective alternative to traditional log systems?

A.Loki
B.Zipkin
C.Prometheus
D.Jaeger
AnswerA

Correct. Loki is a log aggregation system from Grafana Labs.

Why this answer

Loki is a log aggregation system optimized for Kubernetes, designed to be cost-effective and easy to operate.

168
MCQmedium

You are troubleshooting a service that is not accessible from within the cluster. The service has a label selector that matches the pods. You run 'kubectl get endpoints myservice' and see that the ENDPOINTS column is empty. What is the most likely cause?

A.The kube-proxy is not running
B.The service's label selector does not match any pods
C.The service is in a different namespace
D.The service type is LoadBalancer and no external load balancer is provisioned
AnswerB

Endpoints are created for pods matching the selector; if none match, endpoints are empty.

Why this answer

The ENDPOINTS column being empty for a service indicates that the service's label selector does not match any running pods. Kubernetes uses the label selector to dynamically populate the endpoints list; if no pods match, the service has no backends to forward traffic to, making it inaccessible from within the cluster.

Exam trap

Kubernetes often tests the distinction between service endpoint population (which depends on label selectors) and traffic forwarding (which depends on kube-proxy), leading candidates to incorrectly blame kube-proxy when the actual issue is a selector mismatch.

How to eliminate wrong answers

Option A is wrong because if kube-proxy were not running, the service would still have endpoints (as long as pods match the selector), but traffic would not be forwarded; the ENDPOINTS column would not be empty. Option C is wrong because a service in a different namespace would not be accessible by name without a fully qualified name, but the 'kubectl get endpoints' command would still show endpoints if pods in that namespace match the selector. Option D is wrong because a LoadBalancer service without an external load balancer provisioned would still have internal endpoints (the pod IPs) and the ENDPOINTS column would not be empty; the issue is external access, not internal reachability.

169
Multi-Selectmedium

Which TWO of the following are Prometheus metric types? (Select two.)

Select 2 answers
A.Event
B.Gauge
C.Set
D.Counter
E.Timer
AnswersB, D

Gauge represents a single numerical value that can go up and down.

Why this answer

Prometheus metric types include Counter, Gauge, Histogram, and Summary. The correct answers are B (Gauge) and D (Counter). Options A (Event), C (Set), and E (Timer) are not Prometheus metric types.

170
MCQhard

A team wants to set up alerts when a Kubernetes pod consumes more than 90% of its memory limit for over 5 minutes. They use Prometheus and Alertmanager. Which Prometheus query would trigger an alert for a specific pod named 'web-app' in the 'default' namespace?

A.container_memory_usage_bytes{pod='web-app'} > 0.9
B.container_memory_usage_bytes{pod='web-app'} / container_spec_memory_limit_bytes{pod='web-app'} > 0.9
C.avg(container_memory_usage_bytes{pod='web-app'}) > 0.9
D.container_memory_limit_bytes{pod='web-app'} > 0.9
AnswerB

This calculates the percentage of memory used relative to the limit.

Why this answer

The correct query divides container memory usage by its limit and compares to 0.9.

171
Multi-Selecthard

Which TWO of the following are features of a service mesh like Istio or Linkerd? (Select 2)

Select 2 answers
A.Container image building
B.Traffic management (routing, load balancing)
C.Observability (metrics, tracing, logs)
D.Service discovery
E.Auto-scaling of services
AnswersB, C

Service mesh enables fine-grained traffic management.

Why this answer

Service mesh provides observability (metrics, tracing, logs) and traffic management (routing, load balancing). Auto-scaling is not a service mesh feature; it's handled by Kubernetes HPA or Knative. Service discovery is also not a direct feature of service mesh; it's typically provided by Kubernetes DNS.

172
MCQeasy

What is the purpose of values.yaml in a Helm chart?

A.To specify the chart metadata
B.To define the Kubernetes resources to create
C.To define the release name
D.To store default configuration values for the chart
AnswerD

values.yaml holds default parameters.

Why this answer

values.yaml provides default configuration values that can be overridden at install/upgrade time.

173
MCQmedium

In Kustomize, what is the purpose of an overlay?

A.To apply environment-specific customizations on top of a base
B.To merge multiple Kubernetes manifests into one
C.To template variables into YAML files
D.To define the base configuration of an application
AnswerA

Overlays use patches to modify the base for specific environments.

Why this answer

Kustomize overlays allow customizing a base configuration for different environments (e.g., dev, prod) by applying patches without modifying the base.

174
MCQmedium

A DevOps team wants to implement GitOps for their Kubernetes cluster. Which tool is specifically designed for Kubernetes GitOps and can automatically sync the cluster state with a Git repository?

A.ArgoCD
B.Jenkins
C.Kustomize
D.Helm
AnswerA

Why this answer

ArgoCD is a GitOps tool specifically designed for Kubernetes. It continuously monitors a Git repository and automatically syncs the cluster state to match the desired state. Helm (option D) is a package manager.

Kustomize (option C) is a configuration management tool. Jenkins (option B) is a CI/CD tool but not GitOps-native. Therefore, ArgoCD (option A) is the correct answer.

175
Multi-Selecthard

Which TWO of the following are valid methods to expose a set of pods to external traffic in Kubernetes?

Select 2 answers
A.LoadBalancer Service
B.NodePort Service
C.Headless Service
D.ClusterIP Service
E.Ingress
AnswersA, B

Provisions an external load balancer.

Why this answer

A LoadBalancer Service is a valid method to expose pods to external traffic because it provisions an external load balancer (e.g., AWS ELB, GCP LB) that assigns a public IP address, routing external traffic to the Service's ClusterIP and then to the pods. This is a standard Kubernetes Service type defined in the ServiceSpec, making it correct for external exposure.

Exam trap

The KCNA exam often tests the distinction between 'exposing pods' and 'routing traffic' — the trap here is that candidates mistakenly select Ingress as a direct exposure method, when in fact Ingress only defines routing rules and relies on a Service (like NodePort or LoadBalancer) to actually make pods reachable from outside the cluster.

176
MCQhard

You have a Deployment with 3 replicas. You need to perform a rolling update with 2 extra pods during the update and ensure that only 1 pod is unavailable at any time. Which update strategy configuration achieves this?

A.maxSurge: 1, maxUnavailable: 2
B.maxSurge: 0, maxUnavailable: 2
C.maxSurge: 3, maxUnavailable: 0
D.maxSurge: 2, maxUnavailable: 1
AnswerD

Why this answer

It sets maxSurge to 2 (allowing up to 2 extra pods above the desired 3, for a total of 5 pods during the update) and maxUnavailable to 1 (ensuring at most 1 pod is unavailable at any time). This satisfies the requirement of having 2 extra pods during the update while keeping only 1 pod unavailable.

Exam trap

The trap here is that candidates often confuse maxSurge and maxUnavailable as percentages or misinterpret the requirement for '2 extra pods' as a surge of 2, but forget that maxUnavailable must also be set to 1 to limit downtime, leading them to pick option A or B.

How to eliminate wrong answers

Option A is wrong because maxSurge: 1 allows only 1 extra pod, not the required 2 extra pods. Option B is wrong because maxSurge: 0 means no extra pods are allowed, and maxUnavailable: 2 allows 2 pods to be unavailable, violating the requirement of only 1 unavailable pod. Option C is wrong because maxSurge: 3 allows 3 extra pods (more than needed), and maxUnavailable: 0 means zero pods can be unavailable, which is too restrictive and does not match the requirement of allowing 1 unavailable pod.

