View Full Linux Foundation KCNA Exam Dumps and Practice Test Dumps.

 

Question 261

Which Kubernetes object allows a workload to use a specific set of permissions when accessing the Kubernetes API?

1. Service
2. ServiceAccount
3. ConfigMap
4. PersistentVolume

Correct Answer: 2

Explanation

A ServiceAccount provides an identity for processes running inside Kubernetes Pods. When a workload needs to communicate with the Kubernetes API, the ServiceAccount associated with that workload can be granted permissions through RBAC. This allows administrators to define exactly which resources and actions the workload can access. Services provide networking, ConfigMaps store configuration, and PersistentVolumes provide storage. ServiceAccounts are therefore an important part of workload identity and access control. Using dedicated ServiceAccounts rather than broad permissions can help implement more controlled access within a Kubernetes cluster.

Question 262

Which Kubernetes RBAC resource grants permissions defined by a Role to subjects within a Namespace?

1. ClusterRole
2. RoleBinding
3. ClusterRoleBinding
4. ServiceAccount

Correct Answer: 2

Explanation

A RoleBinding associates a Role with users, groups, or ServiceAccounts within a Namespace. The Role contains the actual permission rules, while the RoleBinding determines which subjects receive those permissions. A RoleBinding can also reference a ClusterRole while restricting the resulting access to the Namespace where the binding exists. ClusterRoleBinding is used for cluster-wide authorization, while a ServiceAccount represents an identity rather than directly defining permissions. RoleBindings therefore provide the connection between namespace-scoped permissions and the identities that need to use them.

Question 263

Which Kubernetes RBAC resource is used to grant permissions across the entire cluster?

1. Role
2. RoleBinding
3. ClusterRoleBinding
4. ConfigMap

Correct Answer: 3

Explanation

A ClusterRoleBinding grants the permissions defined by a ClusterRole to specified subjects at the cluster level. Subjects can include users, groups, or ServiceAccounts. This means the permissions can apply across the cluster according to the rules in the referenced ClusterRole. A Role is normally namespace-scoped, and a RoleBinding normally grants permissions within a particular Namespace. ConfigMaps store configuration rather than authorization rules. Because ClusterRoleBindings can provide broad access, they should be configured carefully according to the principle of least privilege.

Question 264

Which Kubernetes resource defines permissions such as get, list, create, or delete on API resources?

1. Role
2. Service
3. Namespace
4. PersistentVolumeClaim

Correct Answer: 1

Explanation

A Role defines a collection of permissions for Kubernetes API resources within a Namespace. Its rules specify resources, API groups, and verbs such as get, list, watch, create, update, patch, and delete. The Role itself does not assign these permissions to an identity. A RoleBinding is required to associate the Role with users, groups, or ServiceAccounts. Services provide network access, Namespaces organize resources, and PersistentVolumeClaims request storage. Roles are therefore a fundamental building block of namespace-scoped RBAC authorization.

Question 265

Which Kubernetes object is primarily responsible for providing stable network access to Pods rather than managing the Pods themselves?

1. Job
2. Service
3. ReplicaSet
4. DaemonSet

Correct Answer: 2

Explanation

A Service provides stable network access to a set of Pods without directly managing their lifecycle. It normally selects Pods using labels and provides a stable endpoint through which clients can communicate. The Pods behind the Service may be replaced, rescheduled, or scaled without requiring clients to track individual Pod IP addresses. ReplicaSets maintain Pod replicas, Jobs handle finite tasks, and DaemonSets run workloads on eligible nodes. Services therefore separate networking concerns from workload lifecycle management and are a key component of Kubernetes application connectivity.

Question 266

Which Kubernetes object is most appropriate for an application that needs stable Pod names and ordered deployment?

1. Deployment
2. StatefulSet
3. Job
4. DaemonSet

Correct Answer: 2

Explanation

A StatefulSet is designed for applications that require stable identities, predictable Pod names, and often ordered deployment or termination. Each Pod receives an ordinal identity that remains associated with the workload instance. StatefulSets are commonly used for databases and distributed systems where individual instances may have distinct roles or persistent data. Deployments generally manage interchangeable Pods, Jobs handle finite workloads, and DaemonSets place workloads across nodes. StatefulSet is therefore the Kubernetes workload controller best suited to applications requiring persistent identity and stateful behavior.

Question 267

Which Kubernetes workload controller is intended to run one Pod on each eligible node?

