How many Troubleshooting Scenario Questions questions are on this page?

This page has 12 Troubleshooting Scenario Questions scenario questions for the KCNA exam, each with detailed explanations and wrong-answer analysis.

How should I approach KCNA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Kubernetes and Cloud Native Associate KCNA questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Kubernetes and Cloud Native Associate KCNA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

KCNA

exam code

CNCF

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediumdrag order

Full question →

Drag and drop the steps to troubleshoot a Pod stuck in CrashLoopBackOff into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

A
1. Use kubectl describe pod to check events, 2. Use kubectl logs to see application errors, 3. Check resource constraints (CPU/memory limits), 4. Verify image name and command in the pod spec, 5. Fix the issue and redeploy.
This is correct because it follows a logical troubleshooting flow: first gather events and logs to identify the cause, then check resources and configuration, then apply the fix.
B
1. Use kubectl logs to see application errors, 2. Use kubectl describe pod to check events, 3. Verify image name and command in the pod spec, 4. Check resource constraints (CPU/memory limits), 5. Fix the issue and redeploy.
Why wrong: This is incorrect because checking logs before events might miss underlying scheduling or resource issues that the describe command reveals first.
C
1. Check resource constraints (CPU/memory limits), 2. Use kubectl describe pod to check events, 3. Use kubectl logs to see application errors, 4. Verify image name and command in the pod spec, 5. Fix the issue and redeploy.
Why wrong: This is incorrect because starting with resource checks is premature; you need to first understand why the pod is crashing via events and logs.
D
1. Fix the issue and redeploy, 2. Use kubectl describe pod to check events, 3. Use kubectl logs to see application errors, 4. Check resource constraints (CPU/memory limits), 5. Verify image name and command in the pod spec.
Why wrong: This is incorrect because you cannot fix the issue without first diagnosing it; this order attempts to fix without analysis, which is ineffective.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

An application deployment in Kubernetes uses a Deployment object. During a rolling update, the new ReplicaSet fails to become healthy. What is the default behavior of the Deployment controller?

A
It continues the rollout, ignoring the health check failures
Why wrong: The controller respects health checks and will not proceed if new pods are unhealthy.
B
It automatically rolls back to the previous revision
Why wrong: Automatic rollback is not default; it requires a rollout undo command or a specific configuration.
C
It scales down the old ReplicaSet to zero
Why wrong: Scaling down the old ReplicaSet would cause downtime; the controller preserves the old version.
D
It pauses the rollout and keeps the old ReplicaSet running
By default, the Deployment controller will pause the rollout, leaving the old ReplicaSet active.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full DNS explanation →

A developer reports that a Pod cannot reach another Service in the same namespace via its DNS name. The Service name is 'api'. What is the correct DNS query for a Pod to resolve this Service?

A
api.svc.cluster.local
Why wrong: Missing the namespace.
B
api.namespace.svc.cluster.local
Why wrong: This would work if the namespace were known, but the shortest correct answer is 'api'.
C
api
Within the same namespace, the short name works.
D
api.default.svc.cluster.local
Why wrong: The namespace is not 'default' unless it is; the question states the same namespace, so the short name is sufficient.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

A cloud-native application uses a service mesh (Istio) for traffic management. The team notices increased latency in inter-service communication. Which likely cause should be investigated first?

A
Kubernetes Network Policies blocking traffic
Why wrong: Would cause errors, not just latency.
B
Misconfigured sidecar proxy settings
Can cause significant latency.
C
Application code is not optimized for the mesh
Why wrong: Code doesn't change.
D
mTLS encryption overhead
Why wrong: Overhead is minimal.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A user runs 'kubectl exec -it pod1 -- /bin/sh' and gets the error: 'error: unable to upgrade connection: container not found ("app")'. The pod has one container named 'app'. What is the most likely cause?

A
The pod is running on a different node
Why wrong: kubectl exec works across nodes; the location does not prevent connection.
B
The container image does not have /bin/sh
Why wrong: Missing shell would give a different error, typically 'executable file not found'.
C
The container name is misspelled
Why wrong: If the container name is wrong, the error would mention 'container not found' but the user says the container is named 'app'.
D
The pod is in a CrashLoopBackOff state
If the container is crashing repeatedly, it may not be running when exec attempts to connect, resulting in this error.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

A Service of type ClusterIP is created for a Deployment, but Pods in other namespaces cannot reach it. What is the most likely cause?

A
NetworkPolicies are blocking cross-namespace traffic
Why wrong: While possible, the most likely cause is DNS naming.
B
The Pods in other namespaces are using the short Service name without the namespace suffix
Cross-namespace access requires the full DNS name including the namespace.
C
The Service is not publishing the correct port
Why wrong: Port mismatch would cause connection failure, not DNS resolution issues across namespaces.
D
The Service selector does not match the Pod labels
Why wrong: If the selector didn't match, the Service wouldn't work within the namespace either.

Full breakdown with real-world context →

Question 7easymultiple choice

Full question →

A Kubernetes administrator is troubleshooting a pod that is stuck in CrashLoopBackOff. The pod's restart count is increasing. Which initial step should the administrator take to diagnose the issue?

A
Run 'kubectl describe pod <pod-name>' to check events
Why wrong: Events may indicate issues but usually lack application-level error details.
B
Check the Prometheus metrics for the pod's CPU usage
Why wrong: CPU metrics are unlikely to reveal crash causes.
C
Run 'kubectl exec -it <pod-name> -- /bin/sh' to inspect the container
Why wrong: Cannot exec into a crashed pod; it must be running.
D
Run 'kubectl logs <pod-name>' to view the application logs
Logs often contain error messages that explain why the application is crashing.

