Kubernetes and Cloud Native Associate

Question 1

During a security review, your team is documenting the '4Cs of Cloud Native Security' model to prioritize where controls should be applied. A colleague argues that if the outermost layer is poorly secured, weaknesses there can undermine all the layers built on top of it. Which layer of the 4Cs model is the outermost, foundational layer that the other three depend on?

Accepted Answer

Cloud (the underlying infrastructure such as the provider, network, and physical hosts)

Answer

Cluster (the Kubernetes control plane and worker node configuration)

Answer

Container (the image contents and runtime settings)

Answer

Code (the application logic and its dependencies)

Question 2

A developer notices that when the control plane component responsible for exposing the cluster's REST interface is temporarily unavailable, kubectl commands fail and no new Pods can be created, but existing Pods keep running normally. Which control plane component are they describing?

Accepted Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

etcd

Question 3

Your team manages a production application with Argo CD. The Application resource has both automated sync and self-heal enabled. An on-call engineer, responding to an incident, manually runs 'kubectl scale deployment web --replicas=8' to handle a traffic spike. The Git manifest still declares 3 replicas. What will Argo CD do?

Accepted Answer

Detect the drift and revert the deployment back to 3 replicas to match the Git manifest

Answer

Update the Git repository to reflect the new value of 8 replicas

Answer

Leave the deployment at 8 replicas and mark the Application as OutOfSync without changing anything

Answer

Scale the deployment to the average of 3 and 8 replicas

Question 4

Your team uses Argo CD to deploy a microservices application. The application requires that a database migration Job completes successfully before the API Deployment starts, and a namespace-level ConfigMap must exist before either. All resources live in the same Git repository under one Application. What is the recommended Argo CD mechanism to control the order in which these resources are applied during a sync?

Accepted Answer

Add sync-wave annotations to the resources so Argo CD applies them in ascending wave order

Answer

Split each resource into separate Applications and manually sync them one at a time in the UI

Answer

Set the Application's syncPolicy to automated with prune enabled to force sequential ordering

Answer

Rely on Kubernetes to automatically detect resource dependencies and apply them in the correct order

Question 5

A team runs a stateless web API whose traffic spikes unpredictably during marketing campaigns. Each pod is already sized correctly for a single request stream, but the application cannot benefit from more CPU or memory per instance because it is single-threaded. The team wants the application to handle sudden bursts of concurrent users automatically. Which autoscaling approach best fits this situation?

Accepted Answer

Horizontal scaling — add more pod replicas as load increases

Answer

Vertical scaling — increase the CPU and memory allocated to each existing pod

Answer

Cluster scaling only — add more nodes without changing the workload

Answer

Manual scaling — have an operator adjust replicas before each campaign

Question 6

A team is designing a CI/CD pipeline for a cloud-native application on Kubernetes. Developers push code to a Git repository, and the pipeline must produce an artifact that the cluster can run. In which stage of a typical cloud-native CI/CD flow is the container image built and pushed to a registry?

Accepted Answer

During the continuous integration (CI) stage, after code is committed and tests pass, so the image is available for later deployment

Answer

During the continuous deployment (CD) stage, immediately before the kubelet schedules the Pod onto a node

Answer

By the Kubernetes scheduler at runtime, which compiles source code into an image when a Pod is created

Answer

By the container runtime on each node the first time a Pod referencing the image starts

Question 7

A small team manually starts and stops containers across a fleet of five servers. As traffic grows, they struggle to keep applications running when a server crashes, to distribute load evenly, and to roll out new versions without downtime. They are evaluating whether to adopt a container orchestrator like Kubernetes. Which capability best explains why orchestration would solve their core problem?

Accepted Answer

It automatically maintains the desired number of running application instances, reschedules them when nodes fail, and manages placement and updates across the fleet

Answer

It replaces the container runtime so that containers no longer need an image to start

Answer

It compiles application source code into container images during deployment

Answer

It removes the need for networking between servers by running all containers on a single host

Question 8

A platform engineer is validating whether a newly built Kubernetes cluster conforms to the Kubernetes networking model. They want to confirm the fundamental rule that any CNI implementation must satisfy for the cluster to be considered compliant. Which statement correctly describes a core requirement of the Kubernetes networking model?

Accepted Answer

Every Pod must be reachable by every other Pod across all nodes without using NAT, and each Pod sees the same IP that others use to reach it.

Answer

Pods on different nodes must communicate exclusively through a NodePort Service to reach each other.

Answer

Each node must run kube-proxy in IPVS mode so that Pod-to-Pod traffic is address-translated between nodes.

Answer

Pod IP addresses must be assigned by the API server from a single shared range so that all Pods on a node share one IP.