177
Multi-Selecteasy

Which two of the following are benefits of using Kubernetes for container orchestration? (Select TWO.)

Select 2 answers
A.Integrated continuous integration pipeline
B.Automatic code compilation
C.Self-healing: automatically restarts failed containers
D.Built-in database management
E.Automated rollouts and rollbacks
AnswersC, E

Kubernetes replaces containers that fail.

Why this answer

Kubernetes provides self-healing capabilities through controllers like ReplicaSets and Deployments, which monitor pod health via liveness probes. If a container fails or becomes unresponsive, the controller automatically terminates the unhealthy pod and creates a replacement to maintain the desired replica count, ensuring application resilience without manual intervention.

Exam trap

A common pitfall is assuming that Kubernetes includes built-in CI/CD, code compilation, or database management features. In reality, these are external tools integrated separately. Kubernetes core features focus on container orchestration, including self-healing (via liveness probes and controllers) and automated rollouts/rollbacks (via Deployments).

178
MCQhard

Which of the following patterns is used to improve resilience by isolating failures to a subset of components?

A.Timeout
B.Retry
C.Circuit breaker
D.Bulkhead
AnswerD

Why this answer

The Bulkhead pattern (D) is correct because it isolates failures by partitioning resources (e.g., thread pools, connections) into separate pools for different components or services. This prevents a failure in one component from exhausting shared resources and cascading to others, directly improving resilience by containing the blast radius.

Exam trap

CNCF often tests the distinction between patterns that prevent cascading failures (Bulkhead) versus patterns that handle transient failures (Retry/Timeout) or protect against repeated failures (Circuit Breaker), leading candidates to confuse the goal of isolation with failure detection or recovery.

How to eliminate wrong answers

Option A is wrong because Timeout is a pattern that limits the wait time for a response, preventing indefinite hangs, but it does not isolate failures to a subset of components—it only terminates slow operations. Option B is wrong because Retry is a pattern that automatically reattempts a failed operation, which can help with transient failures but does not isolate failures; in fact, it can exacerbate resource exhaustion if not combined with other patterns. Option C is wrong because Circuit Breaker is a pattern that monitors for failures and stops requests to a failing service to allow recovery, but it does not isolate failures to a subset of components—it protects callers from a failing dependency, not partition resources across components.

179
Multi-Selecteasy

Which TWO statements about container images are correct? (Choose two.)

Select 2 answers
A.Images are always pulled from a private registry
B.Each layer is identified by a unique hash
C.Images can be modified at runtime by writing to the container layer
D.Images are built from a series of read-only layers
E.Images are stored on the host filesystem after being pulled
AnswersB, D

Layers are content-addressable and identified by their digest.

Why this answer

Each layer in a container image is identified by a unique content-addressable hash (typically a SHA-256 digest). This hash is computed from the layer's contents and metadata, ensuring integrity and enabling layer caching and deduplication across images. The hash is used in the image manifest (as defined by the OCI Image Specification) to reference each layer uniquely.

Exam trap

CNCF often tests the misconception that images are stored directly on the host filesystem like regular files, when in reality they are stored in a runtime-managed cache (e.g., /var/lib/docker) and are not directly accessible as ordinary files.

180
MCQmedium

A pod spec includes a liveness probe that runs 'cat /tmp/healthy'. The probe is configured with initialDelaySeconds: 10, periodSeconds: 5. At what point does the kubelet first execute the probe?

A.Immediately after the pod is created
B.Only when the container is unhealthy
C.5 seconds after the container starts
D.10 seconds after the container starts
AnswerD

The initialDelaySeconds of 10 means the probe is first executed 10 seconds after the container starts.

Why this answer

The kubelet first executes the liveness probe 10 seconds after the container starts because `initialDelaySeconds: 10` tells the kubelet to wait that long before initiating the first probe. The `periodSeconds: 5` only defines the interval between subsequent probes, not the initial delay. This ensures the container has time to start and create the `/tmp/healthy` file before being checked.

Exam trap

The trap here is confusing `initialDelaySeconds` with `periodSeconds`, leading candidates to think the probe runs after 5 seconds (the period) instead of 10 seconds (the initial delay).

How to eliminate wrong answers

Option A is wrong because the kubelet does not execute probes immediately after pod creation; it waits for the container to start and then applies `initialDelaySeconds`. Option B is wrong because liveness probes are executed periodically regardless of container health, not only when the container is unhealthy; the probe itself determines health. Option C is wrong because `periodSeconds: 5` controls the interval between probes after the first one, not the initial delay; the first probe occurs after `initialDelaySeconds`, which is 10 seconds.

181
MCQmedium

Which DORA metric measures the percentage of deployments that cause a failure in production?

A.Lead time for changes
B.Mean time to recover (MTTR)
C.Change failure rate
D.Deployment frequency
AnswerC

Change failure rate is the percentage of deployments causing failure.

Why this answer

Change failure rate is the percentage of deployments that result in degraded service or require remediation.

182
MCQhard

A developer wants to inject environment variables into a pod from a ConfigMap named 'app-config'. Which YAML snippet correctly mounts all key-value pairs from the ConfigMap as environment variables?

A.env: - name: CONFIG value: "$(CONFIGMAP)"
B.envFrom: - configMapRef: name: app-config
C.volumes: - name: config configMap: name: app-config volumeMounts: - name: config mountPath: /etc/config
D.env: - name: CONFIG valueFrom: configMapKeyRef: name: app-config key: config.yaml
AnswerB

This mounts all keys from the ConfigMap as environment variables.

Why this answer

`envFrom` with a `configMapRef` injects all key-value pairs from the ConfigMap named 'app-config' as environment variables into the container. This is the standard Kubernetes method for bulk injection of ConfigMap data into environment variables, as opposed to selecting individual keys.

Exam trap

The trap here is that candidates often confuse `envFrom` (bulk injection) with `env` + `configMapKeyRef` (single key injection) or volume mounts (file-based injection), leading them to pick options that inject only one key or mount files instead of environment variables.

How to eliminate wrong answers

Option A is wrong because `env` with `value: "$(CONFIGMAP)"` is not valid syntax; Kubernetes does not support referencing a ConfigMap via a variable expansion like `$(CONFIGMAP)` — it requires explicit `valueFrom` or `envFrom`. Option C is wrong because it mounts the ConfigMap as a volume at `/etc/config`, which injects keys as files, not as environment variables — this does not satisfy the requirement to inject them as environment variables. Option D is wrong because it uses `env` with `configMapKeyRef` to inject only a single key (`config.yaml`) from the ConfigMap, not all key-value pairs.

183
MCQeasy

Which of the following is considered one of the three pillars of observability?

A.Events
B.Metrics
C.Alerts
D.Profiles
AnswerB

Metrics are one of the three pillars of observability, along with logs and traces.

Why this answer

The three pillars of observability in cloud native environments are logs, metrics, and traces.

184
MCQmedium

A DevOps team notices that a new deployment of a web application is not receiving traffic even though the pods are running. The deployment has a selector matching the pod labels, and a Service of type ClusterIP exists. What is the most likely cause?

A.The Service's targetPort does not match the container's containerPort.
B.The pods do not have a readiness probe defined.
C.The Service type should be NodePort to receive traffic.
D.The Service is not exposed via an Ingress.
AnswerA

The Service routes traffic to the targetPort, which must match the port the container listens on.

Why this answer

The most likely cause is that the Service's targetPort does not match the container's containerPort. In Kubernetes, a Service routes traffic to pods by forwarding packets to the port specified in the Service's `targetPort` field. If this does not match the `containerPort` defined in the pod's container spec, the traffic will be dropped because the kube-proxy will forward packets to a closed port on the pod, resulting in no connectivity even though the pods are running.

