View Full Linux Foundation KCNA Exam Dumps and Practice Test Dumps.

 

Question 221

Which Kubernetes object groups resources into a logical and isolated management boundary?

1. Namespace
2. Service
3. Pod
4. Node

Correct Answer: 1

Explanation

A Namespace provides a logical boundary for organizing Kubernetes resources within a cluster. It allows different teams, applications, or environments to separate resources while using the same underlying cluster. Namespaces are also commonly used with RBAC, ResourceQuotas, and NetworkPolicies to apply administrative and security controls. A Service provides networking, a Pod runs containers, and a Node provides compute resources. Namespaces do not create physical isolation by themselves, but they provide an important organizational and administrative abstraction for managing resources in shared Kubernetes environments.

Question 222

Which Kubernetes feature allows resources in different namespaces to use the same resource names without conflict?

1. Labels
2. Namespaces
3. Annotations
4. Selectors

Correct Answer: 2

Explanation

Namespaces allow many Kubernetes resource names to be reused within different logical environments. For example, a Deployment named web can exist in both a development Namespace and a production Namespace because the resources have different namespace-qualified identities. This makes Namespaces useful for separating teams, applications, and environments within one cluster. Labels and selectors help organize and identify resources, while annotations store metadata. Namespaces therefore provide an important scope for many Kubernetes resources and allow resource management to remain organized in larger clusters.

Question 223

Which Kubernetes metadata field is primarily used to identify and select objects?

1. Annotations
2. Labels
3. Finalizers
4. Owner references

Correct Answer: 2

Explanation

Labels are key-value pairs attached to Kubernetes objects and are primarily used for identification, grouping, and selection. Controllers and Services commonly use label selectors to determine which Pods they should manage or target. For example, a Service can select Pods with a label such as app=frontend. Annotations are also key-value metadata but are generally intended for additional information that is not used for selection. Labels are therefore fundamental to Kubernetes organization and workload association because many controllers depend on them to identify related resources.

Question 224

Which Kubernetes metadata mechanism is intended for storing non-identifying information about an object?

1. Labels
2. Selectors
3. Annotations
4. Replicas

Correct Answer: 3

Explanation

Annotations provide a way to attach additional metadata to Kubernetes objects without using that information for selection. They can store configuration details, tool-specific information, timestamps, or other data that controllers and external systems may need. Labels, by contrast, are intended for identification and selection and should contain values appropriate for grouping resources. Annotations can hold larger or more descriptive metadata than labels. They are commonly used by Kubernetes tools, controllers, and external integrations to record information associated with resources.

Question 225

What does a Kubernetes Service selector normally use to identify its backend Pods?

1. Pod labels
2. Pod annotations
3. Node taints
4. Resource limits

Correct Answer: 1

Explanation

A Kubernetes Service normally uses a label selector to identify the Pods that should receive traffic. The selector is matched against labels attached to Pods. For example, a Service selector might target Pods labeled app=backend. When matching Pods change because of scaling, rolling updates, or rescheduling, the Service can automatically update its backend endpoints. Annotations do not normally determine Service membership, while node taints and resource limits serve different scheduling and resource-management purposes. Labels and selectors therefore form an essential part of Kubernetes Service discovery.

Question 226

Which scheduling mechanism prevents Pods from being placed on nodes unless the Pods tolerate the node’s taint?

1. Node labels
2. Taints and tolerations
3. ResourceQuota
4. Service selectors

Correct Answer: 2

Explanation

Taints and tolerations provide a mechanism for controlling which Pods can be scheduled onto particular nodes. A taint marks a node with a condition that repels Pods unless those Pods have a matching toleration. This is useful for dedicating nodes to specific workloads, separating workloads, or preventing ordinary Pods from being scheduled onto nodes with special characteristics. A toleration allows a Pod to be considered for such a node, but it does not by itself force scheduling there. Taints and tolerations are therefore important Kubernetes scheduling controls.

Question 227

Which Kubernetes feature can influence Pod placement by requiring or preferring nodes with specific labels?

1. Node affinity
2. ConfigMap
3. NetworkPolicy
4. ServiceAccount

Correct Answer: 1

Explanation

Node affinity allows Pods to specify rules about the nodes on which they should run. These rules are based on node labels and can be either required or preferred depending on the configuration. For example, a workload may require nodes labeled for a particular hardware type or prefer nodes in a specific availability zone. Node affinity provides more flexible scheduling control than simply selecting an arbitrary node. ConfigMaps store configuration, NetworkPolicies control network traffic, and ServiceAccounts provide workload identities. Node affinity is therefore a key scheduling feature.