Question 9

A platform engineer creates a ClusterRole named 'log-reader' that allows getting and listing pods in all namespaces. They then create a RoleBinding in the 'team-a' namespace that references the 'log-reader' ClusterRole and binds it to the user 'dev-alice'. After this, dev-alice reports she can read pods in 'team-a' but gets 'Forbidden' errors when reading pods in the 'team-b' namespace. What best explains this behavior?

Accepted Answer

A RoleBinding grants the permissions in the referenced ClusterRole only within the namespace where the RoleBinding exists, so access is limited to 'team-a'.

Answer

ClusterRoles cannot be referenced by RoleBindings, so the binding is silently ignored and dev-alice has no permissions at all.

Answer

The ClusterRole must include an explicit namespace field listing 'team-b' before its rules apply there.

Answer

RoleBindings automatically propagate to all namespaces, so the Forbidden error indicates a misconfigured API server.

Question 10

A backend team runs three Pods created by a Deployment. Frontend Pods in the same cluster need to reach the backend reliably, but the backend Pods are frequently rescheduled, so their IP addresses keep changing. The team does not want to expose the backend outside the cluster. Which approach provides a stable internal address for the frontend to use?

Accepted Answer

Create a ClusterIP Service that selects the backend Pods, and have the frontend connect to the Service name

Answer

Configure the frontend to connect directly to each backend Pod IP listed in the Deployment status

Answer

Create a NodePort Service so the frontend can reach the backend through the node's external port

Answer

Hard-code the backend ReplicaSet name in the frontend configuration so it always resolves the Pods

Question 11

A large retail company runs Kubernetes in production but does not sell cloud native software. Their platform team wants to influence CNCF project roadmaps, share real-world adoption experiences, and get guidance on evaluating projects — without becoming maintainers of any project. Which CNCF community group is designed specifically for organizations in this position?

Accepted Answer

The CNCF End User Community (including the End User Technical Advisory Board)

Answer

The Technical Oversight Committee (TOC)

Answer

The Governing Board

Answer

A project's set of maintainers and approvers

Question 12

A startup has built an open-source tool that automates cloud native cost analysis. The team wants to donate the project to the CNCF to increase its visibility, gain neutral governance, and grow a broader contributor community. They are unsure which entry point in the CNCF process is appropriate for a brand-new, early-stage project seeking initial acceptance into the foundation. Which CNCF maturity level should they target for their initial project submission?

Accepted Answer

Sandbox, the entry point intended for early-stage, innovative projects seeking a neutral home

Answer

Incubating, which requires demonstrated production adoption by multiple organizations

Answer

Graduated, which signals a mature, widely adopted project with sustained governance

Answer

Archived, which preserves projects that are no longer actively maintained

Question 13

A platform team at your company is selecting an open source service mesh to adopt for a mission-critical production environment. Leadership requires that the chosen CNCF project demonstrates proven adoption, a healthy contributor community, and strong governance before it is trusted for production. Which CNCF project maturity level best signals that a project meets these criteria?

Accepted Answer

Graduated

Answer

Sandbox

Answer

Incubating

Answer

Archived

Question 14

A platform team at your company is evaluating a new open-source tool they found in the CNCF landscape. They notice it was recently accepted into the CNCF at the earliest maturity level, has a small number of contributors, and is intended primarily for early adopters and experimentation rather than production-critical workloads. Which CNCF project maturity level best matches this description?

Accepted Answer

Sandbox

Answer

Incubating

Answer

Graduated

Answer

Archived

Question 15

A cloud native platform team wants to contribute domain-specific expertise (such as storage or observability) to help review projects and produce best-practice guidance under the CNCF's technical governance structure. Which body within the CNCF is organized around specific technical domains to provide this kind of focused guidance and support to the Technical Oversight Committee?

Accepted Answer

Special Interest Groups (SIGs)

Answer

The Governing Board

Answer

The End User Community

Answer

The Cloud Native Landscape working group

Question 16

A company wants to contribute an internal project to the CNCF and is researching how the foundation is governed. They want to understand which body is responsible for defining the technical vision, reviewing and approving new projects into the CNCF, and overseeing project maturity progression. Which group performs this role?

Accepted Answer

The Technical Oversight Committee (TOC)

Answer

The Governing Board (GB)

Answer

The individual project maintainers

Answer

The End User Community

Question 17

You are bringing up a brand-new Kubernetes cluster. The control plane is healthy and worker nodes show status Ready. However, every application Pod you create remains stuck in the ContainerCreating state, and 'kubectl describe pod' shows an event referencing 'failed to set up sandbox: networkPlugin cni failed to set up pod ... no CNI configuration found'. What is the most likely cause?

Accepted Answer

No Container Network Interface (CNI) plugin has been installed, so the kubelet cannot configure pod networking.

Answer

A default-deny NetworkPolicy is blocking all traffic to the new Pods.

Answer

The Service selector does not match the Pod labels, preventing traffic routing.

