I85PREP
⌘ K
KCNA study materials
KCNA study resources

KCNA practice questions

One question at a time. Build your KCNA understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Kubernetes Fundamentals

What is the smallest deployable unit that Kubernetes creates and manages?

  1. A container
  2. A Pod Correct answer.
  3. A ReplicaSet
  4. A Deployment

Explanation

Kubernetes schedules and manages Pods, and a Pod is the smallest API object that can be created and run. A Pod wraps one or more containers that share a network namespace and storage volumes. Controllers such as Deployments and ReplicaSets manage Pods rather than being scheduled themselves.

Question 2Kubernetes Fundamentals

Which kubectl command lists the Pods in the current namespace?

  1. kubectl describe pods
  2. kubectl get pods Correct answer.
  3. kubectl list pods
  4. kubectl show pods

Explanation

The get verb retrieves API objects, so kubectl get pods prints the Pods visible in the current namespace. Adding -A or --all-namespaces widens the listing to the whole cluster. describe is used for detailed state and events of one object, not for listing a set.

Question 3Kubernetes Fundamentals

What is the primary purpose of a Kubernetes Namespace?

  1. To schedule Pods onto specific nodes
  2. To separate cluster resources into groups Correct answer.
  3. To store container images for the cluster
  4. To isolate network traffic between Pods on different nodes

Explanation

Namespaces partition a single cluster into logical scopes so that names, quotas, and role bindings can be applied per group. Most namespaced objects must have unique names only within their namespace. Namespaces do not by themselves block network traffic or control scheduling.

Question 4Kubernetes Fundamentals

Which component runs on every node and starts and monitors containers?

  1. kubelet Correct answer.
  2. kube-scheduler
  3. kube-apiserver
  4. kube-proxy

Explanation

The kubelet is the node agent that watches for Pods assigned to its node and asks the container runtime to start, stop, and monitor their containers. It also runs probes and reports node and Pod status back to the API server. The control-plane components are not node-local agents.

Question 5Kubernetes Fundamentals

What is the default restartPolicy for containers in a Pod?

  1. Never
  2. Always Correct answer.
  3. OnFailure
  4. UnlessStopped

Explanation

When restartPolicy is not specified, a Pod uses Always, so the kubelet restarts any container that exits. Never and OnFailure are the other permitted values and are commonly set for batch workloads. The policy applies to every container in the Pod.

Question 6Kubernetes Fundamentals

What are labels used for in Kubernetes?

  1. Defining resource CPU limits
  2. Encrypting Secrets at rest
  3. Storing application configuration data
  4. Grouping objects for selection Correct answer.

Explanation

Labels are key-value metadata attached to objects so that selectors can identify a set of them. Services, ReplicaSets, and NetworkPolicies all use label selectors to find the objects they act on. Labels carry no configuration payload and have no effect on encryption or resource sizing.

Question 7Kubernetes Fundamentals

Which Service type exposes an application on a cluster-internal virtual IP?

  1. ClusterIP Correct answer.
  2. NodePort
  3. ExternalName
  4. LoadBalancer

Explanation

ClusterIP is the default Service type and allocates a virtual IP reachable only from inside the cluster. NodePort additionally opens a port on every node, and LoadBalancer provisions an external load balancer. ExternalName maps the Service to a DNS name instead of a virtual IP.

Question 8Kubernetes Fundamentals

Which object holds non-confidential configuration data as key-value pairs?

  1. PersistentVolume
  2. Secret
  3. ConfigMap Correct answer.
  4. ServiceAccount

Explanation

ConfigMaps store plain configuration data that can be consumed as environment variables, command-line arguments, or mounted files. They are intended for non-sensitive data, with Secrets used for sensitive values. PersistentVolumes and ServiceAccounts serve unrelated purposes.

Question 9Kubernetes Fundamentals

A Pod's container shows the waiting reason CrashLoopBackOff. What does this indicate?

  1. The Pod is waiting for a node whose taints and labels satisfy its requirements
  2. The Pod is being evicted because the node is under memory pressure
  3. The kubelet restarts the container with increasing delay after repeated failures Correct answer.
  4. The container image is still being pulled from the remote registry

Explanation

CrashLoopBackOff means the container has started and exited repeatedly, so the kubelet applies exponential backoff before each new restart attempt. The delay grows from a few seconds up to a cap of several minutes. Inspecting container logs and the previous terminated state usually reveals the root cause.

