Kubernetes and Cloud Native Associate KCNA Practice Test 27
Question 260
In the situation "An application returns stale values because a dependency's DNS answer is cached too long", the team applies "Inspect client DNS behavior and Service discovery updates during rollout". Which outcome is the strongest verification?
- The correlated failing request appears in logs from the affected replica
- The debug session identifies the fault while the original image digest remains unchanged
- A corrected Pod passes readiness and rollout status becomes Complete
- A controlled backend transition refreshes the client destination successfully
Explanation
Correct Answer
D:A controlled backend transition refreshes the client destination successfully. This is stronger than observing a saved configuration because it tests the actual outcome of inspect client DNS behavior and Service discovery updates during rollout. The underlying principle is that name-resolution caching can outlive endpoint or service changes in some clients. The original risk was that assuming every request repeats DNS resolution can hide stale connection targets.
Incorrect Answers
A:Distributed services require selecting the affected execution instance. The observation “The correlated failing request appears in logs from the affected replica” would validate that property, rather than the required “A controlled backend transition refreshes the client destination successfully”. Name-resolution caching can outlive endpoint or service changes in some clients.
B:Ephemeral troubleshooting separates observation tooling from the release artifact. The observation “The debug session identifies the fault while the original image digest remains unchanged” would validate that property, rather than the required “A controlled backend transition refreshes the client destination successfully”. Name-resolution caching can outlive endpoint or service changes in some clients.
C:Delivery debugging begins with resource status and failure conditions. The observation “A corrected Pod passes readiness and rollout status becomes Complete” would validate that property, rather than the required “A controlled backend transition refreshes the client destination successfully”. Name-resolution caching can outlive endpoint or service changes in some clients.
Question 261
For this Kubernetes condition, A new telemetry library sends spans but their relationships are lost between services. The proposed approach is: Propagate supported trace context through each service call. Which technical principle BEST supports that choice?
- Distributed tracing requires correlation propagation to connect spans across boundaries
- Actionable alerting links signals to service health and response decisions
- Prometheus gathers time-series metrics from configured scrape targets
- SLIs quantify observable service behavior while SLOs express a reliability target
Explanation
Correct Answer
A:Distributed tracing requires correlation propagation to connect spans across boundaries. That principle directly explains the selected remediation, propagate supported trace context through each service call, for this case. Without the distinction, independent unlinked spans cannot reconstruct end-to-end request latency. The expected confirmation is that a single trace contains parent-child spans across the whole request path.
Incorrect Answers
B:Actionable alerting links signals to service health and response decisions. The operation “Actionable alerting links signals to service health and response decisions” does not address the particular Kubernetes requirement “Distributed tracing requires correlation propagation to connect spans across boundaries”.
C:Prometheus gathers time-series metrics from configured scrape targets. The operation “Prometheus gathers time-series metrics from configured scrape targets” does not address the particular Kubernetes requirement “Distributed tracing requires correlation propagation to connect spans across boundaries”.
D:SLIs quantify observable service behavior while SLOs express a reliability target. The operation “SLIs quantify observable service behavior while SLOs express a reliability target” does not address the particular Kubernetes requirement “Distributed tracing requires correlation propagation to connect spans across boundaries”.
Question 262
The platform team applies this control: Explain containers, orchestration, automation, observability, and open interfaces together. The original issue is: A team must understand why Kubernetes is part of a broader cloud-native ecosystem. Which observation BEST validates the result?
- An injected dependency outage produces bounded latency and graceful degradation
- The architecture design accounts for automated rollout, monitoring, and scaling
- A representative event workload meets latency and cost targets under the chosen model
- Each service deploys safely and interface compatibility tests protect consumers
Explanation
Correct Answer
B:The architecture design accounts for automated rollout, monitoring, and scaling. This is stronger than observing a saved configuration because it tests the actual outcome of explain containers, orchestration, automation, observability, and open interfaces together. The underlying principle is that cloud-native systems combine organizational practices and technology, not only a container runtime. The original risk was that treating containers alone as cloud-native adoption can ignore deployment and reliability needs.
Incorrect Answers
A:Resilience patterns keep transient dependency faults from consuming all callers. The observation “An injected dependency outage produces bounded latency and graceful degradation” would validate that property, rather than the required “The architecture design accounts for automated rollout, monitoring, and scaling”. Cloud-native systems combine organizational practices and technology, not only a container runtime.
