Kubernetes and Cloud Native Associate KCNA Practice Test 19
Question 180
For this Kubernetes condition, An application should always check for an updated image when using a mutable tag. The proposed approach is: Set an appropriate imagePullPolicy and prefer immutable release identifiers. Which technical principle BEST supports that choice?
- Container lifecycle normally follows its primary process state
- Pod-level co-location permits coordinated companion services and local networking
- Linux user and capability boundaries can constrain process privileges
- Image pull policy determines whether a node checks the registry for an image
Explanation
Correct Answer
D:Image pull policy determines whether a node checks the registry for an image. That principle directly explains the selected remediation, set an appropriate imagePullPolicy and prefer immutable release identifiers, for this case. Without the distinction, assuming local cache always matches an updated mutable tag causes drift. The expected confirmation is that restarted Pods retrieve the intended image under the configured policy.
Incorrect Answers
A:Container lifecycle normally follows its primary process state. The operation “Container lifecycle normally follows its primary process state” does not address the particular Kubernetes requirement “Image pull policy determines whether a node checks the registry for an image”.
B:Pod-level co-location permits coordinated companion services and local networking. The operation “Pod-level co-location permits coordinated companion services and local networking” does not address the particular Kubernetes requirement “Image pull policy determines whether a node checks the registry for an image”.
C:Linux user and capability boundaries can constrain process privileges. The operation “Linux user and capability boundaries can constrain process privileges” does not address the particular Kubernetes requirement “Image pull policy determines whether a node checks the registry for an image”.
Question 181
A cloud-native operations team faces this condition: A new deployment adds a required database field and must remain backward compatible during rollout. Which response is MOST appropriate?
- Use an expand-and-contract schema migration across compatible application versions
- Use Kustomize overlays or equivalent declarative environment customization
- Package and manage shared resources through Helm charts with explicit values
- Use a controlled reconciliation agent with narrowly scoped cluster permissions
Explanation
Correct Answer
A:Use an expand-and-contract schema migration across compatible application versions. This is appropriate for the described asset and control gap because mixed-version rolling deployments require old and new software to tolerate shared data schema. If the issue is left untreated, dropping a field before old Pods stop can break in-flight requests. An assessor can verify remediation when both application revisions function during the transition and cleanup follows cutover.
Incorrect Answers
B:Use Kustomize overlays or equivalent declarative environment customization. The operation “Use Kustomize overlays or equivalent declarative environment customization” does not address the particular Kubernetes requirement “Use an expand-and-contract schema migration across compatible application versions”.
C:Package and manage shared resources through Helm charts with explicit values. The operation “Package and manage shared resources through Helm charts with explicit values” does not address the particular Kubernetes requirement “Use an expand-and-contract schema migration across compatible application versions”.
D:Use a controlled reconciliation agent with narrowly scoped cluster permissions. The operation “Use a controlled reconciliation agent with narrowly scoped cluster permissions” does not address the particular Kubernetes requirement “Use an expand-and-contract schema migration across compatible application versions”.
Question 182
In the situation "A namespace quota rejects a new Pod despite a node with free capacity", the team applies "Check ResourceQuota usage and the Pod's requested resources". Which outcome is the strongest verification?
- The new Pods meet the configured maximum zone skew
- The namespace receives approved quota capacity and the Pod is admitted
- The assigned worker is compatible with the bound volume's topology
- The Pod fits the capacity of an eligible node and schedules without excess disruption
Explanation
Correct Answer
B:The namespace receives approved quota capacity and the Pod is admitted. This is stronger than observing a saved configuration because it tests the actual outcome of check ResourceQuota usage and the Pod's requested resources. The underlying principle is that admission quota checks operate independently from node scheduling capacity. The original risk was that increasing the number of nodes does not automatically increase namespace quota.
Incorrect Answers
A:Topology spread helps distribute matching Pods across failure domains. The observation “The new Pods meet the configured maximum zone skew” would validate that property, rather than the required “The namespace receives approved quota capacity and the Pod is admitted”. Admission quota checks operate independently from node scheduling capacity.
C:Persistent storage topology can limit where a Pod may safely start. The observation “The assigned worker is compatible with the bound volume's topology” would validate that property, rather than the required “The namespace receives approved quota capacity and the Pod is admitted”. Admission quota checks operate independently from node scheduling capacity.
