How many Troubleshooting Scenario Questions questions are on this page?

This page has 10 Troubleshooting Scenario Questions scenario questions for the KCNA exam, each with detailed explanations and wrong-answer analysis.

How should I approach KCNA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Kubernetes and Cloud Native Associate KCNA questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Kubernetes and Cloud Native Associate KCNA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

KCNA

exam code

CNCF

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

A Service of type ClusterIP is created for a Deployment, but Pods in other namespaces cannot reach it. What is the most likely cause?

A
NetworkPolicies are blocking cross-namespace traffic
Why wrong: While possible, the most likely cause is DNS naming.
B
The Pods in other namespaces are using the short Service name without the namespace suffix
Cross-namespace access requires the full DNS name including the namespace.
C
The Service is not publishing the correct port
Why wrong: Port mismatch would cause connection failure, not DNS resolution issues across namespaces.
D
The Service selector does not match the Pod labels
Why wrong: If the selector didn't match, the Service wouldn't work within the namespace either.

Full breakdown with real-world context →

Question 2hardmulti select

Full question →

A user reports that a web application is not accessible via its Service. The Service is of type ClusterIP. Which TWO steps should be taken to troubleshoot?

A
Verify that the kube-proxy is running on the node
kube-proxy is responsible for implementing the Service abstraction via iptables or IPVS.
B
Check that the container runtime is working
Why wrong: Container runtime issues affect Pods, but the Service connectivity problem is likely at the network layer.
C
Check the kube-apiserver status
Why wrong: The API server is for managing the cluster state, not for forwarding traffic to Services.
D
Check if the Service has any endpoints using 'kubectl get endpoints'
Endpoints show the Pods that the Service routes to.
E
Restart all nodes in the cluster
Why wrong: This is a drastic measure and not an appropriate first troubleshooting step.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

A user reports that they cannot connect to a database service named 'db-service' from another pod in the same namespace. The service selector matches the database pod's labels. Which command would you run FIRST to troubleshoot the service's endpoints?

A
kubectl describe pod db-service
Why wrong: There is no pod named 'db-service' likely; the pod has a different name.
B
kubectl get endpoints db-service
Endpoints show the IP addresses of pods selected by the service. If empty, the selector is mismatched.
C
kubectl exec -it <some-pod> -- curl db-service
Why wrong: While this tests connectivity, first verify endpoints exist.
D
kubectl logs db-service
Why wrong: You cannot log a service; logs are for pods.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

You are troubleshooting a service that is not accessible from within the cluster. The service has a label selector that matches the pods. You run 'kubectl get endpoints myservice' and see that the ENDPOINTS column is empty. What is the most likely cause?

A
The kube-proxy is not running
Why wrong: kube-proxy manages network rules, but endpoints are managed by the endpoint controller.
B
The service's label selector does not match any pods
Endpoints are created for pods matching the selector; if none match, endpoints are empty.
C
The service is in a different namespace
Why wrong: Service endpoints are namespace-scoped, but empty endpoints within the same namespace indicate no matching pods.
D
The service type is LoadBalancer and no external load balancer is provisioned
Why wrong: Even for LoadBalancer type, endpoints should still show internal pod IPs.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A pod in the 'default' namespace cannot reach a pod in the 'backend' namespace by service name 'db-service'. Both namespaces exist and the service is running. What is the most likely cause?

A
The pod does not have network policy allowing cross-namespace traffic
Why wrong: NetworkPolicy can restrict traffic, but by default all pods can communicate across namespaces.
B
The service is not exposed on a port
Why wrong: If the service were not exposed, no connection would be possible even within the namespace.
C
The kube-proxy is not running
Why wrong: kube-proxy is needed for service networking, but if it were down, no services would work.
D
The pod is using the wrong service name format for cross-namespace access
The correct format is 'db-service.backend.svc.cluster.local'.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

A service of type ClusterIP is created but pods cannot reach it using the service name. The pods are in the same namespace. What is a likely cause?

A
The service is not exposed externally
Why wrong: ClusterIP is internal; that doesn't cause DNS failure.
B
CoreDNS is not running or misconfigured
DNS resolution for service names relies on CoreDNS; if it's down, names won't resolve.
C
The service port does not match the container port
Why wrong: Port mismatch would cause connection refused, not DNS resolution failure.
D
The selector does not match any pod labels
Why wrong: If the selector doesn't match, the service would have no endpoints, but DNS would still resolve.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full DNS explanation →

A Service of type ClusterIP has been created, but pods in the same namespace cannot reach it by its DNS name. The Service selector matches the pods. What is a likely cause?