Question 10Kubernetes Fundamentals

Which controller creates and deletes Pods so that the number of running replicas matches the desired count?

  1. kube-proxy
  2. kube-scheduler
  3. ReplicaSet controller Correct answer.
  4. Vertical Pod Autoscaler

Explanation

The ReplicaSet controller reconciles the observed number of Pods with the spec's replica count by creating or deleting Pods. A Deployment drives this indirectly by managing ReplicaSets. The scheduler only assigns nodes, and autoscalers adjust requests or replica counts through other mechanisms.

Question 11Kubernetes Fundamentals

A Service's selector matches no Pods. What happens to traffic sent to that Service?

  1. The Pods are restarted until their labels match the selector
  2. The Service object is deleted by the endpoints controller
  3. kube-proxy removes the Service from the API server
  4. The Service has no endpoints and the traffic is dropped Correct answer.

Explanation

A Service routes to the Pod IPs listed in its EndpointSlice, which is populated only from Pods matching the selector. With no matching Pods the endpoint list is empty, so connections to the ClusterIP fail. The Service object itself remains in place.

Question 12Kubernetes Fundamentals

Which workload resource gives each Pod a stable network identity and ordered rollout?

  1. StatefulSet Correct answer.
  2. DaemonSet
  3. CronJob
  4. Deployment

Explanation

StatefulSets assign each replica a stable ordinal name and a stable DNS identity, and they create, update, and delete Pods in order. They are the standard choice for clustered stateful applications that need stable identities. Deployments give interchangeable Pods with random names.

Question 13Kubernetes Fundamentals

Which workload resource runs one copy of a Pod on every node that matches its node selector?

  1. Deployment
  2. DaemonSet Correct answer.
  3. Job
  4. ReplicaSet

Explanation

A DaemonSet creates a Pod on each eligible node and adds Pods as new nodes join. It is typically used for node-level agents such as log shippers or monitoring exporters. The other workload types manage a fixed replica count or run to completion rather than covering every node.

Question 14Kubernetes Fundamentals

How is data stored in a Kubernetes Secret by default?

  1. It is kept as plaintext only in kubelet memory on each node
  2. It is encrypted with the cluster's service account key before being written to etcd
  3. It is hashed with SHA-256 and can never be read back
  4. It is base64-encoded and readable by anyone with API access to it Correct answer.

Explanation

Secret values are base64-encoded, which is an encoding rather than protection, so anyone allowed to read the Secret can decode it. Encryption at rest only happens when the API server is configured with an encryption provider. Access control to Secrets is therefore enforced through RBAC.

Question 15Kubernetes Fundamentals

What happens when a readiness probe fails on a running container?

  1. The container is restarted by the kubelet
  2. The Deployment rolls back to the previous revision
  3. The Pod is evicted from its node
  4. The Pod is removed from the Service's endpoints Correct answer.

Explanation

Readiness probes control whether a Pod is considered ready to receive traffic, so a failing probe removes the Pod from Service endpoints without restarting it. Liveness probes are the ones that trigger container restarts. The Pod stays on its node and keeps running.

Question 16Kubernetes Fundamentals

What does a container's CPU request tell the scheduler?

  1. The maximum CPU the container may consume before being throttled
  2. The number of CPU cores reserved for system daemons on the node
  3. The priority the container gets when the node is under pressure
  4. The CPU the scheduler reserves for the container Correct answer.

Explanation

Requests are used by the scheduler to find nodes with enough unallocated CPU, and the requested amount is guaranteed to the container. The upper bound on CPU use is the limit, which also determines throttling. Priority under contention is governed by QoS class and priority settings, not by the request alone.

Question 17Kubernetes Fundamentals

What is the role of etcd in a Kubernetes cluster?

  1. It load-balances traffic between Pods
  2. It stores the cluster state as key-value data Correct answer.
  3. It schedules Pods onto suitable nodes
  4. It provides the container runtime for nodes

Explanation

etcd is the consistent key-value store that holds all API objects and cluster state, making it the source of truth for the control plane. Losing quorum in etcd makes the API server unable to accept writes. It does not run containers or route traffic.