D:Preemption cannot create a sufficiently large node from several small nodes. The observation “The Pod fits the capacity of an eligible node and schedules without excess disruption” would validate that property, rather than the required “The namespace receives approved quota capacity and the Pod is admitted”. Admission quota checks operate independently from node scheduling capacity.
Question 183
In a Kubernetes environment this issue remains open: A Pod Security policy is specified in documentation but no enforcement runs in the namespace. Which failure is the MOST direct consequence?
- Running default privileged images broadens the damage of runtime exploitation
- Allowing arbitrary unaudited images weakens deployment supply-chain assurance
- Policy notes alone cannot prevent an unsafe Pod specification from admission
- A blanket untested deny can make healthy applications appear unavailable
Explanation
Correct Answer
C:Policy notes alone cannot prevent an unsafe Pod specification from admission. This is the direct concern in the stated scenario because pod Security Admission uses namespace-level modes such as enforce, audit, and warn. The matching mitigation is to configure supported Pod Security Admission labels and verify enforcement levels. Successful verification would show that a privileged test Pod is rejected under the intended enforce setting.
Incorrect Answers
A:Security contexts can enforce nonroot process identity for Pod containers. That explains the warning “Running default privileged images broadens the damage of runtime exploitation”; this case instead concerns “Policy notes alone cannot prevent an unsafe Pod specification from admission”. Pod Security Admission uses namespace-level modes such as enforce, audit, and warn.
B:Admission controls can reject noncompliant resources before they are stored. That explains the warning “Allowing arbitrary unaudited images weakens deployment supply-chain assurance”; this case instead concerns “Policy notes alone cannot prevent an unsafe Pod specification from admission”. Pod Security Admission uses namespace-level modes such as enforce, audit, and warn.
D:Least-privilege network controls require enumerating all legitimate communication paths. That explains the warning “A blanket untested deny can make healthy applications appear unavailable”; this case instead concerns “Policy notes alone cannot prevent an unsafe Pod specification from admission”. Pod Security Admission uses namespace-level modes such as enforce, audit, and warn.
Question 184
The platform team applies this control: Collect metrics, structured logs, and distributed traces with correlation identifiers. The original issue is: A team monitors CPU but cannot determine why a multi-service request fails. Which observation BEST validates the result?
- Series count falls while aggregate service-level signals remain available
- A shared collector receives usable traces and metrics from multiple service runtimes
- A documented availability SLI drives a clear SLO and measured error budget
- One trace spans services and links the error to relevant logs and metrics
Explanation
Correct Answer
D:One trace spans services and links the error to relevant logs and metrics. This is stronger than observing a saved configuration because it tests the actual outcome of collect metrics, structured logs, and distributed traces with correlation identifiers. The underlying principle is that metrics summarize quantities while logs and traces provide event and request context. The original risk was that cPU charts alone rarely reveal the exact failing service dependency.
Incorrect Answers
A:High-cardinality labels increase time-series storage and query pressure. The observation “Series count falls while aggregate service-level signals remain available” would validate that property, rather than the required “One trace spans services and links the error to relevant logs and metrics”. Metrics summarize quantities while logs and traces provide event and request context.
B:OpenTelemetry standardizes telemetry generation and transport across languages. The observation “A shared collector receives usable traces and metrics from multiple service runtimes” would validate that property, rather than the required “One trace spans services and links the error to relevant logs and metrics”. Metrics summarize quantities while logs and traces provide event and request context.
C:SLIs quantify observable service behavior while SLOs express a reliability target. The observation “A documented availability SLI drives a clear SLO and measured error budget” would validate that property, rather than the required “One trace spans services and links the error to relevant logs and metrics”. Metrics summarize quantities while logs and traces provide event and request context.
Question 185
In the situation "A developer needs to identify which users can update Deployments in one namespace", the team applies "Review Role, RoleBinding, and subject references for the namespace". Which outcome is the strongest verification?
- A test user can read allowed objects but cannot update forbidden Deployments
- The prior image is restored and healthy endpoints are serving requests
- The rollout reaches completion only after updated replicas satisfy readiness
- The command returns only payments resources and excludes other namespaces
Explanation
Correct Answer
A:A test user can read allowed objects but cannot update forbidden Deployments. This is stronger than observing a saved configuration because it tests the actual outcome of review Role, RoleBinding, and subject references for the namespace. The underlying principle is that rBAC permissions are granted through bound roles rather than folder ownership. The original risk was that assuming source repository access equals cluster authorization misstates privileges.
