Medium — KCNA Practice Quiz

Question 1

A developer notices that when the control plane component responsible for exposing the cluster's REST interface is temporarily unavailable, kubectl commands fail and no new Pods can be created, but existing Pods keep running normally. Which control plane component are they describing?

Accepted Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

etcd

Question 2

Your team manages a production application with Argo CD. The Application resource has both automated sync and self-heal enabled. An on-call engineer, responding to an incident, manually runs 'kubectl scale deployment web --replicas=8' to handle a traffic spike. The Git manifest still declares 3 replicas. What will Argo CD do?

Accepted Answer

Detect the drift and revert the deployment back to 3 replicas to match the Git manifest

Answer

Update the Git repository to reflect the new value of 8 replicas

Answer

Leave the deployment at 8 replicas and mark the Application as OutOfSync without changing anything

Answer

Scale the deployment to the average of 3 and 8 replicas

Question 3

Your team uses Argo CD to deploy a microservices application. The application requires that a database migration Job completes successfully before the API Deployment starts, and a namespace-level ConfigMap must exist before either. All resources live in the same Git repository under one Application. What is the recommended Argo CD mechanism to control the order in which these resources are applied during a sync?

Accepted Answer

Add sync-wave annotations to the resources so Argo CD applies them in ascending wave order

Answer

Split each resource into separate Applications and manually sync them one at a time in the UI

Answer

Set the Application's syncPolicy to automated with prune enabled to force sequential ordering

Answer

Rely on Kubernetes to automatically detect resource dependencies and apply them in the correct order

Question 4

A team runs a stateless web API whose traffic spikes unpredictably during marketing campaigns. Each pod is already sized correctly for a single request stream, but the application cannot benefit from more CPU or memory per instance because it is single-threaded. The team wants the application to handle sudden bursts of concurrent users automatically. Which autoscaling approach best fits this situation?

Accepted Answer

Horizontal scaling — add more pod replicas as load increases

Answer

Vertical scaling — increase the CPU and memory allocated to each existing pod

Answer

Cluster scaling only — add more nodes without changing the workload

Answer

Manual scaling — have an operator adjust replicas before each campaign

Question 5

A team is designing a CI/CD pipeline for a cloud-native application on Kubernetes. Developers push code to a Git repository, and the pipeline must produce an artifact that the cluster can run. In which stage of a typical cloud-native CI/CD flow is the container image built and pushed to a registry?

Accepted Answer

During the continuous integration (CI) stage, after code is committed and tests pass, so the image is available for later deployment

Answer

During the continuous deployment (CD) stage, immediately before the kubelet schedules the Pod onto a node

Answer

By the Kubernetes scheduler at runtime, which compiles source code into an image when a Pod is created

Answer

By the container runtime on each node the first time a Pod referencing the image starts

Question 6

A platform engineer is validating whether a newly built Kubernetes cluster conforms to the Kubernetes networking model. They want to confirm the fundamental rule that any CNI implementation must satisfy for the cluster to be considered compliant. Which statement correctly describes a core requirement of the Kubernetes networking model?

Accepted Answer

Every Pod must be reachable by every other Pod across all nodes without using NAT, and each Pod sees the same IP that others use to reach it.

Answer

Pods on different nodes must communicate exclusively through a NodePort Service to reach each other.

Answer

Each node must run kube-proxy in IPVS mode so that Pod-to-Pod traffic is address-translated between nodes.

Answer

Pod IP addresses must be assigned by the API server from a single shared range so that all Pods on a node share one IP.

Question 7

A platform engineer creates a ClusterRole named 'log-reader' that allows getting and listing pods in all namespaces. They then create a RoleBinding in the 'team-a' namespace that references the 'log-reader' ClusterRole and binds it to the user 'dev-alice'. After this, dev-alice reports she can read pods in 'team-a' but gets 'Forbidden' errors when reading pods in the 'team-b' namespace. What best explains this behavior?

Accepted Answer

A RoleBinding grants the permissions in the referenced ClusterRole only within the namespace where the RoleBinding exists, so access is limited to 'team-a'.

Answer

ClusterRoles cannot be referenced by RoleBindings, so the binding is silently ignored and dev-alice has no permissions at all.

Answer

The ClusterRole must include an explicit namespace field listing 'team-b' before its rules apply there.

Answer

RoleBindings automatically propagate to all namespaces, so the Forbidden error indicates a misconfigured API server.

Question 8

A backend team runs three Pods created by a Deployment. Frontend Pods in the same cluster need to reach the backend reliably, but the backend Pods are frequently rescheduled, so their IP addresses keep changing. The team does not want to expose the backend outside the cluster. Which approach provides a stable internal address for the frontend to use?

