100 Free KCNA Practice Questions and Answers
100 questions for the KCNA exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
JSON is a serialization format but not the architectural model for Kubernetes objects.
Not this one. Try another answer.
Why B is wrong
YAML is a serialization format for defining objects, not the object model itself.
Not this one. Try another answer.
Why C is wrong
Java is a programming language unrelated to Kubernetes object architecture.
Right, D is the answer.
Why D is right
Services and Pods in Kubernetes are REST objects, meaning they are managed through RESTful API calls to the kube-apiserver. While they are often defined using YAML or JSON manifests for convenience, the underlying representation and interaction model is REST-based.
Question 2 Play from 01:29
What is CRD?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
CRD stands for Custom Resource Definition, which is the mechanism for extending the Kubernetes API with custom resource types. CRDs allow users to define new Kubernetes objects and manage them like native resources. The other options contain incorrect expansions with irrelevant terms like 'Restricted' or 'RUST' which are not related to Kubernetes API extensions.
Not this one. Try another answer.
Why B is wrong
CRD does not stand for 'Custom Restricted Definition'.
Not this one. Try another answer.
Why C is wrong
RUST is not part of Kubernetes API extension terminology.
Not this one. Try another answer.
Why D is wrong
RUST is a programming language not related to Custom Resource Definitions.
Question 3 Play from 03:06
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Controller Manager runs multiple controllers (Deployment controller, ReplicaSet controller, etc.) that continuously monitor the cluster state and reconcile actual state with desired state. When you create a Deployment, the controller manager ensures the correct number of replicas are running and takes corrective actions when discrepancies occur.
Not this one. Try another answer.
Why B is wrong
The API Server handles requests and stores data but does not actively reconcile resource state; it serves as the communication hub.
Not this one. Try another answer.
Why C is wrong
kubelet runs on worker nodes and manages individual Pod lifecycle but does not reconcile cluster-wide Deployment or ReplicaSet state.
Not this one. Try another answer.
Why D is wrong
etcd is the backing data store for cluster state but does not perform reconciliation logic or maintain desired state.
Question 4 Play from 04:46
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
kubectl exec is the Kubernetes command used to execute commands inside running containers within a Pod. The syntax is kubectl exec <pod-name> -- <command>, where the -- separates kubectl arguments from the command to be executed in the container.
Not this one. Try another answer.
Why B is wrong
docker exec is for Docker containers on a local host, not for Kubernetes Pods.
Not this one. Try another answer.
Why C is wrong
kubectl run is used to create new workloads, not to execute commands in existing containers.
Not this one. Try another answer.
Why D is wrong
kubectl attach is used to attach to standard input/output of a running container, not to execute arbitrary commands.
Question 5 Play from 06:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Kubernetes Dashboard is the open-source UI for Kubernetes, not Helm.
Right, B is the answer.
Why B is right
Helm is a package manager for Kubernetes applications that uses charts to define, install, and manage complex Kubernetes deployments. It provides templating, versioning, and dependency management for Kubernetes resources. Kubernetes dashboards are separate tools like the Kubernetes Dashboard, custom schedulers are scheduler plugins rather than Helm's function, and end-to-end testing frameworks serve different purposes.
Not this one. Try another answer.
Why C is wrong
Helm is a package manager, not a custom scheduler.
Not this one. Try another answer.
Why D is wrong
End-to-end testing projects are separate from Helm's package management role.
Question 6 Play from 07:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Summary is a metric type that tracks observations and provides quantile information, not a simple increasing/decreasing value.
Not this one. Try another answer.
Why B is wrong
Counter is a metric type that only increases monotonically and is used for cumulative measurements like total requests.
Not this one. Try another answer.
Why C is wrong
Histogram is a metric type that tracks the distribution of values across buckets, not a single numerical value.
Right, D is the answer.
Why D is right
A Gauge is the Prometheus metric type that represents a single numerical value which can arbitrarily increase or decrease over time, making it suitable for measurements like temperature, memory usage, or request latency.
Question 7 Play from 09:14
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The kubectl rollout history command is the correct way to view the revision history of a Deployment. It displays all previous revisions and their details, allowing you to see what changes were made in each rollout. This is essential for understanding deployment changes and performing rollbacks if needed.
Not this one. Try another answer.
Why B is wrong
kubectl rollout status shows the current state of a rollout but not the historical revisions.
Not this one. Try another answer.
Why C is wrong
kubectl get history is not a valid Kubernetes command; the correct command uses rollout not get.
Not this one. Try another answer.
Why D is wrong
kubectl describe rollout is not a valid command syntax; describe works on resources but rollout is managed through rollout subcommands.
Question 8 Play from 10:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While 'Community' could seem plausible, the correct acronym uses 'Computing' not 'Community'.
Right, B is the answer.
Why B is right
CNCF is the official acronym for the Cloud Native Computing Foundation, an open governance foundation hosted by the Linux Foundation that promotes the adoption of cloud-native technologies and best practices.
Not this one. Try another answer.
Why C is wrong
The 'N' stands for 'Native', not 'Neutral', and 'Computing' is correct, not 'Neutral Computing'.
Not this one. Try another answer.
Why D is wrong
This incorrectly uses both 'Neutral' and 'Community', neither of which are correct in the CNCF acronym.
Question 9 Play from 12:20
What Kubernetes API object is missing from this sequence?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Docker is a container runtime tool, not a Kubernetes API object in the application chain.
Not this one. Try another answer.
Why B is wrong
Proxy is not a standard Kubernetes API object; proxying is handled by kube-proxy.
Right, C is the answer.
Why C is right
The correct chain is Gateway API → Service → Pod → Container. Pods are the missing link that actually run containers. EndpointSlice tracks Pod IP addresses for service discovery, but the Pod itself is the fundamental compute unit that wraps containers. Docker is a container runtime, not an API object in this chain. Proxy and Firewall are not standard Kubernetes API objects in this flow.
Not this one. Try another answer.
Why D is wrong
Firewall is not a Kubernetes API object; network policies provide firewall-like functionality.
Question 10 Play from 14:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Thirty seconds is far shorter than the default of five minutes.
Not this one. Try another answer.
Why B is wrong
Thirty minutes is much longer than the default of five minutes.
Not this one. Try another answer.
Why C is wrong
One minute is shorter than the default; pods tolerate the not-ready and unreachable taints for 300 seconds.
Right, D is the answer.
Why D is right
When a node's Ready condition becomes Unknown or False, Kubernetes taints it as not- ready or unreachable, and pods tolerate that taint for 300 seconds by default before they are evicted. The default eviction timeout is therefore five minutes.
Show all 100 questionsShow fewer questions
Question 11 Play from 15:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Frontend proxy is a generic term and not a specific cloud-native service mesh proxy.
Not this one. Try another answer.
Why B is wrong
Kube-proxy is a Kubernetes component for service load balancing, not a service mesh proxy.
Not this one. Try another answer.
Why C is wrong
Reverse proxy is a general architectural concept, not a specific cloud-native service mesh solution.
Right, D is the answer.
Why D is right
Envoy is the primary cloud-native proxy used in service meshes like Istio for managing ingress and egress traffic between services. It can also function as an application gateway and provides advanced traffic management, security, and observability features. Frontend proxy is a generic term, kube-proxy is a Kubernetes network component for service routing (not a service mesh proxy), and reverse proxy is a general concept rather than a specific cloud-native solution.
Question 12 Play from 17:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
On login is not a valid container restart policy in Docker or Kubernetes.
Not this one. Try another answer.
Why B is wrong
On update is not a valid container restart policy.
Not this one. Try another answer.
Why C is wrong
On start is not a valid restart policy; the closest standard policy is 'always' but not 'on start'.
Right, D is the answer.
Why D is right
Docker and container orchestration platforms support 'on-failure' as a valid restart policy, which automatically restarts a container if it exits with a non-zero exit code. This is a standard restart policy used in production environments. The other options are not recognized restart policy values in Docker or Kubernetes.
Question 13 Play from 18:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Bash scripts run on worker nodes are not the Kubernetes-native deployment method.
Not this one. Try another answer.
Why B is wrong
Helm is an additional tool beyond the base Kubernetes installation.
Right, C is the answer.
Why C is right
The native way to deploy workloads to Kubernetes without additional tools is to create a manifest file (YAML) and apply it using kubectl apply or kubectl create commands. This is the standard, built-in method that requires only kubectl and does not depend on external tools like Helm, scripting languages, or direct node access.
Not this one. Try another answer.
Why D is wrong
Python scripts are not executed with kubectl; they would need to be containerized and deployed as workloads.
Question 14 Play from 20:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Metrics are quantitative measurements (counters, gauges, histograms) rather than sequences of events.
Not this one. Try another answer.
Why B is wrong
Logs are individual text records of events, not structured series showing request flow relationships.
Not this one. Try another answer.
Why C is wrong
Spans are individual units within traces, not the complete series that encodes end-to-end flow.
Right, D is the answer.
Why D is right
Traces represent the complete end-to-end request flow through a distributed system, composed of related spans that show how a request travels across multiple services. Traces provide visibility into the entire journey of a request from entry to exit across a distributed architecture.
Question 15 Play from 21:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
NetworkPolicy manages network access controls and security; it is not related to HTTP routing that Gateway API addresses.
Not this one. Try another answer.
Why B is wrong
Service is a core Kubernetes networking primitive for internal service discovery; Gateway API is an evolution of Ingress, not Service.
Not this one. Try another answer.
Why C is wrong
NodePort is a basic service type for exposing services; Gateway API is the successor to Ingress for external HTTP(S) routing, not NodePort.
Right, D is the answer.
Why D is right
Gateway API is the successor to the Ingress API. While Ingress provides basic HTTP(S) routing, Gateway API offers more powerful, flexible, and expressive routing capabilities with better separation of concerns, support for multiple protocols, and more granular traffic management suited to modern cloud native applications.
Question 16 Play from 23:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
template is not mandatory and status is not a creation field; it's automatically generated.
Not this one. Try another answer.
Why B is wrong
status is not a creation field; it's generated by the cluster, not specified by users.
Not this one. Try another answer.
Why C is wrong
template is not a top-level mandatory field; it appears within specs of certain resources.
Right, D is the answer.
Why D is right
The mandatory fields for creating any Kubernetes object via YAML are apiVersion (API version), metadata (object identity information), kind (object type), and spec (desired state). These four fields are required in every Kubernetes manifest.
Question 17 Play from 25:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Failed indicates the Pod's containers have exited with non-zero status codes.
Not this one. Try another answer.
Why B is wrong
Succeeded indicates all containers in the Pod have terminated successfully.
Not this one. Try another answer.
Why C is wrong
Unknown indicates the state of the Pod could not be determined, typically due to communication issues with the node.
Right, D is the answer.
Why D is right
When a Pod is waiting for container images to download on the scheduled node, it is in the Pending state. The Pending state indicates that the Pod has been accepted by the cluster but one or more of its containers have not yet been created, typically due to image pulls, resource constraints, or scheduler delays.
