I85PREP
⌘ K
KLCP study materials
KLCP study resources

KLCP practice questions

One question at a time. Build your KLCP understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Kubernetes Fundamentals

Which Kubernetes object is the smallest deployable unit that can be created and managed?

  1. Container
  2. Namespace
  3. Pod Correct answer.
  4. Node

Explanation

A Pod is the smallest deployable unit in Kubernetes and represents one or more containers that share storage and network resources. Containers run inside Pods rather than being scheduled directly on their own.

Question 2Kubernetes Fundamentals

What is the default restart policy for a Pod created without an explicit restartPolicy field?

  1. Always Correct answer.
  2. Never
  3. UnlessStopped
  4. OnFailure

Explanation

When restartPolicy is omitted, Kubernetes defaults it to Always, so containers are restarted whenever they exit. OnFailure and Never must be set explicitly.

Question 3Kubernetes Fundamentals

A Deployment named web is scaled from 3 to 5 replicas. Which object directly owns the resulting Pods?

  1. The Deployment
  2. A Service
  3. A ReplicaSet Correct answer.
  4. The kubelet

Explanation

A Deployment manages ReplicaSets, and the ReplicaSet is the controller that directly owns and creates the Pods. The Deployment changes the ReplicaSet's desired count rather than owning Pods itself.

Question 4Kubernetes Fundamentals

Which command shows the labels of all Pods in the current namespace?

  1. kubectl get pods --show-labels Correct answer.
  2. kubectl describe pods --labels
  3. kubectl get pods -o name
  4. kubectl label pods --list

Explanation

The --show-labels flag on kubectl get appends a LABELS column listing each object's labels. The other forms either do not display labels or are not valid flag combinations.

Question 5Kubernetes Fundamentals

A Service has selector app=frontend, but no Pods carry that label. What happens when a client connects to the Service's ClusterIP?

  1. The connection is rejected by the kube-proxy rules
  2. The Service forwards to the kube-apiserver
  3. The connection is refused or times out because there are no endpoints Correct answer.
  4. Traffic is routed to any Pod in the namespace

Explanation

A Service routes traffic only to Pods matching its selector, and those Pods form its Endpoints. With no matching Pods, there are no endpoints and connections fail.

Question 6Kubernetes Fundamentals

Which Service type exposes an application on each node's IP at a static port?

  1. NodePort Correct answer.
  2. ClusterIP
  3. ExternalName
  4. LoadBalancer

Explanation

A NodePort Service allocates a port on every node and forwards traffic to the Service. ClusterIP is internal only, ExternalName maps to a DNS name, and LoadBalancer builds on NodePort with a cloud load balancer.

Question 7Kubernetes Fundamentals

What is the purpose of a Namespace in Kubernetes?

  1. To isolate network traffic between Pods
  2. To schedule Pods onto specific nodes
  3. To encrypt secrets at rest
  4. To provide a virtual cluster for scoping and naming resources Correct answer.

Explanation

Namespaces partition a cluster into virtual scopes so names must be unique only within a namespace. They scope names and some policies but do not by themselves isolate network traffic.

Question 8Kubernetes Fundamentals

Which field in a container spec defines the command that runs as PID 1 in the container?

  1. command Correct answer.
  2. entrypoint
  3. shell
  4. args

Explanation

In a Kubernetes container spec, command overrides the image's ENTRYPOINT and becomes the process launched in the container. The args field overrides the image's CMD instead.

Question 9Kubernetes Fundamentals

A Pod's container repeatedly exits with a non-zero code and restartPolicy is OnFailure. What status will the container most likely show?

  1. ImagePullBackOff
  2. Completed
  3. CrashLoopBackOff Correct answer.
  4. Pending

Explanation

With OnFailure, a container that exits non-zero is restarted, and repeated rapid failures cause kubelet to back off, producing CrashLoopBackOff. Completed indicates a zero exit code, and ImagePullBackOff relates to image retrieval.

Question 10Kubernetes Fundamentals

Which resource stores non-confidential configuration as key-value pairs that Pods can consume as environment variables or files?

  1. PersistentVolume
  2. ServiceAccount
  3. Secret
  4. ConfigMap Correct answer.

Explanation

A ConfigMap holds non-sensitive configuration data that can be injected into Pods as env vars or mounted files. Secrets are intended for sensitive data, and the other objects serve different purposes.

Question 11Kubernetes Fundamentals

A Pod references a ConfigMap key as an environment variable, but the key does not exist and the reference is not marked optional. What is the result?

  1. The container starts and logs a warning
  2. The Pod runs with an empty value for that variable
  3. The ConfigMap is created automatically with an empty key
  4. The Pod fails to start and the container is not created Correct answer.

