Kubernetes and Cloud Native Associate KCNA Practice Test 14
Question 130
The platform team applies this control: Apply required Pod anti-affinity using a node topology key. The original issue is: A database's three replicas must avoid sharing the same physical worker. Which observation BEST validates the result?
- Measured autoscaling changes intended replica capacity without forced random migrations
- The replicas land on distinct nodes and survive failure of one worker
- The Pod is scheduled only on nodes satisfying the required label
- Scheduling events identify insufficient requested CPU and placement succeeds after adjustment
Explanation
Correct Answer
B:The replicas land on distinct nodes and survive failure of one worker. This is stronger than observing a saved configuration because it tests the actual outcome of apply required Pod anti-affinity using a node topology key. The underlying principle is that pod anti-affinity can keep matching Pods on separate topology domains. The original risk was that placing every replica on one node creates a single-node outage risk.
Incorrect Answers
A:Default placement is not continuous live-CPU load balancing among healthy nodes. The observation “Measured autoscaling changes intended replica capacity without forced random migrations” would validate that property, rather than the required “The replicas land on distinct nodes and survive failure of one worker”. Pod anti-affinity can keep matching Pods on separate topology domains.
C:Hard placement constraints restrict eligible nodes through label matching. The observation “The Pod is scheduled only on nodes satisfying the required label” would validate that property, rather than the required “The replicas land on distinct nodes and survive failure of one worker”. Pod anti-affinity can keep matching Pods on separate topology domains.
D:The scheduler tests resource requests against node allocatable capacity. The observation “Scheduling events identify insufficient requested CPU and placement succeeds after adjustment” would validate that property, rather than the required “The replicas land on distinct nodes and survive failure of one worker”. Pod anti-affinity can keep matching Pods on separate topology domains.
Question 131
In the situation "An enterprise plans a dependency strategy using only a marketing list of CNCF-related tools", the team applies "Review actual project scope, maturity, licensing, and stewardship before adoption". Which outcome is the strongest verification?
- A maintainer reproduces the issue and merges an appropriately reviewed change
- The evaluation records the actual current maturity and independent suitability evidence
- The tool assessment cites project documentation and a successful proof of concept
- Multiple stakeholders participate through documented open community channels
Explanation
Correct Answer
C:The tool assessment cites project documentation and a successful proof of concept. This is stronger than observing a saved configuration because it tests the actual outcome of review actual project scope, maturity, licensing, and stewardship before adoption. The underlying principle is that cNCF ecosystem membership is a discovery aid, not a blanket production guarantee. The original risk was that choosing by branding alone may miss operational fit or maintenance risks.
Incorrect Answers
A:Open-source collaboration relies on actionable reports and maintainer review. The observation “A maintainer reproduces the issue and merges an appropriately reviewed change” would validate that property, rather than the required “The tool assessment cites project documentation and a successful proof of concept”. CNCF ecosystem membership is a discovery aid, not a blanket production guarantee.
B:CNCF maturity stages such as Sandbox, Incubating, and Graduated have distinct meanings. The observation “The evaluation records the actual current maturity and independent suitability evidence” would validate that property, rather than the required “The tool assessment cites project documentation and a successful proof of concept”. CNCF ecosystem membership is a discovery aid, not a blanket production guarantee.
D:Vendor-neutral communities can coordinate shared cloud-native standards and adoption. The observation “Multiple stakeholders participate through documented open community channels” would validate that property, rather than the required “The tool assessment cites project documentation and a successful proof of concept”. CNCF ecosystem membership is a discovery aid, not a blanket production guarantee.
Question 132
In a Kubernetes environment this issue remains open: A service suffers cascading failures when one downstream system becomes slow. Which failure is the MOST direct consequence?
- Dependence on an undocumented provider-specific API can make migration difficult
- Splitting every function into microservices without contracts adds operational complexity
- Static overprovisioning can waste resources while still failing under unpredictable peaks
- Unlimited retries can amplify downstream overload and collapse the calling service
Explanation
Correct Answer
D:Unlimited retries can amplify downstream overload and collapse the calling service. This is the direct concern in the stated scenario because resilience patterns keep transient dependency faults from consuming all callers. The matching mitigation is to apply timeouts, bounded retries, and circuit-breaking where appropriate. Successful verification would show that an injected dependency outage produces bounded latency and graceful degradation.
Incorrect Answers
A:Open standards reduce unnecessary vendor coupling across cloud-native infrastructure. That explains the warning “Dependence on an undocumented provider-specific API can make migration difficult”; this case instead concerns “Unlimited retries can amplify downstream overload and collapse the calling service”. Resilience patterns keep transient dependency faults from consuming all callers.
