antony@notes:~/misc$ cat "KCNA-真題.md"
KCNA 真題
KCNA 真題
:::info
KCNA 的考題最後更新於 2024 年 11 月 16 日。
:::
Question #1
What native runtime is Open Container Initiative (OCI) compliant?
A. runc B. runV C. kata-containers D. gvisor
:::spoiler Correct Answer: A
Here’s why:
runcis a CLI tool for spawning and running containers on Linux according to the OCI specification.
- REF : runc Introduction
:::
Question #2
Which API object is the recommended way to run a scalable, stateless application on your cluster?
A. ReplicaSet B. Deployment C. DaemonSet D. Pod
:::spoiler Correct Answer: B
Here’s why:
- ReplicaSet for statefull applications
- Deployment is for stateless applications
- DaemonSet is for application that has to be on every node.
- Pod is created as part of replicaset, deployment, daemonset
:::
Question #3
A CronJob is scheduled to run by a user every one hour. What happens in the cluster when it’s time for this CronJob to run?
A. Kubelet watches API Server for CronJob objects. When it’s time for a Job to run, it runs the Pod directly. B. Kube-scheduler watches API Server for CronJob objects, and this is why it’s called kube-scheduler. C. CronJob controller component creates a Pod and waits until it finishes to run. D. CronJob controller component creates a Job. Then the Job controller creates a Pod and waits until it finishes to run.
:::spoiler Correct Answer: D
Here’s why:
CronJob Controller: The CronJob controller is responsible for managing CronJobs. It schedules Jobs based on the CronJob’s schedule (e.g., every hour).
Job Creation: When it’s time for a CronJob to run, the CronJob controller creates a Job resource. This Job represents the workload that needs to be executed.
Job Controller: Once the Job is created, the Job controller is responsible for managing this Job. It ensures that the Pods specified by the Job are created and completed successfully.
Pod Execution: The Job controller creates one or more Pods based on the Job specification. These Pods execute the tasks defined by the Job. The Job controller waits until the Pod(s) complete their execution.
:::
Question #4
What is the purpose of the kubelet component within a Kubernetes cluster?
A. dashboard for Kubernetes Clusters that allows management and troubleshooting of applications. B. A network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept. C. A component that watches for newly created Pods with no assigned node, and selects a node for them to run on. D. An agent that runs on each node in the cluster. It makes sure that containers are running in a Pod.
:::spoiler Correct Answer: D
Here’s why:
kubelet An agent that runs on each node in the cluster. It makes sure that containers are running in a Pod.
The kubelet takes a set of PodSpecs that are provided through various mechanisms and ensures that the containers described in those PodSpecs are running and healthy. The kubelet doesn’t manage containers which were not created by Kubernetes.
:::
Question #5
What is the default value for authorization-mode in Kubernetes API server?
A.
--authorization-mode=RBACB.--authorization-mode=AlwaysAllowC.--authorization-mode=AlwaysDenyD.--authorization-mode=ABAC
:::spoiler Correct Answer: B
Here’s why:
--authorization-mode stringsOrdered list of plug-ins to do authorization on secure port. Defaults toAlwaysAllowif--authorization-configis not used. Comma-delimited list of:AlwaysAllow,AlwaysDeny,ABAC,Webhook,RBAC,Node.
:::
Question #6
Let’s assume that an organization needs to process large amounts of data in bursts, on a cloud-based Kubernetes cluster. For instance: each Monday morning, they need to run a batch of 1000 compute jobs of 1 hour each, and these jobs must be completed by Monday night. What’s going to be the most cost-effective method?
A. Run a group of nodes with the exact required size to complete the batch on time, and use a combination of taints, tolerations, and nodeSelectors to reserve these nodes to the batch jobs. B. Leverage the Kubernetes Cluster Autoscaler to automatically start and stop nodes as they’re needed. C. Commit to a specific level of spending to get discounted prices (with e.g. “reserved instances” or similar mechanisms). D. Use PriorityСlasses so that the weekly batch job gets priority over other workloads running on the cluster, and can be completed on time.
:::spoiler Correct Answer: B
Here’s why:
Burst processing workloads, like the one described, benefit from the elasticity provided by cloud-based Kubernetes clusters. With Kubernetes Cluster Autoscaler, you can scale your cluster up when there’s a demand for more resources (e.g., Monday mornings when the batch jobs need to run) and scale it down during periods of low demand (e.g., after the batch jobs are completed). This ensures that you’re only paying for the resources you actually need, avoiding over-provisioning and reducing costs.
:::
Question #7
What is a Kubernetes service with no cluster IP address called?
A. Headless Service B. Nodeless Service C. IPLess Service D. Specless Service
:::spoiler Correct Answer: A
Here’s why:
Headless Service: This type of service doesn’t have a cluster IP address assigned. Instead, it maps directly to the pods it manages, allowing communication with individual pods using their unique IP addresses.
:::
Question #8
CI/CD stands for:
A. Continuous Information / Continuous Development B. Continuous Integration / Continuous Development C. Cloud Integration / Cloud Development D. Continuous Integration / Continuous Deployment
:::spoiler Correct Answer: D
Here’s why:
In software engineering, CI/CD or CICD is the combined practices of continuous integration (CI) and continuous delivery (CD) or, less often, continuous deployment.
- REF : CI/CD - Wiki
:::
Question #9
What default level of protection is applied to the data in Secrets in the Kubernetes API?
A. The values use AES Symmetric Encryption B. The values are stored in plain text C. The values are encoded with SHA256 hashes D. The values are base64 encoded
:::spoiler Correct Answer: D
為何 Kubernetes Secret 的內容被編碼為 base64 的字串? Kubernetes 最初採用這種編碼方法的決策，是為了讓 Secret 能夠容納二進位資料。
參考文章 :
- Yet another rant in favor of Kubernetes Secrets https://dev.to/canelasevero/yet-another-rant-in-favor-of-kubernetes-secrets-432k
:::
Question #10
What function does kube-proxy provide to a cluster?
A. Implementing the Ingress resource type for application traffic. B. Forwarding data to the correct endpoints for Services. C. Managing data egress from the cluster nodes to the network. D. Managing access to the Kubernetes API.
:::spoiler Correct Answer: B
kube-proxy 的主要職責就是為叢集中的每個 Service 管理網路流量，讓外部或內部的流量能正確導向到對應的 Pod。 :::
Question #11
How long should a stable API element in Kubernetes be supported (at minimum) after deprecation?
A. 9 months B. 24 months C. 12 months D. 6 months
:::spoiler Correct Answer: C
Here’s why:
https://kubernetes.io/docs/reference/using-api/deprecation-policy/#deprecating-a-feature-or-behavior :::
Question #12
What is the name of the lightweight Kubernetes distribution built for IoT and edge computing?
A. OpenShift B. k3s C. RKE D. k1s
:::spoiler Correct Answer: B
Here’s why:
Question #13
Kubernetes ___ allows you to automatically manage the number of nodes in your cluster to meet demand.
A. Node Autoscaler B. Cluster Autoscaler C. Horizontal Pod Autoscaler D. Vertical Pod Autoscaler
:::spoiler Correct Answer: B
Here’s why:
What is Cluster Autoscaler? Cluster Autoscaler is a standalone program that adjusts the size of a Kubernetes cluster to meet the current needs.
When does Cluster Autoscaler change the size of a cluster? Cluster Autoscaler increases the size of the cluster when:
- there are pods that failed to schedule on any of the current nodes due to insufficient resources.
- adding a node similar to the nodes currently present in the cluster would help.
Cluster Autoscaler decreases the size of the cluster when some nodes are consistently unneeded for a significant amount of time. A node is unneeded when it has low utilization and all of its important pods can be moved elsewhere.
:::
Question #14
Which of the following statements is correct concerning Open Policy Agent (OPA)?
A. The policies must be written in Python language. B. Kubernetes can use it to validate requests and apply policies. C. Policies can only be tested when published. D. It cannot be used outside Kubernetes.
:::spoiler Correct Answer: B
Here’s why:
The Open Policy Agent (OPA, pronounced “oh-pa”) is an open source, general-purpose policy engine that unifies policy enforcement across the stack. OPA provides a high-level declarative language that lets you specify policy as code and simple APIs to offload policy decision-making from your software. You can use OPA to enforce policies in microservices, Kubernetes, CI/CD pipelines, API gateways, and more.
:::
Question #15
In a cloud native world, what does the IaC abbreviation stands for?
