Kubernetes and Cloud Native Associate KCNA Practice Test 41
Question 400
The team has not corrected this condition: An auditor must reconstruct who changed a critical cluster role during an incident. Which risk is MOST relevant?
- A default open Pod network can permit cross-team connections despite namespace separation
- Unrestricted host mounts can let a compromised Pod affect worker filesystems
- Running default privileged images broadens the damage of runtime exploitation
- Application stdout alone does not identify every control-plane authorization change
Explanation
Correct Answer
D:Application stdout alone does not identify every control-plane authorization change. This is the direct concern in the stated scenario because kubernetes audit records provide context on authenticated API requests. The matching mitigation is to enable appropriate control-plane audit logging with protected retention. Successful verification would show that a test role modification has an auditable actor and request record.
Incorrect Answers
A:Namespaces partition resource names and policy scope but are not automatic network firewalls. That explains the warning “A default open Pod network can permit cross-team connections despite namespace separation”; this case instead concerns “Application stdout alone does not identify every control-plane authorization change”. Kubernetes audit records provide context on authenticated API requests.
B:Pod security context and admission standards limit process and host access. That explains the warning “Unrestricted host mounts can let a compromised Pod affect worker filesystems”; this case instead concerns “Application stdout alone does not identify every control-plane authorization change”. Kubernetes audit records provide context on authenticated API requests.
C:Security contexts can enforce nonroot process identity for Pod containers. That explains the warning “Running default privileged images broadens the damage of runtime exploitation”; this case instead concerns “Application stdout alone does not identify every control-plane authorization change”. Kubernetes audit records provide context on authenticated API requests.
Question 401
Given the requirement "A platform owner wants new database claims to provision volumes automatically", the proposed fix is "Configure a suitable dynamic provisioner and StorageClass". Which principle explains why it works?
- StorageClasses describe how persistent volumes are created by storage drivers
- Volume placement influences eligible nodes and availability zones for stateful workloads
- Kubernetes snapshots require compatible snapshot controller and CSI support
- PersistentVolumeClaims request storage independently of physical volume provisioning
Explanation
Correct Answer
A:StorageClasses describe how persistent volumes are created by storage drivers. That principle directly explains the selected remediation, configure a suitable dynamic provisioner and StorageClass, for this case. Without the distinction, creating claims without a working provisioner can leave them Pending. The expected confirmation is that a new PVC becomes Bound after its supported volume is provisioned.
Incorrect Answers
B:Volume placement influences eligible nodes and availability zones for stateful workloads. The operation “Volume placement influences eligible nodes and availability zones for stateful workloads” does not address the particular Kubernetes requirement “StorageClasses describe how persistent volumes are created by storage drivers”.
C:Kubernetes snapshots require compatible snapshot controller and CSI support. The operation “Kubernetes snapshots require compatible snapshot controller and CSI support” does not address the particular Kubernetes requirement “StorageClasses describe how persistent volumes are created by storage drivers”.
D:PersistentVolumeClaims request storage independently of physical volume provisioning. The operation “PersistentVolumeClaims request storage independently of physical volume provisioning” does not address the particular Kubernetes requirement “StorageClasses describe how persistent volumes are created by storage drivers”.
Question 402
For this Kubernetes condition, A vendor wants one auditable artifact promoted across development and production. The proposed approach is: Build an immutable image once and promote its verified digest through environments. Which technical principle BEST supports that choice?
- Release tooling preserves revisions that support controlled restoration
- Artifact promotion preserves the same tested application bits across stages
- Mixed-version rolling deployments require old and new software to tolerate shared data schema
- Readiness probes control endpoint eligibility independently of process status
Explanation
Correct Answer
B:Artifact promotion preserves the same tested application bits across stages. That principle directly explains the selected remediation, build an immutable image once and promote its verified digest through environments, for this case. Without the distinction, rebuilding from an unpinned branch during promotion can change program behavior. The expected confirmation is that the production deployment references the exact previously tested image digest.
Incorrect Answers
A:Release tooling preserves revisions that support controlled restoration. The operation “Release tooling preserves revisions that support controlled restoration” does not address the particular Kubernetes requirement “Artifact promotion preserves the same tested application bits across stages”.
C:Mixed-version rolling deployments require old and new software to tolerate shared data schema. The operation “Mixed-version rolling deployments require old and new software to tolerate shared data schema” does not address the particular Kubernetes requirement “Artifact promotion preserves the same tested application bits across stages”.