Accepted Answer

Create a ClusterIP Service that selects the backend Pods, and have the frontend connect to the Service name

Answer

Configure the frontend to connect directly to each backend Pod IP listed in the Deployment status

Answer

Create a NodePort Service so the frontend can reach the backend through the node's external port

Answer

Hard-code the backend ReplicaSet name in the frontend configuration so it always resolves the Pods

Question 9

A large retail company runs Kubernetes in production but does not sell cloud native software. Their platform team wants to influence CNCF project roadmaps, share real-world adoption experiences, and get guidance on evaluating projects — without becoming maintainers of any project. Which CNCF community group is designed specifically for organizations in this position?

Accepted Answer

The CNCF End User Community (including the End User Technical Advisory Board)

Answer

The Technical Oversight Committee (TOC)

Answer

The Governing Board

Answer

A project's set of maintainers and approvers

Question 10

A platform team at your company is selecting an open source service mesh to adopt for a mission-critical production environment. Leadership requires that the chosen CNCF project demonstrates proven adoption, a healthy contributor community, and strong governance before it is trusted for production. Which CNCF project maturity level best signals that a project meets these criteria?

Accepted Answer

Graduated

Answer

Sandbox

Answer

Incubating

Answer

Archived

Question 11

A cloud native platform team wants to contribute domain-specific expertise (such as storage or observability) to help review projects and produce best-practice guidance under the CNCF's technical governance structure. Which body within the CNCF is organized around specific technical domains to provide this kind of focused guidance and support to the Technical Oversight Committee?

Accepted Answer

Special Interest Groups (SIGs)

Answer

The Governing Board

Answer

The End User Community

Answer

The Cloud Native Landscape working group

Question 12

A company wants to contribute an internal project to the CNCF and is researching how the foundation is governed. They want to understand which body is responsible for defining the technical vision, reviewing and approving new projects into the CNCF, and overseeing project maturity progression. Which group performs this role?

Accepted Answer

The Technical Oversight Committee (TOC)

Answer

The Governing Board (GB)

Answer

The individual project maintainers

Answer

The End User Community

Question 13

You are bringing up a brand-new Kubernetes cluster. The control plane is healthy and worker nodes show status Ready. However, every application Pod you create remains stuck in the ContainerCreating state, and 'kubectl describe pod' shows an event referencing 'failed to set up sandbox: networkPlugin cni failed to set up pod ... no CNI configuration found'. What is the most likely cause?

Accepted Answer

No Container Network Interface (CNI) plugin has been installed, so the kubelet cannot configure pod networking.

Answer

A default-deny NetworkPolicy is blocking all traffic to the new Pods.

Answer

The Service selector does not match the Pod labels, preventing traffic routing.

Answer

The PersistentVolumeClaim for the Pods cannot be bound to a PersistentVolume.

Question 14

A platform engineer is documenting how the Kubernetes networking model works for a new team. They want to explain which piece of the stack is responsible for assigning each Pod an IP address and enabling Pods on different nodes to reach one another directly, without NAT between them. Which component fulfills this responsibility?

Accepted Answer

The Container Network Interface (CNI) plugin installed in the cluster

Answer

The kubelet, which allocates Pod IPs from the API server

Answer

The Service resource, which provides each Pod its routable IP

Answer

The container runtime, which builds the overlay network via CRI

Question 15

A team packages a web server whose configuration must be provided as a file at /etc/app/config.yaml inside the container. The configuration content is stored in a ConfigMap named app-config under the key config.yaml. Which approach correctly delivers this file into the Pod?

Accepted Answer

Mount the ConfigMap as a volume and mount that volume at /etc/app, so the key config.yaml appears as a file

Answer

Reference the ConfigMap key with envFrom so it becomes an environment variable the app reads on startup

Answer

Use a Secret instead, since only Secrets can be mounted as files inside a container

Answer

Add the ConfigMap name to the Pod's spec.imagePullSecrets so the kubelet injects the file at build time

Question 16

A developer wants to store the entire contents of a 3 MB application configuration file inside a single ConfigMap and mount it into their Pods. When they try to create the ConfigMap, the API server rejects it. What is the most likely reason for the rejection?

Accepted Answer

A ConfigMap's total data cannot exceed roughly 1 MiB because of the underlying etcd object size limit.

Answer

ConfigMaps can only store key-value pairs, not the contents of files.

Answer

ConfigMaps must be created in the kube-system namespace to hold large files.

Answer

The file must be base64-encoded before it can be stored in any ConfigMap.

Question 17

A developer stores an application's configuration in a ConfigMap and mounts it into a Pod as environment variables using the envFrom field. After updating a value in the ConfigMap with kubectl edit, they notice the running Pod still uses the old configuration value. What is the most likely reason?

Accepted Answer

Environment variables injected from a ConfigMap are set only at container startup and are not updated in a running container.

Answer

The ConfigMap change was saved to etcd but never propagated to the API server, so the Pod cannot see it.

Answer

ConfigMaps are immutable by default, so the kubectl edit command silently failed to apply the change.

Answer

The Pod must be labeled with configmap-reload=true for environment variables to refresh automatically.