C:Serverless and event-driven designs can suit intermittent work but have operational tradeoffs. The observation “A representative event workload meets latency and cost targets under the chosen model” would validate that property, rather than the required “The architecture design accounts for automated rollout, monitoring, and scaling”. Cloud-native systems combine organizational practices and technology, not only a container runtime.
D:Cloud-native architecture often favors independently deployable components with clear boundaries. The observation “Each service deploys safely and interface compatibility tests protect consumers” would validate that property, rather than the required “The architecture design accounts for automated rollout, monitoring, and scaling”. Cloud-native systems combine organizational practices and technology, not only a container runtime.
Question 263
An operator notices this unresolved gap: A local developer needs temporary access to a private Pod port for diagnosis. What consequence BEST explains the need to address it?
- Restarting every Evicted Pod without fixing disk pressure perpetuates churn
- A readiness probe alone only changes traffic eligibility and will not restart it
- Exposing the service publicly for local debugging can introduce unnecessary access
- Aggressive liveness checks can keep a healthy slow-starting app in a reboot loop
Explanation
Correct Answer
C:Exposing the service publicly for local debugging can introduce unnecessary access. This is the direct concern in the stated scenario because port forwarding establishes an explicit temporary API-mediated connection path. The matching mitigation is to use a scoped kubectl port-forward session and terminate it after testing. Successful verification would show that the local probe succeeds while no new externally reachable Service is created.
Incorrect Answers
A:Node resource pressure can trigger Pod eviction independent of application exit codes. That explains the warning “Restarting every Evicted Pod without fixing disk pressure perpetuates churn”; this case instead concerns “Exposing the service publicly for local debugging can introduce unnecessary access”. Port forwarding establishes an explicit temporary API-mediated connection path.
B:Liveness probes detect a running container that requires restart. That explains the warning “A readiness probe alone only changes traffic eligibility and will not restart it”; this case instead concerns “Exposing the service publicly for local debugging can introduce unnecessary access”. Port forwarding establishes an explicit temporary API-mediated connection path.
D:Startup probes protect slow initialization from premature liveness restarts. That explains the warning “Aggressive liveness checks can keep a healthy slow-starting app in a reboot loop”; this case instead concerns “Exposing the service publicly for local debugging can introduce unnecessary access”. Port forwarding establishes an explicit temporary API-mediated connection path.
Question 264
A team implemented the proposed remedy for this problem: A scheduler assigns Pods based on requests but users expect it to react to live utilization by itself. Which evidence BEST shows it works?
- The eviction event cites resource pressure and critical Pods remain served
- The replicas land on distinct nodes and survive failure of one worker
- An urgent essential Pod gains resources while lower-priority capacity is displaced
- Measured autoscaling changes intended replica capacity without forced random migrations
Explanation
Correct Answer
D:Measured autoscaling changes intended replica capacity without forced random migrations. This is stronger than observing a saved configuration because it tests the actual outcome of use suitable autoscaling or descheduling components rather than assuming automatic migrations. The underlying principle is that default placement is not continuous live-CPU load balancing among healthy nodes. The original risk was that leaving workloads to drift can create hotspots after initial scheduling.
Incorrect Answers
A:Scheduling priority and node pressure affect workload retention. The observation “The eviction event cites resource pressure and critical Pods remain served” would validate that property, rather than the required “Measured autoscaling changes intended replica capacity without forced random migrations”. Default placement is not continuous live-CPU load balancing among healthy nodes.
B:Pod anti-affinity can keep matching Pods on separate topology domains. The observation “The replicas land on distinct nodes and survive failure of one worker” would validate that property, rather than the required “Measured autoscaling changes intended replica capacity without forced random migrations”. Default placement is not continuous live-CPU load balancing among healthy nodes.
C:Priority influences scheduling order and can affect lower-priority eviction. The observation “An urgent essential Pod gains resources while lower-priority capacity is displaced” would validate that property, rather than the required “Measured autoscaling changes intended replica capacity without forced random migrations”. Default placement is not continuous live-CPU load balancing among healthy nodes.
Question 265
A cloud-native operations team faces this condition: A configuration upgrade must be coordinated across teams without direct shell access to nodes. Which response is MOST appropriate?
- Use supported Kubernetes API configuration workflows and controlled reviews
- Use kubectl describe to inspect conditions and recent warning events
- Apply a suitable LimitRange with documented defaults and boundaries
- Retrieve the prior terminated container logs using the appropriate kubectl option
Explanation
Correct Answer
A:Use supported Kubernetes API configuration workflows and controlled reviews. This is appropriate for the described asset and control gap because cluster management is expressed primarily through versioned API objects. If the issue is left untreated, manual per-node tweaks drift from declarative manifests and audit history. An assessor can verify remediation when reviewed configuration applies consistently and survives node replacement.
