Courseiva

CCNA Container Orchestration Questions

75 of 210 questions · Page 2/3 · Container Orchestration · Answers revealed

76
Multi-Selectmedium

Which TWO of the following are valid ways to expose a set of pods as a network service in Kubernetes? (Select two.)

Select 1 answer
A.Creating a Deployment with a label selector
B.Creating a PersistentVolumeClaim
C.Creating an Ingress resource
D.Assigning a public IP directly to a Pod
E.Creating a Service of type ClusterIP
AnswersE

ClusterIP allocates a virtual IP reachable only inside the cluster, and kube-proxy load-balances connections across the selected pods. It is the default Service type and a valid way to expose pods internally to other workloads.

Why this answer

Option E (Creating a Service of type ClusterIP) is correct because a ClusterIP Service provides a stable virtual IP and DNS name that load-balances traffic to the set of pods matched by its label selector, which is the fundamental way to expose pods internally. Option A is not correct because a Deployment only manages pod replicas and their labels; it does not itself create a network endpoint or stable service address. Option B is not correct because a PersistentVolumeClaim provides storage, not network exposure.

Option C is not correct because an Ingress exposes Services (via an ingress controller), not pods directly, and therefore is not itself a way to expose a set of pods as a network service. Option D is not correct because assigning a public IP directly to a Pod is not a supported or durable Kubernetes service-exposure mechanism, since pod IPs are ephemeral and not managed as service endpoints.

Exam trap

A common misconception is that a Deployment itself provides network exposure, but a Deployment only manages pod replicas and requires a separate Service resource to expose them as a network service. Another trap is assuming Ingress directly exposes pods; Ingress routes to Services, which then select pods.

77
Multi-Selectmedium

Which TWO statements correctly describe how Kubernetes handles self-healing? (Select two.)

Select 2 answers
A.If a node fails, the ReplicaSet controller automatically recreates the pods on healthy nodes
B.If a container in a pod crashes, the kubelet restarts it according to the pod's restart policy
C.Kubernetes automatically fixes application-level bugs by rolling back to a previous version
D.Kubernetes can automatically resolve OOMKilled errors by increasing memory limits
E.Kubernetes can automatically resolve OOMKilled errors by increasing memory limits
AnswersA, B

The ReplicaSet (or Deployment) controller detects that pods are no longer running and creates replacement pods on available nodes.

Why this answer

The ReplicaSet controller monitors the cluster for node failures and, when a node becomes unhealthy, it creates replacement pods on other healthy nodes to maintain the desired replica count. This is a core self-healing mechanism in Kubernetes that operates at the controller level, independent of the kubelet.

Exam trap

CNCF often tests the distinction between automatic self-healing at the infrastructure level (node/pod restarts) versus manual or policy-driven recovery for application-level issues, leading candidates to incorrectly assume Kubernetes automatically fixes bugs or adjusts resource limits.

78
MCQeasy

Which component of Kubernetes is responsible for maintaining the desired state of the cluster?

A.kube-scheduler
B.kube-controller-manager
C.kubelet
D.kube-apiserver
AnswerB

The kube-controller-manager runs reconciliation loops that continuously compare observed cluster state against the declared desired state, then act to close any drift. This directly satisfies the stem's requirement: it is the control-plane component responsible for maintaining that desired state, distinct from the API server, which merely stores it.

Why this answer

The kube-controller-manager is the component that runs controller processes, which are responsible for regulating the state of the cluster. It continuously watches the current state via the kube-apiserver and takes corrective actions to match the desired state defined in the cluster's control loop, such as ensuring the correct number of pods are running.

Exam trap

CNCF often tests the misconception that the kube-scheduler maintains desired state because it 'schedules' pods, but scheduling is only one part of the control loop; the actual state reconciliation is done by the controller-manager.

How to eliminate wrong answers

Option A is wrong because the kube-scheduler is responsible for assigning pods to nodes based on resource availability and constraints, not for maintaining the desired state. Option C is wrong because the kubelet is an agent that runs on each node and ensures containers are running in a pod, but it does not maintain the cluster-wide desired state. Option D is wrong because the kube-apiserver serves as the front-end for the Kubernetes control plane, handling API requests and storing state in etcd, but it does not actively enforce or reconcile the desired state.

79
MCQeasy

Which of the following best describes a key advantage of containers over virtual machines?

A.Containers share the host OS kernel, resulting in lower resource overhead compared to VMs
B.Containers take longer to start than VMs because they need to initialize a kernel
C.Containers consume more disk space than VMs because they include a full operating system
D.Containers have stronger isolation than VMs because each container runs its own kernel
AnswerA

Containers share the host OS kernel and isolate only the process, so each avoids booting a full guest OS. That removes the hypervisor and duplicate kernel overhead, giving lower resource consumption than VMs, which is the advantage the stem asks for.

Why this answer

Containers share the host operating system kernel, which means they do not need to boot a separate kernel or emulate hardware. This shared kernel model eliminates the overhead of running a full guest OS per instance, resulting in significantly lower memory and CPU consumption compared to virtual machines, which each run a complete OS stack including a separate kernel.

Exam trap

The exam often tests the misconception that containers provide stronger isolation than VMs because they are 'self-contained,' but the trap here is that containers actually share the host kernel, making isolation weaker than the hypervisor-based isolation of VMs.

How to eliminate wrong answers

Option B is wrong because containers start in seconds (often sub-second) since they only need to initialize the application process, whereas VMs take minutes because they must boot a full kernel and operating system. Option C is wrong because containers are lightweight (typically tens of MB) as they package only the application and its dependencies, while VMs include a full OS (gigabytes) and thus consume more disk space. Option D is wrong because containers share the host kernel and have weaker isolation (e.g., via cgroups and namespaces), whereas VMs provide stronger isolation by running each instance with its own separate kernel and hypervisor-enforced boundaries.

80
MCQmedium

A DevOps engineer wants to update a Deployment's container image from 'v1' to 'v2' with zero downtime. Which kubectl command should they use?

A.kubectl rollout restart deployment/<name>
B.kubectl patch deployment <name> -p '{"spec":{"template":{"spec":{"containers":[{"name":"<container>","image":"<image>:v2"}]}}}}'
C.kubectl set image deployment/<name> <container>=<image>:v2
D.kubectl edit deployment <name>
AnswerC

This subcommand patches the Deployment's pod template with the new image tag, triggering a rolling update that replaces pods gradually while maintaining availability. It satisfies the zero-downtime constraint by honouring the Deployment's rolling update strategy rather than deleting pods outright.

Why this answer

`kubectl set image` directly updates the container image in a Deployment's pod template, triggering a rolling update that replaces pods incrementally with zero downtime. Kubernetes Deployments manage ReplicaSets to ensure availability during the update, making this the simplest and most reliable command for a controlled image change.

Exam trap

The trap here is that candidates may confuse `kubectl rollout restart` (which only restarts pods with the same image) with `kubectl set image` (which actually changes the image), or assume that any command modifying the Deployment (like patch or edit) inherently provides zero downtime without considering the rolling update mechanism.

How to eliminate wrong answers

Option A is wrong because `kubectl rollout restart` triggers a restart of all pods with the existing image, not an image update; it does not change the container image from 'v1' to 'v2'. Option B is wrong because while a patch can update the image, it requires manually specifying the full container name and image string, which is error-prone and less concise than `kubectl set image`; it also does not inherently enforce a rolling update strategy if the Deployment's update strategy is misconfigured. Option D is wrong because `kubectl edit` opens an interactive editor, which is not suitable for automation or scripting and introduces risk of human error; it does not guarantee zero downtime if the user accidentally changes other fields.

81
MCQeasy

Which of the following is a container runtime that implements the Container Runtime Interface (CRI)?

A.containerd
B.Docker
C.runc
D.kubelet
AnswerA

Containerd implements the Kubernetes Container Runtime Interface, satisfying the stem's requirement for a CRI-compliant runtime. It manages the full container lifecycle — image transfer, storage, and execution — via a daemon, and is the default runtime for most Kubernetes distributions, unlike Docker, which required the deprecated dockershim adapter.

Why this answer

containerd is a high-level container runtime that directly implements the Container Runtime Interface (CRI) by exposing a gRPC API that kubelet can call to manage pods and containers. It was originally extracted from Docker and is now the default runtime in many Kubernetes distributions, providing image transfer, container lifecycle management, and storage/network attachment without requiring Docker as an intermediary.

Exam trap

CNCF often tests the misconception that Docker is a CRI-compliant runtime, when in fact Docker uses a separate adapter (dockershim) that was removed in Kubernetes v1.24, making containerd the standard CRI implementation.

How to eliminate wrong answers

Option B (Docker) is wrong because Docker does not implement the CRI natively; instead, Kubernetes uses the dockershim (deprecated since v1.24) as a CRI adapter to translate CRI calls into Docker API calls, meaning Docker is not a CRI-compliant runtime itself. Option C (runc) is wrong because runc is a low-level OCI runtime that only creates and runs containers according to the OCI spec; it does not implement the CRI gRPC interface or handle higher-level tasks like image management or pod sandbox creation. Option D (kubelet) is wrong because kubelet is the Kubernetes node agent that acts as a CRI client, not a CRI implementation; it calls the CRI API on a container runtime (like containerd) to manage containers.

82
MCQmedium

A Kubernetes cluster runs a DaemonSet named 'node-agent' that must run on every node, including the control-plane node. The control-plane node has a taint 'node-role.kubernetes.io/control-plane:NoSchedule'. The DaemonSet currently does not schedule pods on the control-plane node. Which change to the DaemonSet spec will ensure its pods run on the control-plane node?

A.Add a toleration for the taint 'node-role.kubernetes.io/control-plane:NoSchedule' to the DaemonSet's pod template.
B.Add a node selector to the DaemonSet's pod template that matches the control-plane node's labels.
C.Increase the DaemonSet's 'spec.template.spec.priorityClassName' to a higher priority class.
D.Set the DaemonSet's update strategy to 'OnDelete' so that pods are only created when nodes are added.
AnswerA

Taints repel pods unless the pod has a matching toleration. Adding a toleration for the control-plane taint allows the DaemonSet pods to be scheduled onto that node. DaemonSets do not automatically tolerate control-plane taints, so this explicit toleration is required to run on every node including the control-plane node.

Why this answer

Taints and tolerations work together to control scheduling. A taint on a node repels pods that do not tolerate it. To run DaemonSet pods on a tainted node such as a control-plane node, the pod template must include a toleration for that specific taint.

Other scheduling controls like node selectors or priority classes do not override taints.

Exam trap

The trap here is assuming that DaemonSets automatically tolerate all taints, including control-plane taints, when in fact explicit tolerations are required for tainted nodes.

83
MCQhard

A microservices application has multiple services that need to discover each other by name. Which Kubernetes object provides built-in service discovery via DNS?

A.Ingress
B.Namespace
C.ConfigMap
D.Service
AnswerD

A Service assigns a stable DNS name and virtual IP to a set of pods, letting microservices resolve each other by name regardless of pod churn. It provides the built-in service discovery the scenario requires.

Why this answer

A Kubernetes Service object provides built-in service discovery via DNS. When a Service is created, the cluster's DNS (typically CoreDNS) automatically assigns it a DNS name in the format `<service>.<namespace>.svc.cluster.local`, allowing other microservices to resolve the Service by name without hardcoding IP addresses or using external service registries.

Exam trap

The trap here is that candidates often confuse Ingress (external routing) with internal DNS-based service discovery, or assume that Namespaces themselves provide DNS resolution, when in fact it is the Service object that triggers DNS record creation.

How to eliminate wrong answers

Option A is wrong because an Ingress is an API object that manages external HTTP/S access to Services, not internal service discovery or DNS resolution between microservices. Option B is wrong because a Namespace is a logical isolation boundary for resources and does not itself provide DNS-based service discovery; it only scopes the DNS names of Services within it. Option C is wrong because a ConfigMap is used to store non-sensitive configuration data as key-value pairs and has no role in DNS resolution or service discovery.

84
Multi-Selecthard

Which THREE of the following are valid container runtimes that can be used with Kubernetes via the Container Runtime Interface (CRI)? (Select three.)

Select 3 answers
A.rkt
B.containerd
C.Kata Containers
D.Docker
E.CRI-O
AnswersB, C, E

containerd is a CRI-compliant runtime and is widely used in Kubernetes.

Why this answer

B is correct because containerd is a core container runtime that implements the CRI (Container Runtime Interface) directly via its built-in CRI plugin. It was extracted from Docker and is now the default runtime in many Kubernetes distributions, handling image management, container lifecycle, and execution without requiring an external shim.

Exam trap

Kubernetes often tests the misconception that Docker is a valid CRI-compliant runtime, but the trap is that Docker uses containerd under the hood and was removed from Kubernetes as a direct runtime after v1.24, so candidates must recognize that only runtimes with native CRI implementations (like containerd, CRI-O, and Kata Containers) are valid.

85
MCQmedium

Which component is responsible for running containers in a Kubernetes node and implements the Container Runtime Interface (CRI)?

A.kubelet
B.etcd
C.kube-proxy
D.containerd
AnswerD

containerd is a CRI-compliant container runtime that runs on each node, pulling images and managing container lifecycles for the kubelet. It satisfies the stem's requirement for the node component implementing the Container Runtime Interface, unlike kubelet (orchestrates) or the API server (control plane).

