KCNA Container Orchestration Practice Question
An administrator must run a privileged DaemonSet on every node, including the control-plane node, to collect host logs. The control-plane node has a taint node-role.kubernetes.io/control-plane:NoSchedule. Which change allows the DaemonSet Pods to be scheduled on the control-plane node while keeping the taint intact?
⚠ Common exam trap
Watch out — candidates often confuse nodeSelector or node labels with tolerations, when only a toleration overrides a NoSchedule taint without removing it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a toleration for key node-role.kubernetes.io/control-plane with operator Exists and effect NoSchedule to the DaemonSet Pod template.
Taints repel Pods unless the Pod declares a matching toleration. Adding a toleration with operator Exists and effect NoSchedule for the control-plane taint lets the DaemonSet schedule there while leaving the taint in place, so other workloads remain excluded. Removing the taint, pinning with nodeName, or using a nodeSelector does not meet the requirement of keeping the taint intact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the taint from the control-plane node with kubectl taint nodes --all node-role.kubernetes.io/control-plane-.
Why it's wrong here
Removing the taint would allow the DaemonSet to schedule there, but it also lets any other workload land on the control-plane node, which the administrator wants to avoid. The requirement is to keep the taint intact. Tolerations achieve the same scheduling result without weakening cluster-wide scheduling policy.
- ✗
Set spec.template.spec.nodeName to the control-plane node name in the DaemonSet.
Why it's wrong here
Setting nodeName bypasses the scheduler entirely and pins Pods to a single named node, which breaks the DaemonSet's purpose of running on every node. It also prevents the DaemonSet controller from managing placement across the cluster. A toleration is the correct, scalable mechanism for this requirement.
- ✓
Add a toleration for key node-role.kubernetes.io/control-plane with operator Exists and effect NoSchedule to the DaemonSet Pod template.
Why this is correct
Tolerations allow Pods to be scheduled onto nodes with matching taints without removing the taint. Using operator Exists with effect NoSchedule tolerates the control-plane taint regardless of its value, so the DaemonSet can place a Pod on that node. The taint remains, preserving the default scheduling restriction for other workloads.
- ✗
Add a nodeSelector for node-role.kubernetes.io/control-plane to the DaemonSet Pod template.
Why it's wrong here
A nodeSelector narrows scheduling to nodes with a matching label, but it does not override a NoSchedule taint. The control-plane node would still reject the Pod unless a toleration is present. Labels and taints are separate mechanisms, and only a toleration addresses the taint.
Go deeper
Related to this question
About these practice questions
One of 930 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.