Answer

The PersistentVolumeClaim for the Pods cannot be bound to a PersistentVolume.

Question 18

A platform engineer is documenting how the Kubernetes networking model works for a new team. They want to explain which piece of the stack is responsible for assigning each Pod an IP address and enabling Pods on different nodes to reach one another directly, without NAT between them. Which component fulfills this responsibility?

Accepted Answer

The Container Network Interface (CNI) plugin installed in the cluster

Answer

The kubelet, which allocates Pod IPs from the API server

Answer

The Service resource, which provides each Pod its routable IP

Answer

The container runtime, which builds the overlay network via CRI

Question 19

A team packages a web server whose configuration must be provided as a file at /etc/app/config.yaml inside the container. The configuration content is stored in a ConfigMap named app-config under the key config.yaml. Which approach correctly delivers this file into the Pod?

Accepted Answer

Mount the ConfigMap as a volume and mount that volume at /etc/app, so the key config.yaml appears as a file

Answer

Reference the ConfigMap key with envFrom so it becomes an environment variable the app reads on startup

Answer

Use a Secret instead, since only Secrets can be mounted as files inside a container

Answer

Add the ConfigMap name to the Pod's spec.imagePullSecrets so the kubelet injects the file at build time

Question 20

A developer wants to store the entire contents of a 3 MB application configuration file inside a single ConfigMap and mount it into their Pods. When they try to create the ConfigMap, the API server rejects it. What is the most likely reason for the rejection?

Accepted Answer

A ConfigMap's total data cannot exceed roughly 1 MiB because of the underlying etcd object size limit.

Answer

ConfigMaps can only store key-value pairs, not the contents of files.

Answer

ConfigMaps must be created in the kube-system namespace to hold large files.

Answer

The file must be base64-encoded before it can be stored in any ConfigMap.

Question 21

A developer stores an application's configuration in a ConfigMap and mounts it into a Pod as environment variables using the envFrom field. After updating a value in the ConfigMap with kubectl edit, they notice the running Pod still uses the old configuration value. What is the most likely reason?

Accepted Answer

Environment variables injected from a ConfigMap are set only at container startup and are not updated in a running container.

Answer

The ConfigMap change was saved to etcd but never propagated to the API server, so the Pod cannot see it.

Answer

ConfigMaps are immutable by default, so the kubectl edit command silently failed to apply the change.

Answer

The Pod must be labeled with configmap-reload=true for environment variables to refresh automatically.

Question 22

A developer complains that two containers in the same Pod cannot reach each other over 'localhost' as they expected, but claims each container should have its own IP. As the platform engineer, how do you correctly explain the Kubernetes networking model for containers within a single Pod?

Accepted Answer

All containers in a Pod share a single network namespace and IP address, so they communicate with each other over localhost using different ports.

Answer

Each container in a Pod receives its own unique IP address, and they must communicate using the Pod's Service DNS name.

Answer

Containers in a Pod are network-isolated by default and require a NetworkPolicy to allow localhost traffic between them.

Answer

Containers in a Pod communicate only through a shared emptyDir volume, since intra-Pod network traffic is disabled.

Question 23

A small team currently runs containers directly on individual VMs using shell scripts. When a container crashes at night, it stays down until someone manually restarts it, causing outages. They are evaluating whether adopting a container orchestrator like Kubernetes would help. Which core orchestration capability most directly addresses their problem of crashed containers staying down?

Accepted Answer

Self-healing, where the orchestrator continuously reconciles actual state to the desired state and automatically recreates failed containers

Answer

Immutable container images built from an OCI-compliant registry that prevent containers from crashing

Answer

A service mesh that injects sidecars to encrypt traffic between the containers

Answer

Persistent volumes that retain container data across restarts so no data is lost

Question 24

A platform engineer is building a new Kubernetes cluster and wants to run containers using containerd instead of a different runtime. They need to understand how the kubelet on each node actually launches and manages containers. Through which standardized interface does the kubelet communicate with the container runtime?

Accepted Answer

The Container Runtime Interface (CRI), a gRPC API the kubelet uses to instruct the runtime to pull images and manage container lifecycles

Answer

The Container Network Interface (CNI), which the kubelet calls directly to start and stop containers

Answer

The Kubernetes API server, which forwards container start commands from the kubelet to containerd

Answer

The Open Container Initiative (OCI) runtime spec, which the kubelet invokes as a REST endpoint on each node

Question 25

A platform team maintains a Kubernetes cluster and wants the freedom to switch between different container runtimes (for example, from one runtime to another) without modifying the kubelet or rebuilding the control plane. Which design element of Kubernetes makes this runtime interchangeability possible?