Why this answer

containerd is the correct answer because it is the container runtime that directly manages container lifecycle operations (create, start, stop, delete) on a Kubernetes node and implements the Container Runtime Interface (CRI), which is the gRPC-based protocol that kubelet uses to interact with container runtimes. Kubernetes requires a CRI-compliant runtime, and containerd is a graduated CNCF project that fulfills this role by exposing the CRI API via its `cri` plugin.

Exam trap

CNCF often tests the misconception that kubelet directly runs containers, but in reality kubelet is only the orchestrator agent that delegates to a CRI-compliant runtime like containerd, making containerd the correct answer.

How to eliminate wrong answers

Option A (kubelet) is wrong because kubelet is the node agent that communicates with the control plane and manages pods, but it does not run containers directly—it delegates container operations to a CRI-compliant runtime like containerd. Option B (etcd) is wrong because etcd is a distributed key-value store used for cluster state persistence, not for running containers or implementing CRI. Option C (kube-proxy) is wrong because kube-proxy is a network proxy that handles service routing and load balancing using iptables or IPVS, and it has no role in container runtime operations or the CRI.

86
MCQhard

You run 'kubectl get pods' and see that a pod named 'web-frontend' is in 'Pending' state for more than 5 minutes. What is the most likely cause?

A.The container image does not exist
B.There are insufficient resources on any node to schedule the pod
C.The pod's readiness probe is failing
D.The pod's liveness probe is failing
AnswerB

Pending means the scheduler cannot bind the pod to a node. Insufficient CPU or memory on every candidate node is the classic cause, since the scheduler filters out nodes lacking requested resources and leaves the pod unscheduled.

Why this answer

A pod stuck in 'Pending' state for an extended period typically indicates that the scheduler cannot find a suitable node to run the pod. The most common reason is insufficient resources (CPU, memory, or ephemeral storage) on any available node, causing the scheduler to leave the pod unscheduled. This is confirmed by running 'kubectl describe pod web-frontend' and checking the 'Events' section for 'FailedScheduling' messages.

Exam trap

CNCF often tests the distinction between pod states — candidates confuse 'Pending' (scheduling failure) with image pull errors or probe failures, which occur after scheduling and manifest as different states like 'ImagePullBackOff' or 'CrashLoopBackOff'.

How to eliminate wrong answers

Option A is wrong because if the container image does not exist, the pod would transition to 'ImagePullBackOff' or 'ErrImagePull' state, not remain in 'Pending' — the scheduler would still assign the pod to a node first. Option C is wrong because a failing readiness probe causes the pod to be marked as 'NotReady' but it remains in 'Running' state, not 'Pending'. Option D is wrong because a failing liveness probe triggers container restarts and eventually 'CrashLoopBackOff', but the pod is still scheduled and in 'Running' state, not 'Pending'.

87
MCQhard

A team deploys an application as a StatefulSet with three replicas. They need each Pod to have a stable network identity and its own persistent storage that survives Pod rescheduling. Which two features of StatefulSet satisfy these requirements?

A.A StatefulSet with a ClusterIP Service and hostPath volumes for each Pod
B.A Deployment with a headless Service and a shared PersistentVolume mounted by all replicas
C.A StatefulSet with podManagementPolicy: Parallel and an emptyDir volume per Pod
D.Stable Pod names and a headless Service for network identity, plus volumeClaimTemplates for per-Pod storage
AnswerD

StatefulSet Pods receive stable ordinal names like app-0, app-1, and app-2, and a headless Service provides stable DNS names such as app-0.app.default.svc.cluster.local. volumeClaimTemplates creates a PersistentVolumeClaim for each Pod, ensuring each replica has dedicated storage that persists across rescheduling. Together these features meet both requirements.

Why this answer

StatefulSets provide stable ordinal Pod names and, with a headless Service, stable DNS records for each Pod. volumeClaimTemplates dynamically creates a PersistentVolumeClaim per Pod, giving each replica its own persistent storage that follows the Pod across rescheduling. A Deployment with shared storage or a StatefulSet with emptyDir or hostPath does not meet these requirements.

Exam trap

The trap here is assuming that any Service provides per-Pod DNS names, when only a headless Service does.

88
MCQeasy

A developer wants to run a single instance of a stateless web application that should be automatically restarted if it fails, but does not require scaling or updates. Which Kubernetes resource is most appropriate?

A.DaemonSet
B.Deployment
C.Pod
D.StatefulSet
AnswerB

A Deployment manages a ReplicaSet, which ensures the desired number of Pod replicas are running. If a Pod fails, the ReplicaSet creates a new one. Deployments also support rolling updates and rollbacks. Even for a single instance, a Deployment provides self-healing and declarative updates, making it the best choice for a stateless application.

Why this answer

A Deployment is the standard controller for stateless applications. It provides self-healing by maintaining the desired replica count, and supports rolling updates. While a Pod can run a container, it lacks automatic rescheduling on node failure.

StatefulSet and DaemonSet serve different purposes and are not appropriate for a simple stateless web app.

Exam trap

The trap here is thinking a bare Pod is sufficient because it has a restartPolicy; however, a Pod does not survive node failures or support updates.

89
MCQhard

An application Pod needs to read a database password at runtime. The security team requires that the secret material never be stored in the Pod's container image or in a ConfigMap, and that updates to the secret be reflected in the running container without recreating the Pod. Which approach satisfies these requirements?

A.Bake the password into a private container image and pull it with an imagePullSecret.
B.Pass the password as a command-line argument in the Pod specification.
C.Store the password in a ConfigMap and consume it as an environment variable.
D.Store the password in a Secret and mount it as a volume in the Pod.
AnswerD

A Secret stores sensitive data separately from images and ConfigMaps, and mounting it as a volume projects the value as a file. The kubelet refreshes mounted Secret volumes periodically, so updates to the Secret propagate to the running container without recreating the Pod, provided the application re-reads the file, satisfying both security and live-update requirements.

Why this answer

Kubernetes Secrets keep sensitive data out of images and ConfigMaps. Mounting a Secret as a volume presents the value as a file, and the kubelet periodically refreshes projected Secret volumes so changed values appear in the container filesystem without restarting the Pod. The application must re-read the file to pick up changes, but the platform side meets the security and live-update constraints.

Exam trap

The trap here is assuming that environment-variable injection from a Secret or ConfigMap updates at runtime, when only volume-mounted Secrets are refreshed periodically by the kubelet.

90
MCQmedium

A developer needs to provide a pod with a persistent volume that must be mounted by multiple pods simultaneously for read-write access. The underlying storage system supports concurrent writes from multiple nodes. Which volume type should be used?

A.ReadWriteOncePod (RWOP)
B.ReadWriteMany (RWX)
C.ReadOnlyMany (ROX)
D.ReadWriteOnce (RWO)
AnswerB

ReadWriteMany allows a volume to be mounted as read-write by many nodes simultaneously. This matches the requirement of multiple pods needing read-write access. The underlying storage must support RWX, such as NFS, CephFS, or cloud file storage. This is the correct access mode for shared read-write persistent volumes.

Why this answer

The access mode ReadWriteMany (RWX) allows a persistent volume to be mounted as read-write by multiple nodes, enabling multiple pods to write concurrently. This is essential for shared storage scenarios like a shared database or file server. The underlying storage plugin must support RWX; not all storage systems do.

ReadWriteOnce and ReadWriteOncePod are limited to a single node or pod, respectively, and ReadOnlyMany is read-only.

Exam trap

The trap here is confusing ReadWriteOnce with ReadWriteMany, or assuming that ReadWriteOncePod allows multiple pods, when it actually restricts to a single pod.

91
MCQhard

A cluster administrator is configuring a NetworkPolicy for a set of pods labeled 'role=db' in the 'backend' namespace. The policy should allow ingress only from pods labeled 'role=api' in the 'frontend' namespace, and only on TCP port 6379. Which NetworkPolicy specification correctly enforces this?

A.spec: { podSelector: { matchLabels: { role: db } }, ingress: [ { from: [ { podSelector: { matchLabels: { role: api } } } ], ports: [ { protocol: TCP, port: 6379 } ] } ] }
B.spec: { podSelector: { matchLabels: { role: db } }, ingress: [ { from: [ { namespaceSelector: { matchLabels: { name: frontend } } } ], ports: [ { protocol: TCP, port: 6379 } ] } ] }
C.spec: { podSelector: { matchLabels: { role: db } }, ingress: [ { from: [ { namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: frontend } }, podSelector: { matchLabels: { role: api } } } ], ports: [ { protocol: TCP, port: 6379 } ] } ] }
D.spec: { podSelector: { matchLabels: { role: db } }, ingress: [ { from: [ { namespaceSelector: { matchLabels: { name: frontend } }, podSelector: { matchLabels: { role: api } } } ], ports: [ { protocol: TCP, port: 6379 } ] } ] }
AnswerC

This policy selects pods with 'role=db' in the backend namespace. The ingress rule allows traffic from pods with 'role=api' in namespaces labeled 'kubernetes.io/metadata.name=frontend', which is the standard label automatically applied to namespaces. It restricts to TCP port 6379, correctly enforcing the requirement.

Why this answer

A NetworkPolicy ingress rule can combine namespaceSelector and podSelector to allow traffic from specific pods in specific namespaces. The namespaceSelector must match the namespace's labels; Kubernetes automatically labels namespaces with 'kubernetes.io/metadata.name=<namespace-name>'. The policy must also specify the allowed port.

The correct specification uses the proper namespace label and includes both selectors.

Exam trap

The trap here is using an arbitrary namespace label like 'name: frontend' instead of the automatically applied 'kubernetes.io/metadata.name: frontend', or forgetting to include the podSelector for the source pods.

92
MCQmedium

You want to ensure that a Pod runs on every Node in the cluster. Which resource should you use?

A.Deployment
B.DaemonSet
C.ReplicaSet
D.StatefulSet
AnswerB

A DaemonSet's controller schedules exactly one Pod copy onto every eligible Node, including Nodes added later, and bypasses the scheduler's normal placement logic. That guarantees the required one-Pod-per-Node coverage, which a Deployment or ReplicaSet cannot promise.

Why this answer

A DaemonSet ensures that a copy of a Pod runs on every Node in the cluster, including when new Nodes are added. This is the correct resource for cluster-wide services like log collectors, monitoring agents, or kube-proxy, as it automatically schedules a Pod on each Node and respects node taints and tolerations.

Exam trap

CNCF often tests the misconception that a Deployment with a replica count equal to the number of Nodes will achieve the same effect, but candidates overlook that Deployments do not enforce per-Node scheduling and can leave some Nodes empty due to scheduling constraints or resource limits.

How to eliminate wrong answers

Option A is wrong because a Deployment manages a set of identical Pods with a desired replica count, but it does not guarantee placement on every Node; it uses a scheduler to distribute Pods across available Nodes, which may leave some Nodes empty. Option C is wrong because a ReplicaSet is a lower-level resource that ensures a specified number of Pod replicas are running, but it has no mechanism to enforce per-Node scheduling; it is typically used by Deployments for replica management. Option D is wrong because a StatefulSet is designed for stateful applications that require stable, unique network identities and persistent storage, not for running a Pod on every Node; it uses ordinal indexing and can be scheduled on a subset of Nodes.

93
MCQmedium

Which command would you use to get the logs of a pod named 'backend' in the 'production' namespace?

A.kubectl log pod backend -n production
B.kubectl get logs backend -n production
C.kubectl logs -n production pod/backend
D.kubectl logs backend --namespace=production
AnswerC, D

Correct. This command correctly uses `kubectl logs` with the namespace flag and the pod name, optionally prefixed with `pod/`.

Why this answer

Both option C (`kubectl logs -n production pod/backend`) and option D (`kubectl logs backend --namespace=production`) are valid and functionally equivalent. kubectl accepts the pod name with or without the `pod/` prefix, and flags can appear before or after the resource argument. Options A (`kubectl log`, singular) and B (`kubectl get logs`) are invalid commands. Since two options are correct, the question is ambiguous as written.

Exam trap

Common mistakes include using `kubectl get logs` (invalid), using the singular `kubectl log`, or omitting the namespace flag. Note that the `pod/` prefix is optional and valid but not required.

How to eliminate wrong answers

Option A is wrong because the verb is `log` instead of `logs`; `kubectl log` is not a valid command. Option B is wrong because `kubectl get logs` is not a valid subcommand; `get` is used for resources like pods, not logs. Option C is wrong because the syntax `kubectl logs -n production pod/backend` is incorrect; the resource type prefix `pod/` is not used with `kubectl logs` — the correct form is `kubectl logs backend -n production`.

94
MCQmedium

A container image is built from a Dockerfile with multiple layers. Which statement about container image layers is TRUE?

A.Each layer is created by a RUN instruction and can be modified after the image is built
B.Each layer is unique to the image and cannot be shared with other images
C.Layers are read-only and can be reused across different images
D.All layers in a container image are writable at runtime
AnswerC

Each image layer is immutable and content-addressed, so identical layers are stored once and shared by every image referencing them. This deduplication reduces registry storage and speeds up pulls, since unchanged layers need not be transferred again.

