KCNA · domain
Container Orchestration
Container Orchestration is the largest KCNA domain, covering how Kubernetes schedules, runs, and connects workloads. Questions test core API objects — Pods, Deployments, Jobs, Services, NetworkPolicies — plus probes, container spec fields, and the reconciliation model, using scenario-style multiple choice rather than hands-on kubectl tasks.
Focused practice
Practice Container Orchestration questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about Container Orchestration
Be able to pick the right workload controller and probe for a scenario, and name required container fields. The most important thing: know that liveness restarts containers while readiness controls Service traffic, and that NetworkPolicies are deny-by-default only once a policy selects the pod.
Pod and container spec fields, including required name and image keys
Liveness versus readiness probes and their effect on restarts and endpoints
NetworkPolicy objects selecting pods to allow or deny traffic
Job versus Deployment versus CronJob selection for run-to-completion workloads
Watch out for
Common Container Orchestration exam traps
- ▸Confusing liveness and readiness: liveness failures restart the container, readiness failures only remove the Pod from Service endpoints.
- ▸Assuming NetworkPolicies apply by default; without a policy, all pod traffic is allowed, and enforcement needs a CNI plugin that supports them.
- ▸Choosing a Deployment for batch work; Jobs, not Deployments, track successful completions and retries.
Question index
All Container Orchestration questions (210)
Click any question to see the full explanation, or start a practice session above.
Which of the following is a key benefit of container orchestration compared to running containers manually?
Easy2Which THREE are valid container runtimes that implement the Kubernetes CRI? (Choose three.)
Hard3Which TWO of the following are benefits of using containers over virtual machines? (Choose 2)
Easy4A Kubernetes cluster is experiencing network latency. The team suspects that the number of services and endpoints is causing iptables performance degradation. Which CNI plugin or network policy approach is most likely to improve performance?
Hard5You need to run a batch job that processes a queue and then terminates. Which Kubernetes resource should you use?
Medium6You are designing a microservices application. Which of the following is a key principle of microservices architecture?
Hard7A team runs a stateless web application and wants to update its container image with zero downtime while gradually shifting traffic to the new version. They also need the ability to pause the rollout, inspect the new Pods, and then resume. Which Kubernetes workload and strategy best supports this workflow?
Medium8A developer wants to run a container image locally for testing before deploying to a Kubernetes cluster. Which tool is most appropriate for this task?
Medium9Which TWO of the following are benefits of container orchestration?
Medium10A developer wants to run a containerized application locally for development. Which tool is most appropriate?
Medium11An application requires stable network identities and persistent storage. Which workload type should be used?
Medium12Which of the following is a benefit of using an orchestrator like Kubernetes?
Easy13A Kubernetes cluster runs a critical application that must be highly available. The application consists of three pods managed by a Deployment. To ensure the application remains accessible during a node failure, which configuration should be applied?
Hard14A pod is in the 'CrashLoopBackOff' state. You run 'kubectl logs mypod' and see an error related to missing environment variables. The pod is part of a Deployment. What is the best way to fix this without recreating the entire Deployment?
Medium15Which two of the following are container runtimes that implement the Container Runtime Interface (CRI)? (Choose two.)
Medium16Which of the following is a benefit of using container orchestration platforms like Kubernetes?
Medium17Which TWO of the following are benefits of using a container orchestration platform like Kubernetes? (Select 2)
Medium18An administrator runs 'kubectl get pods' and sees that a pod named 'app-pod' is in 'CrashLoopBackOff'. They run 'kubectl logs app-pod' and see a segmentation fault error. What is the most likely cause?
Medium19An administrator manages a cluster where a Namespace named 'analytics' contains a ResourceQuota that limits pods to 10. A developer applies a manifest containing a ReplicaSet with replicas: 12 in that Namespace. The ReplicaSet controller creates the first 10 Pods successfully, but the remaining 2 Pods are rejected. Which statement best describes what the developer will observe and why?
Hard20You have a Deployment with three replicas. You want to update the container image but ensure that only one pod is updated at a time, and the update proceeds only if the new pod becomes healthy. Which update strategy should you configure?
Hard21You need to deploy a batch job that processes a queue and runs to completion. The job should run exactly once and create exactly one pod per work item, but some items may fail. Which Kubernetes resource is best suited?