A. Infrastructure and Code B. Infrastructure as Code C. Infrastructure above Code D. Infrastructure across Code
:::spoiler Correct Answer: B
Here’s why:
Infrastructure as Code，中文翻為 “基礎架構程式碼” ，提供了一種替代方法，將基礎架構的建立、設定與管理方式自動化。 執行它的好處不僅可以降低 Human Error 、縮短建置系統的時間，還可以確保每次都建立出一模一樣的基礎架構。 :::
Question #16
In which framework do the developers no longer have to deal with capacity, deployments, scaling and fault tolerance, and OS?
A. Docker Swam B. Kubernetes C. Mesos D. Serverless
:::spoiler Correct Answer: D :::
Question #17
Which of the following characteristics is associated with container orchestration?
A. Application message distribution B. Dynamic scheduling C. Deploying application JAR files D. Virtual Machine distribution
:::spoiler Correct Answer: B :::
Question #18
Which of the following workload require a headless service while deploying into the namespace?
A. StatefulSet B. CronJob C. Deployment D. DaemonSet
:::spoiler Correct Answer: A
Here’s why:
StatefulSets currently require a Headless Service to be responsible for the network identity of the Pods. You are responsible for creating this Service.
:::
Question #19
What is Helm?
A. An open source dashboard for Kubernetes. B. A package manager for Kubernetes applications. C. A custom scheduler for Kubernetes. D. An end to end testing project for Kubernetes applications.
:::spoiler Correct Answer: B
Here’s why:
Helm helps you manage Kubernetes applications — Helm Charts help you define, install, and upgrade even the most complex Kubernetes application.
:::
Question #20
Which is the correct kubectl command to display logs in real time?
A.
kubectl logs -p test-container-1B.kubectl logs -c test-container-1C.kubectl logs -l test-container-1D.kubectl logs -f test-container-1
:::spoiler Correct Answer: D
Here’s why:
The
-fflag in the kubectl logs command stands for “follow,” which allows you to continuously stream the logs in real-time as new log entries are added. This is useful for monitoring applications or troubleshooting issues as they occur.
:::
Question #21
How to load and generate data required before the Pod startup?
A. Use an init container with shared file storage. B. Use a PVC volume. C. Use a sidecar container with shared volume. D. Use another pod with a PVC.
:::spoiler Correct Answer: A
Here’s why:
Init containers are executed before the main containers in a Pod are started. They are designed to perform initialization tasks, such as loading and generating data required before the main containers start. Init containers can share file storage with the main containers in the Pod, allowing them to perform tasks like data loading or generation and then making that data available to the main containers.
:::
Question #22
What is the core functionality of GitOps tools like Argo CD and Flux?
A. They track production changes made by a human in a Git repository and generate a human-readable audit trail. B. They replace human operations with an agent that tracks Git commands. C. They automatically create pull requests when dependencies are outdated. D. They continuously compare the desired state in Git with the actual production state and notify or act upon differences.
:::spoiler Correct Answer: D
Here’s why:
GitOps tools like Argo CD and Flux are designed to manage Kubernetes clusters by using Git repositories as the source of truth for cluster configuration. The core functionality of these tools involves continuously comparing the desired state of the cluster, as defined in Git, with the actual state of the cluster running in production. If there are differences between the desired and actual states, these tools will automatically reconcile those differences by either updating the production state to match the desired state or notifying operators of any discrepancies.
:::
Question #23
Which Kubernetes workload resource ensures that all (or some) nodes run a copy of a Pod?
A. ReplicaSet B. StatefulSet C. DaemonSet D. Deployment
:::spoiler Correct Answer: C
Here’s why:
A DaemonSet ensures that all (or some) Nodes run a copy of a Pod. As nodes are added to the cluster, Pods are added to them. As nodes are removed from the cluster, those Pods are garbage collected. Deleting a DaemonSet will clean up the Pods it created.
- REF : DaemonSet - K8s Docs
:::
Question #24
We can extend the Kubernetes API with Kubernetes API Aggregation Layer and CRDs. What is CRD?
A. Custom Resource Definition B. Custom Restricted Definition C. Customized RUST Definition D. Custom RUST Definition
:::spoiler Correct Answer: A
Here’s why:
CRD stands for Custom Resource Definition. It’s a Kubernetes extension mechanism that allows users to define their custom resources and their schema, effectively extending the Kubernetes API. Once defined, these custom resources can be managed and interacted with using standard Kubernetes API operations, just like built-in resources like Pods or Deployments.
:::
Question #25
The Kubernetes project work is carried primarily by SIGs. What does SIG stand for?
A. Special Interest Group B. Software Installation Guide C. Support and Information Group D. Strategy Implementation Group
:::spoiler Correct Answer: A
Here’s why:
SIG stands for Special Interest Group. In the context of Kubernetes, SIGs are groups of contributors focused on specific areas or domains within the project. Each SIG is responsible for overseeing and contributing to the development, maintenance, and improvement of its designated area, such as networking, storage, scalability, or documentation.
:::
Question #26
What is the order of 4C’s in Cloud Native Security, starting with the layer that a user has the most control over?
A. Cloud -> Container -> Cluster -> Code B. Container -> Cluster -> Code -> Cloud C. Cluster -> Container -> Code -> Cloud D. Code -> Container -> Cluster -> Cloud
:::spoiler Correct Answer: D
:::
Question #27
Which group of container runtimes provides additional sandboxed isolation and elevated security?
A. rune, cgroups B. docker, containerd C. runsc, kata D. crun, cri-o
:::spoiler Correct Answer: C
Here’s why:
runsc (gVisor): It’s a lightweight container runtime that runs containers inside a sandboxed environment, providing an additional layer of isolation using user-space kernel emulation. This allows containers to have their own isolated kernel without the overhead of full virtualization.
Kata Containers: It’s an open-source project that combines the security of virtual machines with the speed and manageability of containers. It uses lightweight VMs to run each container, providing strong isolation between containers without the performance overhead of traditional virtual machines.
:::
Question #28
What is the common standard for Service Meshes?
A. Service Mesh Specification (SMS) B. Service Mesh Technology (SMT) C. Service Mesh Interface (SMI) D. Service Mesh Function (SMF)
:::spoiler Correct Answer: C
Here’s why:
The Service Mesh Interface (SMI) is a specification for implementing service mesh functionality across different service mesh implementations. It provides a standard set of APIs for controlling and observing service mesh behavior, allowing for interoperability between various service mesh solutions.
An analogy for SMI could be a universal remote control standard. Just as different electronic devices from different manufacturers can be controlled using a universal remote that adheres to a common standard, service mesh implementations can communicate and interoperate effectively using the Service Mesh Interface (SMI) specification.
:::
Question #29
Which statement about Ingress is correct?
A. Ingress provides a simple way to track network endpoints within a cluster. B. Ingress is a Service type like NodePort and ClusterIP. C. Ingress is a construct that allows you to specify how a Pod is allowed to communicate. D. Ingress exposes routes from outside the cluster to services in the cluster.
:::spoiler Correct Answer: D
Here’s why:
Ingress exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. Traffic routing is controlled by rules defined on the Ingress resource.
:::
Question #30
What best describes cloud native service discovery?
A. It’s a mechanism for applications and microservices to locate each other on a network. B. It’s a procedure for discovering a MAC address, associated with a given IP address. C. It’s used for automatically assigning IP addresses to devices connected to the network. D. It’s a protocol that turns human-readable domain names into IP addresses on the Internet.
:::spoiler Correct Answer: A
Here’s why:
Cloud native service discovery is a crucial aspect of distributed systems architecture, particularly in microservices environments. It enables applications and microservices to dynamically discover and communicate with each other without hardcoding IP addresses or relying on static configurations. This mechanism allows services to be scalable, resilient, and loosely coupled, facilitating efficient communication and interaction within the cloud environment.
An analogy for service discovery could be a directory in a large office building. Just as a directory helps individuals find the locations of various offices or departments within a building, service discovery enables components within a distributed system to locate and communicate with each other dynamically, regardless of their specific network locations or configurations.
:::
Question #31
What components are common in a service mesh?
A. tracing and log storage B. circuit breaking and Pod scheduling C. data plane and runtime plane D. service proxy and control plane
:::spoiler Correct Answer: D
Here’s why:
In a service mesh architecture, service proxies (such as Envoy, Linkerd proxy, or Istio sidecar) are deployed alongside each service instance to handle communication between services. The control plane consists of various components responsible for configuring, managing, and monitoring the behavior of the service proxies, including features like traffic routing, load balancing, encryption, authentication, and observability. Together, these components enable advanced traffic management, security, and observability capabilities in a distributed microservices environment.
:::
Question #32
Which storage operator in Kubernetes can help the system to self-scale, self-heal, etc?