Why this answer

Container image layers are read-only and are stored in a content-addressable storage (e.g., overlayfs, aufs). These layers can be reused across different images when they share the same content hash, which is a fundamental efficiency of Docker's union filesystem. This layer sharing reduces disk usage and speeds up image pulls.

Exam trap

CNCF often tests the misconception that all layers are writable at runtime, but in reality only the container's writable layer is mutable, while the underlying image layers remain read-only.

How to eliminate wrong answers

Option A is wrong because each layer is created by any instruction in the Dockerfile (not just RUN), and layers are immutable after the image is built; they cannot be modified. Option B is wrong because layers are identified by their content hash (SHA256) and are shared between images that use the same base layers, such as multiple images based on the same Ubuntu base. Option D is wrong because at runtime, a thin writable container layer is added on top of the read-only image layers; the image layers themselves remain read-only.

95
MCQmedium

You need to run a batch job that processes a queue of 1000 items. The job should run to completion and then terminate. Which Kubernetes resource is BEST suited for this workload?

A.DaemonSet
B.Job
C.Deployment
D.StatefulSet
AnswerB

A Job creates one or more pods that run until successful completion, then stops — exactly matching the batch requirement. Unlike a Deployment, which maintains a continuous desired replica count and restarts pods indefinitely, a Job tracks completions and terminates once the queue's 1000 items are processed, satisfying the run-to-completion constraint.

Why this answer

A Kubernetes Job is designed for batch processing tasks that run to completion and then terminate. It creates one or more Pods and ensures that a specified number of them successfully terminate. For a queue of 1000 items, a Job can be configured with a parallelism value and a completions count to process all items and then exit, making it the ideal resource for this workload.

Exam trap

CNCF often tests the distinction between workloads that run to completion (Jobs) versus those that are expected to run indefinitely (Deployments, DaemonSets), and the trap here is that candidates may choose Deployment because they associate it with 'running a job' in a general sense, without realizing that a Deployment's default behavior is to maintain a desired number of running Pods and restart them if they exit.

How to eliminate wrong answers

Option A is wrong because a DaemonSet ensures that a copy of a Pod runs on every (or selected) Node in the cluster, which is intended for long-running background services like log collection or monitoring, not for batch jobs that terminate. Option C is wrong because a Deployment manages a set of Pods to run continuously (e.g., web servers) and will restart Pods if they exit, which is the opposite of a batch job that should terminate after completion. Option D is wrong because a StatefulSet is used for stateful applications that require stable network identities and persistent storage (e.g., databases), not for ephemeral batch processing tasks.

96
MCQmedium

A platform team runs a 20-node Kubernetes cluster. They want a single Pod to run on every node so that a node-exporter agent can collect host metrics. They also want the Pod to be automatically created when a new node joins the cluster. Which workload resource should they use?

A.StatefulSet with podManagementPolicy set to Parallel
B.Deployment with replicas set to 20
C.Job with parallelism set to 20
D.DaemonSet
AnswerD

A DaemonSet ensures that a copy of the specified Pod runs on every eligible node in the cluster. When a new node is added, the DaemonSet controller schedules the Pod onto it automatically. This exactly matches the requirement for a node-level metrics agent that must exist on all 20 nodes without manual intervention.

Why this answer

A DaemonSet is the only workload controller that guarantees one Pod per eligible node and automatically schedules a Pod when a new node joins the cluster. This makes it the correct choice for node-level agents such as log collectors, metrics exporters, or storage daemons. Deployments, StatefulSets, and Jobs do not provide this per-node placement guarantee.

Exam trap

The trap here is assuming that a Deployment with a replica count equal to the number of nodes will place one Pod on each node.

97
MCQhard

A pod is stuck in the Pending state. Running 'kubectl describe pod <pod-name>' shows the event: '0/3 nodes are available: 1 node had taint {node.kubernetes.io/disk-pressure: }, 2 nodes had taint {node.kubernetes.io/memory-pressure: }'. What is the most likely cause?

A.All nodes have taints that the pod does not have tolerations for
B.The container image is not found in the registry
C.The pod has a resource request that exceeds available capacity on all nodes
D.The pod's liveness probe is failing
AnswerA

The scheduler cannot bind the pod because every candidate node carries a taint — disk-pressure or memory-pressure — for which the pod declares no matching toleration. Taints repel pods lacking tolerations, so no feasible node remains and the pod stays Pending, exactly matching the "0/3 nodes are available" event.

Why this answer

The pod is stuck in Pending because the scheduler cannot find a node that satisfies its scheduling constraints. The events show that all three nodes have taints (disk-pressure and memory-pressure), and the pod does not have corresponding tolerations to allow it to be scheduled on those nodes. Without tolerations, the pod is not permitted to run on any of the available nodes, leaving it in the Pending state.

Exam trap

CNCF often tests the distinction between taints/tolerations and resource constraints, where candidates mistakenly attribute a Pending state to resource exhaustion when the actual cause is missing tolerations for node taints.

How to eliminate wrong answers

Option B is wrong because a missing container image would cause an ImagePullBackOff or ErrImagePull error, not a Pending state with node taint events. Option C is wrong because resource requests exceeding capacity would produce events like 'Insufficient memory' or 'Insufficient cpu', not taint-related messages. Option D is wrong because a failing liveness probe only affects running pods (causing restarts or CrashLoopBackOff), not pods that have never been scheduled.

98
MCQhard

You have a multi-container pod with a main application container and a sidecar container that handles log shipping. The sidecar container should start before the main container and stop after the main container finishes. Which pod configuration should you use?

A.Define the sidecar as an init container
B.Use the 'startupOrder' field in the pod spec
C.Kubernetes does not natively guarantee startup and shutdown order among containers in a pod
D.Set the sidecar container's command to a script that waits for the main container's port to become available before starting
AnswerC

Containers in a pod start in parallel and terminate in parallel; ordering is not guaranteed without custom logic.

Why this answer

Kubernetes does not provide any built-in mechanism to control the startup or shutdown order of regular containers within the same pod. All containers in a pod start simultaneously in parallel and terminate independently when the pod is deleted. The only ordering guarantee is that init containers run to completion sequentially before any regular containers start, but they cannot be used for sidecar-style log shipping that must remain running alongside the main container.

Exam trap

Kubernetes does not have a built-in mechanism to order regular container startup/shutdown; the only ordering is through init containers, which run to completion and cannot serve as long-running sidecars.

How to eliminate wrong answers

Option A is wrong because init containers run to completion and terminate before any regular containers start; they are not designed to run as long-lived sidecars that persist alongside the main container. Option B is wrong because there is no 'startupOrder' field in the pod spec; Kubernetes does not expose any such field for controlling container startup sequence. Option D is wrong because while a script could poll for a port, this is a workaround, not a native Kubernetes guarantee, and it does not address shutdown ordering — the sidecar would still be terminated at the same time as the main container during pod deletion.

99
MCQmedium

You run the command 'kubectl get pods -n default' and see no pods listed. However, you are sure there should be pods. What is the most likely cause?

A.The current kubectl context is connected to a different cluster
B.All pods are in the 'kube-system' namespace
C.The kube-apiserver is down
D.The pods are in the 'Pending' state and not listed
AnswerA

kubectl queries whatever cluster the active context points to, so an empty default namespace usually means the context targets a different cluster than the one holding the pods. Switching context with kubectl config use-context reveals the intended workloads.

Why this answer

`kubectl` uses the current context defined in the kubeconfig file to determine which cluster and namespace to communicate with. If the context points to a different cluster (e.g., a test or staging cluster), the `kubectl get pods -n default` command will query that cluster's API server, which may have no pods in the `default` namespace, even though the intended cluster has pods. This is a common misconfiguration when working with multiple clusters.

Exam trap

A common pitfall is assuming an empty pod list means no pods exist, without checking the current kubectl context. Candidates often forget that the context determines which cluster and namespace are being queried.

How to eliminate wrong answers

Option B is wrong because the `-n default` flag explicitly queries the `default` namespace, not `kube-system`; pods in `kube-system` are irrelevant unless the namespace is changed. Option C is wrong because if the kube-apiserver were down, `kubectl` would return a connection error (e.g., 'Unable to connect to the server'), not an empty pod list. Option D is wrong because pods in the 'Pending' state are still listed by `kubectl get pods`; they are not hidden—only their status differs.

100
MCQeasy

Which statement accurately describes a key difference between containers and virtual machines?

A.Virtual machines share the host kernel, while containers have their own kernel
B.Both containers and virtual machines require a hypervisor
C.Containers include a full guest operating system
D.Containers share the host OS kernel, while virtual machines include a full guest OS
AnswerD

Containers share the host OS kernel, so they carry only the application and its dependencies, making them lightweight. Virtual machines run a complete guest OS with its own kernel atop a hypervisor, consuming far more resources. This kernel-sharing axis is the fundamental architectural difference between the two.

Why this answer

Containers virtualize at the OS level, sharing the host kernel, while virtual machines (VMs) include a full guest OS with its own kernel, running on a hypervisor. This fundamental architectural difference means containers are lighter and start faster, but VMs provide stronger isolation since each VM has its own kernel and OS instance.

Exam trap

The trap is that candidates often confuse the isolation boundaries between containers and VMs, mistakenly thinking containers have their own kernel (like VMs) or that VMs share the host kernel (like containers). In the context of Kubernetes, containers always share the host OS kernel, while VMs include a full guest OS.

How to eliminate wrong answers

Option A is wrong because it reverses the relationship: virtual machines do NOT share the host kernel (they have their own guest OS kernel), while containers share the host kernel. Option B is wrong because containers do not require a hypervisor; they run directly on the host OS using kernel features like cgroups and namespaces, whereas VMs require a hypervisor (Type 1 or Type 2) to manage guest OS instances. Option C is wrong because containers do not include a full guest operating system; they package only the application and its dependencies, relying on the host OS kernel for system calls.

101
Multi-Selecteasy

Which TWO of the following are true about container networking basics? (Choose 2)

Select 2 answers
A.Containers can only communicate if they are on the same node
B.Containers on the same host can communicate via a bridge network
C.Each container has its own network namespace
D.Container networking does not require any configuration
E.All containers share the host's IP address
AnswersB, C

A bridge network on the host connects containers through a virtual switch, letting them reach each other by IP or container name without leaving the host. This satisfies the stem's requirement about same-host container communication.

Why this answer

Option B is correct because containers on the same host can communicate through a bridge network, such as Docker's default bridge, where veth pairs connect container interfaces to a Linux bridge and IP forwarding enables same-host traffic. Option C is correct because each container is created with its own network namespace, giving it separate interfaces, routing tables, and IP addresses isolated from other containers and the host. Option A is incorrect because containers on different nodes can communicate via overlay networks, routing, or service meshes, not only on the same node.

Option D is incorrect because container networking requires configuration such as bridge creation, IP address assignment, port mapping, or CNI plugin setup. Option E is incorrect because containers normally have their own IP addresses within their network namespace, not the host's IP address, unless using host networking mode.

Exam trap

KCNA often tests the misconception that containers always share the host's IP or that networking is automatic, confusing host mode with default bridge mode.

102
MCQhard

You have a microservices application with a frontend service that needs to communicate with a backend service running in a different namespace ('backend-ns'). The default namespace for the frontend is 'frontend-ns'. What DNS name should the frontend use to reach the backend service named 'backend-svc'?

A.backend-svc.frontend-ns.svc.cluster.local
B.backend-svc.backend-ns.svc.cluster.local
C.backend-svc.backend-ns.cluster.local
D.backend-svc
AnswerB

The fully qualified domain name resolves cross-namespace because Kubernetes DNS appends the namespace segment between service and svc. Since the frontend sits in frontend-ns while the backend runs in backend-ns, the short name backend-svc alone would fail; specifying backend-ns satisfies the cross-namespace constraint directly.

Why this answer

In Kubernetes, DNS names for services follow the pattern `<service>.<namespace>.svc.cluster.local`. Since the backend service 'backend-svc' is in the 'backend-ns' namespace, the correct DNS name is `backend-svc.backend-ns.svc.cluster.local`. This allows the frontend in 'frontend-ns' to resolve the backend service across namespaces.

Exam trap

The trap here is that candidates often forget the 'svc' subdomain or mistakenly use the frontend's namespace instead of the backend's namespace, leading them to choose A or C, while D is a common shortcut that only works within the same namespace.

How to eliminate wrong answers

Option A is wrong because it uses 'frontend-ns' as the namespace, which would only work if the backend service were in the same namespace as the frontend, but it is in 'backend-ns'. Option C is wrong because it omits the required 'svc' subdomain, making the DNS name invalid for Kubernetes service discovery. Option D is wrong because it omits the namespace and cluster domain entirely, which only works for services in the same namespace and does not resolve across namespaces.

103
MCQhard

Which of the following is a characteristic of immutable infrastructure?

A.Infrastructure is version-controlled using Git
B.Infrastructure components are never changed after deployment; they are replaced
C.Servers are updated in-place with configuration management tools
D.Containers are used to ensure portability
AnswerB

Immutable infrastructure treats servers as disposable artefacts: once deployed, components are never patched or reconfigured in place. Changes trigger provisioning of replacement instances from a new image, and the old ones are destroyed, eliminating configuration drift.