Hard22A company wants to adopt immutable infrastructure for its containerized applications. Which practice BEST exemplifies immutability?
Medium23You have a Deployment running 3 replicas. You need to update the container image without downtime. Which command updates the image while performing a rolling update?
Medium24Which of the following is a benefit of container orchestration?
Medium25Which component in Kubernetes is responsible for managing the lifecycle of pods and ensuring the desired number of replicas are running?
Easy26A pod uses a ServiceAccount that has a RoleBinding to a Role with 'get', 'list', 'watch' on 'pods'. The pod tries to list pods in the same namespace. Will the request succeed?
Hard27A workload running in a namespace called 'payments' is defined by a Pod spec with restartPolicy: Always. The cluster's kubelet on node 'worker-3' is healthy, the API server is reachable, and the scheduler has placed the Pod on worker-3. After the Pod's only container exits with code 0, a platform engineer observes that the Pod restarts repeatedly even though the application completed its work successfully. Which Kubernetes behavior explains this observation?
Medium28Which TWO statements about container images are correct? (Choose two.)
Easy29A pod spec includes a liveness probe that runs 'cat /tmp/healthy'. The probe is configured with initialDelaySeconds: 10, periodSeconds: 5. At what point does the kubelet first execute the probe?
Medium30A DevOps team notices that a new deployment of a web application is not receiving traffic even though the pods are running. The deployment has a selector matching the pod labels, and a Service of type ClusterIP exists. What is the most likely cause?
Medium31A Kubernetes cluster has a single control plane node and two worker nodes. The control plane node fails. What is the immediate impact on the workloads running on the worker nodes?
Medium32Refer to the exhibit. How many containers are defined in this Pod?
Easy33A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event '0/4 nodes are available: 4 Insufficient cpu'. What is the most likely cause?
Medium34When using a Service of type ClusterIP, how do pods reach the service?
Hard35Which THREE of the following are true about container lifecycle? (Choose 3)
Medium36You are asked to deploy a Kubernetes service that exposes a set of pods internally within the cluster only. The service should not be accessible from outside the cluster. Which Service type should you choose?
Hard37What is the primary purpose of the Open Container Initiative (OCI)?
Easy38You need to run a stateful application that requires stable network identities and persistent storage per pod. Which Kubernetes resource is BEST suited?
Hard39Which two of the following are characteristics of container images built using OCI standards? (Choose two.)
Medium40You are deploying a stateful application that requires each pod to have a stable, unique network identity and its own persistent storage. Which Kubernetes resource should you use?
Easy41A Kubernetes cluster has two nodes: control-plane and worker. The worker node runs several pods. The control-plane node becomes unreachable. What is the immediate impact on the pods running on the worker node?
Hard42Which of the following is a key benefit of container orchestration?
Easy43What is the primary purpose of a container orchestration platform like Kubernetes?
Easy44Which THREE of the following are key benefits of container orchestration? (Choose 3)
Medium45What is the primary benefit of using containers over virtual machines?
Easy46What is the primary difference between a container and a virtual machine (VM)?
Easy47Which THREE are benefits of using a container orchestration platform? (Select 3)
Medium48Which TWO are benefits of using a container orchestration platform like Kubernetes? (Select TWO.)
Easy49A cluster runs the Horizontal Pod Autoscaler (HPA) v2 for a Deployment named queue-worker. The HPA is configured with minReplicas: 2, maxReplicas: 10, and a target average CPU utilization of 60%. Metrics Server is installed and reports CPU for the Pods. During a burst, CPU utilization rises to 95% and stays there, but the Deployment remains at 2 replicas. Which condition most likely explains why the HPA is not scaling out?
Hard50Which three of the following are benefits of container orchestration? (Choose three.)
Hard51Which THREE of the following are benefits of using container orchestration? (Choose three.)
Hard52A developer needs to run a one-off batch job that processes a dataset and then terminates. The job should run to completion and not restart after successful completion. Which Kubernetes resource is most appropriate for this task?
Easy53Based on the exhibit, why is the pod web-pod not running?
Easy54A container image built using a Dockerfile with multiple layers is stored in a registry. When a node pulls this image, which statement about layers is true?
Medium55What is the purpose of a readiness probe in a Kubernetes pod?
Easy56Which Kubernetes resource should be used to run a one-time task that performs a computation and then exits?
