I85PREP
⌘ K
KCA study materials
KCA study resources

KCA practice questions

One question at a time. Build your KCA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Kubernetes Core Concepts

Which Kubernetes object is the smallest deployable unit that can contain one or more containers sharing a network namespace and storage volumes?

  1. Deployment
  2. ReplicaSet
  3. Pod Correct answer.
  4. Namespace

Explanation

A Pod is the atomic scheduling unit in Kubernetes; containers inside it share an IP address, port space, and any declared volumes. Higher-level controllers such as Deployments and ReplicaSets manage Pods rather than replacing them as the unit.

Question 2Kubernetes Core Concepts

A container in a Pod exits with code 0 and the Pod's restartPolicy is Always. What does the kubelet do?

  1. It marks the Pod as Succeeded and stops restarting containers
  2. It evicts the Pod to another node
  3. It restarts the container according to the backoff schedule Correct answer.
  4. It deletes the Pod and the owning controller creates a replacement

Explanation

With restartPolicy Always the kubelet restarts containers regardless of exit code, applying an exponential backoff delay between attempts. A zero exit status does not change that behavior for this policy.

Question 3Kubernetes Core Concepts

Which field in a Pod specification determines the DNS name that other Pods use to reach a Service?

  1. The Pod's spec.subdomain
  2. The Pod's spec.hostname
  3. The Service's metadata.name combined with its namespace Correct answer.
  4. The container's name

Explanation

A Service gets a cluster DNS record of the form <service-name>.<namespace>.svc.cluster.local, derived from its metadata.name and namespace. Pod hostname and subdomain fields only affect the Pod's own DNS entries, typically when a headless Service is used.

Question 4Kubernetes Core Concepts

What is the default value of the restartPolicy field for a Pod created without an explicit setting?

  1. Always Correct answer.
  2. Never
  3. IfNotPresent
  4. OnFailure

Explanation

The API server defaults restartPolicy to Always when the field is omitted. This is why most long-running workloads restart containers automatically after a crash.

Question 5Kubernetes Core Concepts

A Deployment is created with replicas: 3 and a ReplicaSet is running 3 Pods. An operator manually deletes one Pod. What happens next?

  1. The Deployment rolls back to the previous revision
  2. The remaining two Pods are rescheduled to other nodes
  3. Nothing happens until the next Deployment update
  4. The ReplicaSet creates a new Pod to restore the desired count Correct answer.

Explanation

The ReplicaSet controller continuously reconciles observed state with the desired replica count, so deleting a Pod triggers creation of a replacement. The Deployment is not involved in that per-Pod reconciliation loop.

Question 6Kubernetes Core Concepts

Which statement describes the relationship between a Deployment and a ReplicaSet during a rolling update?

  1. The Deployment deletes the old ReplicaSet before creating any new Pods
  2. The Deployment edits the existing ReplicaSet's Pod template in place
  3. The Deployment converts the old ReplicaSet into a StatefulSet
  4. The Deployment creates a new ReplicaSet and scales the old one down as the new one scales up Correct answer.

Explanation

A rolling update creates a new ReplicaSet with the updated Pod template and gradually shifts replicas from the old ReplicaSet to the new one. The old ReplicaSet is retained with zero replicas so a rollback can scale it back up.

Question 7Kubernetes Core Concepts

Which Namespace scope statement is accurate for a Secret referenced by a Pod?

  1. The Secret must exist in the same Namespace as the Pod Correct answer.
  2. The Secret must exist in the default Namespace
  3. The Secret must exist in the kube-system Namespace
  4. The Secret may exist in any Namespace without restriction

Explanation

Secrets and ConfigMaps are namespaced objects, and a Pod can only reference them from its own Namespace. Cross-namespace references are not supported for these volume and environment sources.

Question 8Kubernetes Core Concepts

What does a Kubernetes Service of type ClusterIP provide by default?