Why this answer

Immutable infrastructure means that once a component (e.g., a server, container, or VM) is deployed, it is never modified. If an update is needed, the entire component is replaced with a new version. This eliminates configuration drift and ensures consistency across environments, which is a core principle in container orchestration with Kubernetes.

Exam trap

The KCNA exam often tests the misconception that version-controlling infrastructure (Option A) or using containers (Option D) automatically makes infrastructure immutable, but immutability specifically requires that deployed components are never modified—only replaced.

How to eliminate wrong answers

Option A is wrong because while version-controlling infrastructure definitions (e.g., using Git for Terraform or Kubernetes manifests) is a best practice, it is not a defining characteristic of immutability—it is a DevOps practice for infrastructure as code. Option C is wrong because updating servers in-place with configuration management tools (e.g., Ansible, Chef) is the opposite of immutable infrastructure; it represents mutable infrastructure where changes are applied to running instances. Option D is wrong because containers improve portability but do not inherently enforce immutability; containers can be updated in-place (e.g., by exec-ing into a running container) unless explicitly managed as immutable.

104
MCQeasy

What is the purpose of a readiness probe in a Kubernetes pod?

A.To check if the container is alive and restart it if not
B.To verify the container's CPU and memory usage
C.To ensure the container can write to persistent storage
D.To check if the container is ready to accept traffic
AnswerD

A readiness probe determines whether the container has finished starting and can serve requests; until it succeeds, the pod is removed from Service endpoints, so no traffic is routed to it. This directly satisfies the stem's requirement of readiness to accept traffic.

Why this answer

A readiness probe in Kubernetes determines whether a container is ready to start accepting traffic. If the probe fails, the container is removed from the Service's endpoints, ensuring no traffic is routed to an unready pod. This is distinct from a liveness probe, which checks if the container is alive and should be restarted.

Exam trap

The exam often tests the confusion between liveness and readiness probes, where candidates mistakenly think a readiness probe restarts the container or that both probes serve the same purpose.

How to eliminate wrong answers

Option A is wrong because it describes a liveness probe, not a readiness probe; a liveness probe restarts the container if it fails, while a readiness probe only controls traffic routing. Option B is wrong because Kubernetes does not use probes to verify CPU or memory usage; resource usage is monitored via metrics servers or resource quotas, not probes. Option C is wrong because readiness probes do not check persistent storage; storage health is typically validated via startup probes or application-level checks, not readiness probes.

105
MCQeasy

What is the purpose of the Container Runtime Interface (CRI) in Kubernetes?

A.To allow kubelet to use different container runtimes
B.To manage persistent storage for containers
C.To provide a network plugin interface for pods
D.To define a standard for container images
AnswerA

CRI is the abstraction layer between kubelet and container runtimes, defining gRPC endpoints for image and container lifecycle operations. It lets kubelet drive containerd, CRI-O or other compliant runtimes interchangeably, decoupling Kubernetes releases from any single runtime implementation.

Why this answer

The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a variety of container runtimes without needing to recompile the Kubernetes source code. By defining a standard API (gRPC-based) for runtime operations like pulling images and managing containers, CRI decouples Kubernetes from specific runtime implementations such as containerd, CRI-O, or Docker (via dockershim). This abstraction allows cluster administrators to choose the most suitable runtime for their environment while maintaining compatibility with the Kubernetes control plane.

Exam trap

A common exam trap is confusing the CRI's role in runtime abstraction with storage (CSI) or networking (CNI) interfaces, leading candidates to select options B or C.

How to eliminate wrong answers

Option B is wrong because persistent storage management is handled by the Container Storage Interface (CSI), not the CRI; CRI focuses solely on runtime operations like container lifecycle and image management. Option C is wrong because network plugin interfaces for pods are provided by the Container Network Interface (CNI), which handles IP allocation and network connectivity, not the CRI. Option D is wrong because container image standards are defined by the Open Container Initiative (OCI) image spec, not the CRI; the CRI consumes OCI-compliant images but does not define the image format itself.

106
Multi-Selecteasy

Which TWO of the following are characteristics of microservices architecture? (Choose 2)

Select 2 answers
A.All services share the same database
B.Services can be deployed independently
C.Communication between services is often via APIs
D.The entire application is deployed as a single unit
E.Services are tightly coupled
AnswersB, C

Each microservice can be developed, deployed, and scaled independently.

Why this answer

Microservices architecture is defined by the ability to deploy each service independently without affecting other services. This independence enables teams to update, scale, and roll back individual components, which is a core principle of container orchestration platforms like Kubernetes that manage these services as separate units.

Exam trap

The trap here is that candidates confuse microservices with service-oriented architecture (SOA) or mistakenly think that sharing a database or tight coupling is acceptable, when in fact microservices require database-per-service and loose coupling to achieve independent deployability.

107
MCQhard

A pod has resource requests of 512Mi memory and 500m CPU, and limits of 1Gi memory and 1 CPU. The node has 4Gi memory and 2 CPU cores. If the pod tries to use 700m CPU, what will happen?

A.The pod will be throttled to 500m CPU
B.The pod will be allowed to use 700m CPU
C.The pod will be evicted from the node
D.The pod will be terminated for exceeding the limit
AnswerB

CPU is a compressible resource, so the 700m request is throttled only against the 1 CPU limit, not rejected. Since 700m sits below that ceiling and the node has spare capacity, the pod receives the full 700m.

Why this answer

The pod's CPU request is 500m, and its CPU limit is 1 CPU (1000m). When the pod attempts to use 700m CPU, it is below the limit of 1000m, so it is allowed to burst up to that amount. Kubernetes uses the CPU request for scheduling and the limit for throttling; since 700m is within the limit, no throttling occurs.

The pod is not evicted or terminated because it has not exceeded its memory limit or violated any resource constraints.

Exam trap

The trap here is that candidates confuse CPU requests with limits, thinking that exceeding the request triggers throttling or eviction, when in fact throttling only occurs at the limit and eviction is tied to memory or node pressure, not CPU usage below the limit.

How to eliminate wrong answers

Option A is wrong because throttling to 500m CPU would only occur if the pod exceeded its CPU limit, but 700m is below the 1000m limit, so the pod is allowed to burst. Option C is wrong because eviction happens when a node runs out of resources (e.g., memory pressure) or when a pod exceeds its memory limit, not for CPU usage below the limit. Option D is wrong because termination for exceeding a limit applies only when the pod surpasses its memory limit or violates a hard resource constraint; CPU usage below the limit does not trigger termination.

108
MCQeasy

A developer wants to run a one-time task that creates a database schema and then exits. Which Kubernetes workload type is most appropriate?

A.DaemonSet
B.StatefulSet
C.Deployment
D.Job
AnswerD

A Job runs pods to completion and is designed for finite, run-to-completion workloads. This matches the stem's constraint of a one-time task that creates a schema and then exits, unlike a Deployment, which maintains continuous desired-state replicas.

Why this answer

A Job is the correct choice because it is designed for finite, one-time tasks that run to completion, such as creating a database schema. Unlike long-running workloads, a Job creates one or more Pods and ensures they terminate successfully after the task finishes, making it ideal for batch processing or initialization tasks.

Exam trap

The trap here is that candidates confuse a one-time task with a Deployment because they think of 'running a container' generically, forgetting that Deployments enforce a restart policy that would keep the task running indefinitely.

How to eliminate wrong answers

Option A is wrong because a DaemonSet ensures that a copy of a Pod runs on all (or selected) nodes, intended for continuous background services like logging or monitoring, not for one-time tasks. Option B is wrong because a StatefulSet is used for stateful applications requiring stable, unique network identities and persistent storage, such as databases, and is designed for long-running rather than ephemeral tasks. Option C is wrong because a Deployment manages a set of identical Pods with a desired replica count, ensuring they run continuously and are automatically restarted if they exit, which is unsuitable for a task that should exit after completion.

109
MCQhard

In a container image built from a Dockerfile, what is the purpose of the CMD instruction?

A.To specify a command that always runs at build time
B.To copy files into the image
C.To provide default arguments for the ENTRYPOINT instruction
D.To define environment variables
AnswerC

CMD supplies default arguments that are passed to the ENTRYPOINT executable when the container starts, and these defaults are overridden if arguments are supplied at runtime. This differs from ENTRYPOINT, which defines the fixed executable itself.

Why this answer

The CMD instruction in a Dockerfile provides default arguments for the ENTRYPOINT instruction when the container is run. If no ENTRYPOINT is defined, CMD itself serves as the default command to execute. This allows users to override the default behavior at runtime by appending arguments to `docker run`, which replace the CMD values while preserving the ENTRYPOINT.

Exam trap

The KCNA exam often tests the distinction between CMD and RUN, where candidates mistakenly think CMD runs at build time, but the trap is that CMD only defines runtime defaults and is overridable, unlike RUN which executes during image creation.

How to eliminate wrong answers

Option A is wrong because CMD specifies a command that runs at container runtime, not at build time; build-time commands are handled by RUN. Option B is wrong because copying files into the image is the purpose of the COPY or ADD instruction, not CMD. Option D is wrong because defining environment variables is the role of the ENV instruction, not CMD.

110
Multi-Selecthard

Which TWO of the following are valid reasons to use a DaemonSet instead of a Deployment? (Select 2)

Select 2 answers
A.You need to run exactly one pod per node for log collection
B.You need to deploy a monitoring agent that should run on every node
C.You need to ensure a pod runs on the control-plane node only
D.You need to run a batch job that completes and exits
E.You need to run a stateless web application with multiple replicas
AnswersA, B

A DaemonSet controller schedules one pod onto every node, including nodes added later, which suits per-node agents such as log collectors. A Deployment instead targets a replica count, so coverage per node is not guaranteed.

Why this answer

A DaemonSet ensures that exactly one pod runs on every node (or a subset of nodes) in the cluster. Option A is correct because log collection agents (e.g., Fluentd, Filebeat) must run on each node to capture all container logs, and a DaemonSet guarantees this per-node scheduling. Option B is correct because monitoring agents (e.g., Prometheus Node Exporter, Datadog agent) need to be present on every node to collect host-level metrics, and a DaemonSet is the ideal controller for this use case.

Exam trap

Kubernetes often tests the distinction between DaemonSets and Deployments by presenting scenarios that involve per-node scheduling versus replica management, and the trap here is that candidates confuse 'run on every node' with 'run on a specific node' or 'run a batch job,' leading them to select options C or D incorrectly.

111
MCQhard

A cluster administrator notices that a Pod scheduled on a node is stuck in the Pending state. The Pod requests 8 CPU cores, but the node has only 4 allocatable CPU cores. The scheduler logs show a FailedScheduling event with the message 'Insufficient cpu'. Which action will allow the Pod to be scheduled without reducing its CPU request?

A.Create a PriorityClass with a high value and assign it to the Pod to preempt other workloads.
B.Reduce the Pod's CPU request to 4 cores so it fits on the existing node.
C.Add a new node to the cluster that has at least 8 allocatable CPU cores and ensure the Pod's scheduling constraints match that node.
D.Add a toleration to the Pod so it can be scheduled on a tainted node.
AnswerC

The scheduler cannot place the Pod because no node has enough allocatable CPU. Adding a node with sufficient capacity and compatible labels or taints allows the scheduler to bind the Pod there. This addresses the root cause without changing the Pod's resource request. Other options either ignore the capacity shortage or alter the request.

Why this answer

The scheduler filters nodes based on available allocatable resources. A Pod requesting 8 CPU cores cannot fit on a node with only 4 allocatable cores, regardless of taints or priority. Adding a node with sufficient CPU capacity and matching scheduling constraints resolves the issue without altering the Pod's request.

Reducing the request would work but violates the scenario constraint.

Exam trap

The trap here is assuming that preemption or tolerations can overcome a node's total CPU capacity limit.

112
MCQeasy

Which Open Container Initiative (OCI) specification defines the format of container images?

A.Runtime Spec
B.Image Spec
C.Container Runtime Interface (CRI)
D.Dockerfile specification
AnswerB

The OCI Image Spec defines the image manifest, configuration, filesystem layers and index format, so it governs how container images are structured and referenced. The Runtime Spec instead covers execution, and the Distribution Spec covers registry interactions.

Why this answer

The OCI Image Spec defines the format and content of container images, including the manifest, configuration, and layers. This ensures that any OCI-compliant runtime can run images built by any OCI-compliant tool, enabling interoperability across different container platforms.

Exam trap

The trap here is confusing the OCI Runtime Spec (which deals with running containers) with the OCI Image Spec (which deals with packaging images), or mistaking the Kubernetes CRI plugin interface for an OCI standard.

How to eliminate wrong answers

Option A is wrong because the OCI Runtime Spec defines the lifecycle and configuration of running containers (e.g., bundle format, state machine), not the image format. Option C is wrong because the Container Runtime Interface (CRI) is a Kubernetes API for integrating container runtimes (like containerd or CRI-O), not an OCI specification for image format. Option D is wrong because the Dockerfile specification is a Docker-specific build instruction format, not an OCI standard; OCI images are built from layers, not directly from Dockerfiles.

113
MCQeasy

What is the Container Runtime Interface (CRI)?