1. Job
2. Deployment
3. DaemonSet
4. ReplicaSet

Correct Answer: 3

Explanation

A DaemonSet ensures that a copy of a specified Pod runs on each node that matches its scheduling requirements. It is commonly used for node-level functions such as log collection, monitoring agents, security software, and networking components. When a new eligible node joins the cluster, the DaemonSet can create a corresponding Pod automatically. Deployments maintain a specified number of replicas, ReplicaSets maintain matching Pods, and Jobs perform finite tasks. DaemonSets therefore provide a specialized mechanism for workloads that need node-level coverage.

Question 268

Which Kubernetes resource can schedule a recurring task using cron-style scheduling syntax?

1. CronJob
2. Job
3. Deployment
4. StatefulSet

Correct Answer: 1

Explanation

A CronJob creates Jobs according to a specified schedule. The schedule uses cron-style syntax to define when executions should occur. Each scheduled execution creates a Job, and the Job creates Pods to perform the task. CronJobs are useful for recurring operations such as backups, cleanup processes, reports, and periodic data processing. A Job by itself handles a finite task without providing recurring scheduling. Deployments and StatefulSets are intended for continuously running workloads rather than scheduled batch operations.

Question 269

Which Kubernetes workload is designed to continue running and maintain a desired number of replicas?

1. Job
2. CronJob
3. Deployment
4. PodDisruptionBudget

Correct Answer: 3

Explanation

A Deployment manages a desired number of replicated Pods and is commonly used for continuously running stateless applications. It works with ReplicaSets to maintain the specified number of replicas and supports rolling updates, scaling, and revision management. Jobs are intended for finite tasks, while CronJobs schedule recurring Jobs. PodDisruptionBudgets help maintain availability during voluntary disruptions but do not manage application replicas. Deployments are therefore one of the primary Kubernetes resources for running scalable stateless applications.

Question 270

Which Kubernetes Deployment strategy replaces old Pods with new Pods gradually?

1. Recreate
2. RollingUpdate
3. Replace
4. SequentialDelete

Correct Answer: 2

Explanation

The RollingUpdate strategy gradually replaces Pods running the old version with Pods running the new version. This can maintain service availability during an application update by controlling how many Pods can be unavailable or newly created at a time. Deployment settings such as maxUnavailable and maxSurge influence the rollout behavior. The Recreate strategy instead removes existing Pods before creating new ones, which can produce downtime. Rolling updates are therefore commonly used when applications need to be updated while continuing to serve traffic.

Question 271

Which Kubernetes command displays the rollout history of a Deployment?

1. kubectl rollout history
2. kubectl history rollout
3. kubectl deployment history
4. kubectl get revisions

Correct Answer: 1

Explanation

The kubectl rollout history command displays revision information for a Deployment. This can help administrators review previous revisions and understand the history of application updates. Rollout history is particularly useful when troubleshooting a problematic release or preparing to revert to a previous version. The related kubectl rollout undo command can restore an earlier revision when appropriate. Kubernetes maintains this revision information through Deployment and ReplicaSet mechanisms, providing administrators with a practical way to manage application version changes.

Question 272

Which Kubernetes command can revert a Deployment to a previous revision?

1. kubectl deployment revert
2. kubectl rollback
3. kubectl rollout undo
4. kubectl undo deployment

Correct Answer: 3

Explanation

The kubectl rollout undo command is used to revert a Deployment to a previous revision. This is useful when an application update introduces a problem and an earlier known configuration needs to be restored. Deployment revisions can be inspected using kubectl rollout history. The rollback process updates the Deployment so that Kubernetes can recreate the appropriate workload state. This functionality supports safer application release management because administrators have a built-in mechanism for returning to a previous Deployment revision.

Question 273

Which Pod lifecycle phase indicates that all containers in the Pod have terminated successfully?

1. Pending
2. Running
3. Succeeded
4. Failed

Correct Answer: 3

Explanation

The Succeeded Pod phase indicates that all containers in the Pod have terminated successfully and will not be restarted. This state is commonly seen with Pods created by Jobs after their tasks complete successfully. Pending means the Pod has not yet completed scheduling or setup, while Running means at least one container is running or starting. Failed indicates that all containers have terminated and at least one terminated unsuccessfully. Understanding Pod phases is useful when examining workload status and diagnosing completed or failed batch operations.

Question 274

Which Pod lifecycle phase indicates that at least one container has terminated unsuccessfully?