A. Rook B. Kubernetes C. Helm D. Container Storage Interface (CSI)
:::spoiler Correct Answer: A
Here’s why:
Rook provides features like self-scaling, self-healing, monitoring, and automation of storage management tasks. It abstracts the complexities of managing distributed storage systems and integrates them seamlessly with Kubernetes, enabling operators to deploy and manage storage clusters as easily as deploying other Kubernetes resources.
:::
Question #33
What fields must exist in any Kubernetes object (e.g. YAML) file?
A. apiVersion, kind, metadata B. kind, namespace, data C. apiVersion, metadata, namespace D. kind, metadata, data
:::spoiler Correct Answer: A
Here’s why:
In any Kubernetes object definition file, there are three mandatory fields that must exist:
apiVersion: Specifies the version of the Kubernetes API that the object uses. This field ensures compatibility and defines the structure of the object.
kind: Specifies the type of Kubernetes object being defined, such as Pod, Service, Deployment, etc. This field determines the behavior and functionality of the object.
metadata: Contains metadata about the object, such as its name, namespace, labels, and annotations. This metadata is used by Kubernetes to identify and manage the object within the cluster.
These fields are essential for Kubernetes to interpret and process the object correctly. The other options do not include all three mandatory fields or contain fields that are not universally required in every Kubernetes object.
:::
Question #34
Which of the following would fall under the responsibilities of an SRE?
A. Developing a new application feature. B. Creating a monitoring baseline for an application. C. Submitting a budget for running an application in a cloud. D. Writing policy on how to submit a code change.
:::spoiler Correct Answer: B
Here’s why:
Designing strategies for disaster recovery and fault tolerance: Just as the maintenance engineer creates contingency plans for breakdowns or accidents, the SRE devises plans for system failures or outages, ensuring that services can quickly recover and continue functioning.
Analyzing system performance metrics: Like reviewing maintenance logs and performance data for each truck, the SRE analyzes metrics from the application’s monitoring systems to identify areas for improvement and optimize performance.
By considering the SRE’s responsibilities in the context of managing a fleet of delivery trucks, we can draw parallels that illustrate the focus on reliability, efficiency, and proactive maintenance inherent in the role.
:::
Question #35
What are the initial namespaces that Kubernetes starts with?
A. default, kube-system, kube-public, kube-node-lease B. default, system, kube-public C. kube-default, kube-system, kube-main, kube-node-lease D. kube-default, system, kube-main, kube-primary
:::spoiler Correct Answer: A
Here’s why:
Kubernetes starts with four initial namespaces:
default Kubernetes includes this namespace so that you can start using your new cluster without first creating a namespace.
kube-node-lease This namespace holds Lease objects associated with each node. Node leases allow the kubelet to send heartbeats so that the control plane can detect node failure.
kube-public This namespace is readable by all clients (including those not authenticated). This namespace is mostly reserved for cluster usage, in case that some resources should be visible and readable publicly throughout the whole cluster. The public aspect of this namespace is only a convention, not a requirement.
kube-system The namespace for objects created by the Kubernetes system.
$ kubectl -n kube-node-lease get lease
NAME HOLDER AGE
tkllm-control-plane tkllm-control-plane 35d
tkllm-worker1 tkllm-worker1 35d
tkllm-worker2 tkllm-worker2 35d:::
Question #36
What is a probe within Kubernetes?
A. A monitoring mechanism of the Kubernetes API. B. A pre-operational scope issued by the kubectl agent. C. A diagnostic performed periodically by the kubelet on a container. D. A logging mechanism of the Kubernetes API.
:::spoiler Correct Answer: C
Here’s why:
Within Kubernetes, a “probe” refers to a diagnostic mechanism used by the kubelet to check the health of containers running within pods.Probes are configured within the PodSpec of Kubernetes pods and are used to determine if the containers within the pod are healthy and ready to serve traffic. There are three types of probes:
Liveness Probe: Determines if the container is still running and healthy. If the liveness probe fails, Kubernetes restarts the container.
Readiness Probe: Determines if the container is ready to serve traffic. If the readiness probe fails, the pod is removed from load balancers, and no traffic is routed to it.
Startup Probe: Similar to the liveness probe, but only runs during the initial startup of a container. It helps delay the liveness and readiness probes until the application inside the container has started.
:::
Question #37
Which Kubernetes feature would you use to guard against split brain scenarios with your distributed application?
A. Replication controllers B. Consensus protocols C. Rolling updates D. StatefulSet
:::spoiler Correct Answer: D
Here’s why:
Think of StatefulSet in Kubernetes as a traffic control system at an intersection with multiple lanes. Just as the traffic control system manages the flow of vehicles through the intersection, ensuring that only one lane can proceed at a time to prevent collisions or gridlock, StatefulSet manages the deployment of stateful applications, ensuring that only one instance can be active or “in charge” at any given time to prevent conflicts or inconsistencies in distributed systems.
:::
Question #38
What feature must a CNI support to control specific traffic flows for workloads running in Kubernetes?
A. Border Gateway Protocol B. IP Address Management C. Pod Security Policy D. Network Policies
:::spoiler Correct Answer: D
Here’s why:
If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), NetworkPolicies allow you to specify rules for traffic flow within your cluster, and also between Pods and the outside world. Your cluster must use a network plugin that supports NetworkPolicy enforcement.
Think of Network Policies in Kubernetes as security checkpoints at different entrances to a building. Just as security personnel at each entrance check IDs and verify permissions before allowing individuals to enter specific areas of the building, Network Policies control the flow of network traffic within the Kubernetes cluster, ensuring that only authorized Pods can communicate with each other and that access to sensitive services is restricted according to defined rules.
:::
Question #39
What is the main role of the Kubernetes DNS within a cluster?
A. Acts as a DNS server for virtual machines that are running outside the cluster. B. Provides a DNS as a Service, allowing users to create zones and registries for domains that they own. C. Allows Pods running in dual stack to convert IPv6 calls into IPv4 calls. D. Provides consistent DNS Names for Pods and Services for workloads that need to communicate with each other.
:::spoiler Correct Answer: D
Here’s why:
Think of Kubernetes DNS as the address book in a large office building. Just as the address book provides a consistent reference for finding the location of different departments or individuals within the building, Kubernetes DNS provides consistent DNS names for Pods and Services, allowing workloads within the cluster to discover and communicate with each other efficiently, regardless of their dynamic IP addresses or locations.
:::
Question #40
Scenario: You have a Kubernetes cluster hosted in a public cloud provider. When trying to create a Service of type LoadBalancer, the external-ip is stuck in the “Pending” state. Which Kubernetes component is failing in this scenario?
A. Cloud Controller Manager B. Load Balancer Manager C. Cloud Architecture Manager D. Cloud Load Balancer Manager
:::spoiler Correct Answer: A
Here’s why:
Cloud controller manager functions The controllers inside the cloud controller manager include:
- Service controller Services integrate with cloud infrastructure components such as managed load balancers, IP addresses, network packet filtering, and target health checking. The service controller interacts with your cloud provider’s APIs to set up load balancers and other infrastructure components when you declare a Service resource that requires them.
:::
Question #41
What are the characteristics for building every cloud-native application?
A. Resiliency, Operability, Observability, Availability B. Resiliency, Containerd, Observability, Agility C. Kubernetes, Operability, Observability, Availability D. Resiliency, Agility, Operability, Observability
:::spoiler Correct Answer: D
Here’s why:
A cloud native application is engineered to run on a platform and is designed for resiliency, agility, operability, and observability.
- Resiliency embraces failures instead of trying to prevent them; it takes advantage of the dynamic nature of running on a platform.
- Agility allows for fast deployments and quick iterations.
- Operability adds control of application life cycles from inside the application instead of relying on external processes and monitors.
- Observability provides information to answer questions about application state.
:::
Question #42
What does CNCF stand for?
A. Cloud Native Community Foundation B. Cloud Native Computing Foundation C. Cloud Neutral Computing Foundation D. Cloud Neutral Community Foundation
:::spoiler Correct Answer: B :::
Question #43
Kubernetes supports multiple virtual clusters backed by the same physical cluster. These virtual clusters are called:
A. namespaces B. containers C. hypervisors D. cgroups
:::spoiler Correct Answer: A
Here’s why:
https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ “Namespaces are intended for use in environments with many users spread across multiple teams, or projects. For clusters with a few to tens of users, you should not need to create or think about namespaces at all. Start using namespaces when you need the features they provide.” :::
Question #44
What component enables end users, different parts of the Kubernetes cluster, and external components to communicate with one another?