  1. A host-level port mapping to a single Pod
  2. A public cloud load balancer with an external IP
  3. A stable virtual IP and DNS name that load-balance traffic to selected Pods Correct answer.
  4. A direct node port exposed on every node

Explanation

ClusterIP is the default Service type and assigns a virtual IP reachable only inside the cluster, with kube-proxy or an equivalent dataplane distributing traffic to endpoints. It provides stable discovery in front of ephemeral Pod IPs.

Question 9Kubernetes Core Concepts

A Service has selector app=web but no Pods carry that label. What is the observable result when clients call the Service IP?

  1. Traffic is routed to any Pod in the Namespace
  2. The Service is deleted by the endpoint controller
  3. The Service automatically adds the label to matching Pods
  4. Connections fail because the Service has no endpoints Correct answer.

Explanation

The endpoints controller populates EndpointSlices only from Pods matching the selector. With no matching Pods the Service has no backends, so connections to the ClusterIP are rejected or time out.

Question 10Kubernetes Core Concepts

Which probe should be used to prevent a container from receiving traffic until it has finished initialization, while keeping the container running during that time?

  1. A liveness probe
  2. A startup probe
  3. A readiness probe Correct answer.
  4. A preStop hook

Explanation

Readiness probes control whether a Pod is listed as ready and included in Service endpoints; failing readiness removes it from traffic without restarting it. Liveness probes instead restart unhealthy containers.

Question 11Kubernetes Core Concepts

What is the purpose of a Kubernetes ConfigMap?

  1. To schedule Pods onto specific nodes
  2. To store encrypted credentials for cluster components
  3. To define resource quotas for a Namespace
  4. To store non-confidential configuration data as key-value pairs consumable by Pods Correct answer.

Explanation

ConfigMaps hold configuration data separate from image content and can be injected as environment variables, command-line arguments, or mounted files. They are intended for non-sensitive data, with Secrets used for credentials.

Question 12Kubernetes Core Concepts

A container requests 500m CPU and has a limit of 1 CPU. Which behavior is expected under sustained CPU demand?

  1. The container is throttled at 1 CPU and is not evicted for CPU overuse Correct answer.
  2. The container is killed immediately when it reaches 500m
  3. The container is rescheduled to a node with more capacity
  4. The container receives unlimited CPU beyond its limit

Explanation

CPU is a compressible resource, so the cgroup enforces the limit by throttling rather than terminating the container. The request influences scheduling and relative share, while the limit caps actual usage.

Question 13Kubernetes Core Concepts

Which Kubernetes object should be used to run a batch task to completion exactly once, retrying on failure up to a configured number of attempts?

  1. A DaemonSet
  2. A StatefulSet
  3. A Job Correct answer.
  4. A Deployment

Explanation

Jobs run Pods until a specified number of successful completions is reached and support backoffLimit for retries. Deployments, DaemonSets, and StatefulSets are designed for long-running workloads that should not terminate.

Question 14Kubernetes Core Concepts

What distinguishes a StatefulSet from a Deployment in terms of Pod identity?

  1. StatefulSet Pods cannot use PersistentVolumes
  2. StatefulSet Pods share a single IP address
  3. StatefulSet Pods get stable ordinal names and persistent identity across rescheduling Correct answer.
  4. StatefulSet Pods are always scheduled to the control-plane node

Explanation

StatefulSet Pods are named with a stable ordinal index such as web-0 and web-1 and retain identity and storage associations when recreated. Deployments instead treat Pods as interchangeable and assign random name suffixes.

Question 15Kubernetes Core Concepts

A DaemonSet is created in a cluster. What placement guarantee does it provide?

  1. One Pod runs on every eligible node, including new nodes as they join Correct answer.
  2. Exactly one Pod runs in the entire cluster
  3. Pods run only on nodes with the control-plane role
  4. Pods are spread evenly across Namespaces

Explanation

The DaemonSet controller creates a Pod on each node that satisfies its scheduling constraints and adds Pods to nodes that later join. This pattern suits node-level agents such as log shippers or network plugins.