1. Failed
2. Pending
3. Running
4. Succeeded

Correct Answer: 1

Explanation

The Failed Pod phase indicates that all containers in the Pod have terminated and at least one container terminated unsuccessfully. This can occur because of application errors, resource-related termination, or other failures. The exact reason can be investigated using commands such as kubectl describe pod and kubectl logs. Pending indicates that the Pod has not yet reached the running stage, Running indicates active or starting containers, and Succeeded indicates successful completion. Pod phases provide a high-level view, while container states provide more detailed information.

Question 275

Which Kubernetes mechanism determines whether a container should be restarted after it terminates?

1. Service selector
2. Restart policy
3. ResourceQuota
4. Node affinity

Correct Answer: 2

Explanation

A Pod’s restart policy determines how Kubernetes responds when containers terminate. Common restart policies include Always, OnFailure, and Never. The appropriate behavior depends on the workload. Long-running application workloads commonly use the default Always behavior, while Jobs may use policies appropriate for finite tasks. Restart policy is different from a Deployment or ReplicaSet replacing an entire Pod. Services manage networking, ResourceQuota manages aggregate resource consumption, and node affinity influences scheduling. Restart policies therefore focus on container restart behavior within a Pod.

Question 276

Which probe should normally be used to prevent traffic from reaching an application that is still initializing?

1. Liveness probe
2. Readiness probe
3. Startup probe
4. Resource probe

Correct Answer: 2

Explanation

A readiness probe determines whether an application is ready to receive traffic. If the readiness check fails, Kubernetes can remove the Pod from the endpoints used by a Service while leaving the container running. This is particularly useful when an application is temporarily unable to serve requests but does not need to be restarted. A startup probe is useful for detecting completion of slow initialization, while a liveness probe determines whether a running container should be restarted. Readiness therefore directly controls whether the application should receive Service traffic.

Question 277

Which Kubernetes probe can protect a slow-starting application from being restarted too early by its liveness check?

1. Startup probe
2. Readiness probe
3. NetworkPolicy
4. ResourceQuota

Correct Answer: 1

Explanation

A startup probe allows Kubernetes to determine when a slow-starting application has successfully initialized before normal liveness and readiness checks take effect as configured. This is useful for applications that require significant time to start, such as services that load large datasets or perform lengthy initialization procedures. Without an appropriate startup configuration, an aggressive liveness probe could incorrectly interpret slow startup as failure and repeatedly restart the container. Startup probes therefore provide a controlled initialization period for applications with longer startup times.

Question 278

Which Kubernetes configuration method allows a Secret value to be exposed to a container as an environment variable?

1. Volume only
2. Environment variable reference
3. Service selector
4. Node affinity

Correct Answer: 2

Explanation

A Kubernetes Secret can be referenced in a container specification so that its values are exposed as environment variables. Secrets can also be mounted as files through volumes. These mechanisms allow applications to consume credentials without embedding them directly into container images. Administrators should still protect access to Secrets using appropriate RBAC permissions and cluster security practices. Service selectors identify backend Pods, node affinity influences scheduling, and volumes provide storage mechanisms. Secret references therefore provide a flexible way to make sensitive configuration available to applications.

Question 279

Which Kubernetes setting can control when an image is pulled from a container registry?

1. imagePullPolicy
2. imageDownloadMode
3. registryPolicy
4. pullStrategy

Correct Answer: 1

Explanation

The imagePullPolicy field controls when Kubernetes attempts to pull a container image from its registry. Common values include Always, IfNotPresent, and Never. The chosen policy affects whether Kubernetes checks the registry or relies on an image already available on the node. The exact default behavior can also depend on the image tag and policy configuration. Understanding imagePullPolicy is important when managing application updates and ensuring that nodes use the intended container image version. It can also affect startup speed and registry traffic.

Question 280

Which Kubernetes mechanism allows Pods to authenticate to a private container registry when pulling images?

1. NetworkPolicy
2. ImagePullSecret
3. ServiceAccountRole
4. RegistryConfigMap

Correct Answer: 2

Explanation

An image pull Secret, commonly called an ImagePullSecret, stores registry authentication information that Kubernetes can use when pulling private container images. A Pod or its associated ServiceAccount can reference the Secret so the kubelet and container runtime can authenticate to the registry. This is useful when application images are stored in private repositories that require credentials. NetworkPolicies control traffic and ConfigMaps store ordinary configuration, but neither is specifically designed to provide private registry authentication. ImagePullSecrets therefore support secure access to private container registries.