Incorrect Answers
B:Deployment revision history supports rollback of Pod-template changes. The observation “The prior image is restored and healthy endpoints are serving requests” would validate that property, rather than the required “A test user can read allowed objects but cannot update forbidden Deployments”. RBAC permissions are granted through bound roles rather than folder ownership.
C:Rollout observability distinguishes declared updates from successful availability. The observation “The rollout reaches completion only after updated replicas satisfy readiness” would validate that property, rather than the required “A test user can read allowed objects but cannot update forbidden Deployments”. RBAC permissions are granted through bound roles rather than folder ownership.
D:Namespaced API queries avoid mixing identical resource names from other teams. The observation “The command returns only payments resources and excludes other namespaces” would validate that property, rather than the required “A test user can read allowed objects but cannot update forbidden Deployments”. RBAC permissions are granted through bound roles rather than folder ownership.
Question 186
In a Kubernetes environment this issue remains open: An application returns stale values because a dependency's DNS answer is cached too long. Which failure is the MOST direct consequence?
- Deleting failing Pods without changing the invalid flag repeats CrashLoopBackOff
- Assuming every request repeats DNS resolution can hide stale connection targets
- Relying on Pod phase alone can conceal saturation or failed dependencies
- Installing tools inside the running container causes untracked deployment mutation
Explanation
Correct Answer
B:Assuming every request repeats DNS resolution can hide stale connection targets. This is the direct concern in the stated scenario because name-resolution caching can outlive endpoint or service changes in some clients. The matching mitigation is to inspect client DNS behavior and Service discovery updates during rollout. Successful verification would show that a controlled backend transition refreshes the client destination successfully.
Incorrect Answers
A:Startup failures often appear in terminated container output and process configuration. That explains the warning “Deleting failing Pods without changing the invalid flag repeats CrashLoopBackOff”; this case instead concerns “Assuming every request repeats DNS resolution can hide stale connection targets”. Name-resolution caching can outlive endpoint or service changes in some clients.
C:A Running Pod indicates process state rather than end-to-end service success. That explains the warning “Relying on Pod phase alone can conceal saturation or failed dependencies”; this case instead concerns “Assuming every request repeats DNS resolution can hide stale connection targets”. Name-resolution caching can outlive endpoint or service changes in some clients.
D:Ephemeral troubleshooting separates observation tooling from the release artifact. That explains the warning “Installing tools inside the running container causes untracked deployment mutation”; this case instead concerns “Assuming every request repeats DNS resolution can hide stale connection targets”. Name-resolution caching can outlive endpoint or service changes in some clients.
Question 187
A cloud-native operations team faces this condition: A container has no guaranteed minimum memory but competes with a busy neighbor. Which response is MOST appropriate?
- Apply required Pod anti-affinity using a node topology key
- Use suitable autoscaling or descheduling components rather than assuming automatic migrations
- Specify realistic memory requests and limits based on observed workload needs
- Correct topology labels and validate admission and scheduler diagnostics
Explanation
Correct Answer
C:Specify realistic memory requests and limits based on observed workload needs. This is appropriate for the described asset and control gap because requests influence scheduling while limits bound container memory consumption. If the issue is left untreated, without appropriate requests a workload may be evicted under pressure. An assessor can verify remediation when the Pod receives adequate requested memory and stays healthy during load.
Incorrect Answers
A:Apply required Pod anti-affinity using a node topology key. The operation “Apply required Pod anti-affinity using a node topology key” does not address the particular Kubernetes requirement “Specify realistic memory requests and limits based on observed workload needs”.
B:Use suitable autoscaling or descheduling components rather than assuming automatic migrations. The operation “Use suitable autoscaling or descheduling components rather than assuming automatic migrations” does not address the particular Kubernetes requirement “Specify realistic memory requests and limits based on observed workload needs”.
D:Correct topology labels and validate admission and scheduler diagnostics. The operation “Correct topology labels and validate admission and scheduler diagnostics” does not address the particular Kubernetes requirement “Specify realistic memory requests and limits based on observed workload needs”.
Question 188
Given the requirement "A slow Java application repeatedly fails liveness checks while still initializing", the proposed fix is "Add a startup probe so liveness is deferred until startup completes". Which principle explains why it works?