Question 16Kubernetes Core Concepts

Which mechanism allows a Pod to reference a PersistentVolumeClaim so that its data survives Pod deletion?

  1. Using a hostPath volume pointing at /tmp
  2. Using an emptyDir volume
  3. Declaring a persistentVolumeClaim volume in the Pod spec and mounting it Correct answer.
  4. Using a configMap volume

Explanation

A persistentVolumeClaim volume binds the Pod to a PVC whose backing PersistentVolume has a lifecycle independent of the Pod. Recreating the Pod with the same claim reattaches the same storage.

Question 17Kubernetes Core Concepts

What is the effect of setting imagePullPolicy to IfNotPresent on a container using the tag latest?

  1. The kubelet uses the cached image if present, but the API server defaults latest images to Always when the policy is unset Correct answer.
  2. The image is always pulled from the registry on every start
  3. The image is never pulled and the Pod fails
  4. The image is pulled only when the node reboots

Explanation

IfNotPresent instructs the kubelet to skip pulling when a local copy exists. However, when imagePullPolicy is omitted, the API server defaults it to Always for images tagged latest, so an explicit IfNotPresent is needed to change that behavior.

Question 18Kubernetes Core Concepts

In a multi-container Pod, how do the containers communicate over the network?

  1. Through an overlay tunnel between containers
  2. Through localhost because they share the Pod's network namespace Correct answer.
  3. Through the node's public IP address
  4. Through a dedicated Service created for each container

Explanation

All containers in a Pod share one network namespace and IP address, so they reach each other on localhost using distinct ports. This is the basis of the sidecar pattern.

Question 19Kubernetes Core Concepts

A Pod is stuck in Pending state and the scheduler reports no nodes available. Which condition best explains this?

  1. The readiness probe is failing
  2. The Pod's Service has no endpoints
  3. The container image failed to pull
  4. No node satisfies the Pod's resource requests and scheduling constraints Correct answer.

Explanation

Pending with an unschedulable condition indicates the scheduler could not find a node meeting requests, affinity, taints, or other constraints. Image pull and probe failures occur after scheduling, during container startup.

Question 20Kubernetes Core Concepts

Which label selector syntax selects Pods where the label env equals prod and tier equals frontend?

  1. env:prod/tier:frontend
  2. env==prod;tier==frontend
  3. env in (prod) and tier in (frontend)
  4. env=prod,tier=frontend Correct answer.

Explanation

Equality-based selectors join requirements with commas, and all requirements must match. Set-based selectors use the in, notin, and exists operators instead.

Question 21Kubernetes Core Concepts

What happens to a Pod with a single container that exceeds its memory limit?

  1. The container is terminated with an OOMKilled reason and restarted per its restart policy Correct answer.
  2. The container is throttled and continues running
  3. The Pod is migrated to another node
  4. The limit is automatically raised to fit usage

Explanation

Memory is an incompressible resource, so the kernel OOM killer terminates the container when it exceeds its limit. The kubelet then applies the Pod's restart policy, often producing CrashLoopBackOff if the condition repeats.

Question 22Kubernetes Core Concepts

Which statement about Namespaces is correct?

  1. Namespaces provide network isolation by default
  2. Deleting a Namespace leaves its contained objects intact
  3. Nodes and PersistentVolumes are namespaced objects
  4. Most namespaced objects must have unique names within a Namespace, and names can repeat across Namespaces Correct answer.

Explanation

Names provide scoping within a Namespace, so two Namespaces may each contain a Deployment named web. Nodes and PersistentVolumes are cluster-scoped and therefore not namespaced.

Question 23Kubernetes Core Concepts

A team needs a Service that exposes an application on a fixed port on every node's IP in addition to the ClusterIP. Which Service type meets this requirement?