Exam trap

The trap here is that candidates often confuse the Service's `port` (the port the Service listens on) with `targetPort` (the port on the pod), assuming they must match, or they incorrectly attribute the issue to missing readiness probes or Ingress resources.

How to eliminate wrong answers

Option B is wrong because a readiness probe controls whether a pod is considered ready to receive traffic, but its absence does not prevent traffic from being sent to the pod; it simply means the pod will always be considered ready. Option C is wrong because a Service of type ClusterIP is perfectly capable of receiving traffic within the cluster; NodePort is only needed for external access from outside the cluster, not for internal traffic. Option D is wrong because an Ingress is an optional API object for HTTP/HTTPS routing and is not required for a ClusterIP Service to receive traffic; the Service itself can be accessed directly via its cluster IP.

185
MCQeasy

A developer wants to run a one-time batch job that processes a queue and then terminates. Which Kubernetes resource should they use?

A.Job
B.StatefulSet
C.Deployment
D.DaemonSet
AnswerA

Jobs run pods until successful completion.

Why this answer

A Kubernetes Job is designed for finite, batch-oriented tasks that run to completion, such as processing a queue and then terminating. Unlike controllers that maintain a desired state (like Deployments or StatefulSets), a Job creates one or more Pods and ensures they successfully exit, making it the correct choice for a one-time batch job.

Exam trap

The trap here is that candidates confuse a Job with a Deployment, assuming that any workload that 'runs' must be a Deployment, but Deployments are designed for long-running services and will restart terminated Pods, whereas a Job is the correct resource for workloads that should run to completion and then stop.

How to eliminate wrong answers

Option B (StatefulSet) is wrong because it is used for stateful applications that require stable, unique network identities and persistent storage, not for one-time batch jobs. Option C (Deployment) is wrong because it manages a set of Pods intended to run continuously (e.g., web servers) and will restart Pods if they exit, which is the opposite of a terminating batch job. Option D (DaemonSet) is wrong because it ensures that a copy of a Pod runs on every node (or a subset of nodes) in the cluster, typically for long-running system services like log collectors or monitoring agents, not for one-time tasks.

186
MCQmedium

A Kubernetes cluster has a single control plane node and two worker nodes. The control plane node fails. What is the immediate impact on the workloads running on the worker nodes?

A.All workloads will stop immediately
B.Existing workloads continue running, but no new pods can be scheduled
C.The kubelet on worker nodes will restart all pods
D.Workloads will be automatically migrated to another cluster
AnswerB

The kubelet on worker nodes keeps existing pods running, but the scheduler cannot assign new pods without the control plane.

Why this answer

In Kubernetes, the control plane is responsible for scheduling new pods and maintaining desired state via the API server, controller manager, and scheduler. When the control plane fails, the kubelets on worker nodes continue to run existing pods based on their local state, but the scheduler cannot assign new pods to nodes, and the API server is unavailable for updates or scaling operations.

Exam trap

CNCF often tests the misconception that the control plane is required for all pod operations, leading candidates to assume workloads stop immediately, when in fact the kubelet provides resilience for existing pods.

How to eliminate wrong answers

Option A is wrong because existing workloads are managed by the kubelet on each worker node, which runs pods independently of the control plane; they do not stop immediately. Option C is wrong because the kubelet does not restart all pods upon control plane failure; it only restarts pods that have failed according to its local restart policy, not as a reaction to the control plane being down. Option D is wrong because Kubernetes does not automatically migrate workloads to another cluster; migration requires manual intervention or a multi-cluster management tool like KubeFed or a service mesh.

187
MCQmedium

What is the purpose of a Readiness Probe in a Kubernetes pod?

A.To ensure the pod is scheduled on a specific node
B.To restart the container if it becomes unresponsive
C.To check if the container is ready to start accepting traffic
D.To check if the container is running
AnswerC

Readiness probe signals readiness to serve.

Why this answer

A Readiness Probe indicates whether a pod is ready to serve traffic; if it fails, the pod is removed from Service endpoints.

188
Multi-Selectmedium

Which TWO resources can be used to store configuration data separately from container images?

Select 2 answers
A.Service
B.PersistentVolume
C.Secret
D.Deployment
E.ConfigMap
AnswersC, E

Secrets store sensitive data like passwords or tokens.

Why this answer

ConfigMaps and Secrets are Kubernetes API objects designed specifically to decouple configuration data and sensitive information from container images. ConfigMaps store non-sensitive key-value pairs (e.g., environment variables, command-line arguments, or configuration files), while Secrets store sensitive data (e.g., passwords, tokens, or SSH keys) in base64-encoded or encrypted form. Both can be mounted into pods as volumes or injected as environment variables, allowing image reuse across different environments without rebuilding.

Exam trap

CNCF often tests the distinction between storage for configuration data (ConfigMaps/Secrets) vs. storage for application data (PersistentVolumes), so candidates mistakenly select PersistentVolume thinking it can store config files, but it is intended for stateful workloads like databases, not for decoupling configuration from images.

189
MCQhard

Refer to the exhibit. A pod 'my-pod' shows repeated 'BackOff' events after the container starts. Which is the most likely cause?

A.The image 'myapp:v2' does not exist.
B.The container exceeds its memory limit.
C.The liveness probe is failing.
D.The application crashes shortly after starting.
AnswerD

Correct; the container starts but then crashes, leading to restart backoff.

Why this answer

The 'BackOff' event in Kubernetes indicates that the container has started but repeatedly crashes, causing the kubelet to increase the restart delay. Option D is correct because an application that crashes shortly after starting will trigger this restart loop, as the container exits with a non-zero exit code, leading to exponential backoff.

Exam trap

The KCNA exam often tests the distinction between 'ImagePullBackOff' (image not found) and 'CrashLoopBackOff' (container crashes after start), so candidates must recognize that 'BackOff' events after the container starts point to a runtime crash, not a pull failure.

How to eliminate wrong answers

Option A is wrong because if the image 'myapp:v2' does not exist, the pod would show 'ErrImagePull' or 'ImagePullBackOff' events, not 'BackOff' after the container starts. Option B is wrong because exceeding the memory limit causes an 'OOMKilled' status and a container restart, but the event would typically be 'OOMKilled' or 'CrashLoopBackOff', not specifically 'BackOff' after a successful start. Option C is wrong because a failing liveness probe results in the container being killed and restarted, but the event would be 'Unhealthy' or 'Liveness probe failed', and the pod would show 'CrashLoopBackOff' rather than 'BackOff' immediately after start.

190
MCQhard

You have a microservices application where Service A needs to communicate with Service B running in a different namespace ('backend'). Both namespaces have a NetworkPolicy that denies all ingress by default. You create a NetworkPolicy in the 'backend' namespace allowing ingress from pods with label 'app: frontend'. What else is needed for Service A to reach Service B?

A.Ensure Service A's pod has the label 'app: frontend' on its pod spec
B.Add a similar NetworkPolicy in the 'default' namespace allowing egress to the 'backend' namespace
C.Change the NetworkPolicy to allow all ingress traffic from any source
D.Add a label to the 'default' namespace matching the NetworkPolicy's namespaceSelector
AnswerD

Correct. By adding a label to the 'default' namespace and including a namespaceSelector matching that label in the NetworkPolicy, you allow ingress from pods in the 'default' namespace. Combined with the podSelector for 'app: frontend', this enables Service A to reach Service B.

