View Full Linux Foundation KCNA Exam Dumps and Practice Test Dumps.

 

Question 101

Which Kubernetes object is used to store non-confidential configuration data that can be consumed by Pods?

1. Secret
2. ConfigMap
3. ServiceAccount
4. PersistentVolume

Correct Answer: 2

Explanation

A ConfigMap stores non-confidential configuration data separately from application container images. Applications can consume ConfigMap values through environment variables, command-line arguments, or mounted files. This allows the same container image to be reused across multiple environments with different configuration settings. ConfigMaps should not normally contain passwords, tokens, or other sensitive information because Kubernetes Secrets are intended for that purpose. Separating configuration from application code also makes deployments easier to maintain. ConfigMaps are therefore a fundamental Kubernetes mechanism for managing application configuration in a flexible and reusable way.

Question 102

Which Kubernetes object provides a way for Pods to access sensitive configuration data such as passwords and tokens?

1. Namespace
2. ConfigMap
3. Secret
4. Service

Correct Answer: 3

Explanation

A Secret is a Kubernetes resource intended for storing sensitive information such as passwords, tokens, and authentication credentials. Secrets can be made available to containers through environment variables or mounted files. Access to Secrets should be controlled using appropriate RBAC permissions, and additional encryption protections may be configured for data stored in etcd. ConfigMaps are designed for non-sensitive configuration, Namespaces provide resource organization, and Services provide network access. Secrets therefore provide the standard Kubernetes resource for separating sensitive configuration from application images and ordinary configuration data.

Question 103

Which Kubernetes command displays the Pods running in the current namespace?

1. kubectl get pods
2. kubectl show pods
3. kubectl list pods
4. kubectl pods

Correct Answer: 1

Explanation

The kubectl get pods command lists Pods in the current namespace. It commonly displays information such as Pod name, readiness, status, restart count, and age. Administrators frequently use this command when checking whether application workloads are running correctly. A specific namespace can be selected with the appropriate namespace option, allowing users to inspect resources outside the current namespace. Other kubectl commands provide additional information, such as kubectl describe pod for detailed resource information and kubectl logs for container output.

Question 104

Which Kubernetes command provides detailed information about a specific Pod, including events?

1. kubectl logs
2. kubectl describe pod
3. kubectl inspect pod
4. kubectl detail pod

Correct Answer: 2

Explanation

The kubectl describe pod command displays detailed information about a Pod and its related resources. The output can include container states, assigned node, labels, volumes, conditions, and recent Kubernetes events. This makes the command particularly useful when troubleshooting Pods that are pending, repeatedly restarting, or failing to start. kubectl logs focuses on application or container output, while the other listed commands are not standard kubectl commands for this purpose. Understanding the difference between logs and resource descriptions is important when diagnosing Kubernetes workload problems.

Question 105

Which Kubernetes command is commonly used to view the output generated by a container in a Pod?

1. kubectl output
2. kubectl show
3. kubectl logs
4. kubectl events

Correct Answer: 3

Explanation

The kubectl logs command retrieves log output from containers running in Pods. It is commonly used to investigate application errors, startup problems, unexpected behavior, and other runtime issues. If a Pod contains multiple containers, the appropriate container can be specified. Logs provide application-level information, while kubectl describe provides Kubernetes resource details and events. The exact availability and retention of logs depend on the container runtime and cluster logging architecture. For basic troubleshooting, however, kubectl logs is one of the most frequently used Kubernetes commands.

Question 106

Which Kubernetes resource is used to define a set of permissions within a specific namespace?

1. ClusterRole
2. Role
3. ServiceAccount
4. Namespace

Correct Answer: 2

Explanation

A Role defines permissions for Kubernetes resources within a specific namespace. It specifies which API resources can be accessed and which actions, such as get, list, create, update, or delete, are allowed. A Role does not automatically grant access; it must be associated with an identity through a RoleBinding. ClusterRole is used for cluster-wide permission definitions or reusable permissions, while ServiceAccounts provide identities. Understanding the relationship between Role, RoleBinding, and ServiceAccount is essential when implementing namespace-level RBAC controls.

Question 107

Which Kubernetes RBAC object connects a Role to a user, group, or ServiceAccount within a namespace?