  1. NodePort Correct answer.
  2. ClusterIP
  3. LoadBalancer
  4. ExternalName

Explanation

NodePort allocates a port in the configured range and forwards it on every node to the Service's endpoints while still providing a ClusterIP. ExternalName only returns a CNAME and does not expose ports.

Question 24Kubernetes Core Concepts

What is the primary role of the kube-scheduler in a Kubernetes cluster?

  1. Serving the Kubernetes API over HTTPS
  2. Running container runtimes on worker nodes
  3. Assigning newly created Pods to nodes based on resource and policy constraints Correct answer.
  4. Storing cluster state in etcd

Explanation

The scheduler watches for unscheduled Pods and selects a suitable node by filtering and scoring candidates against requests, affinity, taints, and other rules. It does not start containers; the kubelet on the chosen node does that.

Question 25Kubernetes Core Concepts

A node is marked with taint dedicated=gpu:NoSchedule. Which Pod specification allows scheduling onto that node?

  1. A label of dedicated=gpu on the Pod
  2. A nodeSelector of dedicated=gpu
  3. A toleration for dedicated=gpu with effect NoSchedule Correct answer.
  4. An annotation of dedicated=gpu

Explanation

Taints repel Pods unless the Pod declares a matching toleration with the same key, value, and effect. A nodeSelector or label on the Pod does not override a taint.

Question 26Kubernetes Core Concepts

Which Kubernetes component watches for newly created Pod objects that have no nodeName assigned and binds them to a suitable node?

  1. kubelet
  2. kube-scheduler Correct answer.
  3. kube-proxy
  4. kube-apiserver

Explanation

The kube-scheduler watches for Pods with an empty nodeName and chooses a node for each based on resource requests, affinity, taints, and other predicates, then records the binding. The kubelet acts only after a Pod is already assigned to its node.

Question 27Kubernetes Core Concepts

What is the default restartPolicy of a Pod created directly by a user without specifying one?

  1. Always Correct answer.
  2. UnlessStopped
  3. Never
  4. OnFailure

Explanation

When restartPolicy is omitted, the API server defaults it to Always, so containers that exit are restarted by the kubelet. OnFailure and Never must be set explicitly.

Question 28Kubernetes Core Concepts

A Pod spec sets terminationGracePeriodSeconds to 5. What does the kubelet do when the Pod is deleted?

  1. It sends SIGTERM, waits up to 5 seconds, then sends SIGKILL to any remaining container processes Correct answer.
  2. It rejects the deletion until the containers exit on their own
  3. It sends SIGKILL immediately without any grace period
  4. It waits 5 seconds before sending SIGTERM to the container

Explanation

On deletion the kubelet runs the termination sequence: a preStop hook if defined, then SIGTERM, then SIGKILL once terminationGracePeriodSeconds elapses. The value caps how long the container has to shut down cleanly.

Question 29Kubernetes Core Concepts

Which field in a container spec defines the maximum amount of memory the container may consume before being subject to enforcement?

  1. resources.limits.memory Correct answer.
  2. securityContext.runAsUser
  3. resources.limits.cpu
  4. resources.requests.memory

Explanation

resources.limits.memory sets the hard ceiling on memory for the container, and exceeding it typically results in the container being OOM-killed. resources.requests.memory only influences scheduling and eviction priority.

Question 30Kubernetes Core Concepts

Which object provides a stable virtual IP and DNS name that load-balances traffic across a set of matching Pods?

  1. NetworkPolicy
  2. PersistentVolume
  3. LimitRange
  4. Service Correct answer.

Explanation

A Service selects Pods by label and gives clients a stable ClusterIP and DNS name, with kube-proxy distributing connections to the backing endpoints. Pods themselves are ephemeral and their IPs change.

Question 31Kubernetes Core Concepts

Which annotation on a Pod template causes kubectl rollout to record the reason for each revision of a Deployment?