B:Cloud-native architecture often favors independently deployable components with clear boundaries. That explains the warning “Splitting every function into microservices without contracts adds operational complexity”; this case instead concerns “Unlimited retries can amplify downstream overload and collapse the calling service”. Resilience patterns keep transient dependency faults from consuming all callers.
C:Elastic systems can adjust replica capacity according to demand and policy. That explains the warning “Static overprovisioning can waste resources while still failing under unpredictable peaks”; this case instead concerns “Unlimited retries can amplify downstream overload and collapse the calling service”. Resilience patterns keep transient dependency faults from consuming all callers.
Question 133
A platform engineer recommends: Version and publish the full application image rather than altering running containers. The original problem is: A team uses containers but still treats each package version as manually installed on every node. Which concept explains the remedy?
- Immutable image-based deployment moves application packaging into build workflows
- Kubernetes uses the Container Runtime Interface to coordinate container execution
- Image builds package application layers from reproducible instructions
- Pod-level co-location permits coordinated companion services and local networking
Explanation
Correct Answer
A:Immutable image-based deployment moves application packaging into build workflows. That principle directly explains the selected remediation, version and publish the full application image rather than altering running containers, for this case. Without the distinction, installing hotfixes by exec in running containers creates unreproducible drift. The expected confirmation is that a replacement Pod starts with the intended dependency versions without manual setup.
Incorrect Answers
B:Kubernetes uses the Container Runtime Interface to coordinate container execution. The operation “Kubernetes uses the Container Runtime Interface to coordinate container execution” does not address the particular Kubernetes requirement “Immutable image-based deployment moves application packaging into build workflows”.
C:Image builds package application layers from reproducible instructions. The operation “Image builds package application layers from reproducible instructions” does not address the particular Kubernetes requirement “Immutable image-based deployment moves application packaging into build workflows”.
D:Pod-level co-location permits coordinated companion services and local networking. The operation “Pod-level co-location permits coordinated companion services and local networking” does not address the particular Kubernetes requirement “Immutable image-based deployment moves application packaging into build workflows”.
Question 134
In the situation "A database moves between zones and fails to attach a disk tied to its original zone", the team applies "Align storage topology, volume binding mode, and Pod scheduling constraints". Which outcome is the strongest verification?
- Capacity grows and prior data remains readable after resizing
- The replacement Pod schedules onto a zone compatible with its disk
- The containers share temporary files and replacement starts with a clean directory
- The Pod reports the mounted filesystem after the driver issue is fixed
Explanation
Correct Answer
B:The replacement Pod schedules onto a zone compatible with its disk. This is stronger than observing a saved configuration because it tests the actual outcome of align storage topology, volume binding mode, and Pod scheduling constraints. The underlying principle is that volume placement influences eligible nodes and availability zones for stateful workloads. The original risk was that forcing the Pod to another zone can leave it waiting on an unattainable volume.
Incorrect Answers
A:PVC expansion depends on driver support and filesystem resizing behavior. The observation “Capacity grows and prior data remains readable after resizing” would validate that property, rather than the required “The replacement Pod schedules onto a zone compatible with its disk”. Volume placement influences eligible nodes and availability zones for stateful workloads.
C:EmptyDir storage lives for a Pod's lifetime and is shared by its containers. The observation “The containers share temporary files and replacement starts with a clean directory” would validate that property, rather than the required “The replacement Pod schedules onto a zone compatible with its disk”. Volume placement influences eligible nodes and availability zones for stateful workloads.
D:CSI drivers integrate vendor storage provisioning and mounting with Kubernetes. The observation “The Pod reports the mounted filesystem after the driver issue is fixed” would validate that property, rather than the required “The replacement Pod schedules onto a zone compatible with its disk”. Volume placement influences eligible nodes and availability zones for stateful workloads.
Question 135
In a Kubernetes environment this issue remains open: A platform team plans disaster recovery for its control-plane configuration and state. Which failure is the MOST direct consequence?
- Careless broad labels may send production traffic to an unintended backend
- Manually creating independent Pods provides no reliable replica reconciliation
- Losing the state store without a valid backup can destroy cluster configuration history
- Using mutable ticket text as a Service selector can disconnect endpoints
Explanation
Correct Answer
C:Losing the state store without a valid backup can destroy cluster configuration history. This is the direct concern in the stated scenario because etcd holds persistent Kubernetes API object state for the control plane. The matching mitigation is to protect and back up etcd according to the cluster distribution recovery procedure. Successful verification would show that an isolated restoration recovers expected objects from a verified etcd snapshot.