Question 18

A developer complains that two containers in the same Pod cannot reach each other over 'localhost' as they expected, but claims each container should have its own IP. As the platform engineer, how do you correctly explain the Kubernetes networking model for containers within a single Pod?

Accepted Answer

All containers in a Pod share a single network namespace and IP address, so they communicate with each other over localhost using different ports.

Answer

Each container in a Pod receives its own unique IP address, and they must communicate using the Pod's Service DNS name.

Answer

Containers in a Pod are network-isolated by default and require a NetworkPolicy to allow localhost traffic between them.

Answer

Containers in a Pod communicate only through a shared emptyDir volume, since intra-Pod network traffic is disabled.

Question 19

A platform engineer is building a new Kubernetes cluster and wants to run containers using containerd instead of a different runtime. They need to understand how the kubelet on each node actually launches and manages containers. Through which standardized interface does the kubelet communicate with the container runtime?

Accepted Answer

The Container Runtime Interface (CRI), a gRPC API the kubelet uses to instruct the runtime to pull images and manage container lifecycles

Answer

The Container Network Interface (CNI), which the kubelet calls directly to start and stop containers

Answer

The Kubernetes API server, which forwards container start commands from the kubelet to containerd

Answer

The Open Container Initiative (OCI) runtime spec, which the kubelet invokes as a REST endpoint on each node

Question 20

A platform team maintains a Kubernetes cluster and wants the freedom to switch between different container runtimes (for example, from one runtime to another) without modifying the kubelet or rebuilding the control plane. Which design element of Kubernetes makes this runtime interchangeability possible?

Accepted Answer

The Container Runtime Interface (CRI), a standardized gRPC API the kubelet uses to communicate with any conforming runtime

Answer

The Container Network Interface (CNI), which standardizes how runtimes attach pods to the network

Answer

The Container Storage Interface (CSI), which lets the kubelet mount volumes from any runtime

Answer

The Open Container Initiative (OCI) image manifest, which the kubelet reads directly to start containers

Question 21

A security review of your team's Kubernetes workloads finds that several containers run as the root user (UID 0) inside their images. Your security lead asks you to reduce the risk that a compromised container could escalate privileges on the host. Which change to the Pod specification most directly addresses this concern as a container security basic?

Accepted Answer

Set securityContext.runAsNonRoot to true (and specify a non-zero runAsUser) so the container is prevented from running as root

Answer

Add a NetworkPolicy that denies all ingress traffic to the affected Pods

Answer

Increase the container's CPU and memory limits to constrain resource abuse

Answer

Change the Service type from LoadBalancer to ClusterIP to reduce external exposure

Question 22

A platform engineer deletes one Pod that was created by a Deployment. Almost immediately, a new Pod appears to replace it. Which control plane component is responsible for continuously comparing the actual cluster state to the desired state and driving the creation of that replacement Pod?

Accepted Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kubelet

Answer

kube-proxy

Question 23

A platform team is designing a cluster and wants to understand the layered responsibility for actually starting containers on a node. The kubelet does not run containers itself. Which statement correctly describes how the kubelet gets a container running on a node?

Accepted Answer

The kubelet talks to a container runtime over the Container Runtime Interface (CRI), and that runtime pulls the image and starts the container process.

Answer

The kubelet calls the container runtime directly over the Container Network Interface (CNI) to launch each container.

Answer

The kube-scheduler starts the container after binding the Pod to the node, bypassing the kubelet entirely.

Answer

The kubelet writes the Pod spec into etcd, and etcd instructs the runtime to launch the container.

Question 24

Your platform team is evaluating whether to replace the container runtime on your Kubernetes nodes from containerd to CRI-O. A colleague worries this will require rewriting the kubelet or changing how pods are defined. What is the primary benefit that the Container Runtime Interface (CRI) provides in this situation?

Accepted Answer

CRI is a standardized gRPC API that lets the kubelet work with any conformant runtime, so containerd can be swapped for CRI-O without changing the kubelet or pod specs

Answer

CRI automatically converts container images from one runtime's proprietary format to another during the migration

Answer

CRI is a networking specification that guarantees pod-to-pod connectivity remains intact regardless of the runtime chosen

Answer

CRI stores pod definitions in etcd so the runtime can be changed by editing the cluster datastore directly

Question 25

Your team is upgrading a Kubernetes cluster and notices in the release notes that the built-in Docker integration (dockershim) has been removed. The nodes currently use Docker as the container runtime. What is the primary reason Kubernetes was able to remove this integration without breaking support for existing OCI container images?

Accepted Answer

The kubelet communicates with runtimes through the Container Runtime Interface (CRI), so any CRI-compliant runtime like containerd or CRI-O can replace Docker while still running the same OCI images.

Answer

OCI images can only be executed by Docker, so the cluster must convert all images to a Kubernetes-native format before the upgrade.

Answer

Kubernetes now runs containers directly in the kubelet process, eliminating the need for any external container runtime.

Answer

The Container Network Interface (CNI) replaced the container runtime, taking over both networking and container execution responsibilities.