Accepted Answer

The Container Runtime Interface (CRI), a standardized gRPC API the kubelet uses to communicate with any conforming runtime

Answer

The Container Network Interface (CNI), which standardizes how runtimes attach pods to the network

Answer

The Container Storage Interface (CSI), which lets the kubelet mount volumes from any runtime

Answer

The Open Container Initiative (OCI) image manifest, which the kubelet reads directly to start containers

Question 26

A security review of your team's Kubernetes workloads finds that several containers run as the root user (UID 0) inside their images. Your security lead asks you to reduce the risk that a compromised container could escalate privileges on the host. Which change to the Pod specification most directly addresses this concern as a container security basic?

Accepted Answer

Set securityContext.runAsNonRoot to true (and specify a non-zero runAsUser) so the container is prevented from running as root

Answer

Add a NetworkPolicy that denies all ingress traffic to the affected Pods

Answer

Increase the container's CPU and memory limits to constrain resource abuse

Answer

Change the Service type from LoadBalancer to ClusterIP to reduce external exposure

Question 27

A platform engineer deletes one Pod that was created by a Deployment. Almost immediately, a new Pod appears to replace it. Which control plane component is responsible for continuously comparing the actual cluster state to the desired state and driving the creation of that replacement Pod?

Accepted Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kubelet

Answer

kube-proxy

Question 28

A platform team is designing a cluster and wants to understand the layered responsibility for actually starting containers on a node. The kubelet does not run containers itself. Which statement correctly describes how the kubelet gets a container running on a node?

Accepted Answer

The kubelet talks to a container runtime over the Container Runtime Interface (CRI), and that runtime pulls the image and starts the container process.

Answer

The kubelet calls the container runtime directly over the Container Network Interface (CNI) to launch each container.

Answer

The kube-scheduler starts the container after binding the Pod to the node, bypassing the kubelet entirely.

Answer

The kubelet writes the Pod spec into etcd, and etcd instructs the runtime to launch the container.

Question 29

Your platform team is evaluating whether to replace the container runtime on your Kubernetes nodes from containerd to CRI-O. A colleague worries this will require rewriting the kubelet or changing how pods are defined. What is the primary benefit that the Container Runtime Interface (CRI) provides in this situation?

Accepted Answer

CRI is a standardized gRPC API that lets the kubelet work with any conformant runtime, so containerd can be swapped for CRI-O without changing the kubelet or pod specs

Answer

CRI automatically converts container images from one runtime's proprietary format to another during the migration

Answer

CRI is a networking specification that guarantees pod-to-pod connectivity remains intact regardless of the runtime chosen

Answer

CRI stores pod definitions in etcd so the runtime can be changed by editing the cluster datastore directly

Question 30

Your team is upgrading a Kubernetes cluster and notices in the release notes that the built-in Docker integration (dockershim) has been removed. The nodes currently use Docker as the container runtime. What is the primary reason Kubernetes was able to remove this integration without breaking support for existing OCI container images?

Accepted Answer

The kubelet communicates with runtimes through the Container Runtime Interface (CRI), so any CRI-compliant runtime like containerd or CRI-O can replace Docker while still running the same OCI images.

Answer

OCI images can only be executed by Docker, so the cluster must convert all images to a Kubernetes-native format before the upgrade.

Answer

Kubernetes now runs containers directly in the kubelet process, eliminating the need for any external container runtime.

Answer

The Container Network Interface (CNI) replaced the container runtime, taking over both networking and container execution responsibilities.

Question 31

A platform team wants their cloud provider to release new storage features (like custom volume provisioning) without waiting for the storage logic to be merged into the main Kubernetes source code and shipped in a Kubernetes release. Which design goal of the Container Storage Interface (CSI) directly addresses this requirement?

Accepted Answer

CSI standardizes how storage vendors integrate with Kubernetes so drivers can be developed and released independently of the Kubernetes release cycle

Answer

CSI encrypts all data written to persistent volumes automatically at the block-device level

Answer

CSI replaces the need for PersistentVolumeClaims by letting pods reference storage backends directly

Answer

CSI guarantees ReadWriteMany access for every volume type regardless of the underlying storage system

Question 32

A platform team wants to attach volumes from a new commercial storage vendor to their Kubernetes pods. The vendor ships a plugin that integrates with Kubernetes without requiring changes to the core Kubernetes source code or recompiling the kubelet. Which Kubernetes mechanism makes this vendor-provided storage integration possible?

Accepted Answer

The Container Storage Interface (CSI), a standard API that lets third-party vendors expose storage systems to Kubernetes via out-of-tree drivers

Answer

The Container Network Interface (CNI), which vendors implement to provision persistent volumes

Answer

The emptyDir volume type, which mounts vendor storage automatically at pod startup

Answer

The Container Runtime Interface (CRI), which the kubelet uses to attach external block storage

Question 33

A team runs a PostgreSQL database on Kubernetes using a PersistentVolumeClaim backed by a CSI driver that supports the snapshot feature. Before applying a risky schema migration, they want to capture a point-in-time copy of the database volume so they can quickly restore it if the migration fails. Which Kubernetes resource should they create to accomplish this?