Why this answer

A NetworkPolicy with only a podSelector in an ingress rule matches pods in the same namespace only. To allow cross-namespace traffic, you must include a namespaceSelector that selects the namespace of the source pods. By adding a label to the 'default' namespace and including a namespaceSelector matching that label in the NetworkPolicy, you enable Service A's pods to be allowed.

Ensure Service A's pod also has the required label 'app: frontend'. Option A is wrong: a podSelector alone only matches pods in the same namespace. Option B is wrong: egress policies are not needed for inbound traffic.

Option C is too permissive and unnecessary.

Exam trap

A common pitfall is to assume that a podSelector in an ingress rule can match pods across namespaces without a namespaceSelector. In reality, a podSelector only matches pods in the same namespace unless combined with a namespaceSelector.

How to eliminate wrong answers

Option B is wrong because egress policies are not required for Service A to reach Service B unless the 'default' namespace has a NetworkPolicy that explicitly denies egress; the question states only ingress is denied by default, so no egress policy is needed. Option C is wrong because it suggests allowing all ingress traffic from any source, which would bypass the intended security restriction and is unnecessary; the existing policy already correctly restricts ingress to pods with the required label. Option D is wrong because namespaceSelector is used to select pods from entire namespaces, not to label the namespace itself; adding a label to the 'default' namespace does not affect the podSelector in the NetworkPolicy, which operates on pod labels, not namespace labels.

191
MCQmedium

Which log aggregation tool is designed specifically for Kubernetes and is often used as a lightweight alternative to Fluentd?

A.Logstash
B.Fluent Bit
C.Loki
D.Elasticsearch
AnswerB

Fluent Bit is lightweight and designed for Kubernetes.

Why this answer

Fluent Bit is a lightweight log processor and forwarder, often used in Kubernetes.

192
MCQhard

You create a Pod with a liveness probe that uses an HTTP GET on port 8080, path /healthz. The probe fails after the container starts. What will happen to the Pod?

A.The Pod will be marked as Unhealthy and removed from Service endpoints
B.The container will be restarted automatically
C.The Pod will be evicted from the node
D.The Pod will be deleted and recreated on a different node
AnswerB

Liveness probe failure triggers container restart.

Why this answer

A liveness probe is designed to determine if a container is still running properly. When an HTTP GET liveness probe fails, kubelet considers the container unhealthy and automatically restarts it according to the Pod's restart policy (defaulting to Always). This ensures the container can recover from transient failures without manual intervention.

Exam trap

The trap here is confusing liveness probes with readiness probes: candidates often think a failing liveness probe removes the Pod from Service endpoints, but that is the job of a readiness probe, while liveness probes only trigger container restarts.

How to eliminate wrong answers

Option A is wrong because removing a Pod from Service endpoints is the behavior of a readiness probe, not a liveness probe; liveness probes only trigger container restarts. Option C is wrong because Pod eviction is caused by node-level issues like resource pressure or node failure, not by a failing liveness probe. Option D is wrong because the Pod is not deleted or recreated on a different node; the container is restarted in place on the same node.

193
MCQeasy

Refer to the exhibit. How many containers are defined in this Pod?

A.2
B.1
C.3
D.0
AnswerA

The YAML defines two containers.

Why this answer

The exhibit shows a Pod manifest with two container definitions under the `containers` field: one named `nginx` and one named `sidecar`. In Kubernetes, the number of containers in a Pod is determined by counting the entries in the `spec.containers` list, not including init containers or ephemeral containers unless explicitly specified. Therefore, the correct answer is 2.

Exam trap

The trap here is that candidates may miscount containers by including init containers or ephemeral containers, or mistakenly think the number of images referenced equals the number of containers, when the manifest explicitly lists only two containers in the `containers` array.

How to eliminate wrong answers

Option B is wrong because it assumes only one container is defined, but the manifest clearly lists two container entries under `spec.containers`. Option C is wrong because it suggests three containers, which would require a third entry in the `containers` list or additional init containers, neither of which is present. Option D is wrong because a Pod must have at least one container to be valid; the manifest explicitly defines two containers, so zero is incorrect.

194
Multi-Selecthard

Which TWO of the following are characteristics of serverless computing?

Select 2 answers
A.Manual server provisioning
B.Long-running processes
C.Event-driven execution
D.Auto-scaling to zero when not in use
E.Reserved capacity for predictable workloads
AnswersC, D

Functions are triggered by events.

Why this answer

Serverless computing is event-driven and auto-scales to zero when idle. Long-running processes are not suitable, and you do not manage the underlying servers. Reserved capacity is a concept for traditional cloud.

195
MCQhard

A Deployment manages 3 replicas of a pod. During a rolling update, one of the new pods enters CrashLoopBackOff. What happens next?

A.The Deployment deletes all pods and recreates them
B.The Deployment automatically reverts to the previous ReplicaSet
C.The Deployment continues the rollout, ignoring the failure
D.The Deployment pauses the rollout and waits for manual intervention
AnswerD

The Deployment controller will not proceed with the update if the new pod fails readiness checks.

Why this answer

By default, a Deployment's rolling update strategy has a `progressDeadlineSeconds` setting (default 600 seconds) and a `maxUnavailable`/`maxSurge` configuration. When a new pod enters CrashLoopBackOff, the Deployment's controller detects that the update is not making progress (the new ReplicaSet cannot reach the desired replica count with healthy pods). After the progress deadline expires, the Deployment marks the rollout as failed and pauses the update, requiring manual intervention (e.g., `kubectl rollout undo` or fixing the pod template).

This behavior is governed by the Deployment controller's reconciliation loop and the `Progressing` condition.

Exam trap

CNCF often tests the misconception that a Deployment automatically rolls back on failure, but in reality, it only pauses after a progress deadline, requiring manual rollback or correction.

How to eliminate wrong answers

Option A is wrong because a Deployment does not delete all pods and recreate them during a rolling update; it incrementally replaces pods by scaling up the new ReplicaSet and scaling down the old one, preserving overall availability. Option B is wrong because the Deployment does not automatically revert to the previous ReplicaSet; it only pauses the rollout after a progress deadline, and an explicit rollback (e.g., `kubectl rollout undo`) is required to revert. Option C is wrong because the Deployment does not ignore the failure; it respects the `progressDeadlineSeconds` and pauses the rollout when progress stalls, such as when a new pod is in CrashLoopBackOff.

196
Multi-Selecteasy

Which TWO of the following are benefits of using Helm for application delivery?

Select 2 answers
A.Automatic scaling based on CPU usage
B.Ability to roll back to previous releases
C.Automatic canary deployments
D.Simplified packaging and templating of Kubernetes resources
E.Built-in monitoring and alerting
AnswersB, D

Helm tracks releases and supports rollback with helm rollback.

Why this answer

Helm manages Kubernetes application releases as packaged charts. The `helm rollback` command allows you to revert to a previous revision of a release, which is a core benefit for safe application delivery and disaster recovery. This capability is built into Helm's release management system, which tracks each deployment as a revision with a unique version number.

Exam trap

CNCF often tests the distinction between Helm's release management features and Kubernetes-native or third-party operational features, so candidates mistakenly attribute capabilities like autoscaling or canary deployments to Helm because they see Helm used in CI/CD pipelines alongside those tools.

197
MCQmedium

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event '0/4 nodes are available: 4 Insufficient cpu'. What is the most likely cause?

A.The pod has exceeded its memory limit
B.The pod's image pull is failing
C.None of the nodes have enough CPU resources to satisfy the pod's request
D.The pod's liveness probe is failing
AnswerC

The event indicates insufficient CPU on all nodes.

