Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
Which control-plane component runs built-in reconciliation controllers, such as the Job controller, that move observed cluster state toward the state declared in API objects?
Separate reconciliation, storage, scheduling, and node execution.
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Application examples from the Kubernetes project for practicing manifests and application behavior in a cluster.
Try it: Use a disposable cluster. Read a simple application's manifests, predict which Pods its Service selects, then change a label and use kubectl to diagnose the resulting connectivity problem.
Source is free. A local cluster uses your computer; hosted clusters may incur charges.
Guided tutorials for learning Kubernetes behavior and building practical skills beyond multiple-choice recall.
Try it: Complete a basic application tutorial. Repeat the task without the walkthrough, then explain the difference between declared configuration and observed cluster state.
Documentation is free. Your chosen cluster environment may have costs.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
Topic: Controllers
Which control-plane component runs built-in reconciliation controllers, such as the Job controller, that move observed cluster state toward the state declared in API objects?
etcd
kubelet
kube-scheduler
kube-controller-manager
Correct answer
kube-controller-manager
kube-controller-manager runs built-in controllers. They observe and update Kubernetes objects through the API server. etcd stores cluster data; kube-scheduler places unscheduled Pods; kubelet manages containers on its node. Controllers do not normally watch etcd directly.
Topic: Assigning Pods to Nodes
A new Pod must be scheduled only on nodes with the label disktype=ssd. Which node-affinity rule makes that a mandatory scheduling condition?
requiredDuringSchedulingIgnoredDuringExecution with a disktype=ssd match expression
preferredDuringSchedulingIgnoredDuringExecution with a disktype=ssd match expression
A toleration for disktype=ssd without any node-affinity rule
A preferred Pod anti-affinity rule
Correct answer
requiredDuringSchedulingIgnoredDuringExecution with a disktype=ssd match expression
Required node affinity excludes nodes that do not match at scheduling time. Preferred affinity is only a preference. A toleration permits placement on a matching tainted node but does not require it. Pod anti-affinity considers other Pods. IgnoredDuringExecution means a later label change does not itself evict an already running Pod.
Topic: kubectl config current-context
Which command prints only the name of the currently selected kubeconfig context?
kubectl config current-context
kubectl config get-contexts
kubectl config view
kubectl cluster-info
Correct answer
kubectl config current-context
kubectl config current-context prints the selected context name. get-contexts lists contexts, config view displays kubeconfig data, and cluster-info displays cluster endpoint information. Checking the context helps confirm which cluster a later command will target.
Topic: Service
You create a normal, non-headless Service and omit spec.type. What does the default ClusterIP type provide?
A port on every node for external access
An automatically provisioned public cloud load balancer
A virtual IP within the cluster network for the Service
A DNS alias configured through spec.externalName
Correct answer
A virtual IP within the cluster network for the Service
A normal ClusterIP Service receives a cluster-internal virtual IP. It does not itself provision a NodePort or external load balancer. ExternalName instead returns a DNS alias. Other mechanisms, such as an Ingress or port-forwarding, can provide access to an application behind a ClusterIP Service.
Topic: Persistent Volumes
An application author wants to request 5 GiB of persistent storage with a supported access mode, without defining the underlying storage implementation. Which resource represents that request?
VolumeAttachment
StorageClass
PersistentVolumeClaim
PersistentVolume
Correct answer
PersistentVolumeClaim
A PersistentVolumeClaim specifies the requested storage amount and access modes. It can bind to a suitable PersistentVolume. A StorageClass describes provisioning policy; a VolumeAttachment tracks a volume attachment. A PVC request does not by itself guarantee that matching storage is available.
Topic: Resource Management for Pods and Containers
In a Linux container entry under spec.containers, which setting caps that container at half a CPU?
resources.requests.cpu: 500m
resources.limits.memory: 500Mi
resources.limits.cpu: 500m
resources.requests.cpu: 500
Correct answer
resources.limits.cpu: 500m
A CPU limit of 500m means half of one CPU and is enforced through CPU throttling. A request influences scheduling and CPU allocation; it is not a usage cap. Memory limits control memory, and a CPU request of 500 means 500 CPUs, not 500 millicores.