Explanation

A non-optional reference to a missing ConfigMap key prevents the container from starting, and the Pod reports a configuration error. Marking the reference optional allows startup with the variable absent.

Question 12Kubernetes Fundamentals

Which volume type shares data between containers in the same Pod and is deleted when the Pod is removed?

  1. persistentVolumeClaim
  2. hostPath
  3. emptyDir Correct answer.
  4. configMap

Explanation

An emptyDir volume is created when a Pod is assigned to a node and persists for the Pod's lifetime, making it suitable for sharing files between containers in that Pod. It is removed when the Pod is deleted.

Question 13Kubernetes Fundamentals

What is the role of a PersistentVolumeClaim?

  1. To mount a Secret into a container
  2. To provision a new node for storage
  3. To request storage with specific size and access modes from a PersistentVolume Correct answer.
  4. To define a StorageClass provisioner

Explanation

A PersistentVolumeClaim expresses a Pod's storage request, including capacity and access modes, and binds to a matching PersistentVolume. It is a request, not the storage itself.

Question 14Kubernetes Fundamentals

Which access mode allows a PersistentVolume to be mounted as read-write by many nodes simultaneously?

  1. ReadWriteOncePod
  2. ReadWriteOnce
  3. ReadOnlyMany
  4. ReadWriteMany Correct answer.

Explanation

ReadWriteMany permits the volume to be mounted read-write by multiple nodes at once. ReadWriteOnce restricts to a single node, and ReadWriteOncePod restricts to a single Pod.

Question 15Kubernetes Fundamentals

Which controller ensures that a specified number of identical Pods are running at all times?

  1. Job
  2. StatefulSet
  3. ReplicaSet Correct answer.
  4. DaemonSet

Explanation

A ReplicaSet maintains a stable set of replica Pods, creating or deleting Pods to match the desired count. Deployments typically manage ReplicaSets to provide rolling updates.

Question 16Kubernetes Fundamentals

Which workload controller is best suited for running one Pod on every eligible node, such as a log collector?

  1. CronJob
  2. DaemonSet Correct answer.
  3. ReplicaSet
  4. Deployment

Explanation

A DaemonSet ensures that a copy of a Pod runs on each eligible node, which fits node-level agents like log shippers. Replica-based controllers do not target every node.

Question 17Kubernetes Fundamentals

What does a Kubernetes Job guarantee about the Pods it manages?

  1. They are exposed through a Service automatically
  2. They run until the desired number of successful completions is reached Correct answer.
  3. They are pinned to a single node
  4. They are restarted indefinitely like a Deployment

Explanation

A Job runs Pods until a specified number of them complete successfully, then stops creating new ones. It is designed for finite, run-to-completion work rather than long-running services.

Question 18Kubernetes Fundamentals

What does a CronJob spec field schedule: "*/5 * * * *" mean?

  1. Five times per day
  2. Every 5 hours
  3. Every 5 minutes Correct answer.
  4. At 5 minutes past every hour

Explanation

CronJob schedules use standard cron syntax, where the first field is minutes. The pattern */5 in the minute field means the job runs every five minutes.

Question 19Kubernetes Fundamentals

Which statement describes the relationship between a Deployment and a ReplicaSet during a rolling update?

  1. The ReplicaSet updates its Pods in place without new Pods
  2. The Deployment creates a new ReplicaSet and scales the old one down gradually Correct answer.
  3. The Deployment deletes its ReplicaSet and creates Pods directly
  4. The Deployment edits the existing Pods' images directly

Explanation

A rolling update creates a new ReplicaSet with the updated Pod template and gradually scales it up while scaling the old ReplicaSet down. Pods are replaced rather than edited in place.

Question 20Kubernetes Fundamentals

Which mechanism restricts which nodes a Pod can be scheduled onto by requiring matching node labels?

  1. resource requests
  2. readiness probes
  3. nodeSelector Correct answer.
  4. Pod affinity

Explanation

nodeSelector constrains scheduling to nodes whose labels match the specified key-value pairs. Resource requests affect capacity-based scheduling rather than label matching.

Question 21Kubernetes Fundamentals

A node is tainted with dedicated=gpu:NoSchedule. Which Pod can be scheduled there?

  1. Only a Pod in the kube-system namespace
  2. Any Pod, because taints only affect eviction
  3. Only a Pod with a matching nodeSelector
  4. Only a Pod with a matching toleration Correct answer.

Explanation

A NoSchedule taint prevents scheduling unless the Pod declares a toleration matching the taint. nodeSelector alone does not satisfy a taint.