Incorrect Answers
B:Use kubectl describe to inspect conditions and recent warning events. The operation “Use kubectl describe to inspect conditions and recent warning events” does not address the particular Kubernetes requirement “Use supported Kubernetes API configuration workflows and controlled reviews”.
C:Apply a suitable LimitRange with documented defaults and boundaries. The operation “Apply a suitable LimitRange with documented defaults and boundaries” does not address the particular Kubernetes requirement “Use supported Kubernetes API configuration workflows and controlled reviews”.
D:Retrieve the prior terminated container logs using the appropriate kubectl option. The operation “Retrieve the prior terminated container logs using the appropriate kubectl option” does not address the particular Kubernetes requirement “Use supported Kubernetes API configuration workflows and controlled reviews”.
Question 266
An operator notices this unresolved gap: A newly deployed app cannot attach a PersistentVolumeClaim and stays Pending. What consequence BEST explains the need to address it?
- Deleting the Pod without fixing its startup error may repeat the failure
- Changing the container command will not provision an unavailable volume
- Aggressive liveness checks can keep a healthy slow-starting app in a reboot loop
- A readiness probe alone only changes traffic eligibility and will not restart it
Explanation
Correct Answer
B:Changing the container command will not provision an unavailable volume. This is the direct concern in the stated scenario because unbound storage claims or topology conflicts can block workload readiness. The matching mitigation is to inspect PVC binding status, StorageClass, and volume topology events. Successful verification would show that the claim becomes Bound and the workload mounts the intended volume.
Incorrect Answers
A:CrashLoopBackOff reflects repeated container start failures with increasing delay. That explains the warning “Deleting the Pod without fixing its startup error may repeat the failure”; this case instead concerns “Changing the container command will not provision an unavailable volume”. Unbound storage claims or topology conflicts can block workload readiness.
C:Startup probes protect slow initialization from premature liveness restarts. That explains the warning “Aggressive liveness checks can keep a healthy slow-starting app in a reboot loop”; this case instead concerns “Changing the container command will not provision an unavailable volume”. Unbound storage claims or topology conflicts can block workload readiness.
D:Liveness probes detect a running container that requires restart. That explains the warning “A readiness probe alone only changes traffic eligibility and will not restart it”; this case instead concerns “Changing the container command will not provision an unavailable volume”. Unbound storage claims or topology conflicts can block workload readiness.
Question 267
In a Kubernetes environment this issue remains open: A container repeatedly fails after a new image was promoted but the old image worked. Which failure is the MOST direct consequence?
- Treating memory kills as network errors delays a useful capacity or code fix
- Increasing application replicas cannot fix a Service with no matched endpoints
- Restarting identical faulty images cannot repair a deterministic regression
- Installing tools inside the running container causes untracked deployment mutation
Explanation
Correct Answer
C:Restarting identical faulty images cannot repair a deterministic regression. This is the direct concern in the stated scenario because version-aware troubleshooting isolates failures introduced by specific changes. The matching mitigation is to compare revision diffs and rollback to a validated prior release if necessary. Successful verification would show that rollback restores service while the failing revision is retained for analysis.
Incorrect Answers
A:An OOM termination indicates a breached memory boundary or node memory pressure. That explains the warning “Treating memory kills as network errors delays a useful capacity or code fix”; this case instead concerns “Restarting identical faulty images cannot repair a deterministic regression”. Version-aware troubleshooting isolates failures introduced by specific changes.
B:Service networking requires matching endpoints and correct destination ports. That explains the warning “Increasing application replicas cannot fix a Service with no matched endpoints”; this case instead concerns “Restarting identical faulty images cannot repair a deterministic regression”. Version-aware troubleshooting isolates failures introduced by specific changes.
D:Ephemeral troubleshooting separates observation tooling from the release artifact. That explains the warning “Installing tools inside the running container causes untracked deployment mutation”; this case instead concerns “Restarting identical faulty images cannot repair a deterministic regression”. Version-aware troubleshooting isolates failures introduced by specific changes.
Question 268
The platform team applies this control: Use application TLS or an approved mesh policy for required encrypted connections. The original issue is: A developer says creating a Service automatically provides end-to-end transport encryption. Which observation BEST validates the result?