  1. kubernetes.io/description
  2. kubernetes.io/change-cause Correct answer.
  3. kubectl.kubernetes.io/last-applied-configuration
  4. deployment.kubernetes.io/revision

Explanation

The kubernetes.io/change-cause annotation stores a human-readable reason that appears in rollout history output. The revision annotation is set by the controller to number ReplicaSets, not to record intent.

Question 32Kubernetes Core Concepts

What is the effect of a Namespace-scoped ResourceQuota that sets requests.cpu to 10?

  1. The sum of CPU requests across Pods in that namespace may not exceed 10 cores Correct answer.
  2. The namespace may contain at most 10 Pods
  3. Each individual Pod in the namespace may request at most 10 CPU
  4. Any node hosting Pods from that namespace must have at least 10 CPU

Explanation

A ResourceQuota constrains the aggregate of the named resource across all objects in the namespace. requests.cpu therefore caps the total CPU requests admitted, not any single Pod's value.

Question 33Kubernetes Core Concepts

Which kubectl command streams the current logs of a running container in a Pod named web-1?

  1. kubectl describe pod web-1
  2. kubectl get pod web-1 -o yaml
  3. kubectl logs -f web-1 Correct answer.
  4. kubectl exec web-1 -- logs

Explanation

kubectl logs retrieves container output, and the -f flag follows the stream as new lines appear. The other commands return object metadata or state rather than log content.

Question 34Kubernetes Core Concepts

A Pod's container has a readiness probe that keeps failing while the container process itself is running. What is the effect on Service traffic to that Pod?

  1. The Pod is removed from the Service's endpoints, so it receives no traffic until the probe succeeds Correct answer.
  2. The Pod is evicted from the node and rescheduled elsewhere
  3. The container is restarted by the kubelet after three failed probes
  4. The Service stops forwarding traffic to every Pod behind it

Explanation

Readiness controls endpoint membership: a failing readiness probe marks the Pod NotReady and removes it from Service endpoints without restarting the container. Liveness, by contrast, triggers restarts.

Question 35Kubernetes Core Concepts

A Deployment with replicas 3 uses RollingUpdate with maxUnavailable 1 and maxSurge 0. During an update, how many Pods of the new version can exist at once at most?

  1. One, because only a single new Pod is created per revision
  2. Two, because one old Pod must be removed before a new one is added Correct answer.
  3. Three, because maxSurge 0 still allows one extra Pod
  4. Zero, because maxSurge 0 blocks the rollout entirely

Explanation

With maxSurge 0 no Pods beyond the desired count may exist, and maxUnavailable 1 permits only one Pod below it. The controller therefore terminates one old Pod before creating one new Pod, so at most two new-version Pods run at a time during the transition.

Question 36Kubernetes Core Concepts

A PersistentVolume has reclaimPolicy Retain and its bound PersistentVolumeClaim is deleted. What happens to the PersistentVolume and its data?

  1. The volume is wiped and returned to the Available pool
  2. The volume is immediately rebound to any new claim that matches its capacity
  3. The volume moves to Released and the data remains until an administrator handles it Correct answer.
  4. The volume is deleted along with the backing storage

Explanation

Retain keeps the volume and its data after the claim is gone, placing it in the Released phase. The volume is not automatically reused, so an administrator must manually clean up or re-create the claim binding.

Question 37Kubernetes Core Concepts

A ConfigMap is mounted as a volume into a running Pod and later edited with kubectl. What do the files inside the container show?

  1. The files keep the original values until the Pod is deleted and recreated
  2. The files are updated only if the Pod is restarted by the kubelet
  3. The mounted files become empty because the ConfigMap changed
  4. The updated values appear after the kubelet sync period, without restarting the Pod Correct answer.

Explanation

Volume-mounted ConfigMap keys are refreshed by the kubelet on its sync loop, so edits propagate into the container filesystem after a short delay. Environment variables sourced from a ConfigMap, in contrast, never update in a running container.

Question 38Kubernetes Core Concepts

Which statement accurately describes how a headless Service differs from a default ClusterIP Service?