Question 22Kubernetes Fundamentals

What is the function of a liveness probe?

  1. To limit CPU usage of a container
  2. To delay Pod scheduling until dependencies are ready
  3. To decide when a container is ready to receive traffic
  4. To restart a container when it fails the probe Correct answer.

Explanation

A liveness probe checks whether a container is still healthy, and repeated failures cause the kubelet to restart it. Readiness probes, by contrast, control traffic eligibility.

Question 23Kubernetes Fundamentals

A container has a readiness probe that is failing while its liveness probe succeeds. What is the effect?

  1. The container is restarted repeatedly
  2. The Pod is evicted from the node
  3. The Pod is removed from Service endpoints Correct answer.
  4. The container is killed and rescheduled

Explanation

A failing readiness probe marks the Pod as not ready, so it is removed from Service endpoints and receives no traffic. Because the liveness probe passes, the container is not restarted.

Question 24Kubernetes Fundamentals

Which object provides a stable DNS name and persistent identity for each replica of a stateful application?

  1. DaemonSet
  2. Deployment
  3. ReplicaSet
  4. StatefulSet Correct answer.

Explanation

A StatefulSet gives each Pod a stable ordinal name and, combined with a headless Service, a stable DNS identity, along with ordered scaling. Deployments and ReplicaSets provide interchangeable Pods without stable identities.

Question 25Kubernetes Fundamentals

Which field in a Pod spec sets the maximum amount of CPU a container may use before being throttled?

  1. priorityClassName
  2. qosClass
  3. limits.cpu Correct answer.
  4. requests.cpu

Explanation

The limits.cpu field caps CPU usage, and the container is throttled when it reaches that limit. Requests describe the guaranteed minimum used for scheduling.

Question 26Kubernetes Fundamentals

Which Kubernetes component watches for newly created Pods that have no assigned node and selects a node for them to run on?

  1. kube-proxy
  2. kubelet
  3. etcd
  4. kube-scheduler Correct answer.

Explanation

The kube-scheduler watches for Pods with an empty nodeName and binds each to a suitable node based on resource requests, affinity, and taints. The kubelet runs on nodes and executes assigned Pods rather than choosing them.

Question 27Kubernetes Fundamentals

Which command displays the labels of the Pods in the default namespace?

  1. kubectl label pods --list
  2. kubectl describe pods --labels
  3. kubectl get pods --show-labels Correct answer.
  4. kubectl get pods -o name

Explanation

The --show-labels flag adds a LABELS column to the tabular output of kubectl get. It works with any resource type that supports labels.

Question 28Kubernetes Fundamentals

A Pod spec sets resources.requests.cpu to 500m. What does this value represent?

  1. A hard limit of 500 CPU cycles
  2. Half of one CPU Correct answer.
  3. 500 CPU cores
  4. 500 millicores per second of burst

Explanation

The suffix m means millicores, and 1000m equals one whole CPU. Therefore 500m is half of a single CPU. Requests influence scheduling, not a hard cap.

Question 29Kubernetes Fundamentals

Which kubectl subcommand creates a resource from a manifest file and records the applied configuration for later use by kubectl apply?

  1. kubectl run -f manifest.yaml
  2. kubectl apply -f manifest.yaml Correct answer.
  3. kubectl expose -f manifest.yaml
  4. kubectl create -f manifest.yaml

Explanation

kubectl apply performs a declarative create-or-update and stores the last applied configuration in an annotation. That record is what later apply operations use to compute a three-way merge.

Question 30Kubernetes Fundamentals

Which field of a Pod spec determines whether a container's filesystem writes survive a container restart within the same Pod?

  1. spec.terminationGracePeriodSeconds
  2. spec.activeDeadlineSeconds
  3. The container's writable layer is discarded on restart regardless of spec fields Correct answer.
  4. spec.restartPolicy

Explanation

A container's writable layer belongs to the container instance, so restarting the container starts from the image again. Data that must persist across restarts has to be written to a volume mounted into the container.

Question 31Kubernetes Fundamentals

A manifest contains two documents separated by a line with three hyphens. What does this allow?

  1. Defining multiple Kubernetes objects in a single file Correct answer.
  2. Marking the start of the required apiVersion field
  3. Splitting a long string across lines
  4. Adding comments to the YAML

Explanation

In YAML, three hyphens start a new document within a stream, and kubectl reads each document as a separate object. This lets one file declare several resources that are created together.

Question 32Kubernetes Fundamentals

What is the effect of setting imagePullPolicy to IfNotPresent on a container whose image tag is latest?