Accepted Answer

A VolumeSnapshot object referencing the existing PVC

Answer

An emptyDir volume mounted alongside the database container

Answer

A second PersistentVolumeClaim with a larger storage request

Answer

A ConfigMap containing the current database configuration

Question 34

Your operations team needs to deploy a log-collection agent that must run exactly one instance on every worker node in the cluster, including any nodes added later through autoscaling. Which Kubernetes workload resource is designed to satisfy this requirement automatically?

Accepted Answer

A DaemonSet, which ensures a copy of the Pod runs on each matching node

Answer

A Deployment with the replica count set equal to the current number of nodes

Answer

A ReplicaSet with a nodeSelector targeting all worker nodes

Answer

A StatefulSet, which gives each node a stable, ordered Pod identity

Question 35

A developer runs `kubectl get pods` and sees only 3 Pods, but a colleague insists the cluster is running dozens of Pods across several teams' applications. What is the most likely reason the developer sees only 3 Pods?

Accepted Answer

kubectl only lists Pods in the current namespace (default), so Pods in other namespaces are not shown unless --all-namespaces or -n is used

Answer

kubectl caps output at the 3 most recently created Pods unless a higher limit is set

Answer

The other Pods are managed by Deployments, and kubectl get pods only shows standalone Pods

Answer

The developer lacks a valid kubeconfig context, so only local Pods appear

Question 36

You run a web application as a Deployment with 3 replicas spread across a 3-node cluster. One worker node suddenly goes offline due to a hardware failure. After a few minutes, you notice the application is still serving traffic normally at full capacity. Which Kubernetes behavior best explains why the desired number of Pods was restored?

Accepted Answer

The Deployment's ReplicaSet controller observed fewer Ready Pods than desired and created replacement Pods, which the scheduler placed on the remaining healthy nodes.

Answer

The kube-scheduler detected the failure and directly restarted the missing Pods on the failed node once it recovered.

Answer

The kubelet on the failed node reconnected to the API server and migrated its Pods to another node automatically.

Answer

kube-proxy re-created the lost Pods on healthy nodes to keep the Service endpoints populated.

Question 37

A developer needs to inject non-sensitive configuration values (such as LOG_LEVEL and CACHE_SIZE) into a container as environment variables. The values are already stored in a ConfigMap named 'app-config'. Which field in the Pod's container spec should be used to pull a specific key from that ConfigMap into a single environment variable?

Accepted Answer

env[].valueFrom.configMapKeyRef

Answer

env[].valueFrom.secretKeyRef

Answer

envFrom[].configMapRef with a fieldRef

Answer

volumeMounts referencing the ConfigMap volume

Question 38

You maintain a Deployment running 6 replicas of a stateless web API. During your next release, the business requires that the application never drops below full capacity and that new Pods must be verified healthy before old Pods are removed. Which change to the Deployment's update strategy best satisfies this requirement?

Accepted Answer

Use the RollingUpdate strategy with maxUnavailable set to 0 and maxSurge set to a positive value

Answer

Use the Recreate strategy so all old Pods terminate before new ones start

Answer

Use the RollingUpdate strategy with maxSurge set to 0 and maxUnavailable set to 2

Answer

Set replicas to 12 temporarily and delete the old Pods manually after the rollout

Question 39

You created a Deployment named 'web' with 3 replicas. A teammate runs 'kubectl delete pod web-6f8d9c-abc12' to troubleshoot a hung Pod. Moments later, a new Pod with a similar name appears and the total count returns to 3. Which Kubernetes component is directly responsible for recreating the deleted Pod to maintain the desired count?

Accepted Answer

The ReplicaSet managed by the Deployment

Answer

The Deployment object itself, by directly creating Pods

Answer

The kube-scheduler, which recreates missing Pods

Answer

The kubelet on the node where the Pod was deleted

Question 40

A developer is writing a Deployment manifest. They set spec.selector.matchLabels to {app: web, tier: frontend}, but under spec.template.metadata.labels they only put {app: web}. When they run kubectl apply, the command is rejected. What is the reason for this error?

Accepted Answer

The Deployment's selector must match the labels defined in the Pod template; a selector label with no corresponding template label is invalid.

Answer

A Deployment selector can only contain a single label key, so specifying two keys is not allowed.

Answer

Pod template labels must be a strict superset of the selector, so the template needs at least three labels to be valid.

Answer

The selector and template labels are unrelated, so the error must be caused by an invalid apiVersion in the manifest.

Question 41

A developer writes a manifest file to create a Deployment and runs 'kubectl apply -f deploy.yaml'. The command returns the error: 'error: resource mapping not found ... no matches for kind "Deployment" in version "v1"'. The file begins with 'apiVersion: v1' and 'kind: Deployment'. What change should the developer make to fix this manifest?