Medium57A developer is troubleshooting a Pod that is stuck in Pending state. The node has sufficient CPU and memory, and the scheduler logs show no errors. Which two factors could prevent the Pod from being scheduled? (Choose two.)
Hard58A developer wants to deploy a stateless web application that should scale to 5 replicas. Each replica must be identical and should be automatically replaced if it fails. Which Kubernetes resource should be used?
Medium59Which Kubernetes resource is used to run a batch job that runs to completion?
Easy60An administrator must run a privileged DaemonSet on every node, including the control-plane node, to collect host logs. The control-plane node has a taint node-role.kubernetes.io/control-plane:NoSchedule. Which change allows the DaemonSet Pods to be scheduled on the control-plane node while keeping the taint intact?
Medium61A DevOps engineer wants to deploy a stateful application that requires stable network identities and persistent storage. Which Kubernetes resource is most appropriate?
Medium62Which THREE of the following are true about the Open Container Initiative (OCI)? (Select 3)
Hard63Which TWO of the following are benefits of using a container orchestration platform like Kubernetes? (Choose two.)
Medium64Which TWO of the following are required fields when defining a container in a Kubernetes Pod spec? (Choose 2)
Medium65Which TWO are characteristics of the microservices architecture that are supported by container orchestration?
Hard66Which of the following is a key principle of microservices architecture?
Easy67A pod is stuck in the 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/3 nodes are available: 1 node had taint that the pod didn't tolerate, 2 Insufficient cpu.' What is the most likely cause?
Medium68Which TWO statements about containers are true compared to virtual machines? (Select TWO.)
Medium69Which command would you run to get a list of all pods in all namespaces?
Medium70Which THREE of the following are key characteristics of microservices architecture?
Hard71You need to deploy an application that requires exactly one pod per cluster node for logging purposes. Which Kubernetes workload resource should you use?
Hard72You need to ensure that a set of pods in a Deployment can be reached by other pods using a stable IP address and DNS name. Which Kubernetes object should you use?
Medium73Drag and drop the steps for a rolling update of a Kubernetes Deployment into the correct order.
Medium74What is the Open Container Initiative (OCI) responsible for?
Medium75A developer wants to run a one-off database migration task in Kubernetes that must complete successfully and then stop. The task should not restart after successful completion, and the developer wants to inspect logs after it finishes. Which resource should be created?
Easy76Which TWO of the following are valid ways to expose a set of pods as a network service in Kubernetes? (Select two.)
Medium77Which TWO statements correctly describe how Kubernetes handles self-healing? (Select two.)
Medium78Which component of Kubernetes is responsible for maintaining the desired state of the cluster?
Easy79Which of the following best describes a key advantage of containers over virtual machines?
Easy80A DevOps engineer wants to update a Deployment's container image from 'v1' to 'v2' with zero downtime. Which kubectl command should they use?
Medium81Which of the following is a container runtime that implements the Container Runtime Interface (CRI)?
Easy82A Kubernetes cluster runs a DaemonSet named 'node-agent' that must run on every node, including the control-plane node. The control-plane node has a taint 'node-role.kubernetes.io/control-plane:NoSchedule'. The DaemonSet currently does not schedule pods on the control-plane node. Which change to the DaemonSet spec will ensure its pods run on the control-plane node?
Medium83A microservices application has multiple services that need to discover each other by name. Which Kubernetes object provides built-in service discovery via DNS?
Hard84Which THREE of the following are valid container runtimes that can be used with Kubernetes via the Container Runtime Interface (CRI)? (Select three.)
Hard85Which component is responsible for running containers in a Kubernetes node and implements the Container Runtime Interface (CRI)?
Medium86You run 'kubectl get pods' and see that a pod named 'web-frontend' is in 'Pending' state for more than 5 minutes. What is the most likely cause?
Hard87A team deploys an application as a StatefulSet with three replicas. They need each Pod to have a stable network identity and its own persistent storage that survives Pod rescheduling. Which two features of StatefulSet satisfy these requirements?
Hard88A developer wants to run a single instance of a stateless web application that should be automatically restarted if it fails, but does not require scaling or updates. Which Kubernetes resource is most appropriate?
Easy89An application Pod needs to read a database password at runtime. The security team requires that the secret material never be stored in the Pod's container image or in a ConfigMap, and that updates to the secret be reflected in the running container without recreating the Pod. Which approach satisfies these requirements?
