KCNA — Kubernetes Resources Practice Questions
Kubernetes Resources Practice Questions
Test your understanding of pods, deployments, services, namespaces, ConfigMaps, secrets, and scheduling.
Question 1
What is the smallest deployable unit in Kubernetes?
- A) Container
- B) Pod
- C) Deployment
- D) ReplicaSet
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | A container runs inside a pod — it’s not a Kubernetes object on its own |
| B | A Pod is the smallest deployable unit. It wraps one or more containers that share networking and storage. |
| C | A Deployment manages ReplicaSets and Pods — it’s a higher-level abstraction |
| D | A ReplicaSet manages Pods — it sits between Deployment and Pod |
Question 2
What happens during a Kubernetes rolling update?
- A) All pods are terminated, then new pods are created
- B) New pods are created gradually while old pods are terminated
- C) The cluster goes offline during the update
- D) Only the container image is swapped in place without recreating pods
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | This describes the “Recreate” strategy, not rolling update |
| B | Rolling updates gradually replace old pods with new ones, maintaining availability throughout. This is the default update strategy. |
| C | Kubernetes rolling updates are designed for zero downtime |
| D | Pods are recreated (new ReplicaSet) — the image isn’t swapped in place |
Question 3
Which Service type creates a cloud load balancer for external access?
- A) ClusterIP
- B) NodePort
- C) LoadBalancer
- D) ExternalName
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | ClusterIP is internal-only — accessible only within the cluster |
| B | NodePort opens a port on every node but doesn’t create a cloud load balancer |
| C | LoadBalancer provisions a cloud provider load balancer (e.g., AWS ELB) that routes external traffic to the service |
| D | ExternalName creates a DNS CNAME mapping — it doesn’t provision any infrastructure |
Question 4
How are Kubernetes Secrets encoded by default?
- A) AES-256 encrypted
- B) SHA-256 hashed
- C) Base64-encoded
- D) Plain text
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | AES-256 encryption requires explicit configuration of etcd encryption at rest — it’s not the default |
| B | Hashing is one-way — Secrets need to be readable, so hashing is never used |
| C | Secrets are Base64-encoded by default, which is NOT encryption. Anyone with access can decode them. True encryption requires configuring encryption at rest. |
| D | While the underlying data is plain text, the Kubernetes API stores it in Base64 format |
Question 5
Which default namespace contains Kubernetes system components?
- A) default
- B) kube-system
- C) kube-public
- D) kube-node-lease
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | The default namespace is where user resources land if no namespace is specified |
| B | kube-system contains all Kubernetes system components: API server, CoreDNS, kube-proxy, controller manager, scheduler, etc. |
| C | kube-public contains publicly readable data (usually cluster info for bootstrapping) |
| D | kube-node-lease stores node heartbeat data used for node health monitoring |
Question 6
What is the purpose of a taint on a Kubernetes node?
- A) To attract specific pods to the node
- B) To repel pods that don’t have a matching toleration
- C) To limit CPU usage on the node
- D) To mark the node for deletion
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Taints repel pods — node affinity or node selectors attract pods |
| B | Taints are applied to nodes to repel pods. Only pods with a matching toleration can be scheduled on a tainted node. |
| C | Resource limits are set in pod specs, not via taints |
| D | Node cordoning and draining are used for maintenance, not taints specifically |
Question 7
What type of workload resource ensures exactly one pod runs on every node?
- A) Deployment
- B) StatefulSet
- C) DaemonSet
- D) ReplicaSet
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Deployments run a specified number of replicas — not necessarily one per node |
| B | StatefulSets are for stateful applications requiring stable network identities |
| C | DaemonSets ensure exactly one pod runs on every node (or selected nodes). Used for log collectors, monitoring agents, and network plugins. |
| D | ReplicaSets maintain a specified number of replicas but don’t guarantee per-node distribution |
Question 8
What probe determines whether a container should be restarted?
- A) Readiness probe
- B) Liveness probe
- C) Startup probe
- D) Health probe
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Readiness probe determines if the pod should receive traffic — failure removes it from Service endpoints but doesn’t restart |
| B | Liveness probe determines if the container is alive. If it fails, kubelet restarts the container. |
| C | Startup probe indicates if the application has started — it disables liveness/readiness until it succeeds |
| D | “Health probe” is not a specific Kubernetes probe type |
Question 9
How do pods discover services within the same cluster?
- A) Through the kube-scheduler
- B) Through DNS (CoreDNS) and environment variables
- C) Through direct IP address lookup in etcd
- D) Through the container runtime
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | kube-scheduler assigns pods to nodes — it doesn’t handle service discovery |
| B | Pods discover services via DNS (CoreDNS resolves service names to ClusterIPs) and environment variables (injected at pod startup) |
| C | Pods never communicate with etcd directly — only the API server does |
| D | Container runtimes run containers — they don’t handle service discovery |
Question 10
What is the difference between a ConfigMap and a Secret in Kubernetes?
- A) ConfigMaps are for pods; Secrets are for nodes
- B) ConfigMaps store non-sensitive data; Secrets store sensitive data (base64-encoded)
- C) ConfigMaps are encrypted; Secrets are plain text
- D) ConfigMaps are immutable; Secrets can be updated
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Both ConfigMaps and Secrets are consumed by pods, not nodes |
| B | ConfigMaps store non-sensitive data in plain text. Secrets store sensitive data in base64-encoded format. Both can be consumed the same way (env vars or volumes). |
| C | It’s the opposite — neither is encrypted by default, but Secrets have base64 encoding |
| D | Both can be mutable or immutable — both support the immutable: true field |
Score Yourself
| Score | Rating | Action |
|---|---|---|
| 9-10 | Excellent | Strong resource knowledge. Move to Chapter 4. |
| 7-8 | Good | Review the topics you missed, then proceed. |
| 5-6 | Fair | Re-read Services, ConfigMaps/Secrets, and scheduling sections. |
| Below 5 | Needs Work | Go back through all Resource sub-topics. |
What’s Next?
You’ve completed Chapter 3 — Kubernetes Core Resources. Now let’s explore the second-largest exam domain: Container Orchestration.