Question 18Kubernetes Fundamentals

Which node component programs iptables or IPVS rules so that Service traffic reaches the right Pods?

  1. kube-proxy Correct answer.
  2. kubelet
  3. kube-scheduler
  4. CoreDNS

Explanation

kube-proxy watches Services and EndpointSlices and translates them into node-level packet forwarding rules. Those rules send traffic destined for a ClusterIP to one of the backing Pod IPs. kubelet and CoreDNS play different roles in the data path.

Question 19Kubernetes Fundamentals

What does maxSurge control in a rolling update of a Deployment?

  1. How many old ReplicaSets are kept in the revision history
  2. How many extra Pods may exist above the desired count Correct answer.
  3. How many Pods may be unavailable below the desired count
  4. How long the rollout waits before it is marked failed

Explanation

maxSurge sets how many Pods beyond the desired replica count may be created temporarily during a rolling update. It works together with maxUnavailable, which controls how many Pods may be missing at any moment. Increasing the surge allows faster rollouts at the cost of extra capacity.

Question 20Kubernetes Fundamentals

Which command creates or updates resources from a manifest and records the applied configuration for later merges?

  1. kubectl create -f app.yaml
  2. kubectl replace --force -f app.yaml
  3. kubectl apply -f app.yaml Correct answer.
  4. kubectl run app --image=app

Explanation

kubectl apply performs a declarative create-or-update and stores the last applied configuration so future merges can compute a three-way diff. This makes it idempotent and safe to run repeatedly. create fails if the object already exists, and replace overwrites the object wholesale.

Question 21Kubernetes Fundamentals

A Pod has two containers: one sets CPU and memory requests equal to its limits, and the other sets no requests or limits at all. Which QoS class does the Pod receive?

  1. BestEffort
  2. Guaranteed
  3. Burstable Correct answer.
  4. Priority

Explanation

Guaranteed requires every container in the Pod to specify requests equal to limits for both CPU and memory. Because one container specifies nothing, the Pod falls into the Burstable class. BestEffort applies only when no container has any requests or limits set.

Question 22Kubernetes Fundamentals

A NetworkPolicy in namespace team-a uses an empty podSelector and declares policyTypes: [Ingress] with no ingress rules. What is the result?

  1. The policy has no effect until at least one rule is added
  2. All ingress traffic to the Pods in team-a is allowed
  3. All ingress traffic to the selected Pods is denied Correct answer.
  4. Egress traffic from the selected Pods is blocked as well

Explanation

An empty podSelector selects every Pod in the namespace, and listing Ingress in policyTypes makes the policy isolate those Pods for inbound traffic. With no ingress rules, no inbound connection is permitted. Egress is unaffected because it is not listed in policyTypes.

Question 23Kubernetes Fundamentals

Which statement about init containers in a Pod is true?

  1. They run to completion one at a time before app containers start Correct answer.
  2. They run in parallel with the app containers and share their probes
  3. They are used only to pull container images onto the node
  4. They are restarted each time an app container is restarted

Explanation

Init containers execute sequentially, and each must terminate successfully before the next one and finally the app containers start. They are useful for setup tasks such as waiting on a dependency or preparing a volume. They do not run alongside app containers and do not support readiness or liveness probes.

Question 24Kubernetes Fundamentals

Which combination of properties must be compatible for a PersistentVolumeClaim to bind to a PersistentVolume?

  1. Capacity, access modes and storage class Correct answer.
  2. The same namespace and the same Pod name
  3. The same volumeMode and the same reclaim policy
  4. Identical labels on the PVC and the PersistentVolume

Explanation

The binder matches a claim to a volume that offers at least the requested capacity, supports the requested access modes, and uses the same storage class and volume mode. A selector can further narrow the candidates but is optional. Namespace and Pod names do not participate in binding.

Question 25Kubernetes Fundamentals

How does the kube-scheduler decide where to place a Pod?