D:Readiness probes control endpoint eligibility independently of process status. The operation “Readiness probes control endpoint eligibility independently of process status” does not address the particular Kubernetes requirement “Artifact promotion preserves the same tested application bits across stages”.
Question 403
The team has not corrected this condition: A project needs repeatable deployments to many clusters without giving developers broad credentials. Which risk is MOST relevant?
- Routing requests to a running but uninitialized process causes transient failures
- Immediate process termination can interrupt in-flight work or cause duplicate payment calls
- Embedding broad production kubeconfigs in CI jobs creates avoidable credential risk
- Switching every user at once makes regression impact harder to contain
Explanation
Correct Answer
C:Embedding broad production kubeconfigs in CI jobs creates avoidable credential risk. This is the direct concern in the stated scenario because pull-based deployment agents can reduce the need to distribute cluster-admin keys. The matching mitigation is to use a controlled reconciliation agent with narrowly scoped cluster permissions. Successful verification would show that the agent applies only approved resources and unrelated changes are denied.
Incorrect Answers
A:Readiness probes control endpoint eligibility independently of process status. That explains the warning “Routing requests to a running but uninitialized process causes transient failures”; this case instead concerns “Embedding broad production kubeconfigs in CI jobs creates avoidable credential risk”. Pull-based deployment agents can reduce the need to distribute cluster-admin keys.
B:Kubernetes sends shutdown signals and allows bounded cleanup before forced stop. That explains the warning “Immediate process termination can interrupt in-flight work or cause duplicate payment calls”; this case instead concerns “Embedding broad production kubeconfigs in CI jobs creates avoidable credential risk”. Pull-based deployment agents can reduce the need to distribute cluster-admin keys.
D:Canary delivery limits the blast radius of new behavior for evaluation. That explains the warning “Switching every user at once makes regression impact harder to contain”; this case instead concerns “Embedding broad production kubeconfigs in CI jobs creates avoidable credential risk”. Pull-based deployment agents can reduce the need to distribute cluster-admin keys.
Question 404
In the situation "A security gate wants to block high-risk image vulnerabilities before rollout", the team applies "Scan release artifacts and enforce an approved image policy before deployment". Which outcome is the strongest verification?
- The proxy remains independently observable while supporting the application Pod
- Runtime health recovers and the assigned Pod successfully starts
- Image inventory lists only required runtime packages after rebuild
- The pipeline blocks an intentionally vulnerable test image under its policy
Explanation
Correct Answer
D:The pipeline blocks an intentionally vulnerable test image under its policy. This is stronger than observing a saved configuration because it tests the actual outcome of scan release artifacts and enforce an approved image policy before deployment. The underlying principle is that container image scanning finds known package risk before admission. The original risk was that treating a successful build as security approval can release vulnerable libraries.
Incorrect Answers
A:Pod-level co-location permits coordinated companion services and local networking. The observation “The proxy remains independently observable while supporting the application Pod” would validate that property, rather than the required “The pipeline blocks an intentionally vulnerable test image under its policy”. Container image scanning finds known package risk before admission.
B:Kubernetes uses the Container Runtime Interface to coordinate container execution. The observation “Runtime health recovers and the assigned Pod successfully starts” would validate that property, rather than the required “The pipeline blocks an intentionally vulnerable test image under its policy”. Container image scanning finds known package risk before admission.
C:Reducing unneeded image contents reduces exposed packages and maintenance cost. The observation “Image inventory lists only required runtime packages after rebuild” would validate that property, rather than the required “The pipeline blocks an intentionally vulnerable test image under its policy”. Container image scanning finds known package risk before admission.
Question 405
For this Kubernetes condition, A workload declares a PVC but its Pod never mounts the volume. The proposed approach is: Check the claim binding, CSI driver, node attachment, and event messages. Which technical principle BEST supports that choice?
- CSI drivers integrate vendor storage provisioning and mounting with Kubernetes
- StorageClasses describe how persistent volumes are created by storage drivers
- Volume placement influences eligible nodes and availability zones for stateful workloads
- PVC expansion depends on driver support and filesystem resizing behavior
Explanation
Correct Answer
A:CSI drivers integrate vendor storage provisioning and mounting with Kubernetes. That principle directly explains the selected remediation, check the claim binding, CSI driver, node attachment, and event messages, for this case. Without the distinction, a Bound claim alone does not prove a successful node-level mount. The expected confirmation is that the Pod reports the mounted filesystem after the driver issue is fixed.