Question 18 Play from 26:22
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Deploying Kubernetes objects via imperative commands (kubectl apply, kubectl create, etc.) is the primary antipattern in GitOps workflows. GitOps requires that all infrastructure state be declared in a Git repository as the single source of truth, with changes deployed through pull requests and automated synchronization, not manual imperative commands.
Not this one. Try another answer.
Why B is wrong
Leaving comments in PR discussions is consistent with GitOps collaborative practices.
Not this one. Try another answer.
Why C is wrong
Declarative manifests in Git are the foundation of GitOps, not an antipattern.
Not this one. Try another answer.
Why D is wrong
Pushing builds with deploy labels is a valid deployment strategy that aligns with GitOps principles.
Question 19 Play from 28:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Pod eviction and starting are handled by kubelet and the control plane, not by kube-scheduler.
Right, B is the answer.
Why B is right
The kube-scheduler performs two essential operations: filtering nodes to find candidates that meet Pod requirements, then scoring those candidates to select the best node. This two-phase scheduling process (predicate/filter and priority/score) is fundamental to how the scheduler works. Pod eviction is handled by kubelet or eviction manager, not the scheduler. Resource monitoring is handled by metrics-server. Container management is handled by kubelet.
Not this one. Try another answer.
Why C is wrong
Resource monitoring and reporting are performed by metrics-server, not kube-scheduler.
Not this one. Try another answer.
Why D is wrong
Starting and terminating containers are kubelet responsibilities, not kube-scheduler.
Question 20 Play from 29:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Developing new features is a software development responsibility, not SRE
Right, B is the answer.
Why B is right
Site Reliability Engineers focus on operational aspects of systems including monitoring, observability, and reliability metrics. Creating a monitoring baseline for an application directly falls within SRE responsibilities as it establishes the foundation for measuring system health and performance. Options A, C, and D are development, finance, and policy responsibilities respectively, not core SRE functions.
Not this one. Try another answer.
Why C is wrong
Budgeting decisions are typically finance or management responsibilities, not SRE technical work
Not this one. Try another answer.
Why D is wrong
Code submission policies are usually set by engineering management or development leads, not SRE
Question 21 Play from 31:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
CPU is less critical than network and disk I/O for etcd performance.
Right, B is the answer.
Why B is right
The etcd cluster's performance is critically dependent on network throughput and disk I/O because etcd is a distributed key-value store that performs frequent writes and reads with consensus requirements across members. Network throughput ensures fast replication between cluster members, while disk I/O determines how quickly data can be persisted. While CPU matters, these two resources are the primary bottlenecks for etcd performance.
Not this one. Try another answer.
Why C is wrong
RAM memory and CPU are not the most important factors; network and disk I/O take precedence.
Not this one. Try another answer.
Why D is wrong
Network throughput is important, but CPU is secondary to disk I/O for etcd clusters.
Question 22 Play from 33:19
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The two primary modes for Service discovery in Kubernetes are environment variables and DNS. Environment variables are automatically injected into Pods to reference Services, while DNS allows Pods to discover Services using DNS names in the form of service-name.namespace.svc.cluster.local.
Not this one. Try another answer.
Why B is wrong
API Calls and LDAP are not the primary service discovery mechanisms in Kubernetes; they are not standard Kubernetes discovery methods.
Not this one. Try another answer.
Why C is wrong
Labels and Radius: while labels are used internally, Radius is an external authentication protocol not related to Kubernetes service discovery.
Not this one. Try another answer.
Why D is wrong
Selectors and DHCP: Selectors are used to identify Pods, not for service discovery; DHCP is not a Kubernetes service discovery mechanism.
Question 23 Play from 35:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Pod Topology Spread Constraints control pod distribution across topology domains for availability, but don't specifically protect against voluntary disruptions.
Right, B is the answer.
Why B is right
Pod Disruption Budgets (PDBs) protect applications during voluntary disruptions like pod deletions and node drains by specifying the minimum number of pods that must remain available. This ensures high availability is maintained even when administrative actions are performed on the cluster.
Not this one. Try another answer.
Why C is wrong
Taints and Tolerances control pod scheduling and node restrictions, not protection from voluntary disruptions.
Not this one. Try another answer.
Why D is wrong
Resource Limits and Requests manage resource allocation and scheduling, not protection from voluntary disruptions.
Question 24 Play from 36:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The three pillars of observability are Metrics, Logs, and Traces. Metrics provide quantitative measurements, logs offer detailed event records, and traces track requests across distributed systems. This is the industry-standard framework for achieving observability.
Not this one. Try another answer.
Why B is wrong
Spans are components of traces, not a separate pillar of observability.
Not this one. Try another answer.
Why C is wrong
Data is too vague and not part of the formal three-pillar framework.
Not this one. Try another answer.
Why D is wrong
Resources and Tracing are not the correct terminology for the three pillars.
Question 25 Play from 38:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
kubeadm is a cluster initialization tool, not responsible for CRI integration.
Right, B is the answer.
Why B is right
The kubelet is the node agent responsible for managing pods and interfacing with the Container Runtime Interface (CRI). It communicates with the container runtime to pull images, create containers, and manage pod lifecycle. The kubelet acts as the bridge between Kubernetes and the container runtime.
Not this one. Try another answer.
Why C is wrong
kube-apiserver is the API endpoint for the control plane, not responsible for container runtime integration.
Not this one. Try another answer.
Why D is wrong
kubectl is a command-line client for interacting with the cluster, not a component that integrates with CRI.
Question 26 Play from 39:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
alpha1v1 and beta3v3 have the version and stage in the wrong order; Kubernetes uses stage before the stage number.
Not this one. Try another answer.
Why B is wrong
alpha1, beta3, and v2 are invalid because they lack the leading version number that must precede the stage designation.
Right, C is the answer.
Why C is right
Valid Kubernetes API versions follow the pattern of a version number optionally followed by a stability level suffix. The format is 'v[number][stage][stage-number]' such as v1alpha1, v2beta3, or v2. Option C correctly shows three valid examples: v1alpha1 (version 1, alpha stage 1), v2beta3 (version 2, beta stage 3), and v2 (stable version 2).
Not this one. Try another answer.
Why D is wrong
2.0 uses dot notation and lacks a leading 'v', violating Kubernetes API version naming conventions which require 'v' prefix and no dots.
Question 27 Play from 41:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
startupProbe detects when a container has started successfully, not livenessProbe.
Right, B is the answer.
Why B is right
The livenessProbe detects when a container has become unresponsive or deadlocked and is no longer functioning correctly. If the liveness probe fails, Kubernetes restarts the container to recover from the unresponsive state.
Not this one. Try another answer.
Why C is wrong
readinessProbe determines when a container is ready to serve traffic, not livenessProbe.
Not this one. Try another answer.
Why D is wrong
Resource limits are enforced separately; livenessProbe does not detect resource limit violations.
Question 28 Play from 43:01
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Init containers are the correct pattern for loading and generating required data before the main pod starts. Init containers run to completion before application containers start, and they can share storage volumes with the main pod. They are specifically designed for setup tasks like data preparation, configuration retrieval, and dependency initialization. Using sidecar containers, separate pods, or just PVC volumes alone doesn't provide the sequential startup guarantee that init containers offer.
Not this one. Try another answer.
Why B is wrong
A PVC volume alone doesn't execute initialization logic or prepare data.
Not this one. Try another answer.
Why C is wrong
Sidecar containers run alongside the main container, not before it starts.
Not this one. Try another answer.
Why D is wrong
Running another pod doesn't guarantee proper initialization sequencing within the same pod.
Question 29 Play from 44:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Financial analysis is not relevant to open-source project governance decisions.
Right, B is the answer.
Why B is right
CNCF projects follow a community-driven approach where conflicts are resolved and decisions are made through discussion among contributors followed by voting mechanisms. This democratic process ensures inclusive decision-making and community consensus rather than relying on financial metrics, random chance, or sole founder authority.
Not this one. Try another answer.
Why C is wrong
Flipism (coin flipping) would be inappropriate and unprofessional for serious project decisions.
Not this one. Try another answer.
Why D is wrong
CNCF projects emphasize community governance, not decisions made unilaterally by founders.
Question 30 Play from 46:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
CRI-O is a fully CRI-compliant container runtime specifically designed for Kubernetes.
Not this one. Try another answer.
Why B is wrong
dockershim was a CRI implementation that allowed Docker to work with Kubernetes (though deprecated in newer versions).
Right, C is the answer.
Why C is right
systemd is an init system and service manager for Linux, not a container runtime implementing the Container Runtime Interface (CRI). CRI-O, containerd, and other CRI- compatible runtimes implement the standard interface for Kubernetes, but systemd does not.
Not this one. Try another answer.
Why D is wrong
containerd is a widely-used, CRI-compliant container runtime supported by Kubernetes.
Question 31 Play from 47:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
etcd is the key-value store for cluster data, not responsible for pod scheduling.
Not this one. Try another answer.
Why B is wrong
kube-controller-manager runs various controllers but scheduling is delegated to kube-scheduler.
Not this one. Try another answer.
Why C is wrong
kube-proxy handles network routing and service proxying, not pod scheduling.
Right, D is the answer.
Why D is right
The kube-scheduler is the Kubernetes control plane component specifically responsible for watching newly created Pods that have no assigned node and selecting an appropriate node for them to run on based on resource requirements and scheduling policies.
Question 32 Play from 49:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Helm is a package manager for Kubernetes, not a proxy for microservices communication.
Not this one. Try another answer.
Why B is wrong
Fluentd is a log aggregation and forwarding tool, not a service proxy.
Right, C is the answer.
Why C is right
Envoy is the CNCF proxy project specifically designed for service-to-service communication, load balancing, and observability in service meshes. It is widely used as the data plane in Istio and other service mesh implementations, providing advanced traffic management and observability features.
Not this one. Try another answer.
Why D is wrong
Prometheus is a monitoring and metrics collection system, not a proxy for inter-service communication.
Question 33 Play from 50:34
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The command `kubectl get pods` lists all running pods in the current namespace. This is the standard Kubernetes command for viewing pod status and information. The get subcommand with pods resource type is the correct syntax.
Not this one. Try another answer.
Why B is wrong
kubectl ls is not a valid kubectl command.
Not this one. Try another answer.
Why C is wrong
kubectl ps is not a valid kubectl command (ps is a Linux command, not a kubectl subcommand).
Not this one. Try another answer.
Why D is wrong
kubectl show pods is not a valid kubectl command; the correct command is kubectl get pods.
Question 34 Play from 51:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Job is used for running one-time or batch workloads that complete once, not recurring workloads.
Not this one. Try another answer.
Why B is wrong
Batch is not a Kubernetes workload object; batch jobs are managed through the Job object.
Not this one. Try another answer.