  1. It lets the kubelet on each node compete for the Pod
  2. It filters nodes that cannot run the Pod, then scores the remaining ones Correct answer.
  3. It asks kube-proxy which node has the most free memory
  4. It always places the Pod on the node that currently runs the fewest Pods

Explanation

Scheduling runs in two phases: filtering removes nodes that fail constraints such as insufficient resources, taints, or affinity rules, and scoring ranks the feasible nodes so the highest-scoring node is chosen. If no node passes filtering, the Pod stays Pending. The choice is made by the scheduler, not by the nodes themselves.

Question 26Kubernetes Fundamentals

Which statement describes networking inside a Pod that runs several containers?

  1. Containers share a network namespace only when a hostPort field is defined.
  2. Containers share one network namespace and reach each other over localhost. Correct answer.
  3. Each container receives its own IP address from the CNI plugin.
  4. Containers reach each other only through a Service object.

Explanation

Every container in a Pod joins the same network namespace and therefore shares the Pod's single IP address. They communicate over localhost, which means two containers in the same Pod cannot bind the same port.

Question 27Kubernetes Fundamentals

Which node agent receives Pod specifications, starts containers, and reports Pod status to the control plane?

  1. kubelet Correct answer.
  2. kube-scheduler
  3. kube-proxy
  4. cloud-controller-manager

Explanation

The kubelet runs on every node and is responsible for acting on PodSpecs, driving the container runtime, and reporting status. The scheduler only chooses nodes, and kube-proxy only programs Service traffic rules.

Question 28Kubernetes Fundamentals

A manifest omits metadata.namespace and the client request carries no namespace. Where does the API server create the object?

  1. In a namespace generated from the object name
  2. In the namespace of the requesting user account
  3. In the kube-system namespace
  4. In the default namespace Correct answer.

Explanation

When no namespace is supplied by the manifest or the request, the API server falls back to the default namespace. kubectl can send a different namespace when the current context defines one.

Question 29Kubernetes Fundamentals

Which command streams the current log output of a container in a running Pod named web-0?

  1. kubectl get pod web-0 -o yaml
  2. kubectl exec web-0 -- ls /var/log
  3. kubectl describe pod web-0
  4. kubectl logs web-0 Correct answer.

Explanation

kubectl logs requests the container's standard output and standard error stream from the kubelet. The describe subcommand shows events and status but not log content.

Question 30Kubernetes Fundamentals

Which metadata field holds arbitrary, non-identifying information such as build numbers or tooling hints and is ignored by label selectors?

  1. annotations Correct answer.
  2. ownerReferences
  3. finalizers
  4. labels

Explanation

Annotations store free-form metadata that is not used for selection, and they can hold larger and more structured values than labels. Labels are the indexed fields that selectors query.

Question 31Kubernetes Fundamentals

A container's liveness probe fails three consecutive times. What does the kubelet do?

  1. Removes the Pod's IP address from the Service endpoints
  2. Restarts the container according to the restart policy Correct answer.
  3. Deletes the Pod and asks the scheduler for a replacement
  4. Marks the Pod phase as Failed and leaves it on the node

Explanation

A failed liveness probe signals that the container is unhealthy, so the kubelet kills and restarts that container as defined by the Pod's restart policy. The Pod itself keeps its place on the node.

Question 32Kubernetes Fundamentals

Which restartPolicy must the Pod template of a Deployment specify?

  1. Always Correct answer.
  2. Never
  3. Any of the three values
  4. OnFailure

Explanation

Deployments manage long-running Pods and only accept restartPolicy Always, a rule enforced at admission. OnFailure and Never are meaningful for run-to-completion workloads such as Jobs.

Question 33Kubernetes Fundamentals

A container's memory usage grows past its configured memory limit. What is the result?

  1. The container is paused, then resumed automatically
  2. The Pod is evicted from the node and rescheduled elsewhere
  3. The container is throttled until memory usage falls below the limit
  4. The container is OOM-killed and restarted per its restart policy Correct answer.

Explanation

Memory is not a compressible resource, so exceeding a memory limit causes the kernel to terminate the process with an out-of-memory kill. The kubelet then applies the Pod's restart policy.

Question 34Kubernetes Fundamentals

Which port range do NodePort Services allocate from by default?