Topic: kubectl get
Which command lists Event objects in the current namespace sorted by their metadata.creationTimestamp?
kubectl get events --sort-by='.metadata.creationTimestamp'
kubectl describe events
kubectl logs events
kubectl events --order=time
Correct answer
kubectl get events --sort-by='.metadata.creationTimestamp'
kubectl get supports --sort-by with a JSONPath field. The selected command orders the Event objects by object creation time, which is not necessarily the time of their latest repeated occurrence. kubectl events is a valid command, but --order=time is not its documented sorting option. describe is not the requested sorted list.
Topic: Kubernetes Components
In a cluster that uses kube-proxy for Service networking, what is its main responsibility?
Assigning pending Pods to nodes
Persisting API objects in etcd
Maintaining node network rules that implement Service traffic forwarding
Starting and restarting application containers
Correct answer
Maintaining node network rules that implement Service traffic forwarding
kube-proxy programs node network rules for Services. kube-scheduler handles placement, etcd persists data, and the kubelet works with the runtime to run containers. Some networking implementations replace kube-proxy, so it is not a universal requirement for every cluster.
Topic: Configure Liveness, Readiness and Startup Probes
A container serves a health endpoint at /ready on port 8080. Which handler should be placed under readinessProbe to check that HTTP endpoint?
tcpSocket with port 8080
httpGet with path /ready and port 8080
exec with command ["true"]
grpc with port 8080
Correct answer
httpGet with path /ready and port 8080
httpGet checks the specified HTTP path and port. tcpSocket checks whether a TCP connection can be established; exec runs a command; grpc uses the gRPC health protocol. A failed readiness probe marks the Pod unready for normal Service traffic and does not itself restart the container.
Topic: Deployments
A Deployment should replace old application replicas gradually while keeping available replicas during an update. Which built-in Deployment strategy supports that behavior?
Recreate
RollingUpdate
OnDelete
Immediate
Correct answer
RollingUpdate
RollingUpdate changes replicas incrementally, using maxUnavailable and maxSurge to control the rollout. Recreate removes old replicas before replacement. OnDelete is not a Deployment strategy. Application compatibility, readiness checks, capacity, and graceful shutdown still determine user-visible availability; RollingUpdate alone does not guarantee zero downtime.
Topic: Configure a Security Context
You want one container in a multi-container Pod to use readOnlyRootFilesystem: true. Where should that setting be configured?
In that container's securityContext
In the Pod's metadata.annotations as readOnlyRootFilesystem
In the container's resources.limits
In the Pod's spec.nodeSelector
Correct answer
In that container's securityContext
The container securityContext contains readOnlyRootFilesystem and other container-level security settings. An annotation, resource limit, or node selector does not enable this setting. Mount separate writable volumes where the application needs to write; a read-only root filesystem does not make every mounted volume read-only.
Topic: Namespaces
Two teams want to create Deployments with the same name in one cluster. What does placing them in different Namespaces provide?
Separate name scopes for namespaced resources
Automatic denial of all network traffic between the teams
A separate control plane for each team
Separate physical worker nodes by default
Correct answer
Separate name scopes for namespaced resources
Namespaces let namespaced resources share a name when they are in different namespaces. They do not automatically provide network isolation, separate nodes, or separate control planes. Use appropriate authorization and network controls where isolation is required; some resources, such as Nodes, are cluster-scoped.
Topic: Troubleshooting Clusters
Which command displays the conditions, addresses, and allocated resource requests and limits for the specific node worker-1?
kubectl node describe worker-1
kubectl describe node worker-1
kubectl get node-info worker-1
kubectl inspect node worker-1
Correct answer
kubectl describe node worker-1
kubectl describe node worker-1 selects that node and shows detailed status and allocation information. The name is needed to target one node. Allocated requests and limits are not a measurement of live CPU or memory consumption. The other commands are not valid kubectl command forms for this task.
Topic: kubectl logs
The api container in Pod web has restarted after a crash. Which command requests the logs of its previous container instance, if those logs are available?
kubectl logs web -c api --previous
kubectl describe pod web
kubectl logs web -c api
kubectl get pod web -o yaml
Correct answer
kubectl logs web -c api --previous
The --previous flag requests the preceding instance's logs, while -c selects the container. Without --previous, logs targets the current instance. describe and get help inspect state but do not return those application logs. Previous logs depend on their availability and are not a durable log archive.