A.A tool for building container images
B.A standard for container runtime logs
C.A specification for container images
D.An API between kubelet and container runtime
AnswerD

CRI is the abstraction layer kubelet calls to start, stop and inspect containers, decoupling Kubernetes from any specific runtime. It satisfies the stem's requirement by defining the gRPC API between kubelet and runtimes such as containerd or CRI-O, so runtimes can be swapped without recompiling kubelet.

Why this answer

The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a variety of container runtimes without needing to recompile the kubelet. It defines a gRPC API (protocol buffers) for the kubelet to communicate with the container runtime, covering operations like pod lifecycle management and image management. Option D correctly identifies this as the API between the kubelet and the container runtime.

Exam trap

The trap here is that candidates often confuse the CRI with container image specifications (OCI Image Spec) or container runtime tools (like Docker), but the CRI is strictly an API interface between the kubelet and the runtime, not a tool or a specification for images.

How to eliminate wrong answers

Option A is wrong because building container images is the job of tools like Docker Build, Buildah, or Kaniko, not the CRI, which is an interface for runtime orchestration. Option B is wrong because the CRI does not standardize container runtime logs; log management is handled by the kubelet via the logging interface (e.g., using the 'kubectl logs' command) and the container runtime's logging driver. Option C is wrong because container image specifications are defined by the OCI Image Spec (Open Container Initiative), not by the CRI, which focuses on runtime operations like starting and stopping containers.

114
MCQhard

You have a Kubernetes cluster with a Deployment that uses a PersistentVolumeClaim (PVC) to store application data. The PVC is bound to a PersistentVolume (PV) with a Retain reclaim policy. You delete the Deployment and the PVC. What happens to the underlying storage?

A.The PV is immediately available for binding to a new PVC because the data is automatically wiped.
B.The PV remains, but it is in a Released state and cannot be bound to a new PVC until manually reclaimed.
C.The PV is automatically deleted, and the storage is released.
D.The PV is deleted, but the underlying storage is retained and must be manually cleaned up.
AnswerB

When a PVC is deleted, the PV's reclaim policy determines its fate. With Retain, the PV moves to a Released state, and the underlying storage is preserved. The PV is not available for new claims because it still holds data and requires manual intervention: an administrator must delete the PV and either clean up or reuse the storage. This prevents accidental data loss and allows for data recovery.

Why this answer

With a Retain reclaim policy, deleting a PVC does not delete the PV or the underlying storage. The PV transitions to a Released state, preserving data and preventing automatic rebinding. An administrator must manually delete the PV and clean up the storage before it can be reused.

This is different from the Delete policy, which dynamically deletes the PV and storage.

Exam trap

The trap here is confusing the Retain reclaim policy with the Delete policy, assuming that the PV is deleted or automatically made available.

115
MCQeasy

A cluster administrator deploys a web application as a Deployment named 'web' with 4 replicas. Users report that requests to the application sometimes reach a Pod that is still starting up and not ready to serve traffic. Which Kubernetes object should the administrator configure to ensure only ready Pods receive traffic?

A.A startup probe on the Pod template
B.A readiness probe on the Pod template
C.A PodDisruptionBudget on the Deployment
D.A liveness probe on the Pod template
AnswerB

A readiness probe determines whether a container is ready to accept traffic. When a Pod is not ready, the kubelet sets its Ready condition to False, and the Endpoints controller removes its IP from the Service's endpoints. This directly prevents traffic from reaching starting or unhealthy Pods, matching the administrator's goal.

Why this answer

Readiness probes control whether a Pod's IP is included in a Service's endpoints. When the probe fails, the Pod is marked NotReady and removed from load balancing. Liveness probes restart containers, startup probes delay other probes, and PodDisruptionBudgets govern voluntary evictions.

Only a readiness probe directly ensures traffic goes solely to Pods ready to serve requests.

Exam trap

The trap here is confusing liveness probes, which restart containers, with readiness probes, which control Service endpoint membership.

116
MCQmedium

An administrator needs to expose a set of pods running a web application on a static port on each node's IP address. Which Service type should they use?

A.ClusterIP
B.NodePort
C.ExternalName
D.LoadBalancer
AnswerB

NodePort exposes a Service on a static port on every node's IP address, forwarding traffic to the backing pods. This matches the requirement for a fixed port reachable via each node, unlike ClusterIP or LoadBalancer.

Why this answer

A NodePort service exposes the application on a static port (30000–32767) on every node's IP address, making the pods accessible externally via <NodeIP>:<NodePort>. This matches the requirement to expose pods on a static port on each node's IP address without needing an external load balancer.

Exam trap

CNCF often tests the misconception that NodePort is the only way to expose services externally, but the trap here is confusing NodePort with LoadBalancer, which also provides external access but requires cloud provider integration and does not guarantee a static port on each node.

How to eliminate wrong answers

Option A is wrong because ClusterIP exposes the service only on a cluster-internal IP, making it unreachable from outside the cluster. Option C is wrong because ExternalName maps a service to an external DNS name via CNAME records, not to node IPs or ports. Option D is wrong because LoadBalancer provisions an external cloud load balancer with a public IP, which is overkill and not required for exposing on each node's static port.

117
MCQmedium

A company is deploying a microservices application on Kubernetes. They want to ensure that configuration data, such as database URLs and feature flags, can be updated without rebuilding container images. Which Kubernetes resource should they use?

A.Secrets
B.Services
C.Deployments
D.ConfigMaps
AnswerD

ConfigMaps store non-confidential key-value configuration separately from pod specifications, so database URLs and feature flags can be mounted as volumes or injected as environment variables and updated without rebuilding the image. Secrets serve credentials, while Deployments and Services handle workloads and networking.

Why this answer

ConfigMaps are the correct Kubernetes resource for decoupling configuration data (like database URLs and feature flags) from container images. They allow you to inject configuration as environment variables or mounted volumes without rebuilding or redeploying the container image, enabling runtime updates.

Exam trap

The trap here is that candidates often confuse ConfigMaps with Secrets, assuming that all configuration must be stored in Secrets, but the KCNA exam tests the distinction that ConfigMaps are for non-sensitive data and Secrets are for sensitive data.

How to eliminate wrong answers

Option A is wrong because Secrets are designed for sensitive data (e.g., passwords, tokens) and are not intended for general configuration like database URLs or feature flags; using Secrets for non-sensitive data adds unnecessary complexity and security overhead. Option B is wrong because Services are a networking abstraction that provides stable endpoints for Pods, not a mechanism for storing or injecting configuration data. Option C is wrong because Deployments manage the desired state and lifecycle of Pods (e.g., scaling, rolling updates), but they do not store configuration data; configuration is typically provided via ConfigMaps or Secrets referenced in the Pod spec.

118
MCQmedium

A Kubernetes Deployment manages a set of pods. What is the primary purpose of a Deployment?

A.To declare the desired state for a set of pods and manage rolling updates
B.To store configuration data as key-value pairs
C.To run a batch job to completion
D.To expose a set of pods as a network service
AnswerA

A Deployment declares the desired state for its ReplicaSet and pods, then the controller reconciles actual state towards it, enabling declarative scaling and rolling updates with rollback. This satisfies the stem's need to manage a set of pods and update them without downtime.

Why this answer

A Kubernetes Deployment declares the desired state for a set of pods and manages rolling updates and rollbacks. It ensures that the specified number of pod replicas are running and provides declarative updates to the application, which is its primary purpose.

Exam trap

The trap is confusing a Deployment with other Kubernetes objects like ConfigMaps, Jobs, or Services; candidates must remember that a Deployment is specifically for managing the desired state and updates of pods, not for configuration, batch processing, or networking.

How to eliminate wrong answers

Option B is wrong because storing configuration data as key-value pairs is the purpose of a ConfigMap, not a Deployment. Option C is wrong because running a batch job to completion is the purpose of a Job or CronJob, not a Deployment. Option D is wrong because exposing a set of pods as a network service is the purpose of a Service, not a Deployment.

119
Multi-Selectmedium

Which THREE of the following are core principles of immutable infrastructure? (Choose 3)

Select 3 answers
A.Rollbacks are performed by redeploying a previous image
B.Infrastructure is patched by applying updates to running servers
C.Infrastructure components are never modified after deployment
D.Deployments are reproducible and consistent
E.All changes are made by updating configuration files on running instances
AnswersA, C, D

Because servers are never patched in place, reverting means destroying the current instances and launching fresh ones from the previously validated image. This satisfies the stem's rollback principle: recovery is a redeployment of an artefact, not an in-place repair of running infrastructure.

Why this answer

Option A is correct because in immutable infrastructure you never repair a running instance; to roll back you simply redeploy the previously built and validated image (e.g., a prior AMI, container image tag, or VM template), which restores the known-good state deterministically. Option C is correct because the defining rule of immutability is that once an instance or component is deployed it is never modified in place — no SSH patching, no config edits — so any change requires replacing it with a new artifact. Option D is correct because immutable patterns rely on versioned, codified artifacts (e.g., Packer-built images, IaC templates, container registries) so that the same build produces identical, reproducible deployments across environments.

Option B is not correct because patching running servers is the mutable, in-place model that immutable infrastructure explicitly rejects. Option E is not correct because editing configuration files on running instances is also an in-place mutation, whereas immutable practice bakes configuration into a new image and redeploys it.

Exam trap

KCNA often tests the misconception that 'updating config files on running servers' or 'patching in place' is compatible with immutability — candidates must recognize that any in-place modification violates the principle.

120
MCQmedium

A cluster administrator examines a node and notices that the kubelet is running, but the node's status shows 'NotReady'. The administrator runs 'systemctl status containerd' on the node and finds the service is inactive. Which component's failure most directly explains the node's 'NotReady' condition?

A.containerd
B.CoreDNS
C.kube-apiserver
D.kube-proxy
AnswerA

The container runtime (containerd) is required by kubelet to create and run pod sandboxes. When containerd is inactive, kubelet cannot start containers, and its node status condition becomes NotReady because the runtime is unreachable. Restarting containerd typically restores the node to Ready.

Why this answer

The kubelet relies on a container runtime to manage pod sandboxes and containers. When containerd is inactive, kubelet cannot perform its core duties, and the node's Ready condition becomes false. Other components like kube-proxy or CoreDNS may affect networking or DNS, but they do not determine node readiness.

Exam trap

The trap here is assuming that any control plane or networking component failure causes NotReady, when the node's readiness is primarily gated by kubelet and the container runtime.

121
MCQmedium

A developer wants to expose a set of pods running a web application on a stable IP address. Which Kubernetes resource should they create?

A.Service
B.ConfigMap
C.Ingress
D.NetworkPolicy
AnswerA

A Service provides a stable virtual IP and DNS name that fronts a dynamically changing set of pod endpoints, selected by labels. Pods themselves are ephemeral, so the Service abstraction delivers the persistent address the web application requires.

Why this answer

A Service in Kubernetes provides a stable IP address and DNS name to expose a set of pods, abstracting away pod IP changes due to scaling or restarts. It acts as a load balancer across the pods, typically using ClusterIP (default), NodePort, or LoadBalancer types. This directly meets the requirement of exposing pods on a stable IP.

Exam trap

The CNCF exam often tests the distinction between Ingress and Service, where candidates mistakenly choose Ingress for stable IP exposure, but Ingress only provides host/path-based routing and requires a Service to actually reach pods.

How to eliminate wrong answers

Option B (ConfigMap) is wrong because it is used to store configuration data as key-value pairs, not to provide network access or a stable IP to pods. Option C (Ingress) is wrong because it manages external HTTP/HTTPS routing to Services, not a stable IP for pods; it requires a Service to function and does not itself assign an IP. Option D (NetworkPolicy) is wrong because it defines firewall rules for pod-to-pod traffic, not exposure or stable IP assignment.

122
MCQeasy

Which of the following is a key benefit of using containers over virtual machines?

A.Each container runs its own operating system
B.Containers provide stronger isolation than VMs
C.Containers require hypervisor to run
D.Containers share the host OS kernel
AnswerD

Containers share the host's kernel and isolate only user space via namespaces and cgroups, so they carry no guest OS. Virtual machines each run a full kernel, making containers far lighter to start and denser to pack.

Why this answer

Containers share the host operating system kernel, which makes them lightweight and fast to start compared to virtual machines. Each container runs as an isolated user-space process on the same kernel, avoiding the overhead of a separate guest OS per instance. This shared-kernel architecture is a fundamental design principle of containerization technologies like Docker and containerd.

Exam trap

The trap here is that candidates often confuse the lightweight nature of containers with stronger isolation, but the key trade-off is that containers share the host kernel, making them less isolated than VMs, not more.

How to eliminate wrong answers

Option A is wrong because each container does not run its own operating system; containers share the host OS kernel and only include the application and its dependencies. Option B is wrong because containers provide weaker isolation than VMs, as they share the host kernel and rely on kernel namespaces and cgroups, whereas VMs use a hypervisor to provide hardware-level isolation. Option C is wrong because containers do not require a hypervisor to run; they run directly on the host OS using the kernel's container runtime, while VMs require a hypervisor.

123
Matchingmedium

Match each Kubernetes command (kubectl) to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

List one or more resources

Show detailed state of a resource

Create or update resources from a file or stdin

Execute a command inside a container

Print logs from a container in a pod

Why these pairings

The correct matches are: kubectl get for listing resources, kubectl describe for detailed info, and kubectl apply for applying configurations. Common confusions include swapping the functions of kubectl delete and kubectl logs.

