KCNA — Mock Exam Part 1
Mock Exam Part 1: Kubernetes Fundamentals & Container Orchestration
15 questions covering KCNA Domains 1 and 2 (68% of the real exam). Time yourself — aim for 22 minutes (1.5 min/question).
Question 1
Which control plane component is responsible for storing the entire cluster state?
- A) kube-apiserver
- B) kube-scheduler
- C) etcd
- D) kube-controller-manager
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | kube-apiserver processes API requests but stores data in etcd |
| B | kube-scheduler makes placement decisions — doesn’t store state |
| C | etcd is the distributed key-value store that persists all cluster state — resources, configurations, secrets, and status information |
| D | kube-controller-manager runs control loops but stores state in etcd via the API server |
Question 2
A pod has three containers. What do they share?
- A) Only CPU and memory
- B) Network namespace and storage volumes
- C) Nothing — containers in a pod are isolated
- D) Only the container runtime
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | CPU and memory are allocated per container — sharing is via network and storage |
| B | Containers in a pod share the same network namespace (IP address, ports) and can share storage volumes. They communicate via localhost. |
| C | Containers in a pod specifically share resources — pods are the sharing boundary |
| D | The container runtime runs on the node, not shared between pod containers |
Question 3
What does the kube-scheduler do when it cannot find a node with enough resources for a pod?
- A) Deletes the pod
- B) Creates a new node
- C) The pod remains in Pending state
- D) Reduces the pod’s resource requests
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | The scheduler doesn’t delete unschedulable pods |
| B | Creating nodes is the Cluster Autoscaler’s job, not the scheduler’s |
| C | The pod stays in Pending state until resources become available. If Cluster Autoscaler is configured, it may add a node — but the scheduler itself just marks the pod as unschedulable. |
| D | The scheduler never modifies pod specs |
Question 4
Which Service type makes a service accessible externally using a cloud provider load balancer?
- A) ClusterIP
- B) NodePort
- C) LoadBalancer
- D) ExternalName
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | ClusterIP is internal only — accessible only within the cluster |
| B | NodePort exposes on each node’s IP at a static port — external but no load balancer |
| C | LoadBalancer provisions a cloud provider’s external load balancer that routes traffic to the service. It includes ClusterIP and NodePort functionality. |
| D | ExternalName maps a service to a DNS name — no load balancer |
Question 5
What is the Container Runtime Interface (CRI)?
- A) A container image format specification
- B) An API that allows kubelet to use different container runtimes
- C) A network plugin interface
- D) A storage driver for containers
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | The container image format is defined by OCI Image Specification |
| B | CRI is a plugin interface that allows the kubelet to work with any container runtime (containerd, CRI-O) without being tied to a specific implementation |
| C | The network plugin interface is CNI (Container Network Interface) |
| D | The storage driver interface is CSI (Container Storage Interface) |
Question 6
What does a Kubernetes Deployment’s maxSurge: 25% setting mean during a rolling update?
- A) 25% of pods can be unavailable
- B) Up to 25% extra pods can be created above the desired count
- C) 25% of traffic goes to the new version
- D) The update completes 25% faster
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | That describes maxUnavailable, not maxSurge |
| B | maxSurge=25% means during the rolling update, up to 25% more pods than the desired count can be created. If desired=4, up to 5 pods can exist during the update (4 + 25% = 5). |
| C | Traffic splitting is done by service mesh, not rolling update parameters |
| D | maxSurge affects capacity, not speed directly |
Question 7
Which component runs on every worker node and ensures containers are running in pods?
- A) kube-apiserver
- B) kube-proxy
- C) kubelet
- D) kube-controller-manager
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | kube-apiserver runs on the control plane, not worker nodes |
| B | kube-proxy handles network rules on each node, not container lifecycle |
| C | kubelet is the primary node agent. It watches for pod specs from the API server and ensures the specified containers are running and healthy. |
| D | kube-controller-manager runs on the control plane |
Question 8
What Linux technology do containers use to limit CPU and memory usage?
- A) Namespaces
- B) SELinux
- C) cgroups (control groups)
- D) iptables
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Namespaces provide isolation (PID, network, mount), not resource limiting |
| B | SELinux provides mandatory access control, not resource limits |
| C | cgroups (control groups) limit, account, and isolate resource usage (CPU, memory, disk I/O, network) for a group of processes |
| D | iptables manages network packet filtering rules |
Question 9
A ReplicaSet ensures that 3 pods are running. One pod crashes. What happens?