- Each ordinal Pod resolves under its own predictable DNS record
- EndpointSlice members appear after selectors align and traffic recovers
- Connectivity tests succeed between Pod IPs on separate workers
- A packet capture confirms TLS-protected sessions between service endpoints
Explanation
Correct Answer
D:A packet capture confirms TLS-protected sessions between service endpoints. This is stronger than observing a saved configuration because it tests the actual outcome of use application TLS or an approved mesh policy for required encrypted connections. The underlying principle is that a Kubernetes Service is an abstraction for reachability, not inherent encryption. The original risk was that sending credentials over an unencrypted Service path can expose them on the network.
Incorrect Answers
A:Headless Services expose endpoint records rather than an ordinary virtual ClusterIP. The observation “Each ordinal Pod resolves under its own predictable DNS record” would validate that property, rather than the required “A packet capture confirms TLS-protected sessions between service endpoints”. A Kubernetes Service is an abstraction for reachability, not inherent encryption.
B:EndpointSlices enumerate ready or eligible network endpoints behind Services. The observation “EndpointSlice members appear after selectors align and traffic recovers” would validate that property, rather than the required “A packet capture confirms TLS-protected sessions between service endpoints”. A Kubernetes Service is an abstraction for reachability, not inherent encryption.
C:CNI plugins configure Pod network connectivity across the cluster. The observation “Connectivity tests succeed between Pod IPs on separate workers” would validate that property, rather than the required “A packet capture confirms TLS-protected sessions between service endpoints”. A Kubernetes Service is an abstraction for reachability, not inherent encryption.
Question 269
Given the requirement "An application needs a changeable feature flag without rebuilding its container image", the proposed fix is "Supply nonsecret configuration through a ConfigMap and suitable Pod reference". Which principle explains why it works?
- ConfigMaps separate ordinary configuration data from immutable image content
- Label selectors determine which eligible Pods become Service endpoints
- A Deployment reconciles ReplicaSets to maintain desired stateless workload capacity
- DaemonSets maintain a designated Pod copy on every selected node
Explanation
Correct Answer
A:ConfigMaps separate ordinary configuration data from immutable image content. That principle directly explains the selected remediation, supply nonsecret configuration through a ConfigMap and suitable Pod reference, for this case. Without the distinction, baking every environment setting into images creates configuration and release drift. The expected confirmation is that a deployment uses the configured flag after an appropriate Pod or mount update.
Incorrect Answers
B:Label selectors determine which eligible Pods become Service endpoints. The operation “Label selectors determine which eligible Pods become Service endpoints” does not address the particular Kubernetes requirement “ConfigMaps separate ordinary configuration data from immutable image content”.
C:A Deployment reconciles ReplicaSets to maintain desired stateless workload capacity. The operation “A Deployment reconciles ReplicaSets to maintain desired stateless workload capacity” does not address the particular Kubernetes requirement “ConfigMaps separate ordinary configuration data from immutable image content”.
D:DaemonSets maintain a designated Pod copy on every selected node. The operation “DaemonSets maintain a designated Pod copy on every selected node” does not address the particular Kubernetes requirement “ConfigMaps separate ordinary configuration data from immutable image content”.
Question 270
For this Kubernetes condition, A container's main process exits immediately while its supporting services remain healthy. The proposed approach is: Fix the intended foreground process and container entrypoint behavior. Which technical principle BEST supports that choice?
- Reducing unneeded image contents reduces exposed packages and maintenance cost
- Container lifecycle normally follows its primary process state
- OCI specifications help standardize image packaging and execution interfaces
- Registry authentication is distinct from Kubernetes workload API authorization
Explanation
Correct Answer
B:Container lifecycle normally follows its primary process state. That principle directly explains the selected remediation, fix the intended foreground process and container entrypoint behavior, for this case. Without the distinction, launching only a short-lived setup script can cause repeated restarts. The expected confirmation is that the correct foreground process remains active and the container stays Running.
Incorrect Answers
A:Reducing unneeded image contents reduces exposed packages and maintenance cost. The operation “Reducing unneeded image contents reduces exposed packages and maintenance cost” does not address the particular Kubernetes requirement “Container lifecycle normally follows its primary process state”.
C:OCI specifications help standardize image packaging and execution interfaces. The operation “OCI specifications help standardize image packaging and execution interfaces” does not address the particular Kubernetes requirement “Container lifecycle normally follows its primary process state”.
D:Registry authentication is distinct from Kubernetes workload API authorization. The operation “Registry authentication is distinct from Kubernetes workload API authorization” does not address the particular Kubernetes requirement “Container lifecycle normally follows its primary process state”.