  1. The kubelet always contacts the registry to check for a newer latest image
  2. The kubelet uses the cached image if one exists locally, even though the tag is latest Correct answer.
  3. The Pod fails validation because latest requires Always
  4. The image is pulled only on the first node in the cluster

Explanation

An explicitly set imagePullPolicy overrides the default behavior. With IfNotPresent the kubelet uses a locally cached image and skips the registry lookup.

Question 33Kubernetes Fundamentals

Which object decouples Secret data from Pods so that credential rotation does not require editing Pod manifests?

  1. A Secret referenced by the Pod Correct answer.
  2. A projected service account token
  3. A downwardAPI fieldRef
  4. An emptyDir volume

Explanation

A Secret holds the credential data separately, and Pods reference it by name. Rotating the value means updating the Secret, and consumers that mount it receive the update without a manifest change.

Question 34Kubernetes Fundamentals

Which statement about a Service's clusterIP is accurate?

  1. It is a virtual IP that exists only in cluster networking rules, not on any interface Correct answer.
  2. It must be a publicly routable address
  3. It is assigned to the first node's primary network interface
  4. It is the same address as the Pod IP of the selected backend

Explanation

The clusterIP is a virtual address that kube-proxy or an equivalent dataplane programs into routing or load-balancing rules. No host owns the address, and traffic is redirected to selected Pod endpoints.

Question 35Kubernetes Fundamentals

A Pod must be scheduled only onto nodes that already carry the label disktype=ssd. Which Pod spec field expresses this requirement?

  1. spec.topologySpreadConstraints with the label key
  2. spec.tolerations matching disktype=ssd
  3. spec.affinity.nodeAffinity with a requiredDuringSchedulingIgnoredDuringExecution node selector term Correct answer.
  4. spec.nodeName set to the label value

Explanation

Required node affinity uses node label matching as a hard scheduling constraint, so the Pod is only placed on nodes with the matching label. The simpler spec.nodeSelector field achieves a similar hard match.

Question 36Kubernetes Fundamentals

What does a HorizontalPodAutoscaler do when its target metric exceeds the configured threshold?

  1. It restarts the Pods to clear their caches
  2. It adds nodes to the cluster
  3. It increases the CPU limit of each Pod
  4. It changes the replica count of the referenced workload Correct answer.

Explanation

The HPA controller computes a desired replica count from observed metrics and patches the scale subresource of the target workload. The workload controller then creates or removes Pods to reach that count.

Question 37Kubernetes Fundamentals

Which resource would you use to give a Deployment's Pods a stable, cluster-internal DNS name such as web.default.svc.cluster.local?

  1. An Ingress named web in the default namespace
  2. A Service named web in the default namespace Correct answer.
  3. A NetworkPolicy named web in the default namespace
  4. A ConfigMap named web in the default namespace

Explanation

Cluster DNS creates records of the form service.namespace.svc.cluster.local for Services. Selecting the Deployment's Pods makes the name resolve to the Service's virtual IP.

Question 38Kubernetes Fundamentals

What is the purpose of a PodDisruptionBudget?

  1. To reserve CPU and memory for critical Pods
  2. To prevent Pods from being scheduled on tainted nodes
  3. To limit how many Pods of a workload may be voluntarily evicted at once Correct answer.
  4. To cap the total number of Pods a Deployment may create

Explanation

A PodDisruptionBudget constrains voluntary disruptions such as node drains by requiring a minimum available or maximum unavailable count. Involuntary failures like node crashes are not governed by it.

Question 39Kubernetes Fundamentals

A container in a Pod exits with code 0 while restartPolicy is Always. What happens next?

  1. The kubelet restarts the container Correct answer.
  2. The Pod is marked Succeeded and left alone
  3. The Pod is deleted by the ReplicaSet
  4. The node cordons itself

Explanation

With restartPolicy Always the kubelet restarts the container regardless of exit code, applying a backoff delay between attempts. Only Never or OnFailure treat a zero exit as terminal.

Question 40Kubernetes Fundamentals

Which field holds the specification of the desired state of a Kubernetes object in a manifest?

  1. kind
  2. spec Correct answer.
  3. metadata
  4. status

Explanation

The spec section declares the desired state that the user wants, while status is filled in by controllers to report observed state. Metadata carries names, labels, and annotations.

Question 41Kubernetes Fundamentals

Which kubectl command shows the events and container status details for a single Pod named api?

  1. kubectl get pod api -o yaml
  2. kubectl exec pod api -- env
  3. kubectl logs pod api
  4. kubectl describe pod api Correct answer.

Explanation

kubectl describe prints a detailed view including conditions, container states, and the most recent events for the object. It is the standard first step for diagnosing scheduling or image problems.

Question 42Kubernetes Fundamentals

What is the function of a ServiceAccount in Kubernetes?