1. RoleBinding
2. ClusterRole
3. ClusterRoleBinding
4. ConfigMap

Correct Answer: 1

Explanation

A RoleBinding grants the permissions defined by a Role to specified subjects such as users, groups, or ServiceAccounts within a namespace. It can also reference a ClusterRole, while the permissions granted by that RoleBinding remain namespace-scoped. ClusterRoleBinding is different because it grants permissions at the cluster level. ConfigMaps store configuration and do not provide authorization. RoleBindings are therefore an important part of Kubernetes RBAC because defining a Role alone does not grant permissions until that Role is bound to an identity.

Question 108

Which Kubernetes object provides a logical boundary for namespaced resources?

1. Node
2. Namespace
3. Service
4. Container

Correct Answer: 2

Explanation

A Namespace provides a logical boundary for many Kubernetes resources. It allows administrators to organize resources into separate environments, teams, or projects within the same cluster. Namespaces can also be used with RBAC permissions and ResourceQuotas to control access and resource consumption. A Node represents compute capacity, a Service provides networking, and a Container represents an application process running within a Pod. Using namespaces can make large clusters easier to manage by separating resources while still allowing multiple workloads to share the same underlying infrastructure.

Question 109

Which Kubernetes object is primarily responsible for exposing Pods through a stable network endpoint?

1. Job
2. Service
3. Secret
4. CronJob

Correct Answer: 2

Explanation

A Kubernetes Service provides a stable network endpoint for accessing a group of Pods selected by labels. Because Pod IP addresses can change when Pods are recreated, applications should generally communicate through Services rather than relying on individual Pod addresses. Services provide service discovery and load distribution across matching backend Pods. Jobs and CronJobs manage finite or scheduled workloads, while Secrets store sensitive configuration. The Service abstraction therefore helps applications communicate reliably even when individual Pods are dynamically created, removed, or rescheduled.

Question 110

Which Service type is commonly used to expose a Kubernetes application through an external cloud provider’s load balancer?

1. ClusterIP
2. NodePort
3. LoadBalancer
4. ExternalName

Correct Answer: 3

Explanation

The LoadBalancer Service type requests external load-balancing functionality from the infrastructure or cloud environment when supported. The platform can provision an external load balancer and associate it with the Kubernetes Service, allowing clients outside the cluster to reach the application. ClusterIP provides internal access, NodePort exposes a port on nodes, and ExternalName maps a Service to an external DNS name. The exact implementation of LoadBalancer Services depends on the Kubernetes environment and its cloud or infrastructure integration.

Question 111

Which Kubernetes object is designed to run a specified number of identical Pods and support rolling updates?

1. Deployment
2. Job
3. ConfigMap
4. ServiceAccount

Correct Answer: 1

Explanation

A Deployment manages a set of replicated Pods and provides mechanisms for rolling updates and rollback of application versions. It normally manages ReplicaSets, which in turn manage the actual Pods. When a new container image or configuration is deployed, the Deployment controller can gradually replace old Pods with new ones according to its update strategy. Jobs are intended for finite tasks, ConfigMaps store configuration, and ServiceAccounts provide identities. Deployments are therefore one of the primary Kubernetes workload resources for continuously running stateless applications.

Question 112

Which Kubernetes workload is designed for applications requiring stable Pod identities and persistent storage?

1. DaemonSet
2. Job
3. StatefulSet
4. CronJob

Correct Answer: 3

Explanation

A StatefulSet is designed for stateful workloads that require stable identities, predictable Pod names, and often persistent storage. StatefulSet Pods receive stable ordinal identities and can be associated with individual PersistentVolumeClaims. This makes StatefulSets useful for distributed databases and other applications where each instance may have a distinct identity or data set. DaemonSets run Pods on eligible nodes, while Jobs and CronJobs handle finite or scheduled tasks. StatefulSets therefore provide capabilities that are not typically required for interchangeable stateless application replicas.

Question 113

Which Kubernetes workload ensures that a copy of a Pod runs on each eligible node?

1. StatefulSet
2. DaemonSet
3. Deployment
4. Job

Correct Answer: 2

Explanation

A DaemonSet ensures that a Pod is scheduled on each node that matches its scheduling requirements. When a new eligible node joins the cluster, the DaemonSet controller can create a corresponding Pod there. When a node is removed, the associated DaemonSet Pod is also no longer needed. DaemonSets are commonly used for node-level monitoring agents, logging agents, and networking components. Deployments manage replicated applications, StatefulSets manage stateful workloads, and Jobs handle finite operations. Therefore, DaemonSet is the appropriate workload type for node-wide agents.

Question 114

Which Kubernetes resource runs a finite task until it successfully completes?