Accepted Answer

Change the apiVersion to 'apps/v1' because Deployments belong to the apps API group

Answer

Change the kind to 'Pod' since Deployments are not a valid resource type in Kubernetes

Answer

Remove the apiVersion field entirely so the API server can infer the correct version

Answer

Add a 'namespace: v1' field to the metadata section to resolve the version mapping

Question 42

A team runs a single-container Pod that caches temporary processing files in a volume defined as 'emptyDir'. During testing, a developer notices that after the Pod is deleted and rescheduled onto another node, all the cached files are gone. They ask you to explain this behavior. What is the correct explanation for why the data did not persist?

Accepted Answer

An emptyDir volume is tied to the Pod's lifecycle and is deleted permanently when the Pod is removed from the node.

Answer

emptyDir volumes are read-only by default, so no data could ever have been written to them.

Answer

emptyDir data is stored in etcd, which purges volume contents on every scheduling event.

Answer

emptyDir volumes automatically replicate across nodes but lose data if the destination node lacks a CSI driver.

Question 43

Your team is designing a disaster recovery plan for a self-managed Kubernetes cluster. During a review, a colleague asks which control plane component stores all cluster state and configuration data (such as the desired number of replicas, Secrets, and object definitions) that must be backed up to fully restore the cluster. Which component should you identify?

Accepted Answer

etcd

Answer

kube-apiserver

Answer

kube-controller-manager

Answer

kubelet

Question 44

Your team uses Flux for GitOps delivery. A separate CI pipeline builds and pushes a new container image tag to the registry each time code merges to main. You want new image tags to be deployed automatically without a developer manually editing the manifest in Git. Which Flux capability accomplishes this while keeping Git as the source of truth?

Accepted Answer

Flux image automation, which scans the registry for new tags and writes the updated image reference back to the Git repository as a commit

Answer

Configuring Flux to pull the ':latest' tag so every reconciliation always deploys the newest image directly from the registry

Answer

Adding a CI step that runs 'kubectl set image' against the cluster immediately after the image is pushed

Answer

Enabling Flux drift detection so it treats the newer registry image as the desired state and self-heals toward it

Question 45

Your platform team uses Argo CD to manage 40 microservices across several environments. Each service currently has its own Argo CD Application manifest, but onboarding a new environment means manually creating dozens of Application objects. You want a single, version-controlled entry point in Git from which Argo CD automatically discovers and manages all the individual Application resources. Which GitOps approach best achieves this?

Accepted Answer

Use the App-of-Apps pattern: create one root Argo CD Application that points to a Git directory containing the child Application manifests.

Answer

Manually run 'kubectl apply' for each Application manifest whenever a new environment is added, then let Argo CD sync.

Answer

Combine all 40 services into a single Helm chart and deploy it as one Argo CD Application to reduce the object count.

Answer

Switch to a push-based CI pipeline that runs 'argocd app create' commands for each service on every commit.

Question 46

Your team manages a production cluster with Argo CD following GitOps principles. The Git repository is the single source of truth for the Deployment manifests. During an incident, an engineer runs 'kubectl scale deployment web --replicas=10' directly against the cluster to handle a traffic spike, but does not update the Git repository. Argo CD is configured with automated sync and self-heal enabled. What will happen to the manual change?

Accepted Answer

Argo CD detects the drift from the Git-declared state and reverts the Deployment back to the replica count defined in the repository.

Answer

Argo CD permanently accepts the live change and updates the Git repository to match the new replica count.

Answer

Argo CD marks the application as Healthy and leaves the manual change in place until the next Git commit.

Answer

Argo CD deletes the Deployment entirely because the live state no longer matches the manifest.

Question 47

Your team currently uses a Jenkins pipeline that runs 'kubectl apply' with cluster credentials stored in the CI system to deploy to production. A security review flags that CI tooling holds long-lived cluster credentials. You are asked to adopt a GitOps approach with Flux to address this. Which characteristic of the GitOps pull-based model directly resolves this concern?

Accepted Answer

An in-cluster agent pulls the desired state from the Git repository and applies it, so external CI systems no longer need cluster credentials

Answer

The CI pipeline pushes manifests to the cluster faster because Flux caches images locally on each node

Answer

Flux encrypts the kubeconfig stored in Jenkins so the credentials can no longer be read by attackers

Answer

GitOps removes the need for a Git repository by storing all desired state directly in etcd

Question 48

Your team adopts GitOps for a production cluster using Flux. A developer, in a hurry to fix an outage, uses 'kubectl edit deployment' to increase the replica count directly on the cluster. Twenty minutes later, the change is gone and the deployment is back to its original replica count. What is the MOST likely reason this happened?