A. kubectl B. AWS Management Console C. Kubernetes API D. Google Cloud SDK
:::spoiler Correct Answer: C
Here’s why:
The Kubernetes API server is the central component that enables communication between end users, different parts of the Kubernetes cluster, and external components. :::
Question #45
Which command will list the resource types that exist within a cluster?
A. kubectl api-resources B. kubectl get namespaces C. kubectl api-versions D. curl
https://kubectrl/namespaces
:::spoiler Correct Answer: A :::
Question #46
Which of these components is part of the Kubernetes Control Plane?
A. coredns B. cloud-controller-manager C. kube-proxy D. kubelet
:::spoiler Correct Answer: B
Here’s why:
https://kubernetes.io/docs/concepts/architecture/cloud-controller/ :::
Question #47
Which of the following systems is NOT compatible with the CRI runtime interface standard?
A. CRI-0 B. dockershim C. systemd D. containerd
:::spoiler Correct Answer: C
Here’s why:
CRI - Container Runtime Interface. systemd is not container runtime interface. :::
Question #48
What is a key feature of a container network?
A. Proxying REST requests across a set of containers. B. Allowing containers running on separate hosts to communicate. C. Allowing containers on the same host to communicate. D. Caching remote disk access.
:::spoiler Correct Answer: B
Here’s why:
B - Allowing containers running on separate hosts to communicate :::
Question #49
How can you monitor the progress for an updated Deployment/DaemonSets/StatefulSets?
A. kubectl rollout watch B. kubectl rollout progress C. kubectl rollout state D. kubectl rollout status
:::spoiler Correct Answer: D
Here’s why:
The correct answer to the question “How can you monitor the progress for an updated Deployment/DaemonSets/StatefulSets?” is D. kubectl rollout status.
Explanation: The kubectl rollout status command is used to monitor the progress of a rollout for Kubernetes resources such as Deployments, DaemonSets, or StatefulSets. This command provides real-time updates on whether the new Pods are being created correctly and whether the old ones are being terminated. It ensures that the rollout is proceeding as expected and alerts if any issues occur during the update.
Other options like kubectl rollout watch, kubectl rollout progress, and kubectl rollout state are not valid Kubernetes commands for monitoring rollout progress. The proper command to use for tracking progress is kubectl rollout status :::
Question #50
What is the goal of load balancing?
A. Automatically measure request performance across instances of an application. B. Automatically distribute requests across different versions of an application. C. Automatically distribute instances of an application across the cluster. D. Automatically distribute requests across instances of an application.
:::spoiler Correct Answer: D :::
Question #51
How are ReplicaSets and Deployments related?
A. Deployments manage ReplicaSets and provide declarative updates to Pods. B. ReplicaSets manage stateful applications, Deployments manage stateless applications. C. Deployments are runtime instances of ReplicaSets. D. ReplicaSets are subsets of Jobs and CronJobs which use imperative Deployments.
:::spoiler Correct Answer: A
Here’s why:
Deployments are higher-level abstractions in Kubernetes that manage ReplicaSets.ReplicaSets, on the other hand, are lower-level controllers responsible for maintaining a specified number of identical Pods to ensure high availability and fault tolerance. ReplicaSets are used by Deployments to manage the lifecycle of Pods, including scaling, rolling updates, and maintaining a desired number of replicas. :::
Question #52
What factors influence the Kubernetes scheduler when it places Pods on nodes?
A. Pod memory requests, node taints, and Pod affinity. B. Pod labels, node labels, and request labels. C. Node taints, node level, and Pod priority. D. Pod priority, container command, and node labels.
:::spoiler Correct Answer: A
Here’s why:
The Kubernetes scheduler takes into account factors like memory and CPU requests/limits, node taints and tolerations, and Pod affinity and anti-affinity rules to decide where to place Pods. :::
Question #53
What is the core metric type in Prometheus used to represent a single numerical value that can go up and down?
A. Summary B. Counter C. Histogram D. Gauge
:::spoiler Correct Answer: D
Here’s why:
The Prometheus data model provides four core metrics:
Counter: A value that increases, like a request or error count Gauge: Values that increase or decrease, like memory size Histogram: A sample of observations, like request duration or response size Summary: Similar to a histogram, but also provides the total count of observations. Seems like “up and down” is the most exact match for “increase and decrease”, hence D :::
Question #54
What is the primary mechanism to identify grouped objects in a Kubernetes cluster?
A. Custom Resources B. Labels C. Label Selector D. Pod
:::spoiler Correct Answer: C
Here’s why:
Question #55
What is the name of the Kubernetes resource used to expose an application?
A. Port B. Service C. DNS D. Deployment
:::spoiler Correct Answer: B
Here’s why:
Question #56
What is a DaemonSet?
A. It’s a type of workload that ensures a specific set of nodes run a copy of a Pod. B. It’s a type of workload responsible for maintaining a stable set of replica Pods running in any node. C. It’s a type of workload that needs to be run periodically on a given schedule. D. It’s a type of workload that provides guarantees about ordering, uniqueness, and identity of a set of Pods.
:::spoiler Correct Answer: A
Here’s why:
A DaemonSet ensures that all (or some) nodes run a copy of a specific Pod. When a new node is added to the cluster, a Pod from the DaemonSet is automatically added to that node. When a node is removed from the cluster, the Pod is also removed. :::
Question #57
What is the telemetry component that represents a series of related distributed events that encode the end-to-end request flow through a distributed system?
A. Metrics B. Logs C. Spans D. Traces
:::spoiler Correct Answer: D
Here’s why:
In a distributed system, traces represent a series of related events that show the end-to-end request flow. Each trace is composed of one or more spans, which represent individual operations within the trace. :::
Question #58
In the Kubernetes platform, which component is responsible for running containers?
A. etcd B. CRI-O C. cloud-controller-manager D. kube-controller-manager
:::spoiler Correct Answer: B
Here’s why:
CRI-O is a lightweight container runtime specifically designed for Kubernetes. It implements the Kubernetes Container Runtime Interface (CRI) to enable the use of containers within Kubernetes clusters. It is responsible for running the containers specified by Kubernetes :::
Question #59
Services and Pods in Kubernetes are ______ objects.
A. JSON B. YAML C. Java D. REST
:::spoiler Correct Answer: D
Here’s why:
The Kubernetes API is the most important component of a Kubernetes cluster. Without it, communication with the cluster is not possible, every user and every component of the cluster itself needs the api-server. Like many other APIs, the Kubernetes API is implemented as a RESTful interface that is exposed over HTTPS. Through the API, a user or service can create, modify, delete or retrieve resources that reside in Kubernetes.
Question #60
What Kubernetes component handles network communications inside and outside of a cluster, using operating system packet filtering if available?
A. kube-proxy B. kubelet C. etcd D. kube-controller-manager
:::spoiler Correct Answer: A
Here’s why:
Question #61
What Kubernetes control plane component exposes the programmatic interface used to create, manage and interact with the Kubernetes objects?
A. kube-controller-manager B. kube-proxy C. kube-apiserver D. etcd
:::spoiler Correct Answer: C
Here’s why:
The kube-apiserver is the Kubernetes control plane component that exposes the Kubernetes API. It provides the programmatic interface used to create, manage, and interact with Kubernetes objects. :::
Question #62
Which type of Service requires manual creation of Endpoints?
A. LoadBalancer B. Services without selectors C. NodePort D. ClusterIP with selectors
:::spoiler Correct Answer: B
Here’s why:
When you create a Kubernetes Service without specifying selectors, Kubernetes does not automatically create Endpoints for the Service. In such cases, you need to manually create the Endpoints to map the Service to the set of Pods or IP addresses you want it to target :::
Question #63
Which of these commands is used to retrieve the documentation and field definitions for a Kubernetes resource?
A. kubectl explain B. kubectl api-resources C. kubectl get –help D. kubectl show
:::spoiler Correct Answer: A
Here’s why:
The kubectl explain command is used to retrieve documentation and field definitions for a Kubernetes resource. It provides detailed information about the fields and their descriptions for a specific resource type. :::
Question #64
Which of the following is a lightweight tool that manages traffic flows between services, enforces access policies, and aggregates telemetry data, all without requiring changes to application code?
A. NetworkPolicy B. Linkerd C. kube-proxy D. Nginx
:::spoiler Correct Answer: B :::
Question #65
Which Kubernetes resource uses immutable: true boolean field?
A. Deployment B. Pod C. ConfigMap D. ReplicaSet
:::spoiler Correct Answer: C
Here’s why:
In Kubernetes, you can create ConfigMaps with an immutable: true boolean field. This feature ensures that the data within the ConfigMap cannot be modified after creation, which can help improve the cluster’s security and stability.
https://kubernetes.io/docs/concepts/configuration/configmap/#configmap-immutable :::
Question #66
Which statement about the Kubernetes network model is correct?