Topic: StorageObjectInUseProtection admission plugin
Which admission plugin adds protection finalizers to newly created PersistentVolume and PersistentVolumeClaim objects?
NodeRestriction
ResourceQuota
StorageObjectInUseProtection
PersistentVolumeClaimResize
Correct answer
StorageObjectInUseProtection
StorageObjectInUseProtection adds PV/PVC protection finalizers. Protection controllers later remove them when protection is no longer needed, allowing deletion to finish. NodeRestriction limits node identity operations; ResourceQuota enforces quotas; PersistentVolumeClaimResize concerns resize admission. Adding finalizers is different from provisioning storage.
Recall the answer before opening each card.
They reconcile API objects through the API server; kube-controller-manager runs built-in control loops.
requiredDuringSchedulingIgnoredDuringExecution. Later node-label changes do not themselves evict the Pod.
kubectl config current-context
A cluster-internal virtual IP. External access requires another mechanism; a headless Service is a separate case.
A PersistentVolumeClaim; it needs suitable backing storage to become bound.
Set resources.limits.cpu: 500m in its container specification.
kubectl get events --sort-by='.metadata.creationTimestamp'. This does not sort by the latest repeated occurrence.
Node network rules for Services. Some cluster networking implementations replace it.
httpGet with the path and port. Readiness failure does not itself restart the container.
No. It controls incremental replacement; readiness, capacity, application compatibility, and shutdown behavior also matter.
In that container's securityContext. Mounted volumes have their own write permissions.
Name scoping for namespaced resources, not automatic network or node isolation.
kubectl describe node worker-1. Allocated requests and limits are not live usage measurements.
kubectl logs web -c api --previous, if the previous instance's logs are still available.
Protection finalizers on PVs and PVCs; protection controllers remove them when the objects no longer need protection.
No. It permits placement; use suitable required node affinity to restrict which nodes are eligible.
Recreate removes old Deployment replicas before creating replacements; RollingUpdate allows incremental overlap.
Repeated liveness failure triggers a container restart according to the probe behavior; readiness determines eligibility for normal Service traffic.
Storage provisioning policy, including a provisioner and parameters.
A PV represents cluster storage; a PVC requests it. Their lifecycles are separate from individual Pods.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Controllers reconcile declared and observed state using the Kubernetes API. Separate that work from persistence in etcd, placement by the scheduler, and container execution managed by the kubelet.
Required node affinity is a scheduling restriction; preferred affinity is a preference. CPU requests and CPU limits solve different problems. During an update, the strategy alone cannot establish application availability.
A ClusterIP is an internal Service address. A Namespace supplies name scope, not automatic security isolation. A PVC is a storage request; PV/PVC protection finalizers delay deletion while the relevant protection condition holds.
Check your kubeconfig context before cluster work. Use the node name when targeting one node, the container name when selecting one container, and --previous when requesting a previous container instance. Event creation time and the latest repeated occurrence are different timestamps.
Study workflow
Run kubectl config current-context and verify that it points to your disposable study cluster.
Choose one missed concept and write the command output or behavior you expect before consulting its linked documentation.
Reproduce a small task in your lab, collect the relevant status or logs, and explain any difference from your prediction.
Write down one condition that would change the answer, such as an optional scheduling preference, missing log history, or a headless Service.
Use fresh questions and repeat the practical task without a walkthrough. A score on this short concept set is not a pass prediction.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
No. It is a short multiple-choice concept review. Use the certification owner's current objectives and hands-on cluster practice to plan complete preparation.
The source links let you verify behavior and read the conditions a short question leaves out. This set received an AI-assisted documentation review, not a claimed human expert sign-off.
No. Recognition and command-line execution are different skills. Reproduce the relevant tasks in a lab and verify the outcome without referring to the answer choices.
Answer from memory, then explain when the statement applies. Open the card's official source when a distinction is unclear.
Check your context, Kubernetes version, networking and storage implementations, and the current official documentation. Report an apparent content error through Certbie's contact page.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