Accepted Answer

The Flux controller reconciled the live cluster state back to match the manifests stored in the Git repository, which remained the source of truth.

Answer

Kubernetes automatically discards manual edits to Deployments after a fixed timeout to enforce immutability.

Answer

The Horizontal Pod Autoscaler scaled the deployment back down because the extra replicas were idle.

Answer

The 'kubectl edit' command only modifies a local copy and never persists changes to the API server.

Question 49

A developer is deploying a database that needs each Pod to be individually addressable by a stable DNS name, rather than being load-balanced behind a single virtual IP. They ask how to configure the Service so that DNS returns the individual Pod IPs directly instead of a single ClusterIP. What should they do?

Accepted Answer

Set the Service's clusterIP field to None, creating a headless Service

Answer

Set the Service's type to NodePort so each Pod gets its own external port

Answer

Set the Service's type to LoadBalancer to expose each Pod separately

Answer

Set externalTrafficPolicy to Local so DNS resolves to Pod IPs

Question 50

Your team maintains a Helm chart for an internal payment service. You release a new chart that adds a configurable readinessProbe template and fixes an indentation bug in a template, but the packaged application container image remains exactly the same as the previous release. Which field in Chart.yaml should you increment to correctly reflect this change according to Helm conventions?

Accepted Answer

The 'version' field, because the chart packaging itself changed even though the app did not

Answer

The 'appVersion' field, because any change to the chart implies a new application version

Answer

Both 'version' and 'appVersion' must always be incremented together on every release

Answer

The 'kubeVersion' field, since template changes affect Kubernetes compatibility

Question 51

Your team maintains a Helm chart for a web application that requires a Redis instance and a PostgreSQL database. Rather than copying those upstream charts into your own templates, you want Helm to automatically fetch and package them as part of your release when you run 'helm dependency update'. Where should you declare these external charts?

Accepted Answer

Under the 'dependencies' field in the chart's Chart.yaml file

Answer

As separate 'requires' entries inside values.yaml

Answer

Inside a 'subcharts' block in the templates/ directory

Answer

In a 'depends-on' annotation on each Kubernetes manifest

Question 52

A platform engineer is packaging a web application with Helm. They want to store the raw Kubernetes manifest definitions with placeholders that get substituted from configurable inputs at install time. Inside a Helm chart directory, which location is designed to hold these parameterized manifest files?

Accepted Answer

The templates/ directory, which contains manifest files with Go templating directives

Answer

The values.yaml file, which stores the fully rendered Kubernetes manifests

Answer

The charts/ directory, which stores the parameterized deployment definitions

Answer

The Chart.yaml file, which embeds the manifest templates as metadata

Question 53

A new engineer wants to install a community-maintained PostgreSQL chart that is published in a public Helm repository at https://charts.example.com. They have Helm installed but have never used this repository before. Which sequence of commands correctly adds the repository, refreshes the local chart index, and installs the chart as a release named 'db'?

Accepted Answer

helm repo add example https://charts.example.com  →  helm repo update  →  helm install db example/postgresql

Answer

helm install db https://charts.example.com/postgresql  →  helm repo update

Answer

helm pull https://charts.example.com  →  helm install db postgresql

Answer

helm repo update example https://charts.example.com  →  helm install db example/postgresql

Question 54

Your team maintains a single Helm chart for a web application that must be deployed to three environments (dev, staging, prod) with different replica counts, image tags, and resource limits. You want to keep one chart while customizing each environment's deployment. What is the recommended Helm approach to achieve this?

Accepted Answer

Maintain a separate values file per environment (e.g., values-dev.yaml, values-prod.yaml) and pass the appropriate one with -f during install/upgrade

Answer

Create three independent copies of the chart, one per environment, and edit the templates directly in each copy

Answer

Hardcode the environment-specific settings into the chart's templates and use kubectl edit to change them after deployment

Answer

Store all environment differences in the Chart.yaml file and rely on Helm to detect the target environment automatically

Question 55

Your team packages a web application as a Helm chart. During a `helm upgrade`, a database schema migration Job must run and complete successfully before the new application Deployment pods are rolled out. If the migration fails, the upgrade should not proceed. Which Helm feature lets you order this migration Job to execute at the correct point in the release lifecycle?

Accepted Answer

Define the Job as a Helm hook using the annotation helm.sh/hook: pre-upgrade

Answer

Set the Job's restartPolicy to OnFailure so Helm waits for it automatically

Answer

Add the Job to a subchart so it renders before the parent chart's Deployment

Answer

Increase the Deployment's initialDelaySeconds so the Job finishes first

Question 56

A platform engineer runs 'helm install myapp ./chart' in a CI pipeline. On the second pipeline run the command fails with an error stating that a release named 'myapp' already exists in the namespace. The team wants the pipeline to reliably update the existing release if it is present, or create it if it is not, without manually checking release state first. Which command best achieves this?