A. Pods can only communicate with Pods exposed via a Service. B. Pods can communicate with all Pods without NAT. C. The Pod IP is only visible inside a Pod. D. The Service IP is used for the communication between Services.
:::spoiler Correct Answer: B
Here’s why:
In the Kubernetes network model, each Pod has a unique IP address, and Pods can communicate with each other directly without needing Network Address Translation (NAT).
Question #67
What is the resource type used to package sets of containers for scheduling in a cluster?
A. Pod B. ContainerSet C. ReplicaSet D. Deployment
:::spoiler Correct Answer: A :::
Question #68
Can a Kubernetes Service expose multiple ports?
A. No, you can only expose one port per each Service. B. Yes, but you must specify an unambiguous name for each port. C. Yes, the only requirement is to use different port numbers. D. No, because the only port you can expose is port number 443.
:::spoiler Correct Answer: B
Here’s why:
In Kubernetes, a Service can expose multiple ports, but you need to assign a unique name to each port to avoid ambiguity.
https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services :::
Question #69
Which persona is normally responsible for defining, testing, and running an incident management process?
A. Site Reliability Engineers B. Project Managers C. Application Developers D. Quality Engineers
:::spoiler Correct Answer: A
Here’s why:
Site Reliability Engineers (SREs) are typically responsible for defining, testing, and running incident management processes. They focus on ensuring the reliability and performance of systems, as well as handling operational issues and incidents. :::
Question #70
What is the default deployment strategy in Kubernetes?
A. Rolling update B. Blue/Green deployment C. Canary deployment D. Recreate deployment
:::spoiler Correct Answer: A :::
Question #71
Which command provides information about the field replicas within the spec resource of a deployment object?
A. kubectl get deployment.spec.replicas B. kubectl explain deployment.spec.replicas C. kubectl describe deployment.spec.replicas D. kubectl explain deployment –spec.replicas
:::spoiler Correct Answer: B
Here’s why:
The command kubectl explain is used to provide detailed information about the fields of Kubernetes objects, including their specifications. The command kubectl explain deployment.spec.replicas specifically provides information about the replicas field within the spec of a deployment object. This is the most appropriate command for getting details about that particular field. :::
Question #72
Which of the following is a responsibility of the governance board of an open source project?
A. Decide about the marketing strategy of the project. B. Review the pull requests in the main branch. C. Outline the project’s “terms of engagement”. D. Define the license to be used in the project.
:::spoiler Correct Answer: C
Here’s why:
The governance board of an open source project is responsible for setting the project’s “terms of engagement,” which includes defining the rules, guidelines, and processes for contributing to and interacting with the project. This ensures that the project operates smoothly and transparently. :::
Question #73
What is the role of a NetworkPolicy in Kubernetes?
A. The ability to cryptic and obscure all traffic. B. The ability to classify the Pods as isolated and non isolated. C. The ability to prevent loopback or incoming host traffic. D. The ability to log network security events.
:::spoiler Correct Answer: B
Here’s why:
In Kubernetes, a NetworkPolicy is used to control the communication between Pods within the cluster. It allows you to specify rules for which Pods can communicate with each other, effectively classifying Pods as isolated or non-isolated based on the defined rules
Question #74
What are the most important resources to guarantee the performance of an etcd cluster?
A. CPU and disk capacity. B. Network throughput and disk I/O. C. CPU and RAM memory. D. Network throughput and CPU.
:::spoiler Correct Answer: B
Here’s why:
Consensus performance, especially commit latency, is limited by two physical constraints: network IO latency and disk IO latency.
Question #75
How do you deploy a workload to Kubernetes without additional tools?
A. Create a Bash script and run it on a worker node. B. Create a Helm Chart and install it with helm. C. Create a manifest and apply it with kubectl. D. Create a Python script and run it with kubectl.
:::spoiler Correct Answer: C :::
Question #76
How do you perform a command in a running container of a Pod?
A.
kubectl exec --B.docker execC.kubectl run --D.kubectl attach -i
:::spoiler Correct Answer: A :::
Question #77
How to create a headless service?
A. By specifying .spec.ClusterIP: headless B. By specifying .spec.clusterIP: None C. By specifying .spec.ClusterIP: 0.0.0.0 D. By specifying .spec.ClusterIP: localhost
:::spoiler Correct Answer: B :::
Question #78
How does dynamic storage provisioning work?
A. A user requests dynamically provisioned storage by including an existing storage class in their PersistentVolumeClaim. B. An administrator creates a storage class and includes it in their pod YAML definition file without creating a PersistentVolumeClaim. C. A pod requests dynamically provisioned storage by including a storage class and the pod name in their PersistentVolumeClaim. D. An administrator creates a PersistentVolume and includes the name of the PersistentVolume in their pod YAML definition file.
:::spoiler Correct Answer: A
Here’s why:
Question #79
Which of the following are tasks performed by a container orchestration tool?
A. Schedule, scale, and manage the health of containers. B. Create images, scale, and manage the health of containers. C. Debug applications, and manage the health of containers. D. Store images, scale, and manage the health of containers.
:::spoiler Correct Answer: A
Here’s why:
https://cloud.google.com/discover/what-is-container-orchestration?hl=en :::
Question #80
Which of the following is a definition of Hybrid Cloud?
A. An architecture that uses a combination of services running in public and private data centers, only including data centers from the same cloud provider. B. A cloud native architecture that uses a combination of services running in public clouds, excluding data centers in different availability zones. C. A cloud native architecture that uses a combination of services running in different public and private clouds, including on-premises data centers. D. An architecture that uses a combination of services running in public and private data centers, excluding serverless functions.
:::spoiler Correct Answer: C
Here’s why:
A cloud native architecture that uses a combination of services running in different public and private clouds, including on-premises data centers. :::
Question #81
What is a Kubernetes Service Endpoint?
A. It is the API Endpoint of our Kubernetes cluster. B. It is a name of special Pod in kube-system namespace. C. It is an IP address that we can access from the Internet. D. It is an object that gets IP addresses of individual Pods assigned to it.
:::spoiler Correct Answer: D :::
Question #82
Why is Cloud-Native Architecture important?
A. Cloud Native Architecture revolves around containers, microservices and pipelines. B. Cloud Native Architecture removes constraints to rapid innovation. C. Cloud Native Architecture is modern for application deployment and pipelines. D. Cloud Native Architecture is a bleeding edge technology and service.
:::spoiler Correct Answer: B :::
Question #83
Which kubernetes component is the smallest deployable unit of computing?
A. StatefulSet B. Deployment C. Pod D. Container
:::spoiler Correct Answer: C
Here’s why:
In Kubernetes, the Pod is the smallest deployable unit of computing. A Pod can contain one or more containers, but it is the fundamental unit that Kubernetes deploys, manages, and scales. Containers within a Pod share the same network and storage resources, making the Pod the atomic unit for scheduling and running containers in Kubernetes. :::
Question #84
What kubectl command is used to retrieve the resource consumption (CPU and memory) for nodes or Pods?
A. kubectl cluster-info B. kubectl version C. kubectl top D. kubectl api-resources
:::spoiler Correct Answer: C :::
Question #85
Which are the two primary modes for Service discovery within a Kubernetes cluster?
A. Environment variables and DNS B. API Calls and LDAP C. Labels and Radius D. Selectors and DHCP
:::spoiler Correct Answer: A
Here’s why:
https://www.densify.com/kubernetes-autoscaling/kubernetes-service-discovery/ :::
Question #86
Which of the following capabilities are you allowed to add to a container using the Restricted policy?
A. CHOWN B. SYS_CHROOT C. SETUID D. NET_BIND_SERVICE
:::spoiler Correct Answer: D
Here’s why:
Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.
Question #87
What methods can you use to scale a deployment?
A. With kubectl edit deployment exclusively. B. With kubectl scale-up deployment exclusively. C. With kubectl scale deployment and kubectl edit deployment. D. With kubectl scale deployment exclusively.
:::spoiler Correct Answer: C :::
Question #88
What is a sidecar container?
A. A Pod that runs next to another container within the same Pod. B. A container that runs next to another Pod within the same namespace. C. A container that runs next to another container within the same Pod. D. A Pod that runs next to another Pod within the same namespace.
:::spoiler Correct Answer: C :::
Question #89
Which is an industry-standard container runtime with an “emphasis” on simplicity, robustness, and portability?
A. cri-o B. lxd C. containerd D. kata-runtime
:::spoiler Correct Answer: C :::
Question #90
What does vertical scaling an application deployment describe best?