Question 228

Which Kubernetes command is commonly used to display all Pods in the current Namespace?

1. kubectl list pods
2. kubectl show pods
3. kubectl get pods
4. kubectl pods

Correct Answer: 3

Explanation

The kubectl get pods command displays Pods in the current Namespace. It typically shows information such as Pod name, readiness, status, restart count, and age. Administrators can add options such as -A or –all-namespaces to view Pods across all Namespaces, or -n to target a specific Namespace. This command is one of the most commonly used Kubernetes inspection commands because Pods are the basic execution units for workloads. It provides a quick way to determine whether application Pods are running as expected.

Question 229

Which kubectl command provides detailed information about a specific Pod, including events?

1. kubectl describe pod
2. kubectl inspect pod
3. kubectl details pod
4. kubectl explain pod

Correct Answer: 1

Explanation

The kubectl describe pod command provides detailed information about a specific Pod. Its output can include labels, annotations, container states, resource information, volumes, node placement, conditions, and recent events. This makes it especially useful when troubleshooting scheduling failures, image-pull problems, startup issues, or container failures. kubectl get pods provides a more concise summary, while kubectl logs focuses on application output. The describe command is therefore a valuable diagnostic tool when the basic Pod status does not explain why a workload is not operating correctly.

Question 230

Which kubectl command is commonly used to view output generated by a container in a Pod?

1. kubectl output
2. kubectl logs
3. kubectl events
4. kubectl print

Correct Answer: 2

Explanation

The kubectl logs command displays logs produced by a container in a Pod. It is commonly used to investigate application startup failures, errors, requests, and other runtime behavior. If a Pod contains multiple containers, the appropriate container can be selected using the relevant kubectl option. Logs provide application-level information, while kubectl describe provides resource and event information. For troubleshooting, administrators often use both commands together to understand what the container is doing and what Kubernetes reports about its state.

Question 231

Which Kubernetes object is responsible for maintaining a desired number of replicas in a Deployment?

1. Service
2. ReplicaSet
3. ConfigMap
4. Namespace

Correct Answer: 2

Explanation

A Deployment normally creates and manages a ReplicaSet, which in turn maintains the desired number of Pods. The ReplicaSet continuously compares the current number of matching Pods with the desired replica count. If fewer Pods are available, it creates additional Pods; if too many exist, it removes excess Pods. Deployments add higher-level capabilities such as rolling updates and revision management. Services provide networking, ConfigMaps provide configuration, and Namespaces organize resources. ReplicaSets therefore provide the replication mechanism underneath a typical Kubernetes Deployment.

Question 232

Which Kubernetes feature is responsible for continuously comparing actual state with desired state and taking corrective action?

1. Reconciliation
2. Port forwarding
3. Service discovery
4. Image pulling

Correct Answer: 1

Explanation

Reconciliation is a fundamental Kubernetes design principle in which controllers continuously compare the actual state of resources with the desired state. When a difference is detected, the appropriate controller takes actions to move the cluster toward the desired configuration. For example, if a Deployment requires three replicas but only two are running, the relevant controllers work to create another Pod. This continuous process supports automation and self-healing. Reconciliation is therefore central to how Kubernetes maintains declared workload and infrastructure states over time.

Question 233

Which Kubernetes object is commonly used to ensure that a monitoring agent runs on every eligible node?

1. Deployment
2. Job
3. DaemonSet
4. StatefulSet

Correct Answer: 3

Explanation

A DaemonSet is designed to run a copy of a Pod on each node that matches its scheduling requirements. This makes it suitable for node-level services such as monitoring agents, logging collectors, security agents, and certain networking components. When a new eligible node is added, Kubernetes can create the DaemonSet Pod on that node automatically. Deployments manage a desired number of interchangeable replicas, Jobs perform finite tasks, and StatefulSets provide stable identities for stateful workloads. DaemonSets are therefore particularly useful for cluster-wide node agents.

Question 234

Which Kubernetes workload is most appropriate for a batch operation that should run once and then finish?