Why this answer

The '0/4 nodes are available: 4 Insufficient cpu' event directly indicates that the Kubernetes scheduler attempted to place the pod on each of the four nodes but found that none had enough allocatable CPU capacity to satisfy the pod's CPU request (specified in the container's `resources.requests.cpu`). This causes the pod to remain in 'Pending' state because the scheduler cannot find a feasible node.

Exam trap

A common pitfall is confusing resource 'requests' (used for scheduling) with 'limits' (used for throttling/eviction). Candidates may mistakenly think 'Insufficient cpu' refers to CPU limits being exceeded, rather than the scheduler failing to find a node with enough free CPU to meet the request.

How to eliminate wrong answers

Option A is wrong because exceeding a memory limit causes a pod to be terminated (OOMKilled) or evicted, not stuck in 'Pending' state with an 'Insufficient cpu' event. Option B is wrong because image pull failures generate events like 'Failed to pull image' or 'ErrImagePull', not a node-level scheduling failure. Option D is wrong because liveness probe failures occur after the pod is already running (affecting the 'Running' state), not during scheduling when the pod is still 'Pending'.

198
MCQhard

When using a Service of type ClusterIP, how do pods reach the service?

A.Via the service's cluster IP and port
B.Via the node's IP address and a high port
C.Via an external load balancer
D.Directly via the pod's IP address
AnswerA

Pods connect to the service's cluster IP and port, which kube-proxy forwards to healthy pods.

Why this answer

A Service of type ClusterIP exposes a stable virtual IP (the cluster IP) and port within the cluster. Pods reach the Service by sending traffic to this cluster IP and port, which is then load-balanced by kube-proxy (using iptables, IPVS, or eBPF rules) to one of the backing pod endpoints. This is the default and most fundamental Service type in Kubernetes.

Exam trap

CNCF often tests the misconception that ClusterIP Services are only reachable from within the same pod or node, when in fact they are reachable from any pod in the cluster (across nodes) via the cluster IP, thanks to kube-proxy's distributed routing rules.

How to eliminate wrong answers

Option B is wrong because reaching a Service via the node's IP address and a high port is the behavior of a NodePort Service, not ClusterIP. Option C is wrong because an external load balancer is used by a LoadBalancer Service, which is built on top of NodePort and ClusterIP, not by ClusterIP itself. Option D is wrong because pods do not reach the Service directly via a pod's IP address; that would bypass the Service abstraction and load balancing, and the Service's cluster IP is the intended stable endpoint.

199
MCQmedium

A Deployment is created with `replicas: 3`. After applying the manifest, only 2 pods are running and one is in Pending state. What is the most likely reason?

A.The Service selector does not match
B.The Deployment name is misspelled
C.There are insufficient resources on the nodes
D.The container image is invalid
AnswerC

Pending often indicates insufficient CPU or memory to schedule the pod.

Why this answer

When a Pod remains in Pending state, it means the scheduler cannot find a node that satisfies the Pod's resource requirements (CPU, memory, or other constraints). Since two Pods are running successfully, the Deployment configuration (image, name, selector) is valid, and the issue is that the cluster lacks sufficient capacity to schedule the third replica. The scheduler continuously evaluates node resources and will leave the Pod pending until resources become available or the request is adjusted.

Exam trap

CNCF often tests the distinction between Pod lifecycle phases (Pending vs. CrashLoopBackOff vs. ImagePullBackOff) to see if candidates confuse scheduling failures with runtime or image errors.

How to eliminate wrong answers

Option A is wrong because a Service selector mismatch would not cause a Pod to be in Pending state; it would affect traffic routing but not Pod scheduling or creation. Option B is wrong because a misspelled Deployment name would cause the manifest to fail at creation time or create a separate resource, not result in a partially running Deployment with two Pods. Option D is wrong because an invalid container image would cause the Pod to enter ImagePullBackOff or ErrImagePull state, not Pending; Pending occurs before the container runtime attempts to pull the image.

200
MCQeasy

Which component on a worker node is responsible for enforcing the desired state of pods as defined in the pod specification?

A.kube-scheduler
B.kube-proxy
C.container runtime
D.kubelet
AnswerD

Why this answer

The kubelet is the primary node agent that runs on each worker node and is responsible for ensuring that containers are running in a pod as specified by the pod's manifest (PodSpec). It continuously monitors pod status and takes corrective actions, such as restarting containers or re-creating pods, to match the desired state defined in the Kubernetes API.

Exam trap

The trap here is that candidates often confuse the kubelet's role with the container runtime or kube-scheduler, assuming that running containers automatically enforces the desired state, when in fact the kubelet is the only component that actively reconciles the actual state with the PodSpec.

How to eliminate wrong answers

Option A is wrong because the kube-scheduler is a control plane component that assigns pods to nodes based on resource availability and constraints, but it does not enforce the desired state of pods on a worker node. Option B is wrong because kube-proxy handles network rules and load balancing for services on each node, not pod lifecycle management or state enforcement. Option C is wrong because the container runtime (e.g., containerd, CRI-O) is responsible for pulling images and running containers, but it does not interpret the PodSpec or enforce the desired state; that is the kubelet's job.

201
MCQhard

A pod is stuck in 'Pending' state. Which of the following is NOT a common cause for a pod to remain Pending?

A.Insufficient CPU or memory resources available in the cluster
B.The node selector in the pod spec does not match any node labels
C.The container runtime is not functioning on the node
D.The pod's PVC is not yet bound to a PV
AnswerC

A non-functioning container runtime does not prevent scheduling; it affects pod execution after scheduling. Therefore, it is NOT a common cause of prolonged Pending state.

Why this answer

A non-functioning container runtime on a node typically results in pod states like CrashLoopBackOff or Error, not prolonged 'Pending' state. Pending state occurs when a pod cannot be scheduled. Insufficient resources (A), node selector mismatch (B), and unbound PVCs (D) are common causes of scheduling failures that keep a pod in Pending.

Container runtime issues affect pod execution after scheduling, not the scheduling process itself. Therefore, C is NOT a common cause for a pod to remain Pending.

Exam trap

Candidates often confuse issues that affect pod scheduling with those that affect pod execution. Container runtime problems cause pods to fail after starting, not to remain in Pending state. The question tests understanding of which conditions prevent scheduling vs. those that impact running pods.

How to eliminate wrong answers

Option A is wrong because insufficient CPU or memory resources in the cluster is a common cause for a pod to remain in 'Pending' state, as the scheduler cannot find a node with enough free resources to place the pod. Option C is wrong because a non-functioning container runtime on a node will cause the pod to stay 'Pending' if the node is the only candidate, as the kubelet cannot start containers; however, this is a less common but valid cause. Option D is wrong because an unbound PVC (PersistentVolumeClaim) is a classic reason for a pod to be stuck in 'Pending', as the scheduler waits for the volume to be bound before proceeding with pod placement.

202
MCQhard

Which of the following is a correct way to assign a pod to a specific node using a nodeSelector?

A.spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: ...
B.spec: nodeName: "node1"
C.spec: nodeSelector: [disktype: ssd]
D.spec: nodeSelector: disktype: ssd
AnswerD

This is the correct syntax for nodeSelector.

Why this answer

`nodeSelector` is a simple pod scheduling constraint that uses a key-value pair in the `spec.nodeSelector` field to match node labels. The correct YAML syntax is `spec: nodeSelector: disktype: ssd`, where `disktype` is the label key and `ssd` is the value, ensuring the pod is scheduled only on nodes with that exact label.