  1. 49152-65535
  2. 30000-32767 Correct answer.
  3. 8000-9000
  4. 1024-4095

Explanation

NodePort Services receive a port in the 30000-32767 range by default. Cluster administrators can change the range with the --service-node-port-range flag on the API server.

Question 35Kubernetes Fundamentals

A Service is defined with clusterIP: None. What is the effect?

  1. Traffic is forwarded only to Pods on the same node
  2. The Service is exposed on every node's IP at a fixed port
  3. The Service is recreated as a LoadBalancer type
  4. DNS returns the individual Pod IPs behind the Service Correct answer.

Explanation

Setting clusterIP to None creates a headless Service: no virtual IP and no kube-proxy rules are created. DNS instead returns one record per ready Pod, which lets clients or other controllers address Pods directly.

Question 36Kubernetes Fundamentals

An Ingress object with correct rules exists, yet no traffic reaches the backend. Which requirement is most likely unmet?

  1. The Ingress rules must reference a StatefulSet rather than a Service
  2. The Ingress object must first be converted into a NodePort Service
  3. An Ingress controller must be running to implement the rules Correct answer.
  4. The cluster must run a CNI plugin that supports encryption

Explanation

An Ingress is only a declarative set of HTTP routing rules; a controller such as ingress-nginx must watch those objects and configure an actual proxy. Without a controller, the rules have no effect.

Question 37Kubernetes Fundamentals

Which workload resource runs Pods until a required number of them finish successfully and then stops?

  1. ReplicaSet
  2. DaemonSet
  3. Job Correct answer.
  4. Deployment

Explanation

A Job creates Pods for run-to-completion work and tracks successful terminations against the completions target. Once the target is met, the Job stops creating Pods.

Question 38Kubernetes Fundamentals

A CronJob sets concurrencyPolicy: Forbid, and a scheduled run is still active when the next run becomes due. What happens?

  1. Both runs execute in parallel until one finishes
  2. The active run is terminated and replaced
  3. The CronJob schedule is suspended indefinitely
  4. The new run is skipped Correct answer.

Explanation

Forbid instructs the CronJob controller to skip a new run while a previous one is still running. Replace terminates the running Job instead, and Allow permits overlapping runs.

Question 39Kubernetes Fundamentals

Which object limits the aggregate CPU and memory that all Pods in a namespace may request or limit?

  1. LimitRange
  2. PriorityClass
  3. ResourceQuota Correct answer.
  4. PodDisruptionBudget

Explanation

ResourceQuota caps total consumption per namespace, for example the sum of requests.cpu or the number of Pods. LimitRange instead sets per-container defaults and min/max bounds.

Question 40Kubernetes Fundamentals

A namespace contains a LimitRange that defines default container limits. How does it affect a Pod whose containers specify no resources at all?

  1. The Pod is placed in the BestEffort QoS class
  2. Defaults from the LimitRange are applied to the containers Correct answer.
  3. The Pod runs with no CPU or memory constraints whatsoever
  4. The Pod is rejected by the API server

Explanation

The LimitRange admission plugin injects the configured defaults into containers that omit resource fields. Because defaults are then present, the Pod is not treated as BestEffort.

Question 41Kubernetes Fundamentals

What determines the lifetime of an emptyDir volume?

  1. It persists until the PersistentVolume backing it is deleted
  2. It exists as long as the Pod exists on that node Correct answer.
  3. It is deleted whenever a container in the Pod restarts
  4. It survives node reboots and is reattached to new Pods

Explanation

An emptyDir is created when a Pod is assigned to a node and its data is removed when the Pod is removed from that node. Container restarts within the same Pod keep the volume and its data.

Question 42Kubernetes Fundamentals

Which Secret type stores credentials that the kubelet uses to pull images from a private registry?

  1. kubernetes.io/basic-auth
  2. kubernetes.io/service-account-token
  3. kubernetes.io/tls
  4. kubernetes.io/dockerconfigjson Correct answer.

Explanation

The dockerconfigjson type holds a .dockerconfigjson payload containing registry authentication details. It is referenced from a Pod through imagePullSecrets.

Question 43Kubernetes Fundamentals

A Service is created without a selector and its Endpoints are maintained manually. What is the typical reason for this pattern?