1. Job
2. Service
3. Deployment
4. DaemonSet

Correct Answer: 1

Explanation

A Job is designed for workloads that perform a finite task and eventually complete. Examples include batch calculations, database migrations, data processing, and administrative scripts. Kubernetes tracks the Job’s completion state and can create replacement Pods according to the configured behavior when failures occur. Deployments are intended for continuously running applications, DaemonSets run workloads on eligible nodes, and Services provide networking. A Job therefore best matches a one-time batch operation where successful completion is the desired final state.

Question 235

Which Kubernetes resource is most appropriate for running a backup task every night?

1. ReplicaSet
2. CronJob
3. StatefulSet
4. Service

Correct Answer: 2

Explanation

A CronJob is designed to create Jobs according to a schedule, making it suitable for recurring operations such as nightly backups. The CronJob defines when the task should run, while each execution creates a Job that handles the actual workload. This separation allows Kubernetes to manage each scheduled execution independently. ReplicaSets maintain Pod replicas, StatefulSets manage stateful workloads, and Services provide network endpoints. CronJobs are therefore the appropriate Kubernetes abstraction when a task needs to execute repeatedly according to a defined schedule.

Question 236

Which Kubernetes object provides a stable identity and persistent storage association for stateful application instances?

1. StatefulSet
2. Deployment
3. DaemonSet
4. Job

Correct Answer: 1

Explanation

A StatefulSet is designed for stateful applications that require stable Pod identities and often persistent storage. Each StatefulSet Pod receives a predictable ordinal identity, which allows individual instances to be distinguished. StatefulSets can also associate Pods with persistent volume claims so that storage can follow the appropriate workload identity. Deployments generally treat replicas as interchangeable, while DaemonSets focus on node-level workloads and Jobs handle finite tasks. StatefulSets are therefore well suited to databases and distributed applications that depend on stable identities.

Question 237

Which Kubernetes object allows a Pod to access a persistent storage claim?

1. NetworkPolicy
2. Service
3. PersistentVolumeClaim
4. ResourceQuota

Correct Answer: 3

Explanation

A PersistentVolumeClaim provides a way for a Pod to request and consume persistent storage. The Pod specification can reference the PVC through a volume configuration, allowing the application container to mount the associated storage. The PVC abstracts the underlying PersistentVolume and storage provider from the application. NetworkPolicies control traffic, Services provide networking, and ResourceQuotas control aggregate resource consumption. Using PVCs allows applications to request persistent storage based on requirements such as capacity and access mode without directly managing the underlying storage implementation.

Question 238

Which Kubernetes resource can restrict how much CPU and memory a Namespace can consume in total?

1. LimitRange
2. ResourceQuota
3. PodDisruptionBudget
4. ConfigMap

Correct Answer: 2

Explanation

ResourceQuota controls aggregate resource consumption within a Namespace. Administrators can configure quotas for CPU, memory, object counts, and other supported resources. For example, a Namespace can be limited to a specific total amount of requested CPU and memory. This helps organizations share a cluster while preventing one group or environment from consuming unlimited resources. LimitRange instead establishes constraints or defaults for individual containers and Pods. PodDisruptionBudget addresses availability during voluntary disruptions, while ConfigMap stores application configuration.

Question 239

Which Kubernetes authorization resource can define permissions that apply across cluster-scoped resources?

1. Role
2. RoleBinding
3. ClusterRole
4. ConfigMap

Correct Answer: 3

Explanation

A ClusterRole defines a set of permissions that can apply to cluster-scoped resources or be reused within Namespaces through appropriate bindings. It can define access to resources such as Nodes and other cluster-level objects, and it can also be referenced by a RoleBinding for namespace-specific access. A Role normally defines permissions within one Namespace. RoleBinding associates permissions with identities within a Namespace, while ConfigMap stores configuration. ClusterRole is therefore an important RBAC resource for defining broader permission sets.

Question 240

Which Kubernetes RBAC resource grants a ClusterRole’s permissions to subjects across the entire cluster?

1. RoleBinding
2. ClusterRoleBinding
3. Role
4. Service

Correct Answer: 2

Explanation

A ClusterRoleBinding associates a ClusterRole with subjects such as users, groups, or ServiceAccounts at the cluster level. The permissions granted through the binding can apply across the cluster according to the rules defined in the referenced ClusterRole. A RoleBinding is generally namespace-scoped, even when it references a ClusterRole. Roles define permissions rather than assigning them, while Services provide networking. ClusterRoleBinding should therefore be used carefully because granting broad permissions can provide extensive access to Kubernetes resources.