A. The act of adding/removing applications to meet demand. B. The act of adding/removing node instances to the cluster to meet demand. C. The act of adding/removing resources to applications to meet demand. D. The act of adding/removing application instances of the same application to meet demand.
:::spoiler Correct Answer: C :::
Question #91
Which Prometheus metric represents a single value that can go up and down?
A. Counter B. Gauge C. Summary D. Histogram
:::spoiler Correct Answer: B :::
Question #92
What is Serverless computing?
A. A computing method of providing backend services on an as-used basis. B. A computing method of providing services for AI and ML operating systems. C. A computing method of providing services for quantum computing operating systems. D. A computing method of providing services for cloud computing operating systems.
:::spoiler Correct Answer: A
Here’s why:
Serverless computing is a cloud computing model in which the cloud provider automatically manages the infrastructure and dynamically allocates resources as needed. Developers can focus on writing code without worrying about server management, and they are only charged for the actual usage of resources rather than pre-provisioned capacity. :::
Question #93
What is the purpose of the CRI?
A. To provide runtime integration control when multiple runtimes are used. B. Support container replication and scaling on nodes. C. Provide an interface allowing Kubernetes to support pluggable container runtimes. D. Allow the definition of dynamic resource criteria across containers.
:::spoiler Correct Answer: C :::
Question #94
Imagine there is a requirement to run a database backup every day. Which Kubernetes resource could be used to achieve that?
A. Kube-scheduler B. CronJob C. Task D. Job
:::spoiler Correct Answer: B :::
Question #95
In CNCF, who develops specifications for industry standards around container formats and runtimes?
A. Open Container Initiative (OCI) B. Linux Foundation Certification Group (LFCG) C. Container Network Interface (CNI) D. Container Runtime Interface (CRI)
:::spoiler Correct Answer: A :::
Question #96
Which of the following options includes valid API versions?
A. alpha1v1, beta3v3, v2 B. alpha1, beta3, v2 C. v1alpha1, v2beta3, v2 D. v1alpha1, v2beta3, 2.0
:::spoiler Correct Answer: C
Here’s why:
Kubernetes follows a specific convention for API versioning, which includes versions like v1alpha1, v2beta3, and stable versions like v1, v2, etc. The format typically consists of a version (vX), followed by an optional alpha or beta designation with a version number (e.g., alpha1, beta3). This structure is used to represent different stages of API stability, from alpha (experimental) to beta (more stable) to full release (e.g., v1, v2)
Question #97
Which of the following will view the snapshot of previously terminated ruby container logs from Pod web-1?
A. kubectl logs -p -c ruby web-1 B. kubectl logs -c ruby web-1 C. kubectl logs -p ruby web-1 D. kubectl logs -p -c web-1 ruby
:::spoiler Correct Answer: A
Here’s why:
https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#logs :::
Question #98
A Kubernetes _____ is an abstraction that defines a logical set of Pods and a policy by which to access them.
A. Selector B. Controller C. Service D. Job
:::spoiler Correct Answer: C :::
Question #99
How many hosts are required to set up a highly available Kubernetes cluster when using an external etcd topology?
A. Four hosts. Two for control plane nodes and two for etcd nodes. B. Four hosts. One for a control plane node and three for etcd nodes. C. Three hosts. The control plane nodes and etcd nodes share the same host. D. Six hosts. Three for control plane nodes and three for etcd nodes.
:::spoiler Correct Answer: D
Here’s why:
Question #100
Which of these events will cause the kube-scheduler to assign a Pod to a node?
A. When the Pod crashes because of an error. B. When a new node is added to the Kubernetes cluster. C. When the CPU load on the node becomes too high. D. When a new Pod is created and has no assigned node.
:::spoiler Correct Answer: D :::
Question #101
What helps an organization to deliver software more securely at a higher velocity?
A. Kubernetes B. apt-get C. Docker Images D. CI/CD Pipeline
:::spoiler Correct Answer: D :::
Question #102
Which resource do you use to attach a volume in a Pod?
A. StorageVolume B. PersistentVolume C. StorageClass D. PersistentVolumeClaim
:::spoiler Correct Answer: D :::
Question #103
Which key-value store is used to persist Kubernetes cluster data?
A. etcd B. ZooKeeper C. ControlPlaneStore D. Redis
:::spoiler Correct Answer: A :::
Question #104
What Linux namespace is shared by default by containers running within a Kubernetes Pod?
A. Host Network B. Network C. Process ID D. Process Name
:::spoiler Correct Answer: B
Here’s why:
By default, containers running within a Kubernetes Pod share the same network namespace. This means that they can communicate with each other using localhost and can also share the same IP address and port space. Sharing the network namespace allows containers within the same Pod to efficiently collaborate and communicate. :::
Question #105
What is a Dockerfile?
A. A bash script that is used to automatically build a docker image. B. A config file that defines which image registry a container should be pushed to. C. A text file that contains all the commands a user could call on the command line to assemble an image. D. An image layer created by a running container stored on the host.
:::spoiler Correct Answer: C :::
Question #106
What does the “nodeSelector” within a PodSpec use to place Pods on the target nodes?
A. Annotations B. IP Addresses C. Hostnames D. Labels
:::spoiler Correct Answer: D :::
Question #107
What do Deployments and StatefulSets have in common?
A. They manage Pods that are based on an identical container spec. B. They support the OnDelete update strategy. C. They support an ordered, graceful deployment and scaling. D. They maintain a sticky identity for each of their Pods.
:::spoiler Correct Answer: A :::
Question #108
What is the practice of bringing financial accountability to the variable spend model of cloud resources?
A. FaaS B. DevOps C. CloudCost D. FinOps
:::spoiler Correct Answer: D :::
Question #109
What is a best practice to minimize the container image size?
A. Use a DockerFile. B. Use multistage builds. C. Build images with different tags. D. Add a build.sh script.
:::spoiler Correct Answer: B :::
Question #110
Which tools enable Kubernetes HorizontalPodAutoscalers to use custom, application-generated metrics to trigger scaling events?
A. Prometheus and the prometheus-adapter. B. Graylog and graylog-autoscaler metrics. C. Graylog and the kubernetes-adapter. D. Grafana and Prometheus.
:::spoiler Correct Answer: A
Here’s why:
Prometheus is widely used for monitoring and collecting metrics in Kubernetes environments. The prometheus-adapter allows Kubernetes HorizontalPodAutoscalers (HPAs) to use custom, application-generated metrics from Prometheus to trigger scaling events. :::
Question #111
Which of the following is a valid PromQL query?
A. SELECT * from http_requests_total WHERE job=apiserver B. http_requests_total WHERE (job=“apiserver”) C. SELECT * from http_requests_total D. http_requests_total(job=“apiserver”)
:::spoiler Correct Answer: D
Here’s why:
In PromQL (Prometheus Query Language), the syntax for filtering metrics based on label values uses curly braces {}. Option D correctly filters the http_requests_total metric to include only the metrics where the label job equals “apiserver”. :::
Question #112
Which of the following best describes horizontally scaling an application deployment?
A. The act of adding/removing node instances to the cluster to meet demand. B. The act of adding/removing applications to meet demand. C. The act of adding/removing application instances of the same application to meet demand. D. The act of adding/removing resources to application instances to meet demand.
:::spoiler Correct Answer: C :::
Question #113
How many different Kubernetes service types can you define?
A. 2 B. 3 C. 4 D. 5
:::spoiler Correct Answer: C
Here’s why:
https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types :::
Question #114
What is the difference between a Deployment and a ReplicaSet?
A. With a Deployment, you can’t control the number of pod replicas. B. A ReplicaSet does not guarantee a stable set of replica pods running. C. A Deployment is basically the same as a ReplicaSet with annotations. D. A Deployment is a higher-level concept that manages ReplicaSets.
:::spoiler Correct Answer: D :::
Question #115
The Container Runtime Interface (CRI) defines the protocol for the communication between:
A. The kubelet and the container runtime. B. The container runtime and etcd. C. The kube-apiserver and the kubelet. D. The container runtime and the image registry.
:::spoiler Correct Answer: A :::
Question #116
Which authorization-mode allows granular control over the operations that different entities can perform on different objects in a Kubernetes cluster?
A. Webhook Mode Authorization Control B. Role Based Access Control C. Node Authorization Access Control D. Attribute Based Access Control
:::spoiler Correct Answer: B
Here’s why:
Role-Based Access Control (RBAC) is an authorization mode in Kubernetes that provides fine-grained control over the actions that users, groups, and service accounts can perform on various resources within the cluster. RBAC allows administrators to define roles and role bindings to specify permissions for different entities. :::
Question #117
Which of the following is a correct definition of a Helm chart?