Incorrect Answers
B:StorageClasses describe how persistent volumes are created by storage drivers. The operation “StorageClasses describe how persistent volumes are created by storage drivers” does not address the particular Kubernetes requirement “CSI drivers integrate vendor storage provisioning and mounting with Kubernetes”.
C:Volume placement influences eligible nodes and availability zones for stateful workloads. The operation “Volume placement influences eligible nodes and availability zones for stateful workloads” does not address the particular Kubernetes requirement “CSI drivers integrate vendor storage provisioning and mounting with Kubernetes”.
D:PVC expansion depends on driver support and filesystem resizing behavior. The operation “PVC expansion depends on driver support and filesystem resizing behavior” does not address the particular Kubernetes requirement “CSI drivers integrate vendor storage provisioning and mounting with Kubernetes”.
Question 406
The platform team applies this control: Inspect pull events and verify scoped imagePullSecret references and registry access. The original issue is: A new container cannot pull its image after a registry authentication rotation. Which observation BEST validates the result?
- Tests isolate one affected worker and service recovers after node remediation
- The image download succeeds after correcting the registered pull credential
- Corrected arguments let the container remain Running without repeated restarts
- The debug session identifies the fault while the original image digest remains unchanged
Explanation
Correct Answer
B:The image download succeeds after correcting the registered pull credential. This is stronger than observing a saved configuration because it tests the actual outcome of inspect pull events and verify scoped imagePullSecret references and registry access. The underlying principle is that container retrieval requires valid credentials before the process can launch. The original risk was that changing liveness probes cannot resolve registry authorization failures.
Incorrect Answers
A:Node-local dataplane or runtime problems can affect only a subset of replicas. The observation “Tests isolate one affected worker and service recovers after node remediation” would validate that property, rather than the required “The image download succeeds after correcting the registered pull credential”. Container retrieval requires valid credentials before the process can launch.
C:Startup failures often appear in terminated container output and process configuration. The observation “Corrected arguments let the container remain Running without repeated restarts” would validate that property, rather than the required “The image download succeeds after correcting the registered pull credential”. Container retrieval requires valid credentials before the process can launch.
D:Ephemeral troubleshooting separates observation tooling from the release artifact. The observation “The debug session identifies the fault while the original image digest remains unchanged” would validate that property, rather than the required “The image download succeeds after correcting the registered pull credential”. Container retrieval requires valid credentials before the process can launch.
Question 407
In the situation "A container's memory usage rises after a release and Pods are killed under traffic", the team applies "Correlate OOMKilled events with memory limits and workload allocation". Which outcome is the strongest verification?
- The correlated failing request appears in logs from the affected replica
- The approved production endpoint is used and a smoke request succeeds
- Memory profiling and adjusted limits remove the repeated OOM terminations
- Corrected arguments let the container remain Running without repeated restarts
Explanation
Correct Answer
C:Memory profiling and adjusted limits remove the repeated OOM terminations. This is stronger than observing a saved configuration because it tests the actual outcome of correlate OOMKilled events with memory limits and workload allocation. The underlying principle is that an OOM termination indicates a breached memory boundary or node memory pressure. The original risk was that treating memory kills as network errors delays a useful capacity or code fix.
Incorrect Answers
A:Distributed services require selecting the affected execution instance. The observation “The correlated failing request appears in logs from the affected replica” would validate that property, rather than the required “Memory profiling and adjusted limits remove the repeated OOM terminations”. An OOM termination indicates a breached memory boundary or node memory pressure.
B:Application configuration differences are common causes of release-specific faults. The observation “The approved production endpoint is used and a smoke request succeeds” would validate that property, rather than the required “Memory profiling and adjusted limits remove the repeated OOM terminations”. An OOM termination indicates a breached memory boundary or node memory pressure.
D:Startup failures often appear in terminated container output and process configuration. The observation “Corrected arguments let the container remain Running without repeated restarts” would validate that property, rather than the required “Memory profiling and adjusted limits remove the repeated OOM terminations”. An OOM termination indicates a breached memory boundary or node memory pressure.
Question 408
A Kubernetes platform team observes this situation: A cluster configuration should always match reviewed content in a Git repository. Which action BEST addresses the requirement?