- A) The Deployment is marked as failed
- B) An alert is sent to the admin
- C) The ReplicaSet controller creates a new pod to maintain 3 replicas
- D) The remaining 2 pods handle all traffic until manual intervention
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | A single pod crash doesn’t fail the Deployment |
| B | Alerting requires separate monitoring tools — not built into ReplicaSets |
| C | The ReplicaSet controller continuously reconciles: desired=3, current=2, so it creates 1 new pod. This is the self-healing capability of Kubernetes. |
| D | Kubernetes automatically maintains the desired replica count — no manual intervention needed |
Question 10
What is the purpose of a Kubernetes Namespace?
- A) Providing CPU isolation between containers
- B) Providing logical isolation and access control boundaries within a cluster
- C) Encrypting traffic between pods
- D) Storing container images
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | CPU isolation is done by cgroups and resource limits, not Namespaces |
| B | Namespaces provide logical grouping and isolation — scoping resource names, enabling per-namespace RBAC, ResourceQuotas, and LimitRanges |
| C | Traffic encryption is handled by service mesh (mTLS), not Namespaces |
| D | Container images are stored in container registries |
Question 11
Which container runtime is the most widely used in production Kubernetes clusters?
- A) Docker Engine
- B) containerd
- C) CRI-O
- D) rkt
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Docker Engine support was removed in K8s 1.24 (dockershim deprecation) |
| B | containerd is the most widely used container runtime in production K8s clusters. It’s a CNCF Graduated project used by major cloud providers (EKS, AKS, GKE). |
| C | CRI-O is used in OpenShift — widely used but less than containerd overall |
| D | rkt (Rocket) has been archived and is no longer maintained |
Question 12
What does a liveness probe failure result in?
- A) The pod is unscheduled
- B) Traffic is removed from the pod
- C) The container is restarted
- D) The node is drained
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Scheduling is a one-time event — probes don’t affect it |
| B | That describes a readiness probe failure — traffic is removed |
| C | A liveness probe failure means the container is unhealthy. kubelet restarts the container according to the pod’s restartPolicy. |
| D | Node draining is an operational action, not triggered by probes |
Question 13
In the context of container networking, what does the CNI specification define?
- A) How containers store persistent data
- B) How container runtimes interact with network plugins
- C) How images are pulled from registries
- D) How secrets are encrypted
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Persistent data is handled by CSI (Container Storage Interface) |
| B | CNI (Container Network Interface) defines a standard interface for network plugins to configure networking for containers — IP allocation, routing, connectivity |
| C | Image pulling is part of the container runtime specification |
| D | Secret encryption is configured at the etcd/API server level |
Question 14
Which Kubernetes resource would you use for a one-time database migration task?
- A) Deployment
- B) DaemonSet
- C) Job
- D) StatefulSet
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Deployments are for long-running services, not one-time tasks |
| B | DaemonSets run a pod on every node — not for one-time tasks |
| C | A Job runs a pod to completion. It’s perfect for one-time tasks like database migrations — the pod runs, completes, and the Job tracks its success/failure. |
| D | StatefulSets are for stateful applications with persistent identity |
Question 15
What is an emptyDir volume in Kubernetes?
- A) A persistent volume that survives pod deletion
- B) A temporary volume that exists for the lifetime of the pod
- C) A read-only volume from a ConfigMap
- D) A network-attached storage volume
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | emptyDir does NOT survive pod deletion — it’s temporary |
| B | emptyDir is created when a pod is assigned to a node and exists for the lifetime of the pod. It’s deleted when the pod is removed. Containers in the pod can read/write to it — useful for sharing data between containers in a pod. |
| C | ConfigMap volumes are different from emptyDir |
| D | Network-attached storage uses PersistentVolumes via CSI |
Score Yourself
| Score | Rating | Action |
|---|---|---|
| 13-15 | Excellent | You’re well-prepared for K8s Fundamentals and Container Orchestration |
| 10-12 | Good | Review topics you missed |
| 7-9 | Fair | Go back to Chapters 2-4 and reinforce weak areas |
| Below 7 | Needs Work | Re-study Chapters 2-4 before proceeding |
What’s Next?
Take Mock Exam Part 2 covering Cloud Native Architecture, Observability, and App Delivery.