1. Service
2. Job
3. Deployment
4. ConfigMap

Correct Answer: 2

Explanation

A Job creates one or more Pods to perform a finite task and tracks whether the required work completes successfully. Jobs are suitable for activities such as batch processing, database migrations, data transformations, and administrative operations. Depending on its configuration, a Job can retry failed Pods and require a particular number of successful completions. Deployments are intended for continuously running workloads, Services provide networking, and ConfigMaps provide configuration. Jobs therefore represent Kubernetes workloads where successful completion, rather than continuous availability, is the primary objective.

Question 115

Which Kubernetes resource creates Jobs according to a recurring schedule?

1. CronJob
2. ReplicaSet
3. StatefulSet
4. Service

Correct Answer: 1

Explanation

A CronJob creates Jobs according to a defined schedule. It is useful for recurring operations such as backups, reports, cleanup tasks, and periodic data processing. Each scheduled execution creates a Job, which then creates the Pods needed to perform the task. CronJobs support scheduling expressions that determine when Jobs should be created. ReplicaSets maintain Pod replicas, StatefulSets manage stateful applications, and Services provide networking. CronJob is therefore the appropriate Kubernetes resource when a task needs to run repeatedly at scheduled intervals.

Question 116

Which Kubernetes component is responsible for making scheduling decisions for unscheduled Pods?

1. kubelet
2. kube-proxy
3. kube-scheduler
4. etcd

Correct Answer: 3

Explanation

The kube-scheduler is responsible for selecting suitable nodes for Pods that have not yet been assigned to a node. It considers scheduling requirements such as available resources, node affinity, taints and tolerations, and other constraints. After a scheduling decision is made, the kubelet on the selected node works with the container runtime to start the workload. etcd stores cluster state, while kube-proxy provides networking functionality. The scheduler therefore plays a central role in deciding where Kubernetes workloads should run.

Question 117

Which Kubernetes control-plane component runs controllers that continuously reconcile desired and actual cluster state?

1. kube-controller-manager
2. kube-proxy
3. containerd
4. kubelet

Correct Answer: 1

Explanation

The kube-controller-manager runs several Kubernetes controllers responsible for monitoring resources and reconciling their actual state with the desired state. Examples include controllers associated with Nodes, ReplicaSets, Jobs, and other Kubernetes resources. When a difference is detected, the appropriate controller takes action to move the cluster toward the desired configuration. kubelet manages workloads on individual nodes, kube-proxy handles networking functions, and containerd provides container runtime functionality. The controller manager is therefore a key part of Kubernetes’ automation and self-healing architecture.

Question 118

Which Kubernetes networking model gives Pods their own IP addresses and allows Pod-to-Pod communication without requiring network address translation between Pods?

1. Host-only networking
2. Flat Pod network model
3. Isolated Pod model
4. External NAT model

Correct Answer: 2

Explanation

Kubernetes generally follows a flat Pod network model in which each Pod receives its own IP address and Pods can communicate directly with one another across nodes without requiring NAT between Pod addresses. The exact implementation is provided by the cluster’s networking solution through the Container Network Interface. This model simplifies application networking because workloads can communicate using Pod IP addresses. Services provide stable endpoints for applications, while CNI implementations provide the underlying network connectivity. Understanding the Pod network model is important for basic Kubernetes networking concepts.

Question 119

Which Kubernetes interface is responsible for providing container networking capabilities?

1. CSI
2. CRI
3. CNI
4. RBAC

Correct Answer: 3

Explanation

CNI stands for Container Network Interface and provides a standardized mechanism for configuring networking for containers and Pods. Kubernetes networking implementations commonly use CNI plugins to assign Pod IP addresses, configure interfaces, and establish connectivity according to the network design. CSI is used for storage integration, while CRI provides the interface between Kubernetes and container runtimes. RBAC manages authorization. Understanding these interfaces helps distinguish the major infrastructure layers around Kubernetes: CNI for networking, CSI for storage, and CRI for container runtime integration.

Question 120

Which Kubernetes interface provides integration between Kubernetes and container runtimes?

1. CNI
2. CRI
3. CSI
4. Ingress

Correct Answer: 2

Explanation

CRI stands for Container Runtime Interface and provides the interface through which Kubernetes can communicate with supported container runtimes. It allows Kubernetes to request operations needed to manage containers and Pods without depending on the internal implementation of a particular runtime. CNI handles networking, CSI handles storage integration, and Ingress provides HTTP or HTTPS routing rules. The separation provided by CRI allows Kubernetes to work with compatible container runtime implementations. Understanding CRI is therefore important when studying the architecture and infrastructure components of Kubernetes.