A. A Helm chart is a collection of YAML files bundled in a tar.gz file and can be applied without decompressing it. B. A Helm chart is a collection of JSON files and contains all the resource definitions to run an application on Kubernetes. C. A Helm chart is a collection of YAML files that can be applied on Kubernetes by using the kubectl tool. D. A Helm chart is similar to a package and contains all the resource definitions to run an application on Kubernetes.
:::spoiler Correct Answer: D :::
Question #118
Which of the following sentences is true about namespaces in Kubernetes?
A. You can create a namespace within another namespace in Kubernetes. B. You can create two resources of the same kind and name in a namespace. C. The default namespace exists when a new cluster is created. D. All the objects in the cluster are namespaced by default.
:::spoiler Correct Answer: C :::
Question #119
How does Horizontal Pod autoscaling work in Kubernetes?
A. The Horizontal Pod Autoscaler controller adds more CPU or memory to the pods when the load is above the configured threshold, and reduces CPU or memory when the load is below. B. The Horizontal Pod Autoscaler controller adds more pods when the load is above the configured threshold, but does not reduce the number of pods when the load is below. C. The Horizontal Pod Autoscaler controller adds more pods to the specified DaemonSet when the load is above the configured threshold, and reduces the number of pods when the load is below. D. The Horizontal Pod Autoscaler controller adds more pods when the load is above the configured threshold, and reduces the number of pods when the load is below.
:::spoiler Correct Answer: D
Here’s why:
https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/ :::
Question #120
What is a Pod?
A. A networked application within Kubernetes. B. A storage volume within Kubernetes. C. A single container within Kubernetes. D. A group of one or more containers within Kubernetes.
:::spoiler Correct Answer: D :::
Question #121
What element allows Kubernetes to run Pods across the fleet of nodes?
A. The node server. B. The etcd static pods. C. The API server. D. The kubelet.
:::spoiler Correct Answer: D :::
Question #122
What is the Kubernetes object used for running a recurring workload?
A. Job B. Batch C. DaemonSet D. CronJob
:::spoiler Correct Answer: D :::
Question #123
In the DevOps framework and culture, who builds, automates, and offers continuous delivery tools for developer teams?
A. Application Users B. Application Developers C. Platform Engineers D. Cluster Operators
:::spoiler Correct Answer: C :::
Question #124
Which kubectl command is useful for collecting information about any type of resource that is active in a Kubernetes cluster?
A. describe B. list C. expose D. explain
:::spoiler Correct Answer: A :::
Question #125
The cloud native architecture centered around microservices provides a strong system that ensures ______________.
A. fallback B. resiliency C. failover D. high reachability
:::spoiler Correct Answer: B :::
Question #126
Which of the following is the correct command to run a nginx deployment with 2 replicas?
A.
kubectl run deploy nginx --image=nginx --replicas=2B.kubectl create deploy nginx --image=nginx --replicas=2C.kubectl create nginx deployment --image=nginx –replicas=2D.kubectl create deploy nginx --image=nginx --count=2
:::spoiler Correct Answer: B :::
Question #127
What does “Continuous Integration” mean?
A. The continuous integration and testing of code changes from multiple sources manually. B. The continuous integration and testing of code changes from multiple sources via automation. C. The continuous integration of changes from one environment to another. D. The continuous integration of new tools to support developers in a project.
:::spoiler Correct Answer: B :::
Question #128
Which of the following options is true about considerations for large Kubernetes clusters?
A. Kubernetes supports up to 1000 nodes and recommends no more than 1000 containers per node. B. Kubernetes supports up to 5000 nodes and recommends no more than 500 pods per node. C. Kubernetes supports up to 5000 nodes and recommends no more than 110 pods per node. D. Kubernetes supports up to 50 nodes and recommends no more than 1000 containers per node.
:::spoiler Correct Answer: C
Here’s why:
https://kubernetes.io/docs/setup/best-practices/cluster-large/ :::
Question #129
Which component of the node is responsible to run workloads?
A. The kubelet. B. The kubeproxy. C. The kube-apiserver. D. The container runtime.
:::spoiler Correct Answer: A
Here’s why:
The component of the node responsible for running workloads is the kubelet. While the container runtime (like Docker, containerd, or CRI-O) is crucial for actually running the containers, the kubelet is the orchestrator that ensures the containers are running as specified by the Kubernetes control plane. :::
Question #130
The IPv4/IPv6 dual stack in Kubernetes:
A. Translates an IPv4 request from a service to an IPv6 service. B. Allows you to access the IPv4 address by using the IPv6 address. C. Requires NetworkPolicies to prevent services from mixing requests. D. Allows you to create IPv4 and IPv6 dual stack services.
:::spoiler Correct Answer: D
Here’s why:
Kubernetes 支援 IPv4/IPv6 dual stack，意思是： 叢集中的 Pod、Service 可以同時擁有 IPv4 與 IPv6 位址，並且可以透過任一協定進行通訊。 https://kubernetes.io/docs/concepts/services-networking/dual-stack/ :::
Question #131
What does “continuous” mean in the context of CI/CD?
A. Frequent releases, Manual processes, Repeatable, Fast processing B. Periodic releases, Manual processes, Repeatable, Automated Processing C. Frequent releases, Automated processes, Repeatable, Fast processing D. Periodic releases, Automated processes, Repeatable, Automated processing
:::spoiler Correct Answer: C
Here’s why:
https://spot.io/resources/ci-cd/what-is-ci-cd-continuous-integration-continuous-deployment/ :::
Question #132
What is ephemeral storage?
A. Storage space that need not persist across restarts. B. Storage that may grow dynamically. C. Storage used by multiple consumers (e.g. multiple Pods). D. Storage that is always provisioned locally
:::spoiler Correct Answer: A
Here’s why:
Question #133
What is the reference implementation of the OCI runtime specification?
A. lxc B. cri-o C. runc D. docker
:::spoiler Correct Answer: C
Here’s why:
runC is the reference implementation of the OCI runtime specification. It is a lightweight, portable container runtime that provides a standardized way to run containers. runC was originally extracted from Docker and has since become the reference implementation for the OCI runtime specification, ensuring compatibility and interoperability across different container runtimes. :::
Question #134
What is a Service?
A. A static network mapping from a Pod to a port. B. A way to expose an application running on a set of Pods. C. The network configuration for a group of Pods. D. An NGINX load balancer that gets deployed for an application.
:::spoiler Correct Answer: B
Here’s why:
https://kubernetes.io/docs/concepts/services-networking/service/ :::
Question #135
What’s the difference between a security profile and a security context?
A. Security Contexts configure Clusters and Namespaces at runtime. Security profiles are control plane mechanisms to enforce specific settings in the Security Context. B. Security Contexts configure Pods and Containers at runtime. Security profiles are control plane mechanisms to enforce specific settings in the Security Context. C. Security Profiles configure Pods and Containers at runtime. Security Contexts are control plane mechanisms to enforce specific settings in the Security Profile. D. Security Profiles configure Clusters and Namespaces at runtime. Security Contexts are control plane mechanisms to enforce specific settings in the Security Profile.
:::spoiler Correct Answer: B
Here’s why:
Question #136
At which layer would distributed tracing be implemented in a cloud native deployment?
A. Network B. Application C. Database D. Infrastructure
:::spoiler Correct Answer: B
Here’s why:
Question #137
What framework does Kubernetes use to authenticate users with JSON Web Tokens?
A. OpenID Connect B. OpenID Container C. OpenID Cluster D. OpenID CNCF
:::spoiler Correct Answer: A
Here’s why:
Kubernetes 使用 OpenID Connect (OIDC) 來處理身份驗證，並利用 JSON Web Tokens (JWTs) 進行用戶身份驗證。 https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens :::
Question #138
Which of the following is a feature Kubernetes provides by default as a container orchestration tool?
A. A portable operating system. B. File system redundancy. C. A container image registry. D. Automated rollouts and rollbacks.
:::spoiler Correct Answer: D
Here’s why:
https://kubernetes.io/docs/concepts/overview/#:~:text=Automated%20rollouts%20and%20rollbacks :::
Question #139
Which of the following sentences is true about container runtimes in Kubernetes?
A. If you let iptables see bridged traffic, you don’t need a container runtime. B. If you enable IPv4 forwarding, you don’t need a container runtime. C. Container runtimes are deprecated, you must install CRI on each node D. You must install a container runtime on each node to run pods on it.
:::spoiler Correct Answer: D
Here’s why:
每個 Node 上都必須安裝一個 Container Runtime，才能讓該節點執行 Pod。Pod 裡的貨櫃由 Container Runtime 負責實際建立、管理與執行。 :::
Question #140
If a Pod was waiting for container images to download on the scheduled node, what state would it be in?