  1. To make the Service resolve to a public DNS name through CoreDNS
  2. To enable client session affinity for all backend Pods
  3. To reach an external database that has no Pods in the cluster Correct answer.
  4. To let the Service load-balance across every Pod in the namespace

Explanation

A selectorless Service gets no automatically generated endpoints, so you register addresses yourself. This pattern is commonly used to give in-cluster clients a stable name for an external system.

Question 44Kubernetes Fundamentals

A Deployment uses the Recreate update strategy. What is observed during an image change?

  1. New Pods start first and old Pods are removed once they are Ready
  2. All old Pods are terminated before any new Pod is created Correct answer.
  3. Old and new Pods run side by side in fixed proportions
  4. Only the image field changes and the existing Pods keep running

Explanation

Recreate tears down all existing Pods before bringing up new ones, which avoids mixed versions at the cost of downtime. RollingUpdate is the default precisely because it avoids that outage.

Question 45Kubernetes Fundamentals

A node carries the taint dedicated=gpu:NoSchedule. How does it affect a Pod with no matching toleration?

  1. It is scheduled there but evicted after one minute
  2. It runs there if its priority class is high enough
  3. It runs there if the node has enough free memory
  4. It is not placed on that node by the scheduler Correct answer.

Explanation

Taints repel Pods, and only Pods whose tolerations match the taint are considered for that node. A toleration permits placement on a tainted node but does not guarantee it.

Question 46Kubernetes Fundamentals

A manifest file is placed in /etc/kubernetes/manifests on a worker node. Which statement about the resulting Pod is true?

  1. Deleting the mirror Pod through the API stops the running container
  2. The scheduler must place it on that node before the kubelet runs it
  3. The Pod is managed by a ReplicaSet created by the kubelet
  4. The kubelet starts it directly; the API server shows a mirror Pod Correct answer.

Explanation

The kubelet periodically reads the static Pod path and starts those Pods itself, with no scheduler involvement. The API server exposes read-only mirror Pods for visibility, and deleting a mirror Pod does not stop the container.

Question 47Kubernetes Fundamentals

A Job specifies completions: 5 and parallelism: 2. How is the work executed?

  1. It runs one Pod at a time until five succeed
  2. It runs five Pods at once and stops after two succeed
  3. It runs at most two Pods at a time until five succeed Correct answer.
  4. It runs two Pods and restarts them until five completions are logged

Explanation

parallelism sets the maximum number of Pods running simultaneously, while completions sets how many successful terminations are required. Here the controller keeps up to two Pods active until five have completed successfully.

Question 48Kubernetes Fundamentals

A StorageClass sets volumeBindingMode: WaitForFirstConsumer. When does the PersistentVolumeClaim bind to a volume?

  1. When the StorageClass provisioner pod starts up
  2. As soon as the PersistentVolumeClaim is created
  3. When a PersistentVolume is created manually in advance
  4. When a Pod that uses the claim is scheduled Correct answer.

Explanation

This binding mode defers provisioning and binding until a Pod referencing the claim is scheduled. That lets the provisioner choose a volume in a zone or node that satisfies the Pod's other scheduling constraints.

Question 49Kubernetes Fundamentals

The kube-apiserver becomes unreachable while Pods are already running on the nodes. What is the effect?

  1. kubelets create replacement Pods from their locally cached PodSpecs
  2. All Pods on every node are stopped until the API server returns
  3. Running Pods keep running, but kubectl and controllers stall Correct answer.
  4. Nodes reboot and re-register once the API server is reachable

Explanation

Kubelets act on the last PodSpecs they received, so existing containers continue to run when the control plane is unavailable. Only API-driven actions, such as new scheduling and controller reconciliation, are blocked.

Question 50Kubernetes Fundamentals

A running Deployment's spec.selector.matchLabels is edited to a new value. What happens?

  1. The old ReplicaSet is deleted and a brand-new one is created
  2. The Deployment adopts the existing Pods that match the new selector
  3. The change triggers a rolling update that uses the new selector
  4. The API server rejects the update because selectors are immutable Correct answer.

Explanation

spec.selector cannot be changed after a Deployment is created, because existing ReplicaSets rely on it to track their Pods. Changing the selector requires creating a new Deployment instead.