- ImagePullBackOff often follows failed pulls or invalid registry authentication
- Kubernetes name resolution depends on DNS service and Pod resolver configuration
- CrashLoopBackOff reflects repeated container start failures with increasing delay
- Startup probes protect slow initialization from premature liveness restarts
Explanation
Correct Answer
D:Startup probes protect slow initialization from premature liveness restarts. That principle directly explains the selected remediation, add a startup probe so liveness is deferred until startup completes, for this case. Without the distinction, aggressive liveness checks can keep a healthy slow-starting app in a reboot loop. The expected confirmation is that the app finishes startup before normal liveness and readiness checks begin.
Incorrect Answers
A:ImagePullBackOff often follows failed pulls or invalid registry authentication. The operation “ImagePullBackOff often follows failed pulls or invalid registry authentication” does not address the particular Kubernetes requirement “Startup probes protect slow initialization from premature liveness restarts”.
B:Kubernetes name resolution depends on DNS service and Pod resolver configuration. The operation “Kubernetes name resolution depends on DNS service and Pod resolver configuration” does not address the particular Kubernetes requirement “Startup probes protect slow initialization from premature liveness restarts”.
C:CrashLoopBackOff reflects repeated container start failures with increasing delay. The operation “CrashLoopBackOff reflects repeated container start failures with increasing delay” does not address the particular Kubernetes requirement “Startup probes protect slow initialization from premature liveness restarts”.
Question 189
A Kubernetes platform team observes this situation: A new image repeatedly crashes because a required flag was renamed. Which action BEST addresses the requirement?
- Inspect previous container logs and the current image command and arguments
- Use an approved ephemeral debug container with captured evidence and minimal privileges
- Inspect pull events and verify scoped imagePullSecret references and registry access
- Filter logs by namespace, labels, Pod identity, and relevant time range
Explanation
Correct Answer
A:Inspect previous container logs and the current image command and arguments. This is appropriate for the described asset and control gap because startup failures often appear in terminated container output and process configuration. If the issue is left untreated, deleting failing Pods without changing the invalid flag repeats CrashLoopBackOff. An assessor can verify remediation when corrected arguments let the container remain Running without repeated restarts.
Incorrect Answers
B:Use an approved ephemeral debug container with captured evidence and minimal privileges. The operation “Use an approved ephemeral debug container with captured evidence and minimal privileges” does not address the particular Kubernetes requirement “Inspect previous container logs and the current image command and arguments”.
C:Inspect pull events and verify scoped imagePullSecret references and registry access. The operation “Inspect pull events and verify scoped imagePullSecret references and registry access” does not address the particular Kubernetes requirement “Inspect previous container logs and the current image command and arguments”.
D:Filter logs by namespace, labels, Pod identity, and relevant time range. The operation “Filter logs by namespace, labels, Pod identity, and relevant time range” does not address the particular Kubernetes requirement “Inspect previous container logs and the current image command and arguments”.
Question 190
A cloud-native operations team faces this condition: A platform uses two runtimes and wants identical portable container image metadata. Which response is MOST appropriate?
- Explain process isolation using a shared host kernel and image filesystem
- Follow Open Container Initiative image and runtime specification conventions
- Use multi-stage builds to separate build tools from runtime artifacts
- Run the container with an unprivileged UID and restricted capabilities
Explanation
Correct Answer
B:Follow Open Container Initiative image and runtime specification conventions. This is appropriate for the described asset and control gap because oCI specifications help standardize image packaging and execution interfaces. If the issue is left untreated, a proprietary image layout may not work across compliant runtimes. An assessor can verify remediation when both supported runtimes can load and run the same compliant image.
Incorrect Answers
A:Explain process isolation using a shared host kernel and image filesystem. The operation “Explain process isolation using a shared host kernel and image filesystem” does not address the particular Kubernetes requirement “Follow Open Container Initiative image and runtime specification conventions”.
C:Use multi-stage builds to separate build tools from runtime artifacts. The operation “Use multi-stage builds to separate build tools from runtime artifacts” does not address the particular Kubernetes requirement “Follow Open Container Initiative image and runtime specification conventions”.
D:Run the container with an unprivileged UID and restricted capabilities. The operation “Run the container with an unprivileged UID and restricted capabilities” does not address the particular Kubernetes requirement “Follow Open Container Initiative image and runtime specification conventions”.