124
Multi-Selecthard

Which TWO of the following are true about service discovery in Kubernetes? (Choose 2)

Select 2 answers
A.Ingress resources can be used for internal service discovery
B.Service discovery is only available for pods on the same node
C.Environment variables are injected into pods for each Service
D.Services are assigned a DNS name in the form <service>.<namespace>.svc.cluster.local
E.Headless Services provide a stable virtual IP for service discovery
AnswersC, D

The kubelet injects environment variables for each active Service into newly created pods, exposing host and port values such as <SVCNAME>_SERVICE_HOST. This satisfies service discovery without DNS, though variables only reflect Services existing at pod creation time.

Why this answer

Option C is correct because Kubernetes injects environment variables (such as <SERVICE_NAME>_SERVICE_HOST and <SERVICE_NAME>_SERVICE_PORT) into every pod for each Service that exists at the time the pod is created, providing one built-in discovery mechanism. Option D is correct because CoreDNS (the cluster DNS add-on) assigns each Service a fully qualified domain name of the form <service>.<namespace>.svc.cluster.local, which pods resolve to reach the Service's ClusterIP. Option A is not correct because Ingress resources handle external HTTP/HTTPS routing into the cluster, not internal service discovery.

Option B is not correct because Service discovery works cluster-wide across all nodes, not just for pods on the same node. Option E is not correct because a headless Service (clusterIP: None) deliberately has no virtual IP; it returns individual pod IPs via DNS records instead of a stable ClusterIP.

Exam trap

The trap is confusing Ingress (external HTTP routing) with internal service discovery, and misremembering headless Services as providing a virtual IP when they actually return pod IPs directly.

125
MCQhard

Which of the following correctly describes the concept of 'immutable infrastructure' in the context of container orchestration?

A.Infrastructure components are recreated from a known good state rather than modified
B.Configuration changes are applied via SSH into running containers
C.Servers are never rebooted
D.Container images are updated in-place by patching existing layers
AnswerA

Immutable infrastructure replaces servers and containers wholesale from a versioned image rather than patching running instances. In orchestration, this means pods are destroyed and rescheduled from a known good artefact, so configuration drift cannot accumulate and rollbacks are simply redeployments.

Why this answer

Immutable infrastructure means that instead of modifying running servers or containers, you replace them entirely with new instances built from a known good image. In container orchestration, this is achieved by building a new container image, deploying it as a new pod/replica set, and tearing down the old ones. This eliminates configuration drift and makes rollbacks deterministic.

Exam trap

The trap is confusing immutability with 'never changing' or 'never rebooting' — candidates may pick option C because they think immutable means static, but the correct definition is about replacement rather than in-place modification.

How to eliminate wrong answers

Option B is wrong because SSHing into running containers to apply configuration changes is the opposite of immutable infrastructure — it introduces mutable state and drift. Option C is wrong because immutability does not mean servers are never rebooted; reboots can happen as part of replacement, but the key is that the instance is recreated, not patched in place. Option D is wrong because updating container images in-place by patching existing layers is not how container images work — layers are immutable by design, and any change requires building a new image.

126
MCQmedium

A Pod is stuck in 'Pending' state. Which command is most helpful to diagnose the issue?

A.kubectl logs my-pod
B.kubectl get events
C.kubectl describe pod my-pod
D.kubectl top pod my-pod
AnswerC

`kubectl describe pod` surfaces the scheduler's events, including `FailedScheduling` messages such as insufficient CPU, memory, or unsatisfied node affinity. This directly addresses the Pending constraint, since Pending means no node has been assigned, and the Events section names the exact reason scheduling failed.

Why this answer

'kubectl describe pod my-pod' provides detailed information about the pod's current state, including events, conditions, and resource constraints. When a pod is stuck in 'Pending', it typically means the scheduler cannot place it on a node due to issues like insufficient CPU/memory, persistent volume claims not being bound, or node selector mismatches. The 'describe' command surfaces these specific reasons in the 'Events' section and 'Conditions' field, making it the most direct diagnostic tool.

Exam trap

CNCF often tests the misconception that 'kubectl logs' is the universal debugging command, but for pending pods, logs are unavailable because containers haven't started, making 'kubectl describe' the correct choice for pre-run failures.

How to eliminate wrong answers

Option A is wrong because 'kubectl logs my-pod' retrieves container logs, but a pod in 'Pending' state has not started any containers yet, so there are no logs to fetch; this command is useful only after the pod is running. Option B is wrong because 'kubectl get events' shows cluster-wide events, which can be noisy and may not filter to the specific pod; while it can include scheduling failures, it lacks the pod-specific context and resource details that 'describe' provides. Option D is wrong because 'kubectl top pod my-pod' shows real-time resource usage metrics, which are only available for running pods; a pending pod has no resource consumption data to report.

127
MCQeasy

A developer wants to store non-sensitive configuration data, such as a database hostname and port, that multiple pods in different namespaces will consume as environment variables. The data must be reusable and not hardcoded in pod specs. Which Kubernetes resource is most appropriate?

A.An emptyDir volume
B.A ConfigMap
C.A downward API volume
D.A Secret with type Opaque
AnswerB

ConfigMaps are designed to hold non-confidential configuration data in key-value pairs. They can be consumed as environment variables, command-line arguments, or configuration files in volumes. Since the data is non-sensitive and needs to be reused across pods in different namespaces, a ConfigMap is the correct and idiomatic choice.

Why this answer

ConfigMaps are the standard Kubernetes object for storing non-confidential configuration data in key-value form. They decouple configuration from pod specifications, allowing the same data to be consumed by multiple pods across namespaces. Pods can reference ConfigMaps as environment variables, command-line arguments, or mounted files.

This promotes reusability and avoids hardcoding values in pod definitions.

Exam trap

The trap here is selecting a Secret for non-sensitive data because it also stores key-value pairs, but Secrets are meant for confidential information and add unnecessary complexity for plain configuration.

128
MCQmedium

You deploy a web application as a Deployment with 3 replicas. Each pod runs an Nginx container that listens on port 80. You need to make the application accessible from outside the cluster on a stable IP address that does not change even if nodes are replaced. Which Service type should you use?

A.ExternalName
B.ClusterIP
C.NodePort
D.LoadBalancer
AnswerD

LoadBalancer Services provision an external load balancer (typically from a cloud provider) that provides a stable, externally accessible IP address. This IP remains consistent even if cluster nodes are replaced or scaled, because the load balancer abstracts the backend nodes. It routes traffic to the Service's ClusterIP and then to the pods, meeting the requirement for external stable access.

Why this answer

A LoadBalancer Service is designed to expose an application externally with a stable IP address, typically via a cloud provider's load balancer. It abstracts the underlying nodes, so the external IP remains unchanged even if nodes are replaced. ClusterIP is internal-only, NodePort uses node IPs and a static port but not a stable external IP, and ExternalName is for mapping to external DNS names.

Exam trap

The trap here is assuming that NodePort provides a stable external IP, but it actually exposes the service on each node's IP, which can change when nodes are replaced.

129
MCQmedium

A cluster administrator needs to run a Pod that requires access to a raw block device on a specific node. The Pod must be scheduled only on nodes labeled disktype=ssd, and it must tolerate a taint hardware=gpu:NoSchedule that exists on those nodes. Which combination of Pod spec fields is required?

A.nodeSelector: disktype=ssd and tolerations for hardware=gpu:NoSchedule
B.tolerations for hardware=gpu:NoSchedule and podAntiAffinity against disktype=ssd
C.nodeName set to the specific node name and tolerations for hardware=gpu:NoSchedule
D.affinity: nodeAffinity with requiredDuringSchedulingIgnoredDuringExecution for disktype=ssd, and no tolerations
AnswerA

nodeSelector restricts scheduling to nodes with the matching label, and the toleration allows the Pod to be placed on nodes tainted with hardware=gpu:NoSchedule. Both are required because the label narrows the candidate nodes and the toleration prevents the taint from repelling the Pod. This combination satisfies the scheduling constraints.

Why this answer

The Pod needs both a node selection mechanism and a toleration. nodeSelector with disktype=ssd restricts scheduling to labeled nodes, and the toleration for hardware=gpu:NoSchedule allows placement on those tainted nodes. Neither alone is sufficient: without the selector, the Pod could land on non-SSD nodes; without the toleration, the taint would block scheduling.

Exam trap

The trap here is thinking that a toleration alone attracts a Pod to a tainted node, when it only permits scheduling on such nodes.

130
MCQmedium

Which of the following is a valid use case for a DaemonSet?

A.Running a batch job that must complete once
B.Running a stateless web application with multiple replicas
C.Running a stateful application with persistent storage
D.Running a logging agent on every node
AnswerD

A DaemonSet guarantees one pod replica per node, automatically scheduling onto new nodes as they join. This satisfies the stem's requirement of running a logging agent on every node, since node-level log collection demands continuous coverage across the whole cluster rather than a fixed replica count.

Why this answer

A DaemonSet ensures that a copy of a pod runs on all (or a subset of) nodes in the cluster. This is ideal for infrastructure pods like logging agents (e.g., Fluentd), monitoring agents (e.g., Prometheus Node Exporter), or kube-proxy, which must be present on every node to collect logs or enforce network rules. Option D directly matches this use case.

Exam trap

The trap here is that candidates confuse DaemonSets with Deployments or StatefulSets, assuming any long-running workload fits, but the key differentiator is the 'one pod per node' requirement, not replication count or statefulness.

How to eliminate wrong answers

Option A is wrong because a batch job that must complete once is a use case for a Job or CronJob, not a DaemonSet, which runs continuously on each node. Option B is wrong because a stateless web application with multiple replicas is typically deployed as a Deployment, which manages replicas across nodes without requiring one pod per node. Option C is wrong because a stateful application with persistent storage is best handled by a StatefulSet, which provides stable network identities and persistent storage per pod, unlike a DaemonSet which does not guarantee unique identities or ordered scaling.

131
MCQeasy

What is the OCI (Open Container Initiative) responsible for?

A.Hosting public container images
B.Providing a default container runtime for Kubernetes
C.Managing container orchestration
D.Defining standards for container images and runtimes
AnswerD

The Open Container Initiative publishes the image-spec and runtime-spec, giving a vendor-neutral format for container images and a standard lifecycle for runtimes. This directly satisfies the stem's ask: OCI governs interoperability standards for images and runtimes, not orchestration, networking or storage, which Kubernetes and CNI/CSI handle separately.

Why this answer

The Open Container Initiative (OCI) is a Linux Foundation project that defines open industry standards for container image formats and container runtimes. Its two main specifications are the OCI Image Spec (which standardizes the container image layout, including layers and manifests) and the OCI Runtime Spec (which defines the lifecycle and configuration for running containers). This ensures interoperability between different container tools and platforms, such as Docker, Podman, and containerd.

Exam trap

CNCF often tests the misconception that the OCI is a tool or platform (like a registry or runtime) rather than a standards body, leading candidates to confuse it with Docker Hub or containerd.

How to eliminate wrong answers

Option A is wrong because hosting public container images is the role of container registries like Docker Hub, Quay.io, or Google Container Registry, not the OCI. Option B is wrong because providing a default container runtime for Kubernetes is not the OCI's responsibility; Kubernetes uses container runtimes like containerd or CRI-O, which may implement OCI specs but are not provided by the OCI itself. Option C is wrong because managing container orchestration is the function of orchestrators like Kubernetes, Docker Swarm, or Nomad, not the OCI, which focuses solely on standardization.

132
MCQmedium

An application requires that a specific set of pods be placed on nodes labeled with 'gpu=true'. Which Kubernetes field should be used in the pod spec to enforce this?

A.nodeSelector
B.topologySpreadConstraints
C.affinity.nodeAffinity
D.tolerations
AnswerA

nodeSelector matches pods to nodes using label key-value pairs, so specifying `gpu: "true"` restricts scheduling to nodes carrying that exact label. This directly satisfies the stem's requirement to enforce placement on `gpu=true` nodes, since the scheduler filters out any node lacking the matching label.

Why this answer

`nodeSelector` is the simplest and most direct Kubernetes field for constraining a pod to nodes that have a specific label. By setting `nodeSelector: { gpu: 'true' }` in the pod spec, the scheduler will only place the pod on nodes that have the label `gpu=true`. This is a hard constraint that does not support complex expressions but is ideal for the stated requirement.

Exam trap

The trap here is that candidates often confuse `nodeSelector` with `nodeAffinity`, thinking the more advanced field is always required, but the question specifically asks for the field that enforces placement on labeled nodes, and `nodeSelector` is the simplest and correct answer for a straightforward label match.

How to eliminate wrong answers

Option B is wrong because `topologySpreadConstraints` controls how pods are distributed across topology domains (e.g., zones, nodes) to achieve even spreading, not to enforce placement on nodes with a specific label. Option C is wrong because `affinity.nodeAffinity` can also enforce placement on labeled nodes, but it is a more advanced and flexible field that supports both required and preferred rules; the question asks for the field that should be used, and `nodeSelector` is the simplest and most direct answer for a simple label match. Option D is wrong because `tolerations` allow pods to be scheduled on nodes with matching taints, but they do not enforce placement on nodes with a specific label; they only permit scheduling on otherwise tainted nodes.