Why C is wrong
DaemonSet ensures a pod runs on every node, but it is not used for scheduling recurring workloads at specific times.
Right, D is the answer.
Why D is right
CronJob is the Kubernetes object specifically designed for running recurring workloads on a scheduled basis. It follows the cron syntax to define when jobs should be executed repeatedly, similar to cron jobs in Unix/Linux systems.
Question 35 Play from 53:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Unrestricted is not an official Pod Security Standard level.
Right, B is the answer.
Why B is right
Kubernetes Pod Security Standards defines three levels: Privileged (least restrictive), Baseline (moderate restrictions), and Restricted (most restrictive). The Restricted standard enforces the most stringent security controls, including disallowing privilege escalation, requiring non-root users, restricting capabilities, and enforcing read-only filesystems - making it suitable for security-critical workloads.
Not this one. Try another answer.
Why C is wrong
Privileged is the least restrictive standard, allowing nearly all security-sensitive settings.
Not this one. Try another answer.
Why D is wrong
Baseline is moderately restrictive but less strict than Restricted.
Question 36 Play from 54:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Every Kubernetes object manifest requires three essential top-level fields: apiVersion (specifies the API version), kind (specifies the object type), and metadata (contains object identification information like name and namespace). These three fields are mandatory and form the foundation of any valid Kubernetes YAML configuration.
Not this one. Try another answer.
Why B is wrong
namespace is not a top-level required field; it belongs inside metadata
Not this one. Try another answer.
Why C is wrong
namespace is not a top-level required field; it is optional and contained within metadata
Not this one. Try another answer.
Why D is wrong
data is not a top-level required field and only appears in specific object types like ConfigMaps and Secrets
Question 37 Play from 56:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A Selector is a mechanism used within Services to identify which pods to target, but it is not itself the abstraction that defines access policy.
Not this one. Try another answer.
Why B is wrong
A Controller manages pod replicas and reconciliation but does not define network access policies or serve as an endpoint for accessing pods.
Right, C is the answer.
Why C is right
A Kubernetes Service is the abstraction that defines a logical set of Pods and a policy by which to access them. Services provide stable endpoints and load balancing for accessing groups of pods, enabling network communication and service discovery.
Not this one. Try another answer.
Why D is wrong
A Job is a workload object for running pods to completion, not an abstraction for defining logical pod sets and access policies.
Question 38 Play from 58:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This reverses the order, placing Cloud first when it should be last as the layer with least user control.
Not this one. Try another answer.
Why B is wrong
This ordering does not follow the principle of user control, starting with containers rather than code.
Not this one. Try another answer.
Why C is wrong
This ordering incorrectly places Cluster first, when Code is the innermost layer users control directly.
Right, D is the answer.
Why D is right
The 4Cs of Cloud Native Security are ordered from most to least user control: Code (application code), Container (container images and runtime), Cluster (Kubernetes infrastructure), and Cloud (cloud provider infrastructure). Users have the most direct control over their own code and progressively less control moving outward to infrastructure layers managed by cloud providers.
Question 39 Play from 59:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
DaemonSet ensures one pod runs on every node, not for managing general stateless workloads.
Not this one. Try another answer.
Why B is wrong
StatefulSet is designed for stateful applications requiring stable pod identities and persistent storage.
Not this one. Try another answer.
Why C is wrong
kubectl is a command-line tool for interacting with Kubernetes, not a resource for managing workloads.
Right, D is the answer.
Why D is right
Deployment is the standard Kubernetes resource for managing stateless application workloads. It provides declarative updates, scaling, and rolling deployments for pods that do not require persistent state or stable identity. Deployments are the most common choice for stateless applications.
Question 40 Play from 1:01:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Using a Dockerfile is necessary for building images but does not inherently minimize size.
Right, B is the answer.
Why B is right
Multistage builds are a best practice for minimizing container image size. They allow you to use multiple FROM statements in a single Dockerfile, enabling you to build in one stage and copy only the necessary artifacts to the final stage, leaving behind build tools and dependencies that are no longer needed in the runtime image.
Not this one. Try another answer.
Why C is wrong
Different image tags do not reduce the image size; they are just different references to images.
Not this one. Try another answer.
Why D is wrong
A build.sh script is an optional build automation tool but is not a best practice for minimizing image size.
Question 41 Play from 1:02:47
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
StatefulSets require a headless service to maintain stable network identities for their pods, enabling pod-to-pod communication and persistent ordering. StatefulSets are designed for applications that need stable hostnames and ordinal indices. Deployments and DaemonSets manage pods without requiring headless services, and CronJobs are one-off batch workloads that don't need stable pod identity.
Not this one. Try another answer.
Why B is wrong
CronJobs run periodic batch jobs and don't require headless services.
Not this one. Try another answer.
Why C is wrong
Deployments manage stateless replicas and use standard services for load balancing.
Not this one. Try another answer.
Why D is wrong
DaemonSets run one pod per node but don't require headless services for functionality.
Question 42 Play from 1:04:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
OpenShift is an enterprise Kubernetes platform, not a lightweight distribution.
Right, B is the answer.
Why B is right
k3s is a lightweight, certified Kubernetes distribution specifically designed for IoT and edge computing environments. It reduces memory and CPU requirements while maintaining full Kubernetes compatibility.
Not this one. Try another answer.
Why C is wrong
RKE (Rancher Kubernetes Engine) is a full Kubernetes installer, not a lightweight edge distribution.
Not this one. Try another answer.
Why D is wrong
k1s is not a recognized Kubernetes distribution.
Question 43 Play from 1:05:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
kubectl edit is one method but not the only method; kubectl scale provides a more direct approach.
Not this one. Try another answer.
Why B is wrong
kubectl scale-up does not exist as a command; the correct command is kubectl scale with the --replicas flag.
Right, C is the answer.
Why C is right
There are two primary methods to scale a Deployment: kubectl scale can directly set the replica count, and kubectl edit allows modification of the deployment specification including the replicas field. Both methods are valid and commonly used.
Not this one. Try another answer.
Why D is wrong
kubectl scale is one valid method, but kubectl edit is also a valid alternative approach.
Question 44 Play from 1:07:10
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Pod logs in Kubernetes are stored in the `/var/log/pods/` directory on the node where the pod is running. This directory contains the container logs for all pods, organized by namespace and pod name. This is the standard location for troubleshooting pod issues when kubectl log retrieval fails. The other paths contain kubeconfig, Kubernetes configuration, or don't exist as standard log locations.
Not this one. Try another answer.
Why B is wrong
~/.kube/config is the kubeconfig file for kubectl configuration, not pod logs.
Not this one. Try another answer.
Why C is wrong
/var/log/k8s/ is not a standard Kubernetes pod log directory.
Not this one. Try another answer.
Why D is wrong
/etc/kubernetes/ contains Kubernetes component configuration files, not pod logs.
Question 45 Play from 1:08:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Kubelet can still communicate with kube-api-server even without a container runtime; the problem is at the execution layer.
Not this one. Try another answer.
Why B is wrong
Node-to-node communication occurs at the network level and is independent of the container runtime.
Right, C is the answer.
Why C is right
The kubelet is the primary node agent that communicates with the container runtime to launch and manage Pods. Without a container runtime (like Docker, containerd, or CRI-O), the kubelet cannot create or run containers, even if it successfully communicates with the API server. The node becomes unable to schedule and execute workloads.
Not this one. Try another answer.
Why D is wrong
Pod-to-Pod networking is handled by the cluster networking layer, not the container runtime directly.
Question 46 Play from 1:10:39
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
etcd is the key-value store used by Kubernetes to persist all cluster data, including configuration, state, and metadata. It serves as the single source of truth for the cluster and is critical to Kubernetes' operation.
Not this one. Try another answer.
Why B is wrong
ZooKeeper is a coordination service used by other systems but is not the store used by Kubernetes for cluster data persistence.
Not this one. Try another answer.
Why C is wrong
ControlPlaneStore is not a real Kubernetes component; etcd is the actual key-value store used by the control plane.
Not this one. Try another answer.
Why D is wrong
Redis is an in-memory data store sometimes used for caching but is not Kubernetes' primary persistent cluster data store.
Question 47 Play from 1:12:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
kube-scheduler is a control plane component, not a node component.
Not this one. Try another answer.
Why B is wrong
kubectl is a command-line client tool for interacting with Kubernetes, not a node component.
Right, C is the answer.
Why C is right
kube-proxy is a node component that runs on every node and manages network connectivity for Kubernetes services. It handles service networking, load balancing, and IP table management at the node level to enable service-to-pod communication.
Not this one. Try another answer.
Why D is wrong
etcd is a control plane component that stores cluster data, not a node component.
Question 48 Play from 1:13:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Kubernetes is a container orchestration platform that helps manage deployment and scaling but does not inherently establish secure, faster delivery practices.
Not this one. Try another answer.
Why B is wrong
apt-get is a package manager for Linux systems and has no direct relationship to secure or accelerated software delivery methodology.
Not this one. Try another answer.
Why C is wrong
Docker Images are containers for packaging applications but are a tool within the pipeline, not the methodology that drives secure velocity.
Right, D is the answer.
Why D is right
A CI/CD Pipeline (Continuous Integration/Continuous Deployment) is the foundational practice that enables organizations to deliver software more securely and at higher velocity. It automates testing, security scanning, and deployment processes, reducing manual errors and enabling rapid, safe releases.
Question 49 Play from 1:15:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Canary is a deployment pattern, not a native Kubernetes strategy, and typically requires manual setup.
Not this one. Try another answer.
Why B is wrong
Recreate terminates all Pods before creating new ones, causing downtime.
Not this one. Try another answer.
Why C is wrong
BlueGreen is a deployment pattern, not a built-in Kubernetes strategy, and requires manual implementation.
Right, D is the answer.
Why D is right
RollingUpdate is the default Kubernetes-native deployment strategy that supports zero- downtime updates. It gradually replaces old Pods with new ones, ensuring that some Pods are always running and available to serve traffic. This gradual transition maintains service availability throughout the update process. Canary and BlueGreen are patterns that can be implemented but are not built-in Kubernetes strategies, and Recreate causes downtime.
Question 50 Play from 1:16:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The correct field is lowercase 'clusterIP', not 'ClusterIP', and the value should be 'None', not 'headless'.
Right, B is the answer.
Why B is right
A headless service in Kubernetes is created by setting .spec.clusterIP: None in the Service manifest. This prevents Kubernetes from assigning a cluster IP and instead returns the Pod IPs directly through DNS, enabling direct Pod-to-Pod communication for stateful applications and service discovery patterns.
Not this one. Try another answer.
Why C is wrong
Setting clusterIP to 0.0.0.0 does not create a headless service; None is the correct value.
Not this one. Try another answer.
Why D is wrong
Setting clusterIP to localhost does not create a headless service; the correct value is None.
Question 51 Play from 1:18:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Jenkins X is a CI/CD platform but not primarily a GitOps engine for parallel job orchestration.