Full breakdown with real-world context →

Question 8hardmulti select

Full question →

A user reports that a web application is not accessible via its Service. The Service is of type ClusterIP. Which TWO steps should be taken to troubleshoot?

A
Verify that the kube-proxy is running on the node
kube-proxy is responsible for implementing the Service abstraction via iptables or IPVS.
B
Check that the container runtime is working
Why wrong: Container runtime issues affect Pods, but the Service connectivity problem is likely at the network layer.
C
Check the kube-apiserver status
Why wrong: The API server is for managing the cluster state, not for forwarding traffic to Services.
D
Check if the Service has any endpoints using 'kubectl get endpoints'
Endpoints show the Pods that the Service routes to.
E
Restart all nodes in the cluster
Why wrong: This is a drastic measure and not an appropriate first troubleshooting step.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

A microservice logs errors when connecting to the database. The logs show 'connection refused'. Which troubleshooting step should be taken first?

A
Verify the database Service and Endpoints in Kubernetes
Directly checks if the database service is available.
B
Scale up the microservice deployment
Why wrong: Does not address connectivity.
C
Restart the microservice pod
Why wrong: May not fix underlying connectivity issue.
D
Check the logs of other microservices
Why wrong: Indirect and may waste time.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full DNS explanation →

A Service of type ClusterIP has been created, but pods in the same namespace cannot reach it by its DNS name. The Service selector matches the pods. What is a likely cause?

A
The Service YAML does not specify a port
Why wrong: If no port is specified, the Service would not work, but the question implies it is created. Additionally, DNS resolution works regardless of port.
B
The kube-dns or CoreDNS pod is not running
DNS resolution is provided by CoreDNS; if it is down, DNS names cannot be resolved.
C
The Service is not exposed on a node port
Why wrong: NodePort is for external access; internal DNS does not depend on it.
D
The pods are using an incorrect container runtime
Why wrong: Container runtime does not affect DNS resolution.

Full breakdown with real-world context →

Question 11mediummultiple choice

Full question →

A team uses a Deployment with 3 replicas and a RollingUpdate strategy. They update the container image. During the update, one of the new pods fails to start. What will happen by default?

A
The update pauses, keeping the remaining old replicas running
The rolling update stops when a new pod fails, ensuring availability of old pods.
B
The entire update is rolled back and all old pods are deleted
Why wrong: This would cause disruption, which the controller avoids.
C
The Deployment automatically rolls back to the previous image
Why wrong: Automatic rollback is not default; manual intervention or a rollout undo command is needed.
D
The failed pod is terminated and not retried
Why wrong: The controller retries the pod creation until it succeeds or the update is paused.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

A user reports that they cannot connect to a database service named 'db-service' from another pod in the same namespace. The service selector matches the database pod's labels. Which command would you run FIRST to troubleshoot the service's endpoints?

A
kubectl describe pod db-service
Why wrong: There is no pod named 'db-service' likely; the pod has a different name.
B
kubectl get endpoints db-service
Endpoints show the IP addresses of pods selected by the service. If empty, the selector is mismatched.
C
kubectl exec -it <some-pod> -- curl db-service
Why wrong: While this tests connectivity, first verify endpoints exist.
D
kubectl logs db-service
Why wrong: You cannot log a service; logs are for pods.

Full breakdown with real-world context →

These KCNA practice questions are part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style KCNA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related KCNA topic practice pages

Kubernetes Fundamentals practice questions

Container Orchestration practice questions

Cloud Native Architecture practice questions

Cloud Native Observability practice questions

Cloud Native Application Delivery practice questions

KCNA fundamentals practice questions

KCNA scenario practice questions

KCNA troubleshooting practice questions

Practice scenarios

Drag and drop the steps to troubleshoot a Pod stuck in CrashLoopBackOff into the correct order.

An application deployment in Kubernetes uses a Deployment object. During a rolling update, the new ReplicaSet fails to become healthy. What is the default behavior of the Deployment controller?

A developer reports that a Pod cannot reach another Service in the same namespace via its DNS name. The Service name is 'api'. What is the correct DNS query for a Pod to resolve this Service?

A cloud-native application uses a service mesh (Istio) for traffic management. The team notices increased latency in inter-service communication. Which likely cause should be investigated first?

A user runs 'kubectl exec -it pod1 -- /bin/sh' and gets the error: 'error: unable to upgrade connection: container not found ("app")'. The pod has one container named 'app'. What is the most likely cause?

A Service of type ClusterIP is created for a Deployment, but Pods in other namespaces cannot reach it. What is the most likely cause?

A Kubernetes administrator is troubleshooting a pod that is stuck in CrashLoopBackOff. The pod's restart count is increasing. Which initial step should the administrator take to diagnose the issue?

A user reports that a web application is not accessible via its Service. The Service is of type ClusterIP. Which TWO steps should be taken to troubleshoot?

A microservice logs errors when connecting to the database. The logs show 'connection refused'. Which troubleshooting step should be taken first?

A Service of type ClusterIP has been created, but pods in the same namespace cannot reach it by its DNS name. The Service selector matches the pods. What is a likely cause?

A team uses a Deployment with 3 replicas and a RollingUpdate strategy. They update the container image. During the update, one of the new pods fails to start. What will happen by default?

A user reports that they cannot connect to a database service named 'db-service' from another pod in the same namespace. The service selector matches the database pod's labels. Which command would you run FIRST to troubleshoot the service's endpoints?