  1. It forwards traffic only to Pods on the same node as the client
  2. It exposes the Service on a random high port on each node
  3. It requires an external load balancer to assign addresses
  4. It has no cluster IP allocated, and DNS returns the individual Pod addresses behind the selector Correct answer.

Explanation

Setting clusterIP to None makes the Service headless, so no virtual IP or proxying occurs and DNS A records point directly at each ready Pod IP. This is commonly used for StatefulSet peer discovery.

Question 39Kubernetes Core Concepts

A Pod requests 2 GiB of memory and every node in the cluster has 1.5 GiB allocatable memory. What is the result?

  1. The Pod is placed on a node and the request is silently reduced
  2. The Pod stays Pending and the scheduler emits a FailedScheduling event citing insufficient memory Correct answer.
  3. The Pod runs but is throttled to the largest node's capacity
  4. The scheduler places the Pod and the kubelet rejects it at container start

Explanation

The scheduler filters out nodes whose allocatable resources cannot satisfy the Pod's requests, so no feasible node remains and the Pod stays Pending with a FailedScheduling event. Requests are never silently reduced.

Question 40Kubernetes Core Concepts

Which probe configuration correctly checks an HTTP endpoint on port 8080 at path /healthz every 10 seconds?

  1. httpGet with path /healthz and port 8080, plus periodSeconds 10 Correct answer.
  2. tcpSocket with port 8080, plus periodSeconds 10
  3. exec running curl /healthz, plus initialDelaySeconds 10
  4. grpc with port 8080, plus timeoutSeconds 10

Explanation

An HTTP health check is expressed with an httpGet action naming the path and port, and periodSeconds sets the interval between checks. The other actions test different protocols or misuse timing fields.

Question 41Kubernetes Core Concepts

A container in a multi-container Pod writes a file to an emptyDir volume. What happens to that data when the Pod is deleted?

  1. The data is permanently deleted with the Pod Correct answer.
  2. The data is retained for the duration set by the Pod's grace period
  3. The data is copied to the container image layer
  4. The data persists on the node and is reused by the next Pod

Explanation

An emptyDir volume exists only for the lifetime of the Pod and is removed when the Pod is deleted from the node. It is intended for scratch space shared between containers, not durable storage.

Question 42Kubernetes Core Concepts

Which selector matches a Pod labeled with app=api and track=canary but not a Pod labeled only app=api?

  1. matchExpressions with key track, operator Exists
  2. matchLabels with app: api only
  3. matchLabels with both app: api and track: canary Correct answer.
  4. matchExpressions with key app, operator In, values [api]

Explanation

A matchLabels map requires every listed label to be present with the given value, so including both keys excludes Pods missing track. Selectors listing only app or only track are satisfied by the single-label Pod.

Question 43Kubernetes Core Concepts

A Deployment's Pods are Running and Ready, but requests to the Service time out. Which cause is consistent with the Service having endpoints while traffic still fails?

  1. The targetPort in the Service does not match the port the container actually listens on Correct answer.
  2. The Pods lack a readiness probe definition
  3. The Deployment strategy is set to Recreate
  4. The Service selector matches no Pods at all

Explanation

When endpoints exist but connections fail, the likely fault is a port mismatch: the Service forwards to targetPort, which must equal the container's listening port. A selector matching no Pods would instead produce an empty endpoint list.

Question 44Kubernetes Core Concepts

A Pod must run only on nodes labeled disktype=ssd. Which configuration enforces this requirement?

  1. nodeSelector with disktype: ssd Correct answer.
  2. a toleration for disktype=ssd:NoSchedule
  3. nodeName set to the hostname of an SSD node
  4. topologySpreadConstraints with topologyKey kubernetes.io/hostname

Explanation

nodeSelector restricts scheduling to nodes whose labels match every listed key-value pair, so disktype: ssd enforces the requirement. nodeName bypasses the scheduler and pins a specific node without label logic.