Accepted Answer

helm upgrade --install myapp ./chart

Answer

helm install myapp ./chart --force

Answer

helm install myapp ./chart --generate-name

Answer

helm template myapp ./chart | kubectl apply -f -

Question 57

Your team maintains a Helm chart used across several environments. Before publishing a new chart version, you want to catch structural issues, missing required values, and malformed templates locally as part of the CI pipeline — without connecting to any cluster or performing an installation. Which Helm command is designed for this validation purpose?

Accepted Answer

helm lint

Answer

helm status

Answer

helm history

Answer

helm get manifest

Question 58

Your team has finished developing a Helm chart for an internal payments service. You now need to bundle the chart into a versioned, distributable archive so it can be uploaded to a shared Helm chart repository for other teams to install. Which Helm command produces this archive?

Accepted Answer

helm package ./payments-chart

Answer

helm install payments ./payments-chart

Answer

helm template ./payments-chart

Answer

helm pull ./payments-chart

Question 59

A teammate deployed an application using Helm several weeks ago, and you now need to know exactly which custom values were supplied at install time so you can reproduce the release in a staging cluster. You do not have access to the original values file they used. Which Helm command retrieves the user-supplied values that were applied to the currently deployed release?

Accepted Answer

helm get values <release-name>

Answer

helm show values <chart-name>

Answer

helm template <chart-name>

Answer

helm lint <chart-name>

Question 60

Your team upgraded a production application using 'helm upgrade myapp ./chart'. After the upgrade, the pods are crashing due to a bad configuration value in the new chart version. You need to quickly restore the previously working state of the release. Which command achieves this most directly?

Accepted Answer

helm rollback myapp 1

Answer

helm uninstall myapp && helm install myapp ./chart

Answer

kubectl rollout undo deployment/myapp

Answer

helm upgrade myapp ./chart --reset-values

Question 61

A platform engineer is authoring a new Helm chart and wants to inspect the exact Kubernetes manifests that would be produced from the templates and values — including any conditional blocks — before ever contacting the cluster or creating a release. Which Helm command best accomplishes this local rendering?

Accepted Answer

helm template myapp ./mychart

Answer

helm install myapp ./mychart

Answer

helm lint ./mychart

Answer

helm history myapp

Question 62

A platform engineer runs 'helm uninstall myapp' to remove a release from the cluster. Later they attempt 'helm rollback myapp 2' to restore a previous good revision, but Helm reports that the release is not found. What is the most likely reason?

Accepted Answer

By default 'helm uninstall' purges the release history, so no revisions remain to roll back to unless '--keep-history' was used.

Answer

Rollback only works on releases that are currently in a 'failed' state, not on ones that were uninstalled.

Answer

The release history is stored in the local Helm cache, which was cleared when the CLI was restarted.

Answer

Rollback requires the original chart tarball to still be present in the working directory.

Question 63

Your team packages a web application as a Helm chart. The chart's values.yaml sets replicaCount: 2 and image.tag: 1.0.0. For a production release named 'web-prod', you need to deploy the same chart but with 5 replicas and image tag 2.1.0, without permanently editing the chart files. Which command achieves this in one step?

Accepted Answer

helm upgrade --install web-prod ./chart --set replicaCount=5 --set image.tag=2.1.0

Answer

helm template web-prod ./chart --set replicaCount=5 --set image.tag=2.1.0

Answer

kubectl apply -f ./chart --set replicaCount=5 --set image.tag=2.1.0

Answer

helm install web-prod ./chart --reuse-values replicaCount=5 image.tag=2.1.0

Question 64

A team deploys an application with Helm. The chart's values.yaml sets replicaCount: 2. They also maintain a prod-values.yaml file that sets replicaCount: 4. During a release they run: helm install myapp ./chart -f prod-values.yaml --set replicaCount: 6. How many replicas will the rendered Deployment request?

Accepted Answer

6, because --set has the highest precedence over both values files

Answer

2, because the chart's built-in values.yaml always takes highest priority

Answer

4, because a values file supplied with -f overrides everything else

Answer

The install fails because replicaCount is defined in three conflicting places

Exam domain	Exam weight	Practice
Kubernetes Fundamentals	44%	Practice this topic
Container Orchestration	28%	Practice this topic
Cloud Native Application Delivery	16%	Practice this topic
Cloud Native Architecture	12%	Practice this topic

Kubernetes and Cloud Native Associate (KCNA) practice exam & study guide

Start studying KCNA

All KCNA study resources

KCNA exam domains

Sample KCNA questions

Key KCNA terms

KCNA frequently asked questions

Kubernetes Fundamentals (44%)

Container Orchestration (28%)

Cloud Native Application Delivery (16%)

Cloud Native Architecture (12%)