A. Failed B. Succeeded C. Unknown D. Pending
:::spoiler Correct Answer: D
Here’s why:
https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase :::
Question #141
What is CloudEvents?
A. It is a specification for describing event data in common formats for Kubernetes network traffic management and cloud providers. B. It is a specification for describing event data in common formats in all cloud providers including major cloud providers C. It is a specification for describing event data in common formats to provide interoperability across services, platforms and systems D. It is a Kubernetes specification for describing events data in common formats for iCloud services, iOS platforms and iMac.
:::spoiler Correct Answer: C
Here’s why:
CloudEvents 是由 CNCF 推出的開放規範，目的是讓來自不同來源的事件（Events）能用一致的格式進行描述，實現跨系統、平台與服務的互通性 https://cloudevents.io/ :::
Question #142
What is the main purpose of etcd in Kubernetes?
A. etcd stores all cluster data in a key value store. B. etcd stores the containers running in the cluster for disaster recovery. C. etcd stores copies of the Kubernetes config files that live /etc/. D. etcd stores the YAML definitions for all the cluster components.
:::spoiler Correct Answer: A
Here’s why:
https://www.armosec.io/glossary/etcd-kubernetes/#:~:text=key%2Dvalue%20data%20store. :::
Question #143
Imagine you’re releasing open-source software for the first time. Which of the following is a valid semantic version?
A. 1.0 B. 2021-10-11 C. 0.1.0-rc D. v1beta1
:::spoiler Correct Answer: C
Here’s why:
Question #144
Which cloud native tool keeps Kubernetes clusters in sync with sources of configuration (like Git repositories), and automates updates to configuration when there is new code to deploy?
A. Flux and ArgoCD B. GitOps Toolkit C. Linkerd and Istio D. Helm and Kustomize
:::spoiler Correct Answer: A
Here’s why:
https://www.pomerium.com/blog/best-kubernetes-management-tools
Question #145
Which tool is used to streamline installing and managing Kubernetes applications?
A. apt B. helm C. service D. brew
:::spoiler Correct Answer: B
Here’s why:
https://helm.sh/ :::
Question #146
What are the two steps performed by the kube-scheduler to select a node to schedule a pod?
A. Grouping and placing B. Filtering and selecting C. Filtering and scoring D. Scoring and creating
:::spoiler Correct Answer: C
kube-scheduler selects a node for the pod in a 2-step operation:
Filtering Scoring
The filtering step finds the set of Nodes where it’s feasible to schedule the Pod. For example, the PodFitsResources filter checks whether a candidate Node has enough available resources to meet a Pod’s specific resource requests. After this step, the node list contains any suitable Nodes; often, there will be more than one. If the list is empty, that Pod isn’t (yet) schedulable.
In the scoring step, the scheduler ranks the remaining nodes to choose the most suitable Pod placement. The scheduler assigns a score to each Node that survived filtering, basing this score on the active scoring rules.
Finally, kube-scheduler assigns the Pod to the Node with the highest ranking. If there is more than one node with equal scores, kube-scheduler selects one of these at random.
:::
Question #147
To visualize data from Prometheus you can use expression browser or console templates. What is the other data visualization tool commonly used together with Prometheus?
A. Grafana B. Graphite C. Nirvana D. GraphQL
:::spoiler Correct Answer: A
Here’s why:
Question #148
Which item is a Kubernetes node component?
A. kube-scheduler B. kubectl C. kube-proxy D. etcd
:::spoiler Correct Answer: C
Here’s why:
https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/#synopsis :::
Question #149
In a serverless computing architecture:
A. Users of the cloud provider are charged based on the number of requests to a function. B. Serverless functions are incompatible with containerized functions. C. Users should make a reservation to the cloud provider based on an estimation of usage. D. Containers serving requests are running in the background in idle status.
:::spoiler Correct Answer: A
Here’s why:
https://cloud.google.com/discover/what-is-serverless-architecture?hl=zh_tw :::
Question #150
How is application data maintained in containers?
A. Store data into data folders. B. Store data in separate folders. C. Store data into sidecar containers. D. Store data into volumes.
:::spoiler Correct Answer: D :::
Question #151
Which of the following scenarios would benefit the most from a service mesh architecture?
A. A few applications with hundreds of pod replicas running in multiple clusters, each one providing multiple services. B. Thousands of distributed applications running in a single cluster, each one providing multiple services. C. Tens of distributed applications running in multiple clusters, each one providing multiple services. D. Thousands of distributed applications running in multiple clusters, each one providing multiple services.
:::spoiler Correct Answer: D
Here’s why:
Service Mesh 最適用情境：
- 應用數量多
- 分散於多叢集（multi-cluster）
- 微服務頻繁互動、需要安全通信與觀察能力 :::
Question #152
Kubernetes___ protect you against voluntary interruptions (such as draining nodes) to run applications in a highly available manner.
A. Pod Topology Spread Constraints B. Pod Disruption Budgets C. Taints and Tolerances D. Resource Limits and Requests
:::spoiler Correct Answer: B
Here’s why:
PodDisruptionBudget（PDB）是 Kubernetes 提供的一種 機制，用來確保 應用程式在節點維護(drain) Pod 時，仍然 維持一定數量的 Pod，以避免服務中斷，從而維持應用的可用性。 https://github.com/mercari/production-readiness-checklist/blob/master/docs/concepts/pod-disruption-budget.md :::
Question #153
What sentence is true about CronJobs in Kubernetes?
A. A CronJob creates one or multiple Jobs on a repeating schedule. B. A CronJob creates one container on a repeating schedule. C. CronJobs are useful on Linux but are obsolete In Kubernetes. D. The CronJob schedule format Is different in Kubernetes and Linux.
:::spoiler Correct Answer: A :::
Question #154
What is the purpose of the kube-proxy?
A. The kube-proxy balances network requests to pods. B. The kube-proxy maintains network rules on nodes. C. The kube-proxy ensures the cluster connectivity with internet. D. The kube-proxy maintains the DNS rules of the cluster.
:::spoiler Correct Answer: B
Here’s why:
Question #155
Manual reclamation policy of a PV resource is known as:
A. claimRef B. Delete C. Retain D. Recycle
:::spoiler Correct Answer: C
Here’s why:
Question #156
Which component of the Kubernetes architecture is responsible for integration with the CRI container runtime?
A. kubeadm B. kubelet C. kube-aplserver D. kubectl
:::spoiler Correct Answer: B
Here’s why:
Question #157
Which one of the following is an open source runtime security tool?
A. lxd B. containerd C. falco D. gvisor
:::spoiler Correct Answer: C
Here’s why:
Question #158
What are the advantages of adopting a GitOps approach for your deployments?
A. Reduce failed deployments, operational costs, and fragile release processes. B. Reduce failed deployments, configuration drift, and fragile release processes. C. Reduce failed deployments, operational costs, and learn git. D. Reduce failed deployments, configuration drift and improve your reputation.
:::spoiler Correct Answer: B :::
Question #159
Which command lists the running containers in the current Kubernetes namespace?
A. kubectl get pods B. kubectl ls C. kubectl ps D. kubectl show pods
:::spoiler Correct Answer: A :::
Question #160
Which of the following is a good habit for cloud native cost efficiency?
A. Follow an automated approach to cost optimization, including visibility and forecasting. B. Follow manual processes for cost analysis, including visibility and forecasting. C. Use only one cloud provider to simplify the cost analysis. D. Keep your legacy workloads unchanged, to avoid cloud costs.
:::spoiler Correct Answer: A :::
Question #161
Which of these is a valid container restart policy?
A. On login B. On update C. On start D. On failure
:::spoiler Correct Answer: D
Here’s why:
https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy :::
2024/11/18 考試心得
多了差不多 10 題不一樣，以下是有印象的幾題
- edge and service proxy tool 是誰，答案是
envoy - node 在 false 或 notready 預設幾分鐘後會驅逐 pod，答案是
5分鐘 - metrics server 的 API 是甚麼，答案是
metrics.k8s.io - v2beta3 代表什麼意思，答案是
The software is well tested. Enabling a feature is considered safe.。 - What Linux namespace is shared by default by containers running within a Kubernetes Pod?
答案變成
storage and netwrok resource - cloud native application 的定義，答案待確認。
- flux ….? 題目忘了，但答案應該是
Gitops。 - Container Orchestration Tools 相關，答案待確認。
- Ephemeral Containers 的定義，答案是
a special type of container that runs temporarily in an existing Pod。有選項是 init contianer 的定義，不要搞混。