Question 45Kubernetes Core Concepts

A StatefulSet named db with serviceName db-headless and replicas 3 creates Pods. Which Pod name and DNS identity is expected?

  1. Pods named db-<random hash>, each with a DNS name assigned at startup
  2. Pods named db-1 through db-3, with DNS names derived from their node hostnames
  3. Pods named db-0, db-1, db-2, each with a stable DNS name such as db-0.db-headless Correct answer.
  4. Pods named db-0 through db-2, all sharing one DNS name that rotates among them

Explanation

StatefulSet Pods receive ordinal names starting at zero and keep them across restarts, and the governing headless Service gives each Pod a stable per-Pod DNS record. This stable identity is the key difference from Deployment Pods.

Question 46Kubernetes Core Concepts

A Pod has two containers, one writing to a shared emptyDir and one reading from it. Which statement about their startup and lifecycle is correct?

  1. They start strictly in the order listed in the spec
  2. The second container starts only after the first exits successfully
  3. Each container gets its own separate emptyDir instance
  4. They start in parallel by default and are restarted together if the Pod is deleted Correct answer.

Explanation

Regular containers in a Pod have no ordering guarantee and start concurrently, and the emptyDir volume is shared by all containers in the Pod. Ordering requires init containers or native sidecar containers.

Question 47Kubernetes Core Concepts

A NetworkPolicy in namespace app selects Pods with role=db and allows ingress only from Pods labeled role=api in the same namespace. What is the result for a Pod labeled role=web in that namespace?

  1. Its connections are denied only if a default-deny policy also exists
  2. Its connections are allowed because both Pods share the namespace
  3. Its connections are allowed because NetworkPolicy applies only to egress
  4. Its connections to the db Pods are denied because the policy isolates those Pods and lists only api as allowed Correct answer.

Explanation

Once a NetworkPolicy selects a Pod for ingress, only traffic matching its allow rules is permitted, so any source not labeled role=api is blocked. Namespace co-location alone does not grant access.

Question 48Kubernetes Core Concepts

A cluster runs three nodes with taints dedicated=batch:NoSchedule. Which Pod spec allows scheduling onto those nodes?

  1. A podAntiAffinity rule against dedicated=batch
  2. A nodeSelector of dedicated: batch without any toleration
  3. A toleration for key dedicated, value batch, effect NoSchedule Correct answer.
  4. An affinity rule with requiredDuringSchedulingIgnoredDuringExecution on dedicated

Explanation

A NoSchedule taint repels Pods unless they carry a matching toleration, which must specify the key, value, and effect. A toleration permits scheduling but does not by itself force placement on the tainted node.

Question 49Kubernetes Core Concepts

A Deployment's Pods are being killed repeatedly with exit code 137 shortly after start, and kubectl describe shows Last State Terminated with Reason OOMKilled. Which change addresses the root cause?

  1. Add a liveness probe with a longer initialDelaySeconds
  2. Increase the container's CPU limit
  3. Change the restartPolicy to Never
  4. Raise the container's memory limit or reduce its memory consumption Correct answer.

Explanation

OOMKilled indicates the container exceeded its memory limit and was terminated by the kernel. The remedy is to give the workload more memory headroom or reduce usage; probe timing and CPU limits do not change memory enforcement.

Question 50Kubernetes Core Concepts

A Deployment uses strategy Recreate while a Service fronts it. What is the observable impact during a rollout?

  1. The Service keeps routing to terminated Pods until their IPs are reused
  2. All existing Pods are terminated before new ones are created, so the Service has no endpoints for a period Correct answer.
  3. Old and new Pods serve traffic simultaneously until the new version is fully ready
  4. The rollout pauses until an operator approves the new ReplicaSet

Explanation

The Recreate strategy tears down the old ReplicaSet completely before creating the new one, producing a window with no ready backends. RollingUpdate is the strategy that maintains availability by overlapping old and new Pods.