Not this one. Try another answer.
Why B is wrong
Flagger is a progressive delivery tool focused on canary deployments, not job orchestration.
Not this one. Try another answer.
Why C is wrong
Flux is a GitOps tool for continuous deployment but is not specialized for orchestrating parallel jobs.
Right, D is the answer.
Why D is right
Argo Workflows is the GitOps engine specifically designed to orchestrate parallel jobs and complex workflows on Kubernetes. It provides a declarative way to define and execute multi-step workflows with parallel execution capabilities.
Question 52 Play from 1:20:02
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A Service is the Kubernetes abstraction that provides a stable network endpoint to expose a group of Pods. Services enable discovery and load balancing of Pods within the cluster, allowing other Pods to communicate with them using a consistent DNS name and IP address regardless of Pod changes.
Not this one. Try another answer.
Why B is wrong
Deployment manages Pod replicas and updates but does not directly expose them for network communication.
Not this one. Try another answer.
Why C is wrong
Unit is not a standard Kubernetes resource abstraction.
Not this one. Try another answer.
Why D is wrong
DaemonSet ensures Pods run on nodes but is not the abstraction for exposing Pod groups to the cluster.
Question 53 Play from 1:21:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Grouping and placing is not the correct terminology for the scheduler's workflow.
Not this one. Try another answer.
Why B is wrong
Filtering and selecting is close but 'scoring' is the more precise second step than 'selecting'.
Right, C is the answer.
Why C is right
The kube-scheduler uses a two-step process: filtering removes nodes that don't meet pod requirements (resource requests, node selectors, tolerations, etc.), and scoring ranks the remaining nodes to select the best fit. This ensures pods are placed on suitable nodes efficiently.
Not this one. Try another answer.
Why D is wrong
Scoring and creating reverses the order and incorrectly includes 'creating' which is not part of the scheduling algorithm.
Question 54 Play from 1:22:51
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Rook is a storage operator for Kubernetes that automates the deployment and management of distributed storage systems like Ceph. It enables self-scaling, self-healing, and self-managing capabilities, allowing storage infrastructure to adapt automatically to cluster needs and recover from failures without manual intervention.
Not this one. Try another answer.
Why B is wrong
Kubernetes itself is the container orchestration platform, not a storage operator.
Not this one. Try another answer.
Why C is wrong
Helm is a package manager for Kubernetes applications, not a storage operator.
Not this one. Try another answer.
Why D is wrong
Container Storage Interface (CSI) is a standard interface for storage plugins, not an operator that provides self-scaling and self-healing capabilities.
Question 55 Play from 1:24:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Host Network is not shared by default; pods have their own isolated network namespace unless explicitly configured with `hostNetwork: true`.
Right, B is the answer.
Why B is right
Containers within a Kubernetes Pod share the Network namespace by default, allowing them to communicate over localhost and share network interfaces. This is one of the defining characteristics of a Pod as an atomic unit.
Not this one. Try another answer.
Why C is wrong
Process ID namespace is not shared by default; each container has its own PID namespace unless the pod explicitly enables shared PID with `shareProcessNamespace: true`.
Not this one. Try another answer.
Why D is wrong
Process Name is not a Linux namespace; the correct term is Process ID (PID) namespace, which is not shared by default in pods.
Question 56 Play from 1:25:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Infrastructure and Code is not the correct expansion.
Right, B is the answer.
Why B is right
IaC stands for Infrastructure as Code, a practice in cloud native development where infrastructure configuration is defined and managed through code files rather than manual processes, enabling version control and automation.
Not this one. Try another answer.
Why C is wrong
Infrastructure above Code is not a recognized term.
Not this one. Try another answer.
Why D is wrong
Infrastructure across Code is not the correct expansion.
Question 57 Play from 1:27:14
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The default deployment strategy in Kubernetes is Rolling Update. When a Deployment is updated, Kubernetes gradually replaces old Pods with new ones, ensuring that some Pods are always running and available during the update process. This minimizes downtime and ensures service continuity by default.
Not this one. Try another answer.
Why B is wrong
Blue/Green deployment is not the default strategy; it requires manual configuration and is more complex to implement.
Not this one. Try another answer.
Why C is wrong
Canary deployment is not the default strategy; it requires additional tooling and configuration to gradually roll out changes to a subset of users.
Not this one. Try another answer.
Why D is wrong
Recreate deployment is available but not the default; it terminates all Pods before creating new ones, causing downtime.
Question 58 Play from 1:28:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
etcd is a distributed key-value store for cluster state, not a container runtime.
Right, B is the answer.
Why B is right
CRI-O is a container runtime interface implementation specifically designed to run containers in Kubernetes environments. It directly interfaces with the container runtime to manage container lifecycle, making it the component responsible for actually executing containers.
Not this one. Try another answer.
Why C is wrong
cloud-controller-manager manages cloud provider-specific resources, not containers.
Not this one. Try another answer.
Why D is wrong
kube-controller-manager runs controller processes but does not directly run containers.
Question 59 Play from 1:30:13
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
kubectl explain retrieves detailed documentation and field definitions for Kubernetes resources, allowing users to understand the structure and available fields for any resource type. This is the standard command for inline API reference documentation.
Not this one. Try another answer.
Why B is wrong
kubectl api-resources lists available resource types but does not show field definitions.
Not this one. Try another answer.
Why C is wrong
kubectl get --help shows help for the get command syntax, not resource field documentation.
Not this one. Try another answer.
Why D is wrong
kubectl show is not a standard kubectl command for retrieving resource documentation.
Question 60 Play from 1:31:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
There is no 'admin' service account created by default in namespaces.
Not this one. Try another answer.
Why B is wrong
There is no 'sysadmin' service account created by default in namespaces.
Not this one. Try another answer.
Why C is wrong
There is no 'root' service account in Kubernetes; 'default' is the correct default account.
Right, D is the answer.
Why D is right
When a Pod does not specify a service account, it automatically uses the 'default' service account in that namespace. Every namespace in Kubernetes has a default service account created automatically. This allows Pods to authenticate with the API server without explicitly specifying credentials, though the default account has minimal permissions by default.
Question 61 Play from 1:33:01
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This reverses Restricted and Baseline; the correct order has Baseline before Restricted.
Not this one. Try another answer.
Why B is wrong
This completely reverses the order from most restrictive to most permissive.
Not this one. Try another answer.
Why C is wrong
This incorrectly places Privileged in the middle of the ordering.
Right, D is the answer.
Why D is right
Pod Security Standards are ordered from most permissive to most restrictive as: Privileged, Baseline, Restricted. Privileged allows all features without restrictions, Baseline provides reasonable defaults blocking known privilege escalations, and Restricted enforces security best practices with minimal required permissions. Option A reverses the middle two standards. Option B reverses the order entirely. Option C places Privileged in the middle which is incorrect.
Question 62 Play from 1:34:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
kube-controller-manager runs controller processes but does not expose the primary API interface.
Not this one. Try another answer.
Why B is wrong
kube-proxy manages network routing and does not expose the Kubernetes API.
Right, C is the answer.
Why C is right
kube-apiserver is the central control plane component that exposes the Kubernetes API, which is the programmatic interface used to create, read, update, and delete all Kubernetes objects. All cluster operations and management occur through this API.
Not this one. Try another answer.
Why D is wrong
etcd is a data store that persists cluster state but does not expose the API itself.
Question 63 Play from 1:36:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Kubernetes does not provide or install a portable operating system; it runs on existing operating systems.
Not this one. Try another answer.
Why B is wrong
File system redundancy is not a default Kubernetes feature; it requires external storage solutions.
Not this one. Try another answer.
Why C is wrong
A container image registry is not provided by default; users must set up or integrate external registries like Docker Hub or private registries.
Right, D is the answer.
Why D is right
Kubernetes provides automated rollouts and rollbacks as a default feature of container orchestration. This allows users to update applications with automatic rollback capabilities if issues are detected, managing application versions and deployments seamlessly without requiring external tooling.
Question 64 Play from 1:37:48
When a NetworkPolicy selects a Pod, it becomes isolated.
How are multiple NetworkPolicies applied to the same Pod handled in Kubernetes?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Restricted does not describe how multiple policies are combined.
Right, B is the answer.
Why B is right
When multiple NetworkPolicies select the same Pod, they are combined in an additive manner. All matching policies apply together, and traffic is allowed only if at least one policy permits it. This design allows multiple independent policies to coexist without conflicts, with the union of all permissions taking effect.
Not this one. Try another answer.
Why C is wrong
NetworkPolicies do not conflict; they work together additively.
Not this one. Try another answer.
Why D is wrong
There is no hierarchical ordering of NetworkPolicies; all applicable ones take effect simultaneously.
Question 65 Play from 1:39:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Network layer tracing does not capture application-level request flows and dependencies.
Right, B is the answer.
Why B is right
Distributed tracing is implemented at the application layer because it requires instrumenting application code to track requests as they traverse multiple services. This enables visibility into request flows, latency, and dependencies across distributed systems.
Not this one. Try another answer.
Why C is wrong
Database layer tracing is too low-level for distributed request tracing across services.
Not this one. Try another answer.
Why D is wrong
Infrastructure layer does not provide sufficient visibility into application request flows.
Question 66 Play from 1:40:43
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Horizontal Pod Autoscaler (HPA) automatically adjusts the number of pods based on observed metrics like CPU utilization or memory usage, making it the primary mechanism for automatically adjusting resources for applications. It scales the number of replicas horizontally.
Not this one. Try another answer.
Why B is wrong
KEDA handles event-driven autoscaling, not automatic resource adjustment based on metrics.
Not this one. Try another answer.
Why C is wrong
Cluster Autoscaler scales the cluster nodes themselves, not application resources.
Not this one. Try another answer.
Why D is wrong
Vertical Pod Autoscaler adjusts CPU and memory requests/limits but does not automatically manage overall resource allocation in the typical sense the question asks.
Question 67 Play from 1:42:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
GitLab Environment Toolkit is not related to Flux's construction.
Right, B is the answer.
Why B is right
Flux is constructed with the GitOps Toolkit, which provides the foundational components and controllers needed to implement GitOps patterns in Kubernetes. The GitOps Toolkit enables declarative infrastructure management through Git repositories.
Not this one. Try another answer.
Why C is wrong
Helm Toolkit is separate from Flux; while they can be integrated, Flux is built on GitOps Toolkit.
Not this one. Try another answer.
Why D is wrong
GitHub Actions Toolkit is not the foundation for Flux.
Question 68 Play from 1:43:44
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
SBOM stands for Software Bill of Materials. It is a formal list of components, libraries, and dependencies included in a software product, used for security and compliance purposes to track what is included in an application.
Not this one. Try another answer.
Why B is wrong
Software Bill Operations Management is not the correct expansion of SBOM.
Not this one. Try another answer.
Why C is wrong
System Bill of Materials is incorrect; it is specifically Software, not System.