Incorrect Answers
A:Label selectors determine which eligible Pods become Service endpoints. That explains the warning “Careless broad labels may send production traffic to an unintended backend”; this case instead concerns “Losing the state store without a valid backup can destroy cluster configuration history”. Etcd holds persistent Kubernetes API object state for the control plane.
B:A Deployment reconciles ReplicaSets to maintain desired stateless workload capacity. That explains the warning “Manually creating independent Pods provides no reliable replica reconciliation”; this case instead concerns “Losing the state store without a valid backup can destroy cluster configuration history”. Etcd holds persistent Kubernetes API object state for the control plane.
D:Annotations hold auxiliary object information that need not identify selection groups. That explains the warning “Using mutable ticket text as a Service selector can disconnect endpoints”; this case instead concerns “Losing the state store without a valid backup can destroy cluster configuration history”. Etcd holds persistent Kubernetes API object state for the control plane.
Question 136
A cloud-native operations team faces this condition: An application needs direct stable discovery of the individual members of a database StatefulSet. Which response is MOST appropriate?
- Use the namespace-qualified Kubernetes Service DNS name where needed
- Configure Gateway API or a supported Ingress controller with matching routes
- Use application TLS or an approved mesh policy for required encrypted connections
- Use a headless Service and stable StatefulSet DNS identities
Explanation
Correct Answer
D:Use a headless Service and stable StatefulSet DNS identities. This is appropriate for the described asset and control gap because headless Services expose endpoint records rather than an ordinary virtual ClusterIP. If the issue is left untreated, load-balancing all peer discovery through one virtual address loses member identity. An assessor can verify remediation when each ordinal Pod resolves under its own predictable DNS record.
Incorrect Answers
A:Use the namespace-qualified Kubernetes Service DNS name where needed. The operation “Use the namespace-qualified Kubernetes Service DNS name where needed” does not address the particular Kubernetes requirement “Use a headless Service and stable StatefulSet DNS identities”.
B:Configure Gateway API or a supported Ingress controller with matching routes. The operation “Configure Gateway API or a supported Ingress controller with matching routes” does not address the particular Kubernetes requirement “Use a headless Service and stable StatefulSet DNS identities”.
C:Use application TLS or an approved mesh policy for required encrypted connections. The operation “Use application TLS or an approved mesh policy for required encrypted connections” does not address the particular Kubernetes requirement “Use a headless Service and stable StatefulSet DNS identities”.
Question 137
Consider this Kubernetes scenario: A vendor wants one auditable artifact promoted across development and production. What is the BEST next action?
- Build an immutable image once and promote its verified digest through environments
- Use Kustomize overlays or equivalent declarative environment customization
- Use a blue-green strategy with a validated traffic-switch operation
- Use an expand-and-contract schema migration across compatible application versions
Explanation
Correct Answer
A:Build an immutable image once and promote its verified digest through environments. This is appropriate for the described asset and control gap because artifact promotion preserves the same tested application bits across stages. If the issue is left untreated, rebuilding from an unpinned branch during promotion can change program behavior. An assessor can verify remediation when the production deployment references the exact previously tested image digest.
Incorrect Answers
B:Use Kustomize overlays or equivalent declarative environment customization. The operation “Use Kustomize overlays or equivalent declarative environment customization” does not address the particular Kubernetes requirement “Build an immutable image once and promote its verified digest through environments”.
C:Use a blue-green strategy with a validated traffic-switch operation. The operation “Use a blue-green strategy with a validated traffic-switch operation” does not address the particular Kubernetes requirement “Build an immutable image once and promote its verified digest through environments”.
D:Use an expand-and-contract schema migration across compatible application versions. The operation “Use an expand-and-contract schema migration across compatible application versions” does not address the particular Kubernetes requirement “Build an immutable image once and promote its verified digest through environments”.
Question 138
In a Kubernetes environment this issue remains open: A critical service is intermittent only when traffic reaches one specific node. Which failure is the MOST direct consequence?
- Installing tools inside the running container causes untracked deployment mutation
- Changing the global image tag may obscure a node-specific infrastructure issue
- Increasing application replicas cannot fix a Service with no matched endpoints
- Relying on Pod phase alone can conceal saturation or failed dependencies
Explanation
Correct Answer
B:Changing the global image tag may obscure a node-specific infrastructure issue. This is the direct concern in the stated scenario because node-local dataplane or runtime problems can affect only a subset of replicas. The matching mitigation is to compare node conditions, CNI health, DNS, and packet paths across workers. Successful verification would show that tests isolate one affected worker and service recovers after node remediation.