Hard90A developer needs to provide a pod with a persistent volume that must be mounted by multiple pods simultaneously for read-write access. The underlying storage system supports concurrent writes from multiple nodes. Which volume type should be used?
Medium91A cluster administrator is configuring a NetworkPolicy for a set of pods labeled 'role=db' in the 'backend' namespace. The policy should allow ingress only from pods labeled 'role=api' in the 'frontend' namespace, and only on TCP port 6379. Which NetworkPolicy specification correctly enforces this?
Hard92You want to ensure that a Pod runs on every Node in the cluster. Which resource should you use?
Medium93Which command would you use to get the logs of a pod named 'backend' in the 'production' namespace?
Medium94A container image is built from a Dockerfile with multiple layers. Which statement about container image layers is TRUE?
Medium95You need to run a batch job that processes a queue of 1000 items. The job should run to completion and then terminate. Which Kubernetes resource is BEST suited for this workload?
Medium96A platform team runs a 20-node Kubernetes cluster. They want a single Pod to run on every node so that a node-exporter agent can collect host metrics. They also want the Pod to be automatically created when a new node joins the cluster. Which workload resource should they use?
Medium97A pod is stuck in the Pending state. Running 'kubectl describe pod <pod-name>' shows the event: '0/3 nodes are available: 1 node had taint {node.kubernetes.io/disk-pressure: }, 2 nodes had taint {node.kubernetes.io/memory-pressure: }'. What is the most likely cause?
Hard98You have a multi-container pod with a main application container and a sidecar container that handles log shipping. The sidecar container should start before the main container and stop after the main container finishes. Which pod configuration should you use?
Hard99You run the command 'kubectl get pods -n default' and see no pods listed. However, you are sure there should be pods. What is the most likely cause?
Medium100Which statement accurately describes a key difference between containers and virtual machines?
Easy101Which TWO of the following are true about container networking basics? (Choose 2)
Easy102You have a microservices application with a frontend service that needs to communicate with a backend service running in a different namespace ('backend-ns'). The default namespace for the frontend is 'frontend-ns'. What DNS name should the frontend use to reach the backend service named 'backend-svc'?
Hard103Which of the following is a characteristic of immutable infrastructure?
Hard104What is the purpose of a readiness probe in a Kubernetes pod?
Easy105What is the purpose of the Container Runtime Interface (CRI) in Kubernetes?
Easy106Which TWO of the following are characteristics of microservices architecture? (Choose 2)
Easy107A pod has resource requests of 512Mi memory and 500m CPU, and limits of 1Gi memory and 1 CPU. The node has 4Gi memory and 2 CPU cores. If the pod tries to use 700m CPU, what will happen?
Hard108A developer wants to run a one-time task that creates a database schema and then exits. Which Kubernetes workload type is most appropriate?
Easy109In a container image built from a Dockerfile, what is the purpose of the CMD instruction?
Hard110Which TWO of the following are valid reasons to use a DaemonSet instead of a Deployment? (Select 2)
Hard111A cluster administrator notices that a Pod scheduled on a node is stuck in the Pending state. The Pod requests 8 CPU cores, but the node has only 4 allocatable CPU cores. The scheduler logs show a FailedScheduling event with the message 'Insufficient cpu'. Which action will allow the Pod to be scheduled without reducing its CPU request?
Hard112Which Open Container Initiative (OCI) specification defines the format of container images?
Easy113What is the Container Runtime Interface (CRI)?
Easy114You have a Kubernetes cluster with a Deployment that uses a PersistentVolumeClaim (PVC) to store application data. The PVC is bound to a PersistentVolume (PV) with a Retain reclaim policy. You delete the Deployment and the PVC. What happens to the underlying storage?
Hard115A cluster administrator deploys a web application as a Deployment named 'web' with 4 replicas. Users report that requests to the application sometimes reach a Pod that is still starting up and not ready to serve traffic. Which Kubernetes object should the administrator configure to ensure only ready Pods receive traffic?
Easy116An administrator needs to expose a set of pods running a web application on a static port on each node's IP address. Which Service type should they use?
Medium117A company is deploying a microservices application on Kubernetes. They want to ensure that configuration data, such as database URLs and feature flags, can be updated without rebuilding container images. Which Kubernetes resource should they use?
Medium118A Kubernetes Deployment manages a set of pods. What is the primary purpose of a Deployment?
Medium119Which THREE of the following are core principles of immutable infrastructure? (Choose 3)
Medium120A cluster administrator examines a node and notices that the kubelet is running, but the node's status shows 'NotReady'. The administrator runs 'systemctl status containerd' on the node and finds the service is inactive. Which component's failure most directly explains the node's 'NotReady' condition?
Medium121A developer wants to expose a set of pods running a web application on a stable IP address. Which Kubernetes resource should they create?
Medium122Which of the following is a key benefit of using containers over virtual machines?
Easy123Match each Kubernetes command (kubectl) to its primary function.
Medium124Which TWO of the following are true about service discovery in Kubernetes? (Choose 2)
Hard125Which of the following correctly describes the concept of 'immutable infrastructure' in the context of container orchestration?
Hard126A Pod is stuck in 'Pending' state. Which command is most helpful to diagnose the issue?
Medium127A developer wants to store non-sensitive configuration data, such as a database hostname and port, that multiple pods in different namespaces will consume as environment variables. The data must be reusable and not hardcoded in pod specs. Which Kubernetes resource is most appropriate?
Easy128You deploy a web application as a Deployment with 3 replicas. Each pod runs an Nginx container that listens on port 80. You need to make the application accessible from outside the cluster on a stable IP address that does not change even if nodes are replaced. Which Service type should you use?
Medium129A cluster administrator needs to run a Pod that requires access to a raw block device on a specific node. The Pod must be scheduled only on nodes labeled disktype=ssd, and it must tolerate a taint hardware=gpu:NoSchedule that exists on those nodes. Which combination of Pod spec fields is required?
Medium130Which of the following is a valid use case for a DaemonSet?
Medium131What is the OCI (Open Container Initiative) responsible for?
Easy132An application requires that a specific set of pods be placed on nodes labeled with 'gpu=true'. Which Kubernetes field should be used in the pod spec to enforce this?
Medium133An application requires that a pod must not be scheduled on the same node as another pod from the same Deployment. Which configuration should be used?
Hard134A Kubernetes administrator needs to ensure that a set of pods can only communicate with each other and with a specific external API, while blocking all other traffic. Which Kubernetes feature should be used to enforce this?
Hard135A pod is running but its container exits with code 137. The pod logs show 'Killed'. What is the most likely cause?
Hard136A cluster administrator needs to run a one-time database migration job that must complete successfully before a new application version is deployed. The job should retry up to 4 times if it fails and should be automatically cleaned up 1 hour after completion. Which Kubernetes resource should be used?
Medium137A Kubernetes cluster has a pod that is stuck in the 'Pending' state. The operations team runs 'kubectl describe pod' and sees the event: '0/3 nodes are available: 3 Insufficient cpu.' What is the most likely cause of this issue?
Hard138A developer wants to ensure that a pod runs only on nodes with SSDs. Which mechanism should be used?
Easy139You have a microservices application deployed as a set of Pods in a Kubernetes cluster. You need to ensure that Pods can discover each other using stable DNS names. Which Kubernetes resource should you create?
Medium140A pod named 'web-app' is not able to resolve the hostname 'db-service' from another namespace 'data'. The 'db-service' Service exists in the 'data' namespace. What is the most likely cause?
Hard141Which TWO of the following are characteristics of a microservices architecture? (Select 2)
Medium142A developer wants to deploy a stateful application that requires stable network identities and persistent storage. Which Kubernetes resource is best suited for this workload?
Medium143A team runs a stateful application in a Kubernetes cluster. They need each Pod to have a stable network identity and its own persistent storage that survives Pod rescheduling. Which controller should they use?
Hard144What is the primary benefit of containers over virtual machines?
Easy145Which TWO of the following are valid container runtimes that implement the CRI? (Choose two.)
Medium146Which component is responsible for managing the lifecycle of containers on a Kubernetes node?
Easy147Which THREE of the following are characteristics of a microservices architecture? (Select 3)
Medium148A platform team must ensure that a critical StatefulSet named ledger in the finance namespace always has at least two Pods available during voluntary disruptions such as node drains, and that Pods are spread across different nodes. Which two resources or settings should they configure? (Choose two.)
Hard149A team wants to deploy a batch job that runs once to process a large dataset. The job should run to completion and then terminate. Which Kubernetes resource should be used?
Medium150What is the concept of 'immutable infrastructure' as applied to Kubernetes?
Medium151Which THREE of the following are true about the Open Container Initiative (OCI)? (Choose 3)
Hard152A company wants to run a batch job that processes data and then terminates. Which Kubernetes resource should they use?
Medium153What is the purpose of the 'kubectl scale' command?
Easy154A Kubernetes administrator is troubleshooting a Pod that is stuck in the Pending state. The Pod has a resource request of cpu: 2 and memory: 4Gi. Which two commands are most appropriate to identify why the Pod cannot be scheduled? (Choose two.)
Hard155What is the primary purpose of the Container Runtime Interface (CRI) in Kubernetes?
Easy156Which component in Kubernetes is responsible for maintaining the desired state of the cluster?
Easy157A cluster administrator is configuring a Pod with a container that requires 2 CPU cores and 4Gi of memory. The administrator sets resource requests to 2 CPU and 4Gi memory, and limits to 4 CPU and 8Gi memory. The Pod is scheduled to a node with 4 CPU and 8Gi memory available. What happens when the container attempts to use 3 CPU and 6Gi memory?
Hard158Which of the following best describes immutable infrastructure?
Hard159Which THREE are benefits of using container orchestration platforms like Kubernetes?
Medium160Which TWO statements accurately describe the concept of immutable infrastructure in the context of container orchestration? (Select two.)
Medium161What is a primary benefit of using containers over virtual machines?
Easy162What is a key advantage of containers compared to virtual machines?
Easy163Which command would you use to view the logs of a specific container in a pod?
Easy164A developer wants to deploy a stateful application that requires stable network identities and persistent storage per pod instance. Which Kubernetes resource is most appropriate?
Medium165A developer creates a Pod with a single container that writes logs to stdout. The Pod is running, but the developer wants to view the last 50 lines of logs from that container and have the command keep streaming new output. Which kubectl command accomplishes this?
Hard166Which command is used to create a Deployment that runs an nginx container with 3 replicas?
Easy167What is a key benefit of container orchestration platforms like Kubernetes?
Easy168What is a key benefit of using containers over virtual machines for application deployment?
Easy169Which component is responsible for running containers on a Kubernetes node?
Easy170You are writing a Deployment YAML (apps/v1) for a stateless web application. The application should have 3 replicas and use rolling updates with maxSurge=1 and maxUnavailable=0. Which field should you set under spec.strategy?
Medium171An administrator needs to store a database password for a Pod to consume as an environment variable. The password must be stored securely and not exposed in the Pod specification. Which Kubernetes resource should the administrator create?
Medium172You need to run a batch job that processes data every hour and exits upon completion. Which Kubernetes resource should you use?
Medium173An administrator needs to ensure that Pods from two different Deployments cannot communicate with each other. Which Kubernetes resource should be used?
Hard174An administrator wants to allow a Pod to consume a ConfigMap named app-config as environment variables, but only the keys DB_HOST and DB_PORT. The ConfigMap contains additional keys. Which Pod spec snippet correctly injects only those two keys as environment variables?
Medium175A platform engineer is troubleshooting a Pod that stays in the Pending phase. Which two conditions can legitimately cause a Pod to remain Pending? (Choose two.)
Medium176Which command correctly creates a Deployment named 'web-app' with the image 'nginx:1.21' and 3 replicas?
Medium177Which of the following describes the Open Container Initiative (OCI) image specification?
Easy178A developer creates a Deployment with 3 replicas. After updating the pod template, they run 'kubectl rollout status deployment/my-deployment' and see that the rollout is stuck. Which command should they use to investigate the rollout history?
Hard179Which TWO statements about Docker Compose and Kubernetes are correct?
Medium180A team deploys a microservice that requires sticky sessions. The service runs on Kubernetes with multiple replicas. Which Kubernetes resource should be used to ensure requests from a client are consistently routed to the same pod?
Medium181A developer wants to run a single instance of a stateless web application in a Kubernetes cluster. The application does not need to maintain state or have a stable network identity. Which workload resource is the most appropriate to use?
Easy182You have a Kubernetes cluster with multiple nodes. You need to ensure that a pod runs on a node that has an SSD. How should you achieve this?
Medium183A cluster administrator needs to schedule a pod that requires 4 CPU cores and 16Gi of memory on a node with sufficient resources. The pod also must tolerate a taint on a dedicated node. Which combination of pod spec fields must be set to ensure the pod lands on the correct node?
Medium184A cluster administrator needs to run a node-level log-shipping agent on every node, including nodes added later, and wants the agent to tolerate the control-plane taint. Which workload API object is the most appropriate choice?
Medium185Which TWO of the following correctly describe the difference between Docker Compose and Kubernetes? (Choose 2)
Medium186Which THREE of the following are true about the Container Runtime Interface (CRI)? (Choose 3)
Hard187An administrator wants to ensure that a pod only runs on nodes that have a specific GPU. Which mechanism should be used to achieve this?
Hard188Which Kubernetes resource is best suited for running a batch processing job that must complete successfully exactly once?
Medium189Which TWO of the following are true about the Open Container Initiative (OCI)?
Medium190Which of the following is an example of immutable infrastructure?
Easy191A Kubernetes cluster runs a critical application in a pod. The operations team wants to receive an alert if the application's main process stops responding to HTTP requests on port 8080 at path /healthz. They need Kubernetes to automatically restart the pod if the health check fails. Which type of probe should they configure?
Medium192A pod is in the 'Pending' state. Which of the following is a likely cause?
Medium193A team runs a stateless API as a Deployment with six replicas across three nodes. They need a stable virtual IP and DNS name that load-balances TCP traffic to the ready replicas from other Pods in the same cluster. Which resource should they create?
Easy194Which TWO statements accurately describe Kubernetes scheduling?
Hard195Which of the following is a key difference between containers and virtual machines?
Easy196A Kubernetes cluster has a Deployment running three replicas of an application. You need to update the container image to a new version with zero downtime. Which approach is most appropriate?
Medium197What is the purpose of the Container Runtime Interface (CRI)?
Easy198A DevOps engineer is designing a Kubernetes architecture for a stateful application that requires stable network identities and persistent storage across pod rescheduling. The engineer needs to choose the appropriate Kubernetes resource types to meet these requirements. Which two resources should the engineer use? (Choose two.)
Hard199A developer creates a Pod with a single container that writes logs to stdout. The Pod is scheduled and running, but the developer needs to view the logs from the past hour. Which kubectl command should the developer use?
Medium200Which Kubernetes resource can be used to define network policies that control traffic between pods?
Hard201Your application consists of a frontend and a backend. The frontend needs to communicate with the backend using a stable DNS name. The backend is deployed as a Deployment with 3 replicas. Which Kubernetes resource should you create to provide a stable DNS name for the backend?
Hard202What is the difference between a liveness probe and a readiness probe?
Medium203Which TWO statements about containers compared to virtual machines are correct? (Select 2)
Medium204You have a microservices application where Service A needs to discover the IP of Service B. Both services run in the same Kubernetes cluster. Which approach is the most Kubernetes-native way for Service A to reach Service B?
Hard205You are designing a microservices application that requires each service to be independently deployable and scalable. The services communicate over HTTP and need service discovery. Which orchestration feature BEST addresses the need for service discovery?
Medium206A user creates a Service of type ClusterIP with a selector matching pods labeled 'app: myapp'. However, a pod named 'myapp-pod' with label 'app: myapp' is not receiving traffic. What is a possible reason?
Hard207You create a Service of type ClusterIP with the name 'my-service' in the 'default' namespace. What DNS name resolves to the service's cluster IP from a pod in the same namespace?
Medium208A Kubernetes administrator needs to restrict inbound traffic to a set of pods. Only pods with the label 'app: frontend' in the same namespace should be allowed to reach the pods on TCP port 8080. Which resource should be used?
Medium209Which THREE of the following are correct statements about Kubernetes Deployments?
Hard210A pod is in CrashLoopBackOff. You check the logs and see 'Error: container process not found'. What is the most likely cause?
MediumOther domains
All KCNA exam domains
Frequently asked questions
- What does the Container Orchestration domain cover on the KCNA exam?
- Be able to pick the right workload controller and probe for a scenario, and name required container fields. The most important thing: know that liveness restarts containers while readiness controls Service traffic, and that NetworkPolicies are deny-by-default only once a policy selects the pod.
- How many questions are in this domain?
- This page lists all 210 Container Orchestration questions in the KCNA question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only Container Orchestration questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.