  1. It defines which nodes a Pod may run on
  2. It provides an identity for processes running in Pods to authenticate to the API server Correct answer.
  3. It stores TLS certificates for Ingress controllers
  4. It records audit events for API requests

Explanation

A ServiceAccount is a namespaced identity that Pods can assume, and its token is mounted for use by API clients in the Pod. Authorization for that identity is then granted through RBAC bindings.

Question 43Kubernetes Fundamentals

A Deployment is created with replicas: 3 and a ReplicaSet is managing the three Pods. One Pod is deleted manually. What is the result?

  1. The Deployment rolls back to the previous revision
  2. The remaining two Pods are also deleted and recreated together
  3. The ReplicaSet creates a replacement Pod Correct answer.
  4. Nothing happens until the next Deployment update

Explanation

A ReplicaSet continuously reconciles the actual Pod count with its desired count. When a Pod disappears, the controller creates a new one to restore the specified number.

Question 44Kubernetes Fundamentals

Which of the following is stored in etcd?

  1. The logs written by application containers
  2. Container image layers pulled by nodes
  3. The kubelet's local volume mounts
  4. The desired and observed state of cluster objects Correct answer.

Explanation

etcd is the cluster's consistent backing store, and the API server persists object definitions and status there. Runtime artifacts such as image layers, logs, and mounts live on nodes.

Question 45Kubernetes Fundamentals

A Pod manifest sets securityContext.runAsUser: 1000 at the Pod level and the container image's process expects to write to a directory owned by root. What is the likely outcome?

  1. The process runs as UID 1000 and may fail with permission denied on that directory Correct answer.
  2. The kubelet changes ownership of the image directories to UID 1000
  3. The container runs as root because the image overrides the Pod setting
  4. The Pod is rejected by the API server for conflicting security settings

Explanation

runAsUser at the Pod level sets the UID for the container process, overriding the image's default user. Files owned by root with restrictive modes then become unwritable by that process.

Question 46Kubernetes Fundamentals

A container has a memory limit of 256Mi and its working set grows past that value. What does the kubelet do?

  1. The limit is automatically raised to the next size
  2. The container is throttled until memory use drops
  3. The Pod is evicted to another node
  4. The container is OOM-killed and restarted according to the restart policy Correct answer.

Explanation

Exceeding a memory limit triggers the kernel out-of-memory killer for that container's cgroup. The kubelet then restarts the container according to the Pod's restart policy.

Question 47Kubernetes Fundamentals

Two Pods on different nodes must exchange traffic, and a NetworkPolicy in the destination Pod's namespace selects that Pod with an empty podSelector and no ingress rules. What is the effect?

  1. All ingress to the selected Pods is denied Correct answer.
  2. Only traffic from the same node is denied
  3. The policy has no effect because it has no rules
  4. Ingress from the same namespace is still allowed

Explanation

An empty podSelector selects all Pods in the namespace, and a policy with an ingress section but no rules allows no ingress. Once a Pod is selected by any policy, traffic not explicitly allowed is denied.

Question 48Kubernetes Fundamentals

A Deployment's rolling update is configured with maxSurge: 0 and maxUnavailable: 0. What happens when a new image is rolled out?

  1. The rollout cannot make progress because no Pods may be added or removed Correct answer.
  2. The update is rejected by the API server
  3. The update proceeds one Pod at a time with zero downtime
  4. The Deployment scales to zero and then back up

Explanation

Both values of zero leave no room to create a new Pod before removing an old one or vice versa. The rollout stalls because the controller cannot satisfy the constraints.

Question 49Kubernetes Fundamentals

A PersistentVolume is defined with a node affinity constraint for a single zone, and a Pod using its claim is scheduled on a node in a different zone. What is the likely result?

  1. The claim is deleted and recreated in the correct zone
  2. The Pod remains Pending because the volume cannot be attached in that zone Correct answer.
  3. The volume is silently migrated to the Pod's zone
  4. The Pod runs but reads and writes fail with I/O errors

Explanation

Volume node affinity restricts where a volume can be attached, and the scheduler honors those constraints for bound claims. A Pod that cannot be placed in the allowed zone stays Pending.

Question 50Kubernetes Fundamentals

Which object is the correct choice to expose a stateful database on a stable per-replica network identity inside the cluster?

  1. A NodePort Service
  2. An ExternalName Service
  3. A LoadBalancer Service
  4. A headless Service with clusterIP: None Correct answer.

Explanation

A headless Service returns individual endpoint addresses through DNS, which combined with a StatefulSet gives each replica a stable name. The other Service types provide a single virtual IP or external mapping.