Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What does a container primarily provide in application deployment?
1.1 Understand container fundamentals and their role in application packaging
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Application examples from the Kubernetes project for practicing manifests and application behavior in a cluster.
Try it: Use a disposable cluster. Read a simple application's manifests, predict which Pods its Service selects, then change a label and use kubectl to diagnose the resulting connectivity problem.
Source is free. A local cluster uses your computer; hosted clusters may incur charges.
Guided tutorials for learning Kubernetes behavior and building practical skills beyond multiple-choice recall.
Try it: Complete a basic application tutorial. Repeat the task without the walkthrough, then explain the difference between declared configuration and observed cluster state.
Documentation is free. Your chosen cluster environment may have costs.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What does a container primarily provide in application deployment?
Isolated runtime environment
Physical server allocation
Network routing rules
Persistent storage volumes
Correct answer
Isolated runtime environment
Containers package application code and dependencies into a lightweight, isolated unit that shares the host OS kernel. This isolation ensures consistent behavior across different environments.
Which component is responsible for scheduling workloads onto nodes in a Kubernetes cluster?
kube-scheduler
kube-apiserver
kubelet
etcd
Correct answer
kube-scheduler
The kube-scheduler watches newly created pods without assigned nodes and selects an appropriate node based on resource availability and policies. It ensures optimal placement within the cluster.
What is the primary purpose of a Kubernetes Namespace?
To partition cluster resources for different teams or projects
To increase the maximum number of nodes
To store container images
To define network policies for external traffic
Correct answer
To partition cluster resources for different teams or projects
Namespaces provide a scope for names and help organize cluster resources for multiple users, teams, or environments. They do not offer full security isolation but aid in resource management.
Which resource definition is used to run a single instance of a pod with a predefined specification?
Deployment
Job
Pod
StatefulSet
Correct answer
Pod
A Pod is the smallest deployable unit in Kubernetes, representing one or more containers that share storage and network. It directly describes the desired state for a single instance workload.
What is a common use case for a Kubernetes Service of type ClusterIP?
Expose an application to external internet traffic
Enable communication between pods within the cluster
Provide a static external IP for load balancing
Route traffic based on URL path patterns
Correct answer
Enable communication between pods within the cluster
ClusterIP is the default service type that exposes the service on an internal cluster IP, making it reachable only from within the cluster. It is ideal for backend pod communication.
Which practice helps ensure that a container starts and runs correctly in a Kubernetes environment?
Defining appropriate liveness and readiness probes
Using the latest untagged image version
Setting the container security context to run as root
Mounting all host directories
Correct answer
Defining appropriate liveness and readiness probes
Probes allow Kubernetes to check container health and readiness. Liveness probes restart unhealthy containers, while readiness probes control traffic routing to pods.
What is the main function of etcd in a Kubernetes cluster?
Reliable distributed key-value store for cluster state
Network traffic routing between nodes
Container image storage and distribution
User authentication and role management
Correct answer
Reliable distributed key-value store for cluster state
etcd is a consistent and highly-available key-value store used as Kubernetes' backing store for all cluster data. The API server reads and writes cluster state to etcd.
Which resource allows you to store and manage sensitive information such as passwords?
Secret
ConfigMap
Volume
Environment variable
Correct answer
Secret
Secrets are designed to hold sensitive data like passwords, tokens, or keys. They are base64-encoded and stored in etcd, meant to be consumed by pods securely.
What does a node in Kubernetes typically represent?
A physical or virtual machine
A container registry
A network policy
A cluster role binding
Correct answer
A physical or virtual machine
A node is a worker machine in Kubernetes, either a physical or virtual machine, where containers are scheduled and run. The kubelet manages the node.
Which resource is best suited for managing batch-oriented, short-lived tasks?
CronJob
Deployment
DaemonSet
Job
Correct answer
Job
A Job is designed to run one or more pods to completion, ensuring a specified number of pods successfully terminate. It is ideal for batch processing tasks.
What is the purpose of a readiness probe in a container?
To determine if the container should be restarted
To check if the container is ready to accept traffic
To measure resource usage for billing
To enforce security policies
Correct answer
To check if the container is ready to accept traffic
Readiness probes signal whether a container is prepared to handle requests. Pods are not added to service endpoints until they pass readiness checks.
Which of the following is a recommended practice for securing a Kubernetes API server?
Allow unrestricted access from any network
Use strong authentication and authorization policies
Disable all logging mechanisms
Run the API server on the default insecure port
Correct answer
Use strong authentication and authorization policies
Securing the API server involves using authentication methods like tokens or certificates and authorization policies such as RBAC. Limiting network exposure is also critical.
What is the role of a ConfigMap in Kubernetes?
To store non-confidential data in key-value pairs for configuration
To manage persistent storage volumes
To schedule pods across nodes
To define network ingress rules
Correct answer
To store non-confidential data in key-value pairs for configuration
ConfigMaps decouple configuration artifacts from image content, allowing environment-specific settings to be injected into pods. They are not suitable for sensitive data.
Which control plane component continuously monitors the cluster state and makes adjustments to move the current state toward the desired state?
Controller Manager
Scheduler
kube-proxy
API Server
Correct answer
Controller Manager
The Controller Manager runs control loops that watch the shared state of the cluster through the API server and makes changes to move the current state toward the desired state.
What is the main benefit of using immutable infrastructure patterns in containerized deployments?