Not this one. Try another answer.
Why D is wrong
Security Baseline for Open Source Management does not match the SBOM acronym.
Question 69 Play from 1:45:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tracing and log storage are observability tools used with service meshes but not core components of the mesh architecture itself.
Not this one. Try another answer.
Why B is wrong
Circuit breaking is a feature enabled by service meshes, but Pod scheduling is a Kubernetes scheduler function, not a mesh component.
Not this one. Try another answer.
Why C is wrong
Runtime plane is not a standard component of service mesh architecture; the correct terms are data plane and control plane.
Right, D is the answer.
Why D is right
A service mesh comprises two primary components: the data plane (service proxies like Envoy that handle actual traffic) and the control plane (which manages and configures the proxies through APIs and policies). Together these enable traffic management, security, and observability across microservices.
Question 70 Play from 1:46:51
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Ephemeral storage refers to temporary storage space that does not persist across container or pod restarts. It is cleaned up when a pod terminates, making it suitable for caches, temporary files, and data that does not need to survive a restart.
Not this one. Try another answer.
Why B is wrong
Dynamic growth is not the defining characteristic of ephemeral storage.
Not this one. Try another answer.
Why C is wrong
Ephemeral storage can be used by individual pods; sharing across multiple pods is not required.
Not this one. Try another answer.
Why D is wrong
Ephemeral storage may be local or network-based; local provisioning is not mandatory.
Question 71 Play from 1:48:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Replication controllers only manage pod replicas; they do not prevent split-brain scenarios
Not this one. Try another answer.
Why B is wrong
While consensus protocols are the mechanism used, this is not a Kubernetes feature but rather what applications implement using StatefulSet
Not this one. Try another answer.
Why C is wrong
Rolling updates manage deployment strategy; they do not address split-brain prevention
Right, D is the answer.
Why D is right
StatefulSet provides ordered, stable pod identities and persistent storage, which are essential for distributed applications that require consensus mechanisms to prevent split- brain scenarios. StatefulSets ensure deterministic pod naming and ordered startup/shutdown, allowing applications like databases and clustered systems to maintain consistency and coordinate properly. Replication controllers and rolling updates do not address consensus; consensus protocols are the mechanism StatefulSets enable.
Question 72 Play from 1:50:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
NetworkPolicy does not encrypt or obscure traffic; it controls connectivity rules.
Right, B is the answer.
Why B is right
NetworkPolicy in Kubernetes is used to define which Pods can communicate with each other and with other network endpoints. It classifies Pods into isolated and non-isolated categories by allowing administrators to specify ingress and egress rules. This provides network segmentation at the Pod level without encrypting traffic, and it applies to allowed communication paths rather than blocking host traffic or logging events.
Not this one. Try another answer.
Why C is wrong
NetworkPolicy doesn't specifically prevent loopback or incoming host traffic; it manages Pod-to-Pod communication.
Not this one. Try another answer.
Why D is wrong
NetworkPolicy enforces connectivity rules but does not inherently log security events.
Question 73 Play from 1:51:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port is a networking concept, not a Kubernetes resource for exposing applications.
Right, B is the answer.
Why B is right
A Service is the Kubernetes resource used to expose applications. Services provide stable network endpoints for accessing Pods, enabling load balancing, service discovery, and network abstraction regardless of underlying Pod changes.
Not this one. Try another answer.
Why C is wrong
DNS is a mechanism that Services may use for discovery, but it is not the resource itself.
Not this one. Try another answer.
Why D is wrong
Deployment manages Pods but does not directly expose applications; Services are used to expose what Deployments create.
Question 74 Play from 1:53:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
NetworkPolicy is a Kubernetes resource for network access control but does not aggregate telemetry or manage traffic flows at the service mesh level.
Right, B is the answer.
Why B is right
Linkerd is a lightweight service mesh that manages traffic between services, enforces policies, and collects telemetry without requiring application code changes. It operates at the infrastructure layer using sidecar proxies to transparently intercept and manage service-to-service communication.
Not this one. Try another answer.
Why C is wrong
kube-proxy handles basic network routing but lacks the sophisticated traffic management, policy enforcement, and telemetry aggregation of a service mesh.
Not this one. Try another answer.
Why D is wrong
Nginx is a web server and reverse proxy but is not a service mesh designed for managing inter-service communication and telemetry in Kubernetes.
Question 75 Play from 1:54:58
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Flux and ArgoCD are the primary cloud-native tools that keep Kubernetes clusters synchronized with configuration sources like Git repositories and automate updates when new code is deployed. Both are GitOps operators that continuously reconcile cluster state with desired state defined in version-controlled repositories.
Not this one. Try another answer.
Why B is wrong
GitOps Toolkit is a component or framework but not the primary tool name; Flux and ArgoCD are the actual GitOps tools.
Not this one. Try another answer.
Why C is wrong
Linkerd and Istio are service mesh tools for managing inter-service communication, not for Git-based cluster synchronization.
Not this one. Try another answer.
Why D is wrong
Helm and Kustomize are package managers and templating tools for Kubernetes manifests, not GitOps synchronization tools.
Question 76 Play from 1:56:45
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Site Reliability Engineers (SREs) are normally responsible for defining, testing, and running incident management processes. SREs focus on reliability, availability, and operational excellence, which includes designing runbooks, establishing escalation procedures, conducting incident drills, and continuously improving incident response through post-mortems and automation.
Not this one. Try another answer.
Why B is wrong
Project Managers typically focus on scheduling, resource allocation, and project timelines, not incident management processes.
Not this one. Try another answer.
Why C is wrong
Application Developers focus on writing code; while they participate in incidents, they do not typically own the incident management process definition.
Not this one. Try another answer.
Why D is wrong
Quality Engineers focus on testing and quality assurance; incident management process ownership falls outside their typical domain.
Question 77 Play from 1:58:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Node Autoscaler is not the correct Kubernetes terminology.
Right, B is the answer.
Why B is right
Cluster Autoscaler automatically adjusts the number of nodes in a cluster based on demand and resource availability. It adds nodes when pods cannot be scheduled and removes underutilized nodes to optimize resource usage.
Not this one. Try another answer.
Why C is wrong
Horizontal Pod Autoscaler scales the number of pod replicas, not the number of nodes.
Not this one. Try another answer.
Why D is wrong
Vertical Pod Autoscaler adjusts CPU and memory requests for pods, not node count.
Question 78 Play from 1:59:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
coredns is an add-on/DNS service running in the cluster, not a core Control Plane component.
Right, B is the answer.
Why B is right
The cloud-controller-manager is a Control Plane component that runs cloud-provider- specific control loops, managing cloud resources and integrating with cloud provider APIs. It is part of the core control plane.
Not this one. Try another answer.
Why C is wrong
kube-proxy is a node component running on worker nodes, not part of the Control Plane.
Not this one. Try another answer.
Why D is wrong
kubelet is a node agent running on each worker node, not a Control Plane component.
Question 79 Play from 2:01:15
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The kubectl cordon command prevents new Pods from being scheduled on a node while allowing existing Pods to continue running, making it the appropriate choice for temporary node maintenance. This marks the node as unschedulable without removing existing workloads, ensuring a graceful transition during maintenance windows.
Not this one. Try another answer.
Why B is wrong
kubectl annotate adds metadata to resources but does not affect scheduling.
Not this one. Try another answer.
Why C is wrong
kubectl label modifies resource labels but does not prevent Pod scheduling.
Not this one. Try another answer.
Why D is wrong
kubectl taint adds a taint that repels Pods, but cordon is the standard command specifically designed for maintenance-mode scheduling prevention.
Question 80 Play from 2:02:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
kubectl rollout watch is not a valid subcommand; you would use kubectl rollout status or kubectl get with --watch flag instead.
Not this one. Try another answer.
Why B is wrong
kubectl rollout progress does not exist as a valid kubectl subcommand.
Not this one. Try another answer.
Why C is wrong
kubectl rollout state is not a valid kubectl subcommand for checking rollout progress.
Right, D is the answer.
Why D is right
kubectl rollout status is the correct command to monitor the progress of Deployments, DaemonSets, and StatefulSets. It displays the current status of the rollout, including how many replicas are ready and updated. The other options (watch, progress, state) are not valid kubectl rollout subcommands.
Question 81 Play from 2:04:23
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Prometheus and the prometheus-adapter together enable HorizontalPodAutoscalers to use custom, application-generated metrics for triggering scaling events. Prometheus collects the custom metrics from applications, and the prometheus-adapter exposes these metrics in a format that Kubernetes HPA can query and use for scaling decisions.
Not this one. Try another answer.
Why B is wrong
Graylog is a log management tool, not a metrics system, and there is no standard graylog-autoscaler metrics tool for this purpose.
Not this one. Try another answer.
Why C is wrong
Graylog is for log aggregation, not metrics collection, and kubernetes-adapter is not a real component for this use case.
Not this one. Try another answer.
Why D is wrong
While Grafana and Prometheus work together for visualization, Grafana alone does not enable HPA; the prometheus-adapter is the critical component.
Question 82 Play from 2:06:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Pod health monitoring is handled by Liveness and Readiness probes, not Ingress resources.
Right, B is the answer.
Why B is right
An Ingress resource in Kubernetes is designed to expose HTTP/HTTPS services running inside the cluster to external traffic. It acts as an entry point and provides routing, SSL/TLS termination, and load balancing for external clients accessing internal services.
Not this one. Try another answer.
Why C is wrong
Configuration data is stored in ConfigMaps and Secrets, not Ingress resources.
Not this one. Try another answer.
Why D is wrong
Persistent volumes and PersistentVolumeClaims manage storage, not Ingress resources.
Question 83 Play from 2:07:50
What is the 4th metric type?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Sampler is not a Prometheus metric type.
Right, B is the answer.
Why B is right
The four core Prometheus metric types are Counter, Gauge, Histogram, and Summary. Counter is a monotonically increasing value used to track cumulative totals like requests served or errors encountered.
Not this one. Try another answer.
Why C is wrong
Final is not a Prometheus metric type.
Not this one. Try another answer.
Why D is wrong
Total is not a Prometheus metric type; while Counters track totals, 'Total' is not the official name of a metric type.
Question 84 Play from 2:09:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
lxc is a container technology but not the OCI reference implementation.
Not this one. Try another answer.
Why B is wrong
cri-o is a container runtime that uses runc but is not the reference implementation itself.
Right, C is the answer.
Why C is right
runc is the reference implementation of the OCI (Open Container Initiative) runtime specification. It is the standard, minimal implementation that other container runtimes are based on or compatible with.
Not this one. Try another answer.
Why D is wrong
Docker uses containerd and runc internally but is not the OCI reference implementation.
Question 85 Play from 2:10:24
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Kubernetes scheduler considers multiple factors when placing Pods on nodes, including Pod resource requests (like memory), node taints (which can repel Pods), and Pod affinity rules (which can attract Pods to specific nodes). These are the primary scheduling constraints.