A
The Service YAML does not specify a port
Why wrong: If no port is specified, the Service would not work, but the question implies it is created. Additionally, DNS resolution works regardless of port.
B
The kube-dns or CoreDNS pod is not running
DNS resolution is provided by CoreDNS; if it is down, DNS names cannot be resolved.
C
The Service is not exposed on a node port
Why wrong: NodePort is for external access; internal DNS does not depend on it.
D
The pods are using an incorrect container runtime
Why wrong: Container runtime does not affect DNS resolution.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

A user runs 'kubectl exec -it pod1 -- /bin/sh' and gets the error: 'error: unable to upgrade connection: container not found ("app")'. The pod has one container named 'app'. What is the most likely cause?

A
The pod is running on a different node
Why wrong: kubectl exec works across nodes; the location does not prevent connection.
B
The container image does not have /bin/sh
Why wrong: Missing shell would give a different error, typically 'executable file not found'.
C
The container name is misspelled
Why wrong: If the container name is wrong, the error would mention 'container not found' but the user says the container is named 'app'.
D
The pod is in a CrashLoopBackOff state
If the container is crashing repeatedly, it may not be running when exec attempts to connect, resulting in this error.

Full breakdown with real-world context →

Question 9hardmultiple choice

Full question →

A developer creates a Deployment with 3 replicas. After updating the pod template, they run 'kubectl rollout status deployment/my-deployment' and see that the rollout is stuck. Which command should they use to investigate the rollout history?

A
kubectl get events
Why wrong: Events show cluster events but not structured rollout history.
B
kubectl describe deployment my-deployment
Why wrong: Describe shows current state but not rollout history.
C
kubectl rollout history deployment/my-deployment
This command displays the rollout history, including revisions and cause of updates.
D
kubectl logs deployment/my-deployment
Why wrong: Logs are for pods, not for deployment rollout history.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

A user runs 'kubectl exec -it pod1 -- /bin/sh' and gets an error: 'error: unable to upgrade connection: container not found'. The pod is running and has one container named 'app'. What is the most likely issue?

A
The pod is not running
Why wrong: The stem states the pod is running.
B
The container does not have a shell binary
Why wrong: If no shell, the error would be 'executable file not found'.
C
The user does not have permission to exec into pods
Why wrong: Permission error would be 'Forbidden', not 'container not found'.
D
The container name was not specified and the pod has multiple containers
When multiple containers exist, you must specify '-c' flag; otherwise, kubectl may fail to find the container.

Full breakdown with real-world context →

These KCNA practice questions are part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style KCNA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related KCNA topic practice pages

Kubernetes Fundamentals practice questions

Container Orchestration practice questions

Cloud Native Architecture practice questions

Cloud Native Observability practice questions

Cloud Native Application Delivery practice questions

KCNA fundamentals practice questions

KCNA scenario practice questions

KCNA troubleshooting practice questions

Practice scenarios

A Service of type ClusterIP is created for a Deployment, but Pods in other namespaces cannot reach it. What is the most likely cause?

A user reports that a web application is not accessible via its Service. The Service is of type ClusterIP. Which TWO steps should be taken to troubleshoot?

A user reports that they cannot connect to a database service named 'db-service' from another pod in the same namespace. The service selector matches the database pod's labels. Which command would you run FIRST to troubleshoot the service's endpoints?

You are troubleshooting a service that is not accessible from within the cluster. The service has a label selector that matches the pods. You run 'kubectl get endpoints myservice' and see that the ENDPOINTS column is empty. What is the most likely cause?

A pod in the 'default' namespace cannot reach a pod in the 'backend' namespace by service name 'db-service'. Both namespaces exist and the service is running. What is the most likely cause?

A service of type ClusterIP is created but pods cannot reach it using the service name. The pods are in the same namespace. What is a likely cause?

A Service of type ClusterIP has been created, but pods in the same namespace cannot reach it by its DNS name. The Service selector matches the pods. What is a likely cause?

A user runs 'kubectl exec -it pod1 -- /bin/sh' and gets the error: 'error: unable to upgrade connection: container not found ("app")'. The pod has one container named 'app'. What is the most likely cause?

A developer creates a Deployment with 3 replicas. After updating the pod template, they run 'kubectl rollout status deployment/my-deployment' and see that the rollout is stuck. Which command should they use to investigate the rollout history?

A user runs 'kubectl exec -it pod1 -- /bin/sh' and gets an error: 'error: unable to upgrade connection: container not found'. The pod is running and has one container named 'app'. What is the most likely issue?