Exam trap

The trap here is that candidates confuse the YAML syntax for `nodeSelector` (a map) with that of `nodeAffinity` or `nodeName`, or incorrectly use an array format like `[disktype: ssd]` instead of the correct key-value pair.

How to eliminate wrong answers

Option A is wrong because it describes `nodeAffinity` with `requiredDuringSchedulingIgnoredDuringExecution`, which is a more advanced scheduling feature using `nodeSelectorTerms`, not the simpler `nodeSelector` field. Option B is wrong because `spec.nodeName` directly assigns a pod to a specific node by name, bypassing the scheduler entirely, which is not the same as using a `nodeSelector` to match labels. Option C is wrong because `nodeSelector` expects a map (key-value pair), not a list; the syntax `[disktype: ssd]` is an array format, which is invalid for `nodeSelector`.

203
Multi-Selecthard

Which THREE are valid ways to provide configuration data to a pod in Kubernetes?

Select 3 answers
A.Use an init container to write configuration to a shared volume
B.Mount a ConfigMap as a volume
C.Mount a Secret as a volume
D.Hardcode environment variables in the pod spec that contain sensitive data
E.Use environment variables from a ConfigMap
AnswersB, C, E

ConfigMaps can be mounted as files in a pod.

Why this answer

A ConfigMap is a Kubernetes API object designed to store non-confidential configuration data in key-value pairs. Mounting a ConfigMap as a volume makes its data available as files in the pod's filesystem, allowing applications to read configuration without hardcoding it into the container image or pod spec. This approach decouples configuration from containerized applications, following the principle of immutable infrastructure.

Exam trap

The KCNA exam often tests the misconception that any method of injecting data into a pod is a 'valid' configuration approach, but the KCNA exam expects you to recognize that only native Kubernetes API objects (ConfigMaps and Secrets) are the recommended and valid ways to provide configuration data, rejecting ad-hoc methods like init container scripts or hardcoded values.

204
MCQeasy

What is the primary purpose of Prometheus in cloud native observability?

A.Provide distributed tracing
B.Visualize data
C.Collect and store logs
D.Collect and store metrics
AnswerD

Prometheus is a metrics system.

Why this answer

Prometheus is a metric system that collects and stores numeric time-series data.

205
Multi-Selectmedium

Which THREE of the following are true about container lifecycle? (Choose 3)

Select 3 answers
A.A container can be paused and resumed
B.A container can be hibernated to save state to disk
C.A container goes through a 'built' phase before running
D.A container terminates when its main process exits
E.A container can be stopped and later restarted
AnswersA, D, E

Container runtimes support pausing and resuming containers using cgroups freezer.

Why this answer

A container lifecycle includes creation, running, pausing, and stopping. Containers can be started, stopped, and restarted. Containers do not have a 'built' phase; images are built separately.

Containers run processes; they are not designed to be hibernated.

206
Multi-Selectmedium

Which TWO of the following are characteristics of Kustomize?

Select 2 answers
A.Requires a values.yaml file for configuration
B.Uses a templating engine similar to Helm
C.Supports patching resources via patchesStrategicMerge
D.Can manage dependencies between charts
E.Uses overlays to customize base configurations
AnswersC, E

Kustomize supports strategic merge patches and JSON patches.

Why this answer

Kustomize uses overlays to customize Kubernetes manifests without templating. It does not use values files or require a package manager.

207
MCQhard

You are asked to deploy a Kubernetes service that exposes a set of pods internally within the cluster only. The service should not be accessible from outside the cluster. Which Service type should you choose?

A.ClusterIP
B.NodePort
C.ExternalName
D.LoadBalancer
AnswerA

ClusterIP provides internal-only access.

Why this answer

ClusterIP is the default Kubernetes Service type that exposes the service on a cluster-internal IP address. This makes the service reachable only from within the cluster, which is exactly what is required for internal-only communication between pods. No external traffic can reach a ClusterIP service unless an ingress controller or proxy is explicitly configured.

Exam trap

CNCF often tests the misconception that ClusterIP is only for inter-pod communication within the same namespace, but it actually works across all namespaces within the cluster, and the trap is that candidates confuse it with NodePort when they think 'internal only' means 'no external access' but forget that NodePort inherently opens external access.

How to eliminate wrong answers

Option B is wrong because NodePort exposes the service on a static port on each node's IP address, making it accessible from outside the cluster via <NodeIP>:<NodePort>. Option C is wrong because ExternalName maps a service to a DNS name (via CNAME records) and does not expose pods internally; it is used to provide an alias for an external service. Option D is wrong because LoadBalancer provisions an external load balancer (e.g., from a cloud provider) and assigns a public IP, making the service accessible from outside the cluster.

208
MCQeasy

What is the primary purpose of the Open Container Initiative (OCI)?

A.To provide a container runtime called Docker
B.To create a container orchestration platform
C.To define the Kubernetes Container Runtime Interface (CRI)
D.To standardize container image and runtime specifications
AnswerD

OCI develops and maintains standards for container images (image spec) and runtimes (runtime spec) to promote compatibility across tools.

Why this answer

The Open Container Initiative (OCI) is an open governance structure that standardizes container image and runtime specifications. It ensures that any OCI-compliant image can run on any OCI-compliant runtime, promoting interoperability across the container ecosystem. This is the core purpose, not to provide a specific runtime or orchestration tool.

Exam trap

The CNCF exam often tests the distinction between a standard (OCI) and an implementation (Docker, containerd), so candidates mistakenly associate the OCI with Docker or Kubernetes rather than its role as a neutral specification body.

How to eliminate wrong answers

Option A is wrong because Docker is a specific container runtime and toolset, not the purpose of the OCI; the OCI standardizes specifications, not a particular implementation. Option B is wrong because container orchestration platforms like Kubernetes are separate projects; the OCI focuses on low-level image and runtime standards, not orchestration. Option C is wrong because the Kubernetes Container Runtime Interface (CRI) is a Kubernetes-specific plugin interface for runtimes, while the OCI defines the broader industry standard for container formats and runtimes.

209
MCQeasy

Which control plane component is responsible for assigning pods to nodes?

A.etcd
B.kube-apiserver
C.kube-scheduler
D.kube-controller-manager
AnswerC

The kube-scheduler watches for newly created pods and assigns them to nodes.

Why this answer

The kube-scheduler is the control plane component responsible for assigning pods to nodes. It watches for newly created pods that have no node assignment and selects an optimal node for each pod based on resource requirements, constraints, policies, and data locality. The scheduler does not actually run the pod; it updates the pod's `nodeName` field via the API server, which then triggers the kubelet on the chosen node to launch the pod.

Exam trap

A common misconception is that kube-apiserver handles scheduling because it is the central API gateway, but the scheduler is a distinct component that runs the scheduling algorithm and communicates with the API server to bind pods to nodes.

How to eliminate wrong answers

Option A is wrong because etcd is a distributed key-value store that holds the cluster state, not a component that makes scheduling decisions. Option B is wrong because kube-apiserver is the front-end for the Kubernetes control plane that exposes the API and validates requests, but it does not assign pods to nodes. Option D is wrong because kube-controller-manager runs controller processes like the node controller and replication controller, but it does not handle pod-to-node assignment; that is the sole responsibility of the scheduler.

210
MCQhard

An SRE team defines an SLO that 99.9% of requests to a service should complete in under 500ms over a 30-day rolling window. If the service receives 10 million requests in a month, what is the maximum number of requests that can exceed the latency threshold while still meeting the SLO?

A.10,000
B.5,000
C.1,000
D.100,000
AnswerA

0.1% of 10 million is 10,000.

Why this answer

SLO of 99.9% means up to 0.1% errors are allowed. 0.1% of 10,000,000 is 10,000 requests.

211
Multi-Selectmedium

Which THREE fields are required in a Kubernetes manifest YAML file?

Select 3 answers
A.kind
B.metadata
C.status
D.spec
E.apiVersion
AnswersA, B, E

Defines the type of Kubernetes resource.

Why this answer

The 'kind' field is required because it tells Kubernetes which type of object to create (e.g., Pod, Deployment, Service). Without it, the API server cannot route the manifest to the correct resource handler. It must be a valid Kubernetes resource kind from the core API or a custom resource definition.

Exam trap

CNCF often tests the misconception that 'spec' is always required, but the KCNA exam expects you to know that status is never user-supplied and that spec is optional for certain built-in resources like Namespace or LimitRange.

212
MCQmedium

You have two pods in different namespaces that need to communicate using a stable IP address. Which Kubernetes object provides a stable endpoint for a set of pods?

A.ConfigMap
B.Ingress
C.Service
D.Deployment
AnswerC

Services provide stable networking endpoints for pods.

Why this answer

A Kubernetes Service provides a stable IP address and DNS name that remains constant regardless of pod restarts or rescheduling, enabling reliable communication between pods in different namespaces. Unlike pods, which have ephemeral IPs, a Service selects a set of pods via label selectors and load-balances traffic to them, ensuring a stable endpoint across namespace boundaries.

Exam trap

A common misconception is that a Deployment itself provides a stable network endpoint, but a Deployment only manages pod lifecycle; the Service object is required to expose those pods with a fixed IP and DNS name.

How to eliminate wrong answers

Option A is wrong because a ConfigMap is used to store configuration data as key-value pairs, not to provide network endpoints or stable IPs for pod communication. Option B is wrong because an Ingress manages external HTTP/HTTPS traffic routing to Services, but it does not itself provide a stable internal IP; it relies on a Service for that purpose. Option D is wrong because a Deployment manages pod replicas and updates, but it does not expose a stable IP; pods managed by a Deployment have dynamic IPs that change on restart, so a Service is needed for a stable endpoint.

213
MCQhard

You need to run a stateful application that requires stable network identities and persistent storage per pod. Which Kubernetes resource is BEST suited?

A.DaemonSet
B.StatefulSet
C.Job
D.Deployment
AnswerB

StatefulSet provides stable pod identities and ordered deployment/ scaling, ideal for stateful workloads.

Why this answer

StatefulSet is the correct choice because it is specifically designed for stateful applications that require stable, unique network identifiers (e.g., pod names like `web-0`, `web-1`) and persistent storage that persists across pod rescheduling. Each pod in a StatefulSet gets a dedicated PersistentVolumeClaim, and the ordinal index ensures consistent identity, which is critical for databases like Cassandra or MySQL.

Exam trap

A common misconception is that Deployment can handle stateful workloads by using PersistentVolumeClaims, but Deployment pods lack stable identities and ordered startup/shutdown, which are essential for many stateful applications.

How to eliminate wrong answers

Option A is wrong because DaemonSet ensures one pod per node for cluster-wide services (e.g., logging agents), but it does not guarantee stable network identities or per-pod persistent storage. Option C is wrong because Job is intended for batch processing tasks that run to completion, not for long-running stateful applications requiring stable storage and identity. Option D is wrong because Deployment provides stateless, interchangeable pods with random names and shared or ephemeral storage, making it unsuitable for applications that require stable network identities and persistent storage per pod.

214
MCQhard

A Deployment is rolling out a new version. The rollout has stalled, and 'kubectl rollout status deployment/myapp' shows 'Waiting for deployment rollout to finish: 2 out of 5 new replicas have been updated...'. The Deployment's spec.strategy.rollingUpdate.maxUnavailable is set to 25% and maxSurge is 25%. What is the maximum number of Pods that could be unavailable during this rollout?

A.1
B.3
C.2
D.0
AnswerC

maxUnavailable=25% of 5 = 1.25, so up to 2 Pods can be unavailable.

Why this answer

With maxUnavailable=25% and maxSurge=25%, the maximum number of unavailable Pods during a rolling update is calculated as the ceiling of 25% of the desired replicas (5), which is 2. This means up to 2 Pods can be unavailable at any time, ensuring the rollout can proceed while maintaining availability.

Exam trap

The trap here is that candidates often forget that maxUnavailable is calculated as a percentage of the desired replicas and rounded up, leading them to incorrectly calculate 25% of 5 as 1.25 and round down to 1, or they misinterpret the rollout status as showing only 2 Pods are updated, assuming that is the maximum unavailable, when in fact the maximum is determined by the strategy, not the current state.

How to eliminate wrong answers

Option A is wrong because 1 is less than the calculated maximum of 2 (ceiling of 25% of 5), and the rollout status shows 2 new replicas are updated, indicating at least 2 Pods are unavailable. Option B is wrong because 3 exceeds the maximum allowed by the rolling update strategy; maxUnavailable=25% limits unavailable Pods to 2, and having 3 unavailable would violate the Deployment's availability guarantee. Option D is wrong because 0 is not possible during a rollout; the rollout status explicitly shows 2 out of 5 new replicas are updated, meaning at least 2 old Pods are being terminated and are unavailable.

215
Multi-Selectmedium

Which TWO statements are true about ArgoCD's health status?

Select 2 answers
A.ArgoCD can be configured to perform automatic rollback on health degradation
B.ArgoCD only supports health checks for Deployments
C.ArgoCD checks the health of resources by comparing their status fields
D.Health status is only determined by the application's YAML definition
E.A healthy application always means the sync status is 'Synced'
AnswersA, C

Self-healing can trigger rollback if health check fails.

Why this answer

ArgoCD assesses health based on Kubernetes resource status and can take actions when health degrades.

216
Multi-Selectmedium

Which THREE are examples of DORA metrics used to measure DevOps performance? (Choose 3)

Select 3 answers
A.Deployment Frequency
B.Number of developers per team
C.Code coverage percentage
D.Mean Time to Restore (MTTR)
E.Lead Time for Changes
AnswersA, D, E

Why this answer

DORA metrics include Deployment Frequency, Lead Time for Changes, Mean Time to Restore (MTTR), and Change Failure Rate. Options A, D, and E are the three correct ones. Option B (Number of developers per team) is not a DORA metric.

Option C (Code coverage percentage) is a software quality metric, not a DORA metric.

217
Multi-Selectmedium

Which two of the following are characteristics of container images built using OCI standards? (Choose two.)

Select 2 answers
A.They are portable across different container runtimes
B.They are composed of layers that can be cached and reused
C.They include a full guest operating system
D.They can only be run by Docker
E.They require a hypervisor to run
AnswersA, B

OCI standards ensure portability.

Why this answer

OCI images are composed of layers (read-only) and are built from a Dockerfile. They are lightweight and portable across different runtimes. They do not include a guest OS (unlike VMs), and they are not tied to a specific runtime.

218
MCQmedium

In Flux, which controller is responsible for reconciling the desired state defined in a Git repository to the cluster?

A.Image Automation Controller
B.Kustomize Controller
C.Source Controller
D.Helm Controller
AnswerB

The Kustomize Controller watches for changes in Kustomize overlays and applies them to the cluster, ensuring the cluster matches the desired state.

Why this answer

Flux's Source Controller fetches artifacts (e.g., Git repositories, Helm repos) but does not apply changes. The Kustomize Controller is the primary controller that reconciles the desired state from those sources to the cluster.

219
Multi-Selecthard

Which THREE of the following are core components of the OpenTelemetry specification? (Select three.)

Select 3 answers
A.Data Model
B.API
C.Collector
D.Exporter
E.SDK
AnswersA, B, E

Data Model defines the schema for telemetry data.

Why this answer

The OpenTelemetry specification defines the API, SDK, and data model. These are the core components.

220
MCQhard

A Kubernetes cluster has two nodes: control-plane and worker. The worker node runs several pods. The control-plane node becomes unreachable. What is the immediate impact on the pods running on the worker node?

A.All pods are immediately terminated
B.Pods continue running, but new pods cannot be scheduled
C.Pods are rescheduled to the control-plane node
D.The worker node is automatically cordoned
AnswerB

Existing pods keep running; scheduling requires the scheduler on the control plane.

Why this answer

When the control-plane node becomes unreachable, the kube-controller-manager cannot communicate with the kubelet on the worker node, so it stops performing scheduling and reconciliation. However, the kubelet on the worker node continues to run existing pods based on the last known desired state stored locally, and the pods themselves are managed by the container runtime (e.g., containerd) independently of the control-plane. Therefore, pods continue running normally, but no new pods can be scheduled because the scheduler, which runs on the control-plane, is unavailable.

Exam trap

The trap here is that candidates often assume the control-plane is required for all pod operations, confusing the control-plane's role in scheduling and reconciliation with the kubelet's independent ability to maintain running workloads, leading them to choose immediate termination or automatic rescheduling.

How to eliminate wrong answers

Option A is wrong because pods are not immediately terminated; the kubelet on the worker node continues to maintain running pods even without contact with the control-plane, as the pod lifecycle is managed locally. Option C is wrong because pods cannot be rescheduled to the control-plane node; the control-plane node is typically tainted (e.g., node-role.kubernetes.io/control-plane:NoSchedule) to prevent workload pods from running on it, and the scheduler is unavailable to make such decisions. Option D is wrong because the worker node is not automatically cordoned; cordoning is a manual or scheduler-driven action that marks a node as unschedulable, but the control-plane being unreachable does not trigger an automatic cordon of the worker node.

221
MCQmedium

You have a Pod that is in 'Pending' state. What is the most likely cause?

A.The node is out of CPU or memory resources.
B.The application inside the container crashed.
C.The container image is missing.
D.The Service does not have any endpoints.
AnswerA

If no node has sufficient resources to satisfy the Pod's requests, the scheduler cannot place it, leaving it Pending.

Why this answer

A Pod in 'Pending' state indicates that the scheduler has not yet assigned it to a node. The most common reason is insufficient resources (CPU or memory) on any available node, causing the scheduler to fail to find a suitable node that meets the Pod's resource requests. This is a core scheduling failure in Kubernetes.

Exam trap

CNCF often tests the distinction between Pod lifecycle states, and the trap here is confusing 'Pending' (pre-scheduling) with post-scheduling failures like image pull errors or container crashes, which have distinct states (e.g., ImagePullBackOff, CrashLoopBackOff).

How to eliminate wrong answers

Option B is wrong because a container crash (e.g., application exit code non-zero) results in a 'CrashLoopBackOff' or 'Error' state, not 'Pending'. Option C is wrong because a missing container image causes the Pod to enter 'ImagePullBackOff' or 'ErrImagePull' state after scheduling, not 'Pending'. Option D is wrong because a Service lacking endpoints does not affect Pod scheduling; it is a networking issue that affects service discovery, not the Pod's lifecycle state.

222
MCQeasy

Which of the following is a key benefit of container orchestration?

A.Manual scaling of applications
B.Requires manual intervention for pod failures
C.Only supports monolithic applications
D.Automated scaling, self-healing, and declarative management
AnswerD

These are core benefits of orchestration.

Why this answer

Container orchestration platforms like Kubernetes provide automated scaling, self-healing, and declarative management.

223
MCQhard

A platform team wants to implement observability for a Kubernetes cluster running 500+ microservices. They need to reduce the cost of storing logs while retaining the ability to search for specific error patterns. Which strategy best achieves this?

A.Increase log retention to one year for compliance
B.Store all logs in a centralized Elasticsearch cluster with high retention
C.Aggregate logs into a single pod for easier indexing
D.Use structured logging and sample debug logs, retaining error logs fully
AnswerD

Sampling reduces volume while keeping critical error logs for search.

Why this answer

Structured logging (e.g., JSON format) enables efficient indexing and querying of logs, while sampling debug logs and retaining error logs fully reduces storage costs without losing critical error patterns. This approach balances observability needs with cost optimization, a key principle in cloud-native environments.

Exam trap

The trap here is that candidates may assume centralized storage (Elasticsearch) or longer retention always improves observability, ignoring the cost and scalability constraints of 500+ microservices in a cloud-native environment.

How to eliminate wrong answers

Option A is wrong because increasing log retention to one year for compliance does not address cost reduction; it increases storage costs and may violate data minimization principles. Option B is wrong because storing all logs in a centralized Elasticsearch cluster with high retention is expensive and inefficient, as it retains unnecessary debug logs and scales poorly for 500+ microservices. Option C is wrong because aggregating logs into a single pod creates a single point of failure, violates pod isolation, and does not reduce storage costs or improve searchability.

224
Multi-Selectmedium

Which TWO of the following are valid ways to expose environment variables from a ConfigMap to a pod?

Select 2 answers
A.volumes and volumeMounts
B.env.value
C.env.valueFrom.secretKeyRef
D.env.valueFrom.configMapKeyRef
E.envFrom
AnswersD, E

Correct. env.valueFrom.configMapKeyRef allows referencing a specific key from a ConfigMap and exposing it as an environment variable.

Why this answer

Environment variables from a ConfigMap can be exposed to a pod using envFrom to inject all key-value pairs as environment variables, or using env.valueFrom.configMapKeyRef to inject a specific key as an environment variable. Using volumes and volumeMounts mounts the ConfigMap as files in the filesystem, not as environment variables. Option B (env.value) is for static values, not references.

Option C (secretKeyRef) is for Secrets, not ConfigMaps.

Exam trap

CNCF often tests the distinction between `configMapKeyRef` and `secretKeyRef`, expecting candidates to know that `secretKeyRef` is for Secrets only, not ConfigMaps, and that `env.value` is for static values, not dynamic references.

225
MCQmedium

You need to provide an application with configuration data that does not change often and should not be baked into the container image. Which Kubernetes resource should you use?

A.Secret
B.PersistentVolumeClaim
C.ConfigMap
D.ServiceAccount
AnswerC

Why this answer

ConfigMap is the correct Kubernetes resource for providing configuration data that does not change often and should not be baked into the container image. It decouples configuration artifacts from image content, allowing you to update configuration without rebuilding images, and supports injection via environment variables, command-line arguments, or volume mounts.

Exam trap

The trap here is that candidates confuse ConfigMap with Secret, assuming all configuration must be secret, or they mistakenly think PersistentVolumeClaim can store configuration files, when in fact ConfigMap is the correct resource for non-sensitive, frequently updated configuration data.

How to eliminate wrong answers

Option A is wrong because Secrets are specifically designed for sensitive data (e.g., passwords, tokens, SSH keys) and are base64-encoded, not for general configuration data that does not change often. Option B is wrong because PersistentVolumeClaim is used to request persistent storage volumes for stateful workloads, not for injecting configuration data into containers. Option D is wrong because ServiceAccount provides an identity for Pods to authenticate with the Kubernetes API server, not for storing or delivering configuration data.

Page 2

Page 3 of 12

Page 4