Not this one. Try another answer.
Why B is wrong
While labels are used in scheduling, the core scheduling factors are resource requests, taints, and affinity rules rather than just labels.
Not this one. Try another answer.
Why C is wrong
Node level is not a standard scheduling factor; the scheduler uses taints, tolerations, and affinity instead.
Not this one. Try another answer.
Why D is wrong
Container command does not influence Pod scheduling; the scheduler primarily considers resource requests, taints, affinity, and priority.
Question 86 Play from 2:12:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
CHOWN is not allowed in the Restricted policy as it could allow privilege escalation.
Not this one. Try another answer.
Why B is wrong
SYS_CHROOT is not allowed in the Restricted policy as it could enable container escape.
Not this one. Try another answer.
Why C is wrong
SETUID is not allowed in the Restricted policy as it permits changing the effective user ID.
Right, D is the answer.
Why D is right
NET_BIND_SERVICE is a Linux capability that allows binding to ports below 1024 and is allowed under the Restricted pod security policy. The Restricted policy prevents most dangerous capabilities but permits NET_BIND_SERVICE as it's necessary for legitimate workloads.
Question 87 Play from 2:13:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application Users consume the applications built by development teams but do not build delivery tools.
Not this one. Try another answer.
Why B is wrong
Application Developers write application code and may use the tools provided by Platform Engineers, but do not typically build the CI/CD infrastructure itself.
Right, C is the answer.
Why C is right
Platform Engineers are responsible for building, automating, and offering continuous delivery tools and infrastructure that enable developer teams to deploy and manage applications efficiently. They bridge the gap between development and operations by creating self-service platforms and CI/CD pipelines.
Not this one. Try another answer.
Why D is wrong
Cluster Operators manage the operational aspects of clusters but are not primarily focused on building and automating continuous delivery tools for developer teams.
Question 88 Play from 2:15:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Border Gateway Protocol is used for external routing between autonomous systems, not for controlling intra-cluster traffic
Not this one. Try another answer.
Why B is wrong
IP Address Management handles IP allocation to pods but does not control traffic flows
Not this one. Try another answer.
Why C is wrong
Pod Security Policy (now deprecated) controls pod security contexts but does not manage traffic flows between workloads
Right, D is the answer.
Why D is right
CNI (Container Network Interface) plugins must support Network Policies to control and restrict specific traffic flows between pods and services in Kubernetes. Network Policies allow fine-grained ingress and egress rules that determine which workloads can communicate with each other, providing microsegmentation within clusters.
Question 89 Play from 2:16:56
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
kube-proxy manages network rules and packet forwarding to implement Services in Kubernetes. It handles routing traffic to appropriate endpoints and uses operating system packet filtering mechanisms (like iptables or IPVS) to direct traffic both within the cluster and to external services.
Not this one. Try another answer.
Why B is wrong
kubelet manages container lifecycle on nodes but does not handle cluster-wide network communications.
Not this one. Try another answer.
Why C is wrong
etcd stores cluster state and configuration data, not network communications.
Not this one. Try another answer.
Why D is wrong
kube-controller-manager runs controller logic but does not handle network packet filtering.
Question 90 Play from 2:18:30
Which API object should be used to hold non-confidential data?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
CSI (Container Storage Interface) is a specification for storage drivers, not a data storage object.
Not this one. Try another answer.
Why B is wrong
RBAC (Role-Based Access Control) manages permissions and access, not application data storage.
Not this one. Try another answer.
Why C is wrong
CNI (Container Network Interface) is a networking plugin specification, not for data storage.
Right, D is the answer.
Why D is right
ConfigMaps are the appropriate Kubernetes API object designed to store non-confidential configuration data in key-value pairs. Unlike Secrets which are intended for sensitive data, ConfigMaps are optimized for general application configuration that does not require encryption or special handling. CSI is a storage interface specification, RBAC is for access control, and CNI is a networking specification, none store application data.
Question 91 Play from 2:20:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
inbound and outbound are not the official NetworkPolicy PolicyTypes terminology.
Right, B is the answer.
Why B is right
Kubernetes NetworkPolicy uses the PolicyTypes field with two valid options: 'ingress' (controlling inbound traffic) and 'egress' (controlling outbound traffic). These terms align with network traffic direction terminology used in Kubernetes networking specifications.
Not this one. Try another answer.
Why C is wrong
push and pull are not valid NetworkPolicy options.
Not this one. Try another answer.
Why D is wrong
get and put are HTTP/REST methods, not NetworkPolicy types.
Question 92 Play from 2:21:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While kube-proxy enables load balancing through network rules, it is not a traditional load balancer that actively balances requests.
Right, B is the answer.
Why B is right
The kube-proxy is a network proxy that runs on each node and maintains network rules. It implements Kubernetes Services by managing iptables/IPVS rules that enable traffic routing to the correct backend pods. It translates Service abstractions into actual network routing logic.
Not this one. Try another answer.
Why C is wrong
kube-proxy handles internal cluster networking and Service routing, not external internet connectivity.
Not this one. Try another answer.
Why D is wrong
DNS rules are managed by CoreDNS or other DNS components, not by kube-proxy.
Question 93 Play from 2:23:15
What should they create to enforce this limit?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Namespace is a grouping mechanism but does not enforce resource limits by itself.
Not this one. Try another answer.
Why B is wrong
LimitRange sets per-Pod or per-Container limits, not aggregate namespace-level limits.
Not this one. Try another answer.
Why C is wrong
ClusterRole is for RBAC permissions management, not resource consumption limits.
Right, D is the answer.
Why D is right
ResourceQuota is the Kubernetes resource that enforces aggregate resource consumption limits at the namespace level. It allows administrators to specify maximum total resource usage (CPU, memory, storage, etc.) for all Pods in a namespace, which is exactly what is needed to limit total memory usage to 4Gi across a namespace.
Question 94 Play from 2:24:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Fallback is a specific recovery strategy but not the primary characteristic ensured by microservices architecture.
Right, B is the answer.
Why B is right
Resiliency is the key characteristic that cloud native microservices architecture ensures. By breaking applications into independent microservices, the system can isolate failures, recover quickly, and continue operating even when individual components fail, making the overall system more resilient and fault-tolerant.
Not this one. Try another answer.
Why C is wrong
Failover refers to automatic switching to backup systems, which is a component of resiliency but not the overarching system characteristic.
Not this one. Try another answer.
Why D is wrong
High reachability is not a primary architectural benefit of microservices-based cloud native systems; resiliency is the foundational guarantee.
Question 95 Play from 2:26:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Deployments do not have an immutable field; they are mutable resources that can be updated.
Not this one. Try another answer.
Why B is wrong
Pods do not have an immutable field; pod specifications can be modified through updates.
Right, C is the answer.
Why C is right
The immutable field is a boolean property available on ConfigMap and Secret resources that, when set to true, prevents the data from being modified after creation. This ensures configuration data cannot be accidentally or maliciously altered, providing immutability guarantees for sensitive or critical configuration. Deployments, Pods, and ReplicaSets do not have an immutable field.
Not this one. Try another answer.
Why D is wrong
ReplicaSets do not have an immutable field; they are mutable controller resources.
Question 96 Play from 2:27:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
CRI-O is a container runtime but is more specifically designed for Kubernetes integration rather than general-purpose portability emphasis.
Not this one. Try another answer.
Why B is wrong
LXD is a container hypervisor for system containers, not an industry-standard application container runtime.
Right, C is the answer.
Why C is right
Containerd is an industry-standard container runtime explicitly designed with emphasis on simplicity, robustness, and portability. It is a CNCF graduated project that serves as the underlying runtime for Kubernetes and Docker, providing a minimal, focused implementation for container lifecycle management across different platforms.
Not this one. Try another answer.
Why D is wrong
Kata-runtime is a hypervisor-based runtime focused on security through virtualization, not emphasizing simplicity and portability as primary design goals.
Question 97 Play from 2:29:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
kube-proxy manages network rules and service proxying, not node status updates.
Right, B is the answer.
Why B is right
The node controller is the control plane component responsible for monitoring node health and updating the node Ready condition. When a node becomes unreachable, the node controller detects this and updates the node's status accordingly.
Not this one. Try another answer.
Why C is wrong
kubelet runs on nodes and reports status but doesn't update Ready conditions from the control plane.
Not this one. Try another answer.
Why D is wrong
kube-apiserver serves the API but doesn't actively monitor and update node conditions.
Question 98 Play from 2:31:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
kubectl cluster-info displays information about the cluster and its components, not resource consumption metrics.
Not this one. Try another answer.
Why B is wrong
kubectl version shows the version of kubectl and the Kubernetes API server, not resource metrics.
Right, C is the answer.
Why C is right
The kubectl top command is used to retrieve resource consumption metrics (CPU and memory usage) for nodes or Pods. It requires the metrics-server to be installed in the cluster and provides real-time resource utilization data.
Not this one. Try another answer.
Why D is wrong
kubectl api-resources lists available API resources in the cluster, not resource consumption data.
Question 99 Play from 2:32:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
lxd is a container management system, not a runtime security monitoring tool.
Not this one. Try another answer.
Why B is wrong
containerd is a container runtime, not a security monitoring tool.
Right, C is the answer.
Why C is right
Falco is an open source runtime security tool that detects suspicious behavior and policy violations in containers and Kubernetes environments. It uses eBPF to monitor system calls and provides real-time threat detection and alerting capabilities.
Not this one. Try another answer.
Why D is wrong
gVisor is a sandbox technology for container isolation, not a runtime security monitoring or alerting tool like Falco.
Question 100 Play from 2:33:48
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The `kubectl api-resources` command lists all resource types (such as pods, services, deployments, etc.) that are available and supported within a Kubernetes cluster, including both built-in and custom resources.
Not this one. Try another answer.
Why B is wrong
kubectl get namespaces lists the namespaces in a cluster, not the resource types available.
Not this one. Try another answer.
Why C is wrong
kubectl api-versions shows the API versions supported, not the individual resource types themselves.
Not this one. Try another answer.
Why D is wrong
This is not a valid kubectl or curl command syntax and would not function to list resources.
Transcript
Play from 00:00 Question 1. Services and Pods in Kubernetes are ______ objects. Here are the options. Option A. JSON. Option B. YAML. Option C. Java. Option D. REST. Pause the video now if you want time to think about the answer.
The correct answer is D. REST. Services and Pods in Kubernetes are REST objects, meaning they are managed through RESTful API calls to the kube-apiserver. While they are often defined using YAML or JSON manifests for convenience, the underlying representation and interaction model is REST-based. Now, why are the other options incorrect? Option A is incorrect. JSON is a serialization format but not the architectural model for Kubernetes objects. Option B is incorrect. YAML is a serialization format for defining objects, not the object model itself. Option C is incorrect. Java is a programming language unrelated to Kubernetes object architecture. Therefore, D, REST, is the correct answer.