Incorrect Answers
A:Ephemeral troubleshooting separates observation tooling from the release artifact. That explains the warning “Installing tools inside the running container causes untracked deployment mutation”; this case instead concerns “Changing the global image tag may obscure a node-specific infrastructure issue”. Node-local dataplane or runtime problems can affect only a subset of replicas.
C:Service networking requires matching endpoints and correct destination ports. That explains the warning “Increasing application replicas cannot fix a Service with no matched endpoints”; this case instead concerns “Changing the global image tag may obscure a node-specific infrastructure issue”. Node-local dataplane or runtime problems can affect only a subset of replicas.
D:A Running Pod indicates process state rather than end-to-end service success. That explains the warning “Relying on Pod phase alone can conceal saturation or failed dependencies”; this case instead concerns “Changing the global image tag may obscure a node-specific infrastructure issue”. Node-local dataplane or runtime problems can affect only a subset of replicas.
Question 139
The team has not corrected this condition: A Service routes requests to an unrelated workload after an application migration. Which risk is MOST relevant?
- Separate Pods would complicate localhost communication and shared lifecycle coordination
- Assuming DNS alone forwards packets can conceal a broken proxy dataplane
- Careless broad labels may send production traffic to an unintended backend
- Mistaking base64 representation for encryption can expose credentials to readers
Explanation
Correct Answer
C:Careless broad labels may send production traffic to an unintended backend. This is the direct concern in the stated scenario because label selectors determine which eligible Pods become Service endpoints. The matching mitigation is to compare Service selectors with the actual Pod labels and ownership. Successful verification would show that endpointSlices contain only the matching and intended application Pod addresses.
Incorrect Answers
A:A Pod is the smallest deployable unit with shared network namespace and volumes. That explains the warning “Separate Pods would complicate localhost communication and shared lifecycle coordination”; this case instead concerns “Careless broad labels may send production traffic to an unintended backend”. Label selectors determine which eligible Pods become Service endpoints.
B:Service traffic steering depends on the cluster's supported node dataplane mechanism. That explains the warning “Assuming DNS alone forwards packets can conceal a broken proxy dataplane”; this case instead concerns “Careless broad labels may send production traffic to an unintended backend”. Label selectors determine which eligible Pods become Service endpoints.
D:Secrets represent sensitive data objects but require additional RBAC and storage protection. That explains the warning “Mistaking base64 representation for encryption can expose credentials to readers”; this case instead concerns “Careless broad labels may send production traffic to an unintended backend”. Label selectors determine which eligible Pods become Service endpoints.
Question 140
In the situation "A cluster app cannot resolve names of other namespaces using an unqualified Service name", the team applies "Use the namespace-qualified Kubernetes Service DNS name where needed". Which outcome is the strongest verification?
- EndpointSlice members appear after selectors align and traffic recovers
- Connectivity tests succeed between Pod IPs on separate workers
- Requests for each host and path reach only its designated Service
- The fully qualified Service name resolves to the expected target endpoint
Explanation
Correct Answer
D:The fully qualified Service name resolves to the expected target endpoint. This is stronger than observing a saved configuration because it tests the actual outcome of use the namespace-qualified Kubernetes Service DNS name where needed. The underlying principle is that dNS search paths are namespace-sensitive inside ordinary Pod configurations. The original risk was that a short name can refer to an unintended same-named local Service.
Incorrect Answers
A:EndpointSlices enumerate ready or eligible network endpoints behind Services. The observation “EndpointSlice members appear after selectors align and traffic recovers” would validate that property, rather than the required “The fully qualified Service name resolves to the expected target endpoint”. DNS search paths are namespace-sensitive inside ordinary Pod configurations.
B:CNI plugins configure Pod network connectivity across the cluster. The observation “Connectivity tests succeed between Pod IPs on separate workers” would validate that property, rather than the required “The fully qualified Service name resolves to the expected target endpoint”. DNS search paths are namespace-sensitive inside ordinary Pod configurations.
C:HTTP routing objects require a working controller to implement actual data-plane behavior. The observation “Requests for each host and path reach only its designated Service” would validate that property, rather than the required “The fully qualified Service name resolves to the expected target endpoint”. DNS search paths are namespace-sensitive inside ordinary Pod configurations.