133
MCQhard

An application requires that a pod must not be scheduled on the same node as another pod from the same Deployment. Which configuration should be used?

A.Node affinity with requiredDuringSchedulingIgnoredDuringExecution
B.Pod affinity with a preferredDuringSchedulingIgnoredDuringExecution
C.Pod anti-affinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname
D.Taints and tolerations
AnswerC

Required pod anti-affinity with topologyKey kubernetes.io/hostname makes the scheduler treat each node as a distinct failure domain, so no two pods sharing the Deployment's label can land on the same host. The requiredDuringSchedulingIgnoredDuringExecution rule enforces this as a hard constraint rather than a preference.

Why this answer

Pod anti-affinity with `requiredDuringSchedulingIgnoredDuringExecution` enforces a hard constraint that prevents two pods from the same Deployment from being scheduled on the same node. The `topologyKey: kubernetes.io/hostname` specifies that the anti-affinity rule applies at the node level, ensuring each pod is placed on a distinct host. This directly meets the requirement that a pod must not be scheduled on the same node as another pod from the same Deployment.

Exam trap

A common pitfall in Kubernetes exams is confusing pod affinity (which attracts pods to the same node) with pod anti-affinity (which repels them). Option B uses `preferredDuringSchedulingIgnoredDuringExecution` which is a soft preference, not a hard requirement, and it uses affinity instead of anti-affinity, so it would actually encourage pods to be together, not apart.

How to eliminate wrong answers

Option A is wrong because node affinity controls pod-to-node placement based on node labels, not pod-to-pod relationships; it cannot prevent two pods from the same Deployment from landing on the same node. Option B is wrong because pod affinity with `preferredDuringSchedulingIgnoredDuringExecution` is a soft preference, not a hard requirement, and it attracts pods to the same node rather than spreading them apart. Option D is wrong because taints and tolerations control which nodes a pod can be scheduled on (by repelling pods unless they tolerate the taint), but they do not enforce anti-affinity between pods of the same Deployment.

134
MCQhard

A Kubernetes administrator needs to ensure that a set of pods can only communicate with each other and with a specific external API, while blocking all other traffic. Which Kubernetes feature should be used to enforce this?

A.Ingress
B.PodSecurityPolicy
C.NetworkPolicy
D.Service mesh
AnswerC

NetworkPolicy is a Kubernetes resource that defines how groups of pods are allowed to communicate with each other and other network endpoints. By selecting pods with a label selector, you can define ingress and egress rules to allow traffic only from specific pods or to specific external IPs. This enforces the required isolation and allows communication with the external API.

Why this answer

NetworkPolicy is the native Kubernetes resource for specifying allowed ingress and egress traffic for pods. It uses label selectors to choose pods and defines rules based on IP blocks, namespaces, or pod selectors. This allows restricting communication to only the desired pods and external API.

Other options like Ingress or PodSecurityPolicy do not provide network segmentation.

Exam trap

The trap here is confusing Ingress with NetworkPolicy; Ingress is for external HTTP routing, while NetworkPolicy controls pod-level network access.

135
MCQhard

A pod is running but its container exits with code 137. The pod logs show 'Killed'. What is the most likely cause?

A.The container's CPU limit was exceeded
B.The container's liveness probe failed
C.The container was OOMKilled due to memory limit
D.The node ran out of disk space
AnswerC

Exit code 137 equals 128 plus signal 9 (SIGKILL), which the kernel sends when a container exceeds its cgroup memory limit. The OOM killer terminates the process, producing the 'Killed' log entry rather than an application-level crash.

Why this answer

Exit code 137 (128 + 9) indicates the container was terminated by SIGKILL. Combined with 'Killed' in logs, this is the definitive signature of an OOMKill event, where the Linux kernel's Out-Of-Memory (OOM) killer terminates the container process because it exceeded its memory limit (specified in the pod's resource limits). Kubernetes enforces memory limits via cgroups, and when the container's memory usage surpasses the limit, the OOM killer sends SIGKILL, resulting in exit code 137.

Exam trap

CNCF often tests the distinction between CPU throttling (which does not kill) and OOMKill (which does), and the trap here is that candidates confuse 'Killed' in logs with a generic failure, not recognizing exit code 137 as the specific OOMKill signal.

How to eliminate wrong answers

Option A is wrong because exceeding CPU limits causes CPU throttling (container runs slower) but never triggers a kill or exit code 137; the container continues running. Option B is wrong because a liveness probe failure results in Kubernetes restarting the container with exit code 143 (SIGTERM) or 0, not 137, and the logs would show 'Liveness probe failed' not 'Killed'. Option D is wrong because node disk pressure leads to pod eviction (not container OOM kill) with a different exit code and a Kubernetes event like 'Evicted', not exit code 137 and 'Killed' in container logs.

136
MCQmedium

A cluster administrator needs to run a one-time database migration job that must complete successfully before a new application version is deployed. The job should retry up to 4 times if it fails and should be automatically cleaned up 1 hour after completion. Which Kubernetes resource should be used?

A.A bare Pod with restartPolicy: Never and activeDeadlineSeconds: 3600
B.A CronJob with schedule: '@once' and successfulJobsHistoryLimit: 1
C.A Deployment with replicas: 1 and a restartPolicy of OnFailure
D.A Job with backoffLimit: 4 and ttlSecondsAfterFinished: 3600
AnswerD

A Job is designed for run-to-completion workloads. Setting backoffLimit: 4 allows up to 4 retries after the initial failure, and ttlSecondsAfterFinished: 3600 tells the Job controller to delete the Job and its pods 1 hour after it finishes. This exactly matches the requirement for a one-time migration with retry and cleanup.

Why this answer

The Job resource is purpose-built for one-off tasks that run to completion. The backoffLimit field controls how many times the Job controller retries a failed pod before marking the Job as failed. The ttlSecondsAfterFinished field enables automatic cleanup of the Job and its pods after a specified period.

Together they satisfy the migration scenario's retry and cleanup requirements without manual intervention.

Exam trap

The trap here is confusing Job with CronJob or assuming a Deployment can handle run-to-completion tasks, when only a Job provides the backoffLimit and TTL cleanup features needed for one-time workloads.

137
MCQhard

A Kubernetes cluster has a pod that is stuck in the 'Pending' state. The operations team runs 'kubectl describe pod' and sees the event: '0/3 nodes are available: 3 Insufficient cpu.' What is the most likely cause of this issue?

A.The pod has a nodeSelector that does not match any node labels.
B.The nodes have CPU resources but are tainted, preventing scheduling.
C.The pod's CPU limit is set too low, causing the scheduler to reject it.
D.The pod's CPU request exceeds the allocatable CPU on any node.
AnswerD

The scheduler reports insufficient CPU on all nodes, meaning no node has enough allocatable CPU to satisfy the pod's CPU request. This occurs when the sum of CPU requests of existing pods plus the new pod's request exceeds the node's capacity. The pod remains Pending until resources are freed or the request is reduced.

Why this answer

The event 'Insufficient cpu' indicates that the scheduler cannot find a node with enough allocatable CPU to meet the pod's CPU request. This happens when the sum of CPU requests from existing pods on each node plus the new pod's request exceeds the node's capacity. The pod remains Pending until resources are freed or the request is lowered.

Other factors like taints or node selectors would produce different event messages.

Exam trap

The trap here is confusing CPU limits with requests; only requests affect scheduling, and the error message explicitly points to insufficient CPU resources.

138
MCQeasy

A developer wants to ensure that a pod runs only on nodes with SSDs. Which mechanism should be used?

A.Apply a taint to nodes without SSDs and add tolerations to the pod
B.Use pod anti-affinity
C.Add a nodeSelector with disktype: ssd
D.Define a ResourceQuota
AnswerC

A nodeSelector matches pod scheduling to node labels, so labelling SSD nodes with disktype: ssd and declaring that selector in the pod spec confines the workload to those nodes. This directly satisfies the stem's requirement that the pod run only on SSD-backed nodes, using Kubernetes' built-in label-based scheduling constraint.

Why this answer

`nodeSelector` is a simple and direct mechanism in Kubernetes to constrain a pod to run only on nodes that have a specific label, such as `disktype=ssd`. By labeling nodes with SSDs and adding the corresponding `nodeSelector` in the pod spec, the scheduler ensures the pod is placed exclusively on those nodes. This approach is straightforward and does not require complex scheduling constraints or resource management.

Exam trap

The trap here is that candidates often confuse taints/tolerations with node selection, thinking they can be used to force pods onto specific hardware, when in fact taints repel pods and tolerations allow exceptions, whereas `nodeSelector` or `nodeAffinity` are the correct tools for positive selection.

How to eliminate wrong answers

Option A is wrong because taints and tolerations are used to repel pods from nodes (or allow them to tolerate repulsion), not to positively select nodes with specific hardware; they control which pods can run on a node but do not guarantee a pod will only run on nodes with SSDs. Option B is wrong because pod anti-affinity is used to prevent pods from co-locating on the same node or topology, not to select nodes based on hardware attributes like SSDs. Option D is wrong because a ResourceQuota limits resource consumption within a namespace and cannot influence node selection based on hardware characteristics.

139
MCQmedium

You have a microservices application deployed as a set of Pods in a Kubernetes cluster. You need to ensure that Pods can discover each other using stable DNS names. Which Kubernetes resource should you create?

A.ConfigMap
B.Ingress
C.Service
D.Deployment
AnswerC

A Service assigns a stable virtual IP and DNS name to a set of Pods, load-balancing across them. Pod IPs change as Pods restart, so the Service abstraction is what provides the stable discovery name required.

Why this answer

A Service of type ClusterIP (the default) provides a stable virtual IP and DNS name (e.g., my-service.namespace.svc.cluster.local) that resolves to the Pods selected by its label selector. This allows Pods to discover each other using consistent DNS names, regardless of Pod IP changes due to scaling or restarts. The kube-dns or CoreDNS addon automatically creates DNS records for Services, enabling service discovery within the cluster.

Exam trap

CNCF often tests the misconception that a Deployment itself provides stable DNS names, but Deployments only manage Pod replicas; the Service resource is required to expose a stable network endpoint and DNS record.

How to eliminate wrong answers

Option A is wrong because a ConfigMap is used to store configuration data as key-value pairs, not to provide network endpoints or DNS names for Pod discovery. Option B is wrong because an Ingress manages external HTTP/HTTPS traffic routing to Services, not internal Pod-to-Pod DNS-based discovery. Option D is wrong because a Deployment manages the desired state and lifecycle of Pods (replicas, updates), but does not create a stable network identity or DNS name for Pods to discover each other.

140
MCQhard

A pod named 'web-app' is not able to resolve the hostname 'db-service' from another namespace 'data'. The 'db-service' Service exists in the 'data' namespace. What is the most likely cause?

A.The pod is trying to resolve 'db-service' without the namespace suffix
B.The Service 'db-service' is not exposed on a port
C.The pod's DNS policy is set to 'None'
D.The pod's container image lacks DNS utilities
AnswerA

DNS resolution in Kubernetes is namespace-scoped: a bare name like `db-service` resolves only within the pod's own namespace. Cross-namespace lookups require the fully qualified form `db-service.data.svc.cluster.local`, so the missing namespace suffix is the constraint the stem describes.

Why this answer

By default, Kubernetes DNS resolves service names only within the same namespace. To resolve a service from another namespace, the pod must use the fully qualified domain name (FQDN) in the format '<service>.<namespace>.svc.cluster.local'. Without the namespace suffix, the DNS query for 'db-service' fails because it is not found in the pod's own namespace.

Exam trap

The trap here is that candidates assume Kubernetes DNS automatically resolves service names across all namespaces, similar to how a flat network would work, but in reality, DNS resolution is namespace-scoped unless the FQDN is used.

How to eliminate wrong answers

Option B is wrong because a Service can exist without being exposed on a port, but DNS resolution of the service name is independent of port exposure; DNS returns the cluster IP regardless of port configuration. Option C is wrong because a DNS policy of 'None' would mean the pod uses no DNS configuration at all, which would prevent resolution of any hostname, not just cross-namespace ones, and the question states only 'db-service' fails. Option D is wrong because DNS resolution is handled by the cluster's DNS service (e.g., CoreDNS) and the node's resolver, not by utilities inside the container image; the pod's container image lacking DNS utilities would not affect the underlying DNS query mechanism.

141
Multi-Selectmedium

Which TWO of the following are characteristics of a microservices architecture? (Select 2)

Select 2 answers
A.Independent deployment of services
B.Tight coupling between services
C.Loose coupling between services
D.Monolithic codebase
E.Shared database for all services
AnswersA, C

Independent deployment lets each service be released, scaled and restarted on its own release cadence, so a change to one service does not force redeployment of the whole application. This satisfies the stem's requirement for a defining microservices characteristic, distinguishing it from monolithic architectures where the entire application ships as one unit.

Why this answer

Option A (Independent deployment of services) is correct because microservices are built as separately deployable units, so a change to one service can be built, tested, and released without redeploying the entire application. Option C (Loose coupling between services) is correct because microservices interact through well-defined interfaces (typically REST, gRPC, or messaging) and minimize dependencies on each other's internal implementation, allowing them to evolve independently. Option B (Tight coupling between services) is incorrect because tight coupling is characteristic of monolithic designs, where components are highly interdependent.