- Use a controlled reconciliation agent with narrowly scoped cluster permissions
- Define a readiness probe that excludes it from traffic until ready
- Implement a CI/CD promotion gate separating build, test, and release stages
- Implement GitOps reconciliation using an approved controller such as Flux or Argo CD
Explanation
Correct Answer
D:Implement GitOps reconciliation using an approved controller such as Flux or Argo CD. This is appropriate for the described asset and control gap because gitOps uses declared source-control desired state with automated convergence. If the issue is left untreated, permanent manual edits can cause configuration drift from the approved repository. An assessor can verify remediation when a reviewed commit is reconciled and unauthorized live drift is corrected.
Incorrect Answers
A:Use a controlled reconciliation agent with narrowly scoped cluster permissions. The operation “Use a controlled reconciliation agent with narrowly scoped cluster permissions” does not address the particular Kubernetes requirement “Implement GitOps reconciliation using an approved controller such as Flux or Argo CD”.
B:Define a readiness probe that excludes it from traffic until ready. The operation “Define a readiness probe that excludes it from traffic until ready” does not address the particular Kubernetes requirement “Implement GitOps reconciliation using an approved controller such as Flux or Argo CD”.
C:Implement a CI/CD promotion gate separating build, test, and release stages. The operation “Implement a CI/CD promotion gate separating build, test, and release stages” does not address the particular Kubernetes requirement “Implement GitOps reconciliation using an approved controller such as Flux or Argo CD”.
Question 409
The team has not corrected this condition: A reporting workload prefers a low-cost node pool but can run elsewhere. Which risk is MOST relevant?
- Using a hard requirement can leave the service Pending during capacity shortage
- Live CPU graphs alone cannot establish whether requested capacity fits
- Leaving workloads to drift can create hotspots after initial scheduling
- Placing every replica on one node creates a single-node outage risk
Explanation
Correct Answer
A:Using a hard requirement can leave the service Pending during capacity shortage. This is the direct concern in the stated scenario because preferred scheduling preferences rank candidates without making placement mandatory. The matching mitigation is to apply preferred node affinity with a documented scheduling weight. Successful verification would show that the scheduler chooses preferred nodes when available and falls back otherwise.
Incorrect Answers
B:The scheduler tests resource requests against node allocatable capacity. That explains the warning “Live CPU graphs alone cannot establish whether requested capacity fits”; this case instead concerns “Using a hard requirement can leave the service Pending during capacity shortage”. Preferred scheduling preferences rank candidates without making placement mandatory.
C:Default placement is not continuous live-CPU load balancing among healthy nodes. That explains the warning “Leaving workloads to drift can create hotspots after initial scheduling”; this case instead concerns “Using a hard requirement can leave the service Pending during capacity shortage”. Preferred scheduling preferences rank candidates without making placement mandatory.
D:Pod anti-affinity can keep matching Pods on separate topology domains. That explains the warning “Placing every replica on one node creates a single-node outage risk”; this case instead concerns “Using a hard requirement can leave the service Pending during capacity shortage”. Preferred scheduling preferences rank candidates without making placement mandatory.
Question 410
In the situation "A deployment needs to expand its disk while retaining the existing volume and data", the team applies "Verify StorageClass expansion support and resize the PVC safely". Which outcome is the strongest verification?
- A new PVC becomes Bound after its supported volume is provisioned
- Capacity grows and prior data remains readable after resizing
- A competing attachment is denied under the selected single-writer policy
- The containers share temporary files and replacement starts with a clean directory
Explanation
Correct Answer
B:Capacity grows and prior data remains readable after resizing. This is stronger than observing a saved configuration because it tests the actual outcome of verify StorageClass expansion support and resize the PVC safely. The underlying principle is that pVC expansion depends on driver support and filesystem resizing behavior. The original risk was that manually replacing storage with an undersized volume risks loss or outage.
Incorrect Answers
A:StorageClasses describe how persistent volumes are created by storage drivers. The observation “A new PVC becomes Bound after its supported volume is provisioned” would validate that property, rather than the required “Capacity grows and prior data remains readable after resizing”. PVC expansion depends on driver support and filesystem resizing behavior.
C:ReadWriteOnce or ReadWriteOncePod semantics constrain mounting according to support. The observation “A competing attachment is denied under the selected single-writer policy” would validate that property, rather than the required “Capacity grows and prior data remains readable after resizing”. PVC expansion depends on driver support and filesystem resizing behavior.
D:EmptyDir storage lives for a Pod's lifetime and is shared by its containers. The observation “The containers share temporary files and replacement starts with a clean directory” would validate that property, rather than the required “Capacity grows and prior data remains readable after resizing”. PVC expansion depends on driver support and filesystem resizing behavior.