Play from 01:29 Question 2. We can extend the Kubernetes API with Kubernetes API Aggregation Layer and CRDs. What is CRD? Here are the options. Option A. Custom Resource Definition. Option B. Custom Restricted Definition. Option C. Customized RUST Definition. Option D. Custom RUST Definition. Pause the video now if you want time to think about the answer.
The correct answer is A. Custom Resource Definition. CRD stands for Custom Resource Definition, which is the mechanism for extending the Kubernetes API with custom resource types. CRDs allow users to define new Kubernetes objects and manage them like native resources. The other options contain incorrect expansions with irrelevant terms like 'Restricted' or 'RUST' which are not related to Kubernetes API extensions. Now, why are the other options incorrect? Option B is incorrect. CRD does not stand for 'Custom Restricted Definition'. Option C is incorrect. RUST is not part of Kubernetes API extension terminology. Option D is incorrect. RUST is a programming language not related to Custom Resource Definitions. Therefore, A, Custom Resource Definition, is the correct answer.
Play from 03:06 Question 3. In a Kubernetes cluster, which component is responsible for maintaining the desired state of applications by reconciling resources such as Deployments and ReplicaSets? Here are the options. Option A. Controller Manager. Option B. Kubernetes API Server. Option C. kubelet. Option D. etcd. Pause the video now if you want time to think about the answer.
The correct answer is A. Controller Manager. The Controller Manager runs multiple controllers (Deployment controller, ReplicaSet controller, etc.) that continuously monitor the cluster state and reconcile actual state with desired state. When you create a Deployment, the controller manager ensures the correct number of replicas are running and takes corrective actions when discrepancies occur. Now, why are the other options incorrect? Option B is incorrect. The API Server handles requests and stores data but does not actively reconcile resource state; it serves as the communication hub. Option C is incorrect. kubelet runs on worker nodes and manages individual Pod lifecycle but does not reconcile cluster-wide Deployment or ReplicaSet state. Option D is incorrect. etcd is the backing data store for cluster state but does not perform reconciliation logic or maintain desired state. Therefore, A, Controller Manager, is the correct answer.
Show full transcriptShow less
Play from 04:46 Question 4. How do you perform a command in a running container of a Pod? Here are the options. Option A. kubectl exec --. Option B. docker exec. Option C. kubectl run --. Option D. kubectl attach -i. Pause the video now if you want time to think about the answer.
The correct answer is A. kubectl exec --. kubectl exec is the Kubernetes command used to execute commands inside running containers within a Pod. The syntax is kubectl exec <pod-name> -- <command>, where the -- separates kubectl arguments from the command to be executed in the container. Now, why are the other options incorrect? Option B is incorrect. docker exec is for Docker containers on a local host, not for Kubernetes Pods. Option C is incorrect. kubectl run is used to create new workloads, not to execute commands in existing containers. Option D is incorrect. kubectl attach is used to attach to standard input/output of a running container, not to execute arbitrary commands. Therefore, A, kubectl exec --, is the correct answer.
Play from 06:13 Question 5. What is Helm? Here are the options. Option A. An open source dashboard for Kubernetes. Option B. A package manager for Kubernetes applications. Option C. A custom scheduler for Kubernetes. Option D. An end to end testing project for Kubernetes applications. Pause the video now if you want time to think about the answer.
The correct answer is B. A package manager for Kubernetes applications. Helm is a package manager for Kubernetes applications that uses charts to define, install, and manage complex Kubernetes deployments. It provides templating, versioning, and dependency management for Kubernetes resources. Kubernetes dashboards are separate tools like the Kubernetes Dashboard, custom schedulers are scheduler plugins rather than Helm's function, and end-to-end testing frameworks serve different purposes. Now, why are the other options incorrect? Option A is incorrect. Kubernetes Dashboard is the open-source UI for Kubernetes, not Helm. Option C is incorrect. Helm is a package manager, not a custom scheduler. Option D is incorrect. End-to-end testing projects are separate from Helm's package management role. Therefore, B, A package manager for Kubernetes applications, is the correct answer.
Play from 07:49 Question 6. What is the core metric type in Prometheus used to represent a single numerical value that can go up and down? Here are the options. Option A. Summary. Option B. Counter. Option C. Histogram. Option D. Gauge. Pause the video now if you want time to think about the answer.
The correct answer is D. Gauge. A Gauge is the Prometheus metric type that represents a single numerical value which can arbitrarily increase or decrease over time, making it suitable for measurements like temperature, memory usage, or request latency. Now, why are the other options incorrect? Option A is incorrect. Summary is a metric type that tracks observations and provides quantile information, not a simple increasing/decreasing value. Option B is incorrect. Counter is a metric type that only increases monotonically and is used for cumulative measurements like total requests. Option C is incorrect. Histogram is a metric type that tracks the distribution of values across buckets, not a single numerical value. Therefore, D, Gauge, is the correct answer.
Play from 09:14 Question 7. What command would be used to check the revisions of Deployment web-app? Here are the options. Option A. kubectl rollout history deployment/web-app. Option B. kubectl rollout status deployment/web-app. Option C. kubectl get history deployment/web-app. Option D. kubectl describe rollout deployment/web-app. Pause the video now if you want time to think about the answer.
The correct answer is A. kubectl rollout history deployment/web-app. The kubectl rollout history command is the correct way to view the revision history of a Deployment. It displays all previous revisions and their details, allowing you to see what changes were made in each rollout. This is essential for understanding deployment changes and performing rollbacks if needed. Now, why are the other options incorrect? Option B is incorrect. kubectl rollout status shows the current state of a rollout but not the historical revisions. Option C is incorrect. kubectl get history is not a valid Kubernetes command; the correct command uses rollout not get. Option D is incorrect. kubectl describe rollout is not a valid command syntax; describe works on resources but rollout is managed through rollout subcommands. Therefore, A, kubectl rollout history deployment/web-app, is the correct answer.
Play from 10:53 Question 8. What does CNCF stand for? Here are the options. Option A. Cloud Native Community Foundation. Option B. Cloud Native Computing Foundation. Option C. Cloud Neutral Computing Foundation. Option D. Cloud Neutral Community Foundation. Pause the video now if you want time to think about the answer.
The correct answer is B. Cloud Native Computing Foundation. CNCF is the official acronym for the Cloud Native Computing Foundation, an open governance foundation hosted by the Linux Foundation that promotes the adoption of cloud-native technologies and best practices. Now, why are the other options incorrect? Option A is incorrect. While 'Community' could seem plausible, the correct acronym uses 'Computing' not 'Community'. Option C is incorrect. The 'N' stands for 'Native', not 'Neutral', and 'Computing' is correct, not 'Neutral Computing'. Option D is incorrect. This incorrectly uses both 'Neutral' and 'Community', neither of which are correct in the CNCF acronym. Therefore, B, Cloud Native Computing Foundation, is the correct answer.
Play from 12:20 Question 9. There is an application running in a logical chain: Gateway API, Service, EndpointSlice, and Container. What Kubernetes API object is missing from this sequence? Here are the options. Option A. Docker. Option B. Proxy. Option C. Pod. Option D. Firewall. Pause the video now if you want time to think about the answer.
The correct answer is C. Pod. The correct chain is Gateway API → Service → Pod → Container. Pods are the missing link that actually run containers. EndpointSlice tracks Pod IP addresses for service discovery, but the Pod itself is the fundamental compute unit that wraps containers. Docker is a container runtime, not an API object in this chain. Proxy and Firewall are not standard Kubernetes API objects in this flow. Now, why are the other options incorrect? Option A is incorrect. Docker is a container runtime tool, not a Kubernetes API object in the application chain. Option B is incorrect. Proxy is not a standard Kubernetes API object; proxying is handled by kube-proxy. Option D is incorrect. Firewall is not a Kubernetes API object; network policies provide firewall-like functionality. Therefore, C, Pod, is the correct answer.
Play from 14:00 Question 10. What is the default eviction timeout when the Ready condition of a node is Unknown or False? Here are the options. Option A. Thirty seconds. Option B. Thirty minutes. Option C. One minute. Option D. Five minutes. Pause the video now if you want time to think about the answer.
The correct answer is D. Five minutes. When a node's Ready condition becomes Unknown or False, Kubernetes taints it as not- ready or unreachable, and pods tolerate that taint for 300 seconds by default before they are evicted. The default eviction timeout is therefore five minutes. Now, why are the other options incorrect? Option A is incorrect. Thirty seconds is far shorter than the default of five minutes. Option B is incorrect. Thirty minutes is much longer than the default of five minutes. Option C is incorrect. One minute is shorter than the default; pods tolerate the not-ready and unreachable taints for 300 seconds. Therefore, D, Five minutes, is the correct answer.
Play from 15:18 Question 11. Which of the following cloud native proxies is used for ingress/egress in a service mesh and can also serve as an application gateway? Here are the options. Option A. Frontend proxy. Option B. Kube-proxy. Option C. Reverse proxy. Option D. Envoy proxy. Pause the video now if you want time to think about the answer.
The correct answer is D. Envoy proxy. Envoy is the primary cloud-native proxy used in service meshes like Istio for managing ingress and egress traffic between services. It can also function as an application gateway and provides advanced traffic management, security, and observability features. Frontend proxy is a generic term, kube-proxy is a Kubernetes network component for service routing (not a service mesh proxy), and reverse proxy is a general concept rather than a specific cloud-native solution. Now, why are the other options incorrect? Option A is incorrect. Frontend proxy is a generic term and not a specific cloud-native service mesh proxy. Option B is incorrect. Kube-proxy is a Kubernetes component for service load balancing, not a service mesh proxy. Option C is incorrect. Reverse proxy is a general architectural concept, not a specific cloud-native service mesh solution. Therefore, D, Envoy proxy, is the correct answer.
Play from 17:05 Question 12. Which of these is a valid container restart policy? Here are the options. Option A. On login. Option B. On update. Option C. On start. Option D. On failure. Pause the video now if you want time to think about the answer.
The correct answer is D. On failure. Docker and container orchestration platforms support 'on-failure' as a valid restart policy, which automatically restarts a container if it exits with a non-zero exit code. This is a standard restart policy used in production environments. The other options are not recognized restart policy values in Docker or Kubernetes. Now, why are the other options incorrect? Option A is incorrect. On login is not a valid container restart policy in Docker or Kubernetes. Option B is incorrect. On update is not a valid container restart policy. Option C is incorrect. On start is not a valid restart policy; the closest standard policy is 'always' but not 'on start'. Therefore, D, On failure, is the correct answer.
Play from 18:27 Question 13. How do you deploy a workload to Kubernetes without additional tools? Here are the options. Option A. Create a Bash script and run it on a worker node. Option B. Create a Helm Chart and install it with helm. Option C. Create a manifest and apply it with kubectl. Option D. Create a Python script and run it with kubectl. Pause the video now if you want time to think about the answer.