Option D (Monolithic codebase) is incorrect because microservices decompose functionality into multiple small, independently managed codebases rather than one unified codebase. Option E (Shared database for all services) is incorrect because microservices generally favor database-per-service to avoid coupling through shared schemas and to preserve service autonomy.

Exam trap

CNCF often tests the misconception that microservices require a shared database for consistency, but the correct pattern is database-per-service to maintain loose coupling and independent scalability.

142
MCQmedium

A developer wants to deploy a stateful application that requires stable network identities and persistent storage. Which Kubernetes resource is best suited for this workload?

A.Deployment
B.DaemonSet
C.StatefulSet
D.Job
AnswerC

StatefulSets give each pod a stable ordinal hostname and its own PersistentVolumeClaim via volumeClaimTemplates, so identity and storage survive rescheduling. Deployments provide neither, as pods are interchangeable with random names and typically share or lose storage.

Why this answer

StatefulSet is the correct choice because it is designed specifically for stateful applications that require stable, unique network identities (via headless Services and ordinal hostnames) and persistent storage (via PersistentVolumeClaims that are retained across Pod rescheduling). Unlike Deployments, StatefulSets guarantee ordered deployment, scaling, and termination, which is essential for databases or message queues.

Exam trap

CNCF often tests the misconception that Deployment can handle stateful workloads because it supports PersistentVolumeClaims, but the trap is that Deployment does not guarantee stable network identities or ordered Pod management, which are critical for stateful applications like databases.

How to eliminate wrong answers

Option A is wrong because Deployment is intended for stateless applications and creates Pods with random, ephemeral identities and no guaranteed storage persistence; it does not provide stable network identities. Option B is wrong because DaemonSet ensures that a copy of a Pod runs on each node (or a subset of nodes) for node-level services like logging or monitoring, not for stateful workloads requiring stable identities and persistent storage. Option D is wrong because Job is designed for batch or one-time tasks that run to completion, not for long-running stateful applications that need persistent storage and stable network identities.

143
MCQhard

A team runs a stateful application in a Kubernetes cluster. They need each Pod to have a stable network identity and its own persistent storage that survives Pod rescheduling. Which controller should they use?

A.A ReplicaSet
B.A DaemonSet
C.A Deployment
D.A StatefulSet
AnswerD

StatefulSets provide stable, unique network identities and persistent storage for each Pod. Pods are created with ordinal names and a headless Service gives them stable DNS names. PersistentVolumeClaims are retained across rescheduling. This exactly matches the requirement for stable identity and per-Pod storage, making it the correct choice.

Why this answer

StatefulSets are designed for stateful applications requiring stable network identifiers and persistent storage. They provide ordinal Pod names, stable DNS via a headless Service, and PersistentVolumeClaims that are retained. Deployments, DaemonSets, and ReplicaSets manage stateless or node-level workloads and do not offer these guarantees.

Exam trap

The trap here is assuming a Deployment with a PersistentVolumeClaim can provide stable per-Pod storage, when it cannot guarantee identity or one-to-one storage.

144
MCQeasy

What is the primary benefit of containers over virtual machines?

A.Containers provide stronger isolation than VMs
B.Containers use more disk space than VMs
C.Containers require a hypervisor to run
D.Containers are more portable and lightweight because they share the host OS kernel
AnswerD

Containers share the host OS kernel, so each container packages only the application and its dependencies rather than a full guest OS. This shared-kernel architecture makes them smaller and faster to start, and lets the same image run unchanged across environments, unlike hypervisor-based virtual machines.

Why this answer

Containers are more portable and lightweight than virtual machines because they share the host OS kernel, eliminating the need for a separate guest OS per instance. This shared kernel approach reduces resource overhead (CPU, memory, and disk) and enables faster startup times, as containers only package the application and its dependencies without duplicating the operating system.

Exam trap

The trap here is that candidates often confuse isolation strength with portability, assuming containers are more secure because they are lightweight, but for the CNCF KCNA exam, it's important to understand that VMs provide stronger isolation due to separate kernels and hypervisor-level boundaries, whereas containers are more portable and lightweight.

How to eliminate wrong answers

Option A is wrong because containers provide weaker isolation than VMs; VMs use a hypervisor to run separate guest OS kernels, offering stronger security boundaries, whereas containers rely on kernel namespaces and cgroups, which share the host kernel. Option B is wrong because containers use less disk space than VMs, as they do not include a full guest OS image and leverage layered filesystems (e.g., overlay2) to share common layers. Option C is wrong because containers do not require a hypervisor; they run directly on the host OS using container runtime engines like containerd or Docker, whereas VMs require a hypervisor (Type 1 or Type 2) to virtualize hardware.

145
Multi-Selectmedium

Which TWO of the following are valid container runtimes that implement the CRI? (Choose two.)

Select 2 answers
A.Kata Containers
B.CRI-O
C.Docker
D.containerd
E.rkt
AnswersB, D

CRI-O is purpose-built to implement the Kubernetes Container Runtime Interface, exposing only the gRPC CRI API rather than a broader runtime surface. This satisfies the stem's requirement for a valid CRI-implementing runtime, letting kubelet manage containers without Docker or containerd shims.

Why this answer

CRI-O (option B) is a lightweight container runtime purpose-built by Red Hat specifically to implement the Kubernetes Container Runtime Interface (CRI), so it directly satisfies the requirement. containerd (option D) also natively implements the CRI plugin, which is why Kubernetes can use it as a container runtime without any additional shim. Kata Containers (option A) is a runtime that provides VM-isolated containers but is typically plugged in via a CRI implementation such as containerd's CRI plugin or CRI-O, not as a standalone CRI runtime itself. Docker (option C) predates the CRI and does not implement it natively; it required the deprecated dockershim adapter to work with Kubernetes. rkt (option E) was an alternative container runtime that never implemented the CRI and has since been discontinued.

Exam trap

CNCF often tests the misconception that Docker is a CRI-compliant runtime because it was historically the default container runtime in Kubernetes, but candidates must remember that Docker uses its own API and was only supported via the now-removed dockershim, making containerd and CRI-O the only correct CRI implementations among the options.

146
MCQeasy

Which component is responsible for managing the lifecycle of containers on a Kubernetes node?

A.kube-scheduler
B.kube-controller-manager
C.kube-apiserver
D.kubelet
AnswerD

The kubelet is the node agent that registers the node with the control plane and manages each pod's lifecycle, ensuring containers described in PodSpecs are running and healthy. It satisfies the stem's requirement for the component managing container lifecycle on a node, unlike the scheduler or controller manager.

Why this answer

The kubelet is the primary node agent that runs on each Kubernetes node. It is responsible for ensuring that containers are running in a Pod as expected by interacting with the container runtime (e.g., Docker, containerd) to manage the container lifecycle—starting, stopping, and monitoring containers based on PodSpecs received from the API server.

Exam trap

CNCF often tests the distinction between control-plane components (scheduler, controller-manager, API server) and node-level agents (kubelet), so the trap here is assuming that container lifecycle management is a control-plane function rather than a node-level responsibility.

How to eliminate wrong answers

Option A is wrong because kube-scheduler is responsible for assigning Pods to nodes based on resource availability and constraints, not for managing container lifecycles on a node. Option B is wrong because kube-controller-manager runs controller processes (e.g., ReplicaSet, Deployment controllers) that regulate cluster state, but it does not directly interact with containers on individual nodes. Option C is wrong because kube-apiserver serves as the front-end for the Kubernetes control plane, exposing the Kubernetes API, but it does not manage container lifecycles on nodes; it only provides the interface for kubelet to retrieve Pod specifications.

147
Multi-Selectmedium

Which THREE of the following are characteristics of a microservices architecture? (Select 3)

Select 3 answers
A.Services share the same database schema
B.Loose coupling between services
C.Independent deployment of services
D.All services are packaged in a single monolithic deployment
E.Decomposition of application into small, independent services
AnswersB, C, E

Services communicate via APIs, reducing dependencies.

Why this answer

Microservices architecture emphasizes loose coupling, where each service communicates via well-defined APIs (e.g., REST, gRPC) and does not share internal implementation details. This allows services to evolve independently without affecting others, which is a core principle of the architecture.

Exam trap

CNCF often tests the misconception that microservices share a database or are deployed as a single unit, confusing them with monolithic or service-oriented architectures (SOA) that may share schemas.

148
Multi-Selecthard

A platform team must ensure that a critical StatefulSet named ledger in the finance namespace always has at least two Pods available during voluntary disruptions such as node drains, and that Pods are spread across different nodes. Which two resources or settings should they configure? (Choose two.)

Select 2 answers
A.A ResourceQuota in the finance namespace limiting CPU and memory requests.
B.A PodDisruptionBudget in the finance namespace with minAvailable: 2 and a selector matching the ledger Pods.
C.A NetworkPolicy in the finance namespace that allows ingress only from the ledger Pods.
D.A topologySpreadConstraint on the StatefulSet Pod template with topologyKey kubernetes.io/hostname and whenUnsatisfiable: DoNotSchedule.
E.A PriorityClass assigned to the ledger Pods with a high value.
AnswersB, D

A PodDisruptionBudget constrains voluntary disruptions by requiring that at least the specified number of Pods remain available. With minAvailable: 2 and a selector for the ledger Pods, node drains and other voluntary evictions will be blocked or delayed until two Pods are healthy. This directly satisfies the availability requirement during voluntary disruptions.

Why this answer

A PodDisruptionBudget with minAvailable: 2 protects the StatefulSet during voluntary disruptions by blocking evictions that would drop below two available Pods. A topologySpreadConstraint keyed on kubernetes.io/hostname with DoNotSchedule enforces placement on separate nodes, which supports both resilience and the availability target. NetworkPolicy, ResourceQuota, and PriorityClass address traffic control, resource limits, and scheduling priority rather than the required availability and spread guarantees.

Exam trap

The trap here is treating PriorityClass or ResourceQuota as availability guarantees, when only a PodDisruptionBudget constrains voluntary evictions and a topologySpreadConstraint enforces node spreading.

149
MCQmedium

A team wants to deploy a batch job that runs once to process a large dataset. The job should run to completion and then terminate. Which Kubernetes resource should be used?

A.DaemonSet
B.CronJob
C.Deployment
D.Job
AnswerD

A Job creates pods that run until successful completion, then stops — exactly matching the run-once-then-terminate constraint. A Deployment would restart pods indefinitely to maintain a desired replica count, which is wrong for batch processing.

Why this answer

A Job resource is designed for batch processing tasks that run to completion and then terminate. It creates one or more Pods and ensures they successfully finish their work, making it the correct choice for a one-time data processing job.

Exam trap

CNCF often tests the distinction between long-running workloads (Deployments, DaemonSets) and finite tasks (Jobs), so the trap here is confusing a one-time batch job with a CronJob due to the word 'batch' or assuming a Deployment can handle termination.

How to eliminate wrong answers

Option A is wrong because a DaemonSet ensures a Pod runs on every node (or a subset) for continuous daemon-like services, not for a one-time batch job. Option B is wrong because a CronJob is used for scheduled, recurring tasks, not a single run. Option C is wrong because a Deployment manages long-running, stateless applications with desired replicas and rolling updates, not a terminating batch job.

150
MCQmedium

What is the concept of 'immutable infrastructure' as applied to Kubernetes?

A.Configuration is stored in environment variables only
B.Containers are rebuilt from the same base image every time
C.Infrastructure components are never replaced; they are updated in place
D.Pods are replaced with new versions rather than being modified
AnswerD

Immutable infrastructure means running instances are never patched or reconfigured in place; instead, Pods are destroyed and recreated from an updated image or manifest. This satisfies the scenario's requirement by eliminating configuration drift, since every replacement Pod starts from an identical, version-controlled definition rather than accumulating manual changes.

Why this answer

Immutable infrastructure in Kubernetes means that instead of modifying running Pods or their containers (e.g., patching a binary or updating a config file in place), you replace the entire Pod with a new version. This is enforced by Kubernetes' declarative model: when you update a Deployment's Pod template, the controller creates new Pods with the new image and terminates the old ones. This ensures consistency, repeatability, and eliminates configuration drift, as every change results in a fresh, identical instance from the same image.

Exam trap

CNCF often tests the distinction between 'immutable' (replace) and 'mutable' (update in place), and the trap here is that candidates confuse the concept with build-time practices (like using the same base image) or configuration injection methods, rather than the core runtime behavior of replacing Pods.

How to eliminate wrong answers

Option A is wrong because storing configuration only in environment variables is a specific pattern (e.g., 12-factor app), but it does not define immutability; immutable infrastructure requires replacing the entire unit, not just how config is injected. Option B is wrong because rebuilding containers from the same base image every time describes a build practice (e.g., using Dockerfile layers), but immutability is about the runtime behavior of replacing Pods, not the image build process. Option C is wrong because it describes mutable infrastructure (e.g., SSHing into a server to apply updates), which is the exact opposite of immutability; immutable infrastructure mandates that components are never updated in place—they are destroyed and recreated.

← PreviousPage 2 of 3 · 210 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Container Orchestration questions.