Simplifies rollback by replacing rather than modifying running instances
Reduces the need for container registries
Eliminates the requirement for health checks
Enables direct SSH access to running containers
Correct answer
Simplifies rollback by replacing rather than modifying running instances
Immutable infrastructure replaces instances with new ones that include the desired changes, simplifying rollbacks and reducing configuration drift.
Recall the answer before opening each card.
Containers provide a lightweight, isolated runtime environment that packages app code and dependencies, ensuring consistent behavior across different environments.
The kube-scheduler watches for unscheduled pods and selects an appropriate node based on resource availability and policies.
Namespaces partition cluster resources among multiple users, teams, or projects, providing scoping for names but not full security isolation.
A Pod is the smallest deployable unit, representing one or more containers that share storage, network, and a specification for running.
ClusterIP is the default service type that exposes the service on an internal IP, making it reachable only from within the cluster.
Liveness probes check if a container is healthy and restarts it if not. Readiness probes check if a container is ready to accept traffic.
etcd is a consistent, highly-available key-value store that serves as the backing store for all cluster data, storing configuration and state.
A Secret is designed to hold sensitive data such as passwords, tokens, or keys, stored base64-encoded in etcd.
A node is a worker machine (physical or virtual) managed by the kubelet, where containers are scheduled and run.
A Job runs one or more pods to completion, ensuring a specified number of pods successfully terminate for batch processing.
It indicates whether a container is prepared to handle requests. Pods are removed from service endpoints until they pass readiness checks.
Use strong authentication (tokens/certificates) and authorization policies like RBAC. Limit network exposure to trusted sources.
A ConfigMap stores non-confidential configuration data in key-value pairs, allowing environment-specific settings to be injected into pods.
The Controller Manager runs control loops that watch cluster state via the API server and make changes to achieve the desired state.
It simplifies rollbacks by replacing instances with new ones instead of modifying them, reducing configuration drift.
The Pod is the smallest deployable unit, encapsulating one or more containers with shared storage and network.
ClusterIP is internal only; for external exposure, use NodePort, LoadBalancer, or Ingress. The question did not cover these, but know the distinction.
Sensitive data like passwords, tokens, or SSH keys should not be stored in ConfigMaps; use Secrets instead.
The kubelet kills the container and restarts it based on the pod's restart policy, helping maintain container health.
The default service type is ClusterIP, which exposes the service on a cluster-internal IP.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
The practice bank tests foundational understanding of containers as isolated runtime environments that share the host OS kernel, providing consistency across deployments. It also covers the physical/virtual machine role of Kubernetes nodes and the importance of etcd as the reliable cluster state store. These concepts are essential for grasping how applications are packaged and how the cluster maintains its desired state.
Questions on kube-scheduler and controller manager illustrate how the control plane ensures workloads are placed appropriately and the cluster state converges to the desired state. The scheduler selects nodes for pods based on resources and policies, while the controller manager runs control loops that react to state changes. Understanding these components is vital for cluster management and troubleshooting.
This section focuses on Kubernetes workload resources: Pods for single-instance tasks, Jobs for batch processing, and Services (ClusterIP) for internal pod communication. Health probes (liveness and readiness) are tested for their roles in container lifecycle management—liveness restarts unhealthy containers, readiness controls traffic flow. Namespaces help organize resources across teams or projects.
The practice bank covers storing non-sensitive configuration in ConfigMaps and sensitive data (passwords, tokens) in Secrets. API server security emphasizes strong authentication and authorization, such as RBAC. Immutable infrastructure patterns are highlighted for simplifying rollbacks by replacing instances instead of modifying them. These topics are critical for secure and maintainable cloud native deployments.
Study workflow
Go through the 15-question practice bank without hints first. Note which questions you answered correctly and which you missed. This identifies your weak areas (e.g., architecure, security, workloads). Focus your study on those topics.
For each question, read the explanation carefully—even for correct answers. The explanation often clarifies the reasoning and key distinctions (e.g., between liveness and readiness probes). Relate each explanation back to the corresponding hint topic.
Use the hints and explanations to review the roles of the kube-scheduler, controller manager, etcd, and API server. Understand how they interact during pod scheduling and cluster state reconciliation. Draw a diagram if helpful.
Reinforce concepts by creating sample resources in a live cluster (e.g., Minikube). Create Pods, Jobs, Secrets, ConfigMaps, and Services. Test liveness and readiness probes. This solidifies your understanding beyond theory.
Based on the flashcards provided here and your weak areas, generate additional flashcards. Use the official KCNA curriculum (as described in the hints) to cover any topics not in this practice bank, such as networking or storage.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
A liveness probe checks if a container is healthy and should be restarted if it fails. A readiness probe checks if a container is ready to accept traffic; pods failing readiness are removed from service endpoints. Both are defined in the pod spec.
etcd stores all cluster data, including configuration, state, and metadata. It is the single source of truth that the API server reads and writes. Without etcd, the cluster cannot maintain or recover its desired state.
Use a ConfigMap for non-sensitive configuration like environment variables or config files. Use a Secret for sensitive data such as passwords, tokens, or SSH keys. Secrets are base64-encoded and can be encrypted at rest.
No, Namespaces primarily provide scoping for resource names and are used for organization (e.g., teams, environments). They do not enforce network isolation by default; network policies are required for that.
Immutable infrastructure means instances are never modified after creation. Instead, new instances with changes are deployed and old ones destroyed. This simplifies rollbacks, eliminates configuration drift, and improves reliability.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