The correct answer is C. Create a manifest and apply it with kubectl. The native way to deploy workloads to Kubernetes without additional tools is to create a manifest file (YAML) and apply it using kubectl apply or kubectl create commands. This is the standard, built-in method that requires only kubectl and does not depend on external tools like Helm, scripting languages, or direct node access. Now, why are the other options incorrect? Option A is incorrect. Bash scripts run on worker nodes are not the Kubernetes-native deployment method. Option B is incorrect. Helm is an additional tool beyond the base Kubernetes installation. Option D is incorrect. Python scripts are not executed with kubectl; they would need to be containerized and deployed as workloads. Therefore, C, Create a manifest and apply it with kubectl, is the correct answer.
Play from 20:12 Question 14. What is the telemetry component that represents a series of related distributed events that encode the end-to-end request flow through a distributed system? Here are the options. Option A. Metrics. Option B. Logs. Option C. Spans. Option D. Traces. Pause the video now if you want time to think about the answer.
The correct answer is D. Traces. Traces represent the complete end-to-end request flow through a distributed system, composed of related spans that show how a request travels across multiple services. Traces provide visibility into the entire journey of a request from entry to exit across a distributed architecture. Now, why are the other options incorrect? Option A is incorrect. Metrics are quantitative measurements (counters, gauges, histograms) rather than sequences of events. Option B is incorrect. Logs are individual text records of events, not structured series showing request flow relationships. Option C is incorrect. Spans are individual units within traces, not the complete series that encodes end-to-end flow. Therefore, D, Traces, is the correct answer.
Play from 21:44 Question 15. Gateway API is a successor to what Kubernetes API? Here are the options. Option A. NetworkPolicy. Option B. Service. Option C. NodePort. Option D. Ingress. Pause the video now if you want time to think about the answer.
The correct answer is D. Ingress. Gateway API is the successor to the Ingress API. While Ingress provides basic HTTP(S) routing, Gateway API offers more powerful, flexible, and expressive routing capabilities with better separation of concerns, support for multiple protocols, and more granular traffic management suited to modern cloud native applications. Now, why are the other options incorrect? Option A is incorrect. NetworkPolicy manages network access controls and security; it is not related to HTTP routing that Gateway API addresses. Option B is incorrect. Service is a core Kubernetes networking primitive for internal service discovery; Gateway API is an evolution of Ingress, not Service. Option C is incorrect. NodePort is a basic service type for exposing services; Gateway API is the successor to Ingress for external HTTP(S) routing, not NodePort. Therefore, D, Ingress, is the correct answer.
Play from 23:21 Question 16. Which of the following options include only mandatory fields to create a Kubernetes object using a YAML file? Here are the options. Option A. apiVersion, template, kind, status. Option B. apiVersion, metadata, status, spec. Option C. apiVersion, template, kind, spec. Option D. apiVersion, metadata, kind, spec. Pause the video now if you want time to think about the answer.
The correct answer is D. apiVersion, metadata, kind, spec. The mandatory fields for creating any Kubernetes object via YAML are apiVersion (API version), metadata (object identity information), kind (object type), and spec (desired state). These four fields are required in every Kubernetes manifest. Now, why are the other options incorrect? Option A is incorrect. template is not mandatory and status is not a creation field; it's automatically generated. Option B is incorrect. status is not a creation field; it's generated by the cluster, not specified by users. Option C is incorrect. template is not a top-level mandatory field; it appears within specs of certain resources. Therefore, D, apiVersion, metadata, kind, spec, is the correct answer.
Play from 25:03 Question 17. If a Pod was waiting for container images to download on the scheduled node, what state would it be in? Here are the options. Option A. Failed. Option B. Succeeded. Option C. Unknown. Option D. Pending. Pause the video now if you want time to think about the answer.
The correct answer is D. Pending. When a Pod is waiting for container images to download on the scheduled node, it is in the Pending state. The Pending state indicates that the Pod has been accepted by the cluster but one or more of its containers have not yet been created, typically due to image pulls, resource constraints, or scheduler delays. Now, why are the other options incorrect? Option A is incorrect. Failed indicates the Pod's containers have exited with non-zero status codes. Option B is incorrect. Succeeded indicates all containers in the Pod have terminated successfully. Option C is incorrect. Unknown indicates the state of the Pod could not be determined, typically due to communication issues with the node. Therefore, D, Pending, is the correct answer.
Play from 26:22 Question 18. Which of the following common practices will be an antipattern when the GitOps workflow goes live? Here are the options. Option A. Deploying Kubernetes objects via imperative commands. Option B. Leaving manual comments in the PR comments forum. Option C. Deploying Kubernetes objects via declarative manifests. Option D. Pushing builds with the deploy label. Pause the video now if you want time to think about the answer.
The correct answer is A. Deploying Kubernetes objects via imperative commands. Deploying Kubernetes objects via imperative commands (kubectl apply, kubectl create, etc.) is the primary antipattern in GitOps workflows. GitOps requires that all infrastructure state be declared in a Git repository as the single source of truth, with changes deployed through pull requests and automated synchronization, not manual imperative commands. Now, why are the other options incorrect? Option B is incorrect. Leaving comments in PR discussions is consistent with GitOps collaborative practices. Option C is incorrect. Declarative manifests in Git are the foundation of GitOps, not an antipattern. Option D is incorrect. Pushing builds with deploy labels is a valid deployment strategy that aligns with GitOps principles. Therefore, A, Deploying Kubernetes objects via imperative commands, is the correct answer.
Play from 28:08 Question 19. What are the two essential operations that the kube-scheduler normally performs? Here are the options. Option A. Pod eviction or starting. Option B. Filtering and Scoring nodes. Option C. Resources monitoring and reporting. Option D. Starting and terminating containers. Pause the video now if you want time to think about the answer.
The correct answer is B. Filtering and Scoring nodes. The kube-scheduler performs two essential operations: filtering nodes to find candidates that meet Pod requirements, then scoring those candidates to select the best node. This two-phase scheduling process (predicate/filter and priority/score) is fundamental to how the scheduler works. Pod eviction is handled by kubelet or eviction manager, not the scheduler. Resource monitoring is handled by metrics-server. Container management is handled by kubelet. Now, why are the other options incorrect? Option A is incorrect. Pod eviction and starting are handled by kubelet and the control plane, not by kube-scheduler. Option C is incorrect. Resource monitoring and reporting are performed by metrics-server, not kube-scheduler. Option D is incorrect. Starting and terminating containers are kubelet responsibilities, not kube-scheduler. Therefore, B, Filtering and Scoring nodes, is the correct answer.
Play from 29:50 Question 20. Which of the following would fall under the responsibilities of an SRE? Here are the options. Option A. Developing a new application feature. Option B. Creating a monitoring baseline for an application. Option C. Submitting a budget for running an application in a cloud. Option D. Writing policy on how to submit a code change. Pause the video now if you want time to think about the answer.
The correct answer is B. Creating a monitoring baseline for an application. Site Reliability Engineers focus on operational aspects of systems including monitoring, observability, and reliability metrics. Creating a monitoring baseline for an application directly falls within SRE responsibilities as it establishes the foundation for measuring system health and performance. Options A, C, and D are development, finance, and policy responsibilities respectively, not core SRE functions. Now, why are the other options incorrect? Option A is incorrect. Developing new features is a software development responsibility, not SRE Option C is incorrect. Budgeting decisions are typically finance or management responsibilities, not SRE technical work Option D is incorrect. Code submission policies are usually set by engineering management or development leads, not SRE Therefore, B, Creating a monitoring baseline for an application, is the correct answer.
Play from 31:39 Question 21. What are the most important resources to guarantee the performance of an etcd cluster? Here are the options. Option A. CPU and disk capacity. Option B. Network throughput and disk I/O. Option C. CPU and RAM memory. Option D. Network throughput and CPU. Pause the video now if you want time to think about the answer.
The correct answer is B. Network throughput and disk I/O. The etcd cluster's performance is critically dependent on network throughput and disk I/O because etcd is a distributed key-value store that performs frequent writes and reads with consensus requirements across members. Network throughput ensures fast replication between cluster members, while disk I/O determines how quickly data can be persisted. While CPU matters, these two resources are the primary bottlenecks for etcd performance. Now, why are the other options incorrect? Option A is incorrect. CPU is less critical than network and disk I/O for etcd performance. Option C is incorrect. RAM memory and CPU are not the most important factors; network and disk I/O take precedence. Option D is incorrect. Network throughput is important, but CPU is secondary to disk I/O for etcd clusters. Therefore, B, Network throughput and disk I/O, is the correct answer.
Play from 33:19 Question 22. Which are the two primary modes for Service discovery within a Kubernetes cluster? Here are the options. Option A. Environment variables and DNS. Option B. API Calls and LDAP. Option C. Labels and Radius. Option D. Selectors and DHCP. Pause the video now if you want time to think about the answer.
The correct answer is A. Environment variables and DNS. The two primary modes for Service discovery in Kubernetes are environment variables and DNS. Environment variables are automatically injected into Pods to reference Services, while DNS allows Pods to discover Services using DNS names in the form of service-name.namespace.svc.cluster.local. Now, why are the other options incorrect? Option B is incorrect. API Calls and LDAP are not the primary service discovery mechanisms in Kubernetes; they are not standard Kubernetes discovery methods. Option C is incorrect. Labels and Radius: while labels are used internally, Radius is an external authentication protocol not related to Kubernetes service discovery. Option D is incorrect. Selectors and DHCP: Selectors are used to identify Pods, not for service discovery; DHCP is not a Kubernetes service discovery mechanism. Therefore, A, Environment variables and DNS, is the correct answer.
Play from 35:09 Question 23. Kubernetes___ protect you against voluntary interruptions (such as deleting Pods, draining nodes) to run applications in a highly available manner. Here are the options. Option A. Pod Topology Spread Constraints. Option B. Pod Disruption Budgets. Option C. Taints and Tolerances. Option D. Resource Limits and Requests. Pause the video now if you want time to think about the answer.
The correct answer is B. Pod Disruption Budgets. Pod Disruption Budgets (PDBs) protect applications during voluntary disruptions like pod deletions and node drains by specifying the minimum number of pods that must remain available. This ensures high availability is maintained even when administrative actions are performed on the cluster. Now, why are the other options incorrect? Option A is incorrect. Pod Topology Spread Constraints control pod distribution across topology domains for availability, but don't specifically protect against voluntary disruptions. Option C is incorrect. Taints and Tolerances control pod scheduling and node restrictions, not protection from voluntary disruptions. Option D is incorrect. Resource Limits and Requests manage resource allocation and scheduling, not protection from voluntary disruptions. Therefore, B, Pod Disruption Budgets, is the correct answer.
Play from 36:52 Question 24. What are the 3 pillars of Observability? Here are the options. Option A. Metrics, Logs, and Traces. Option B. Metrics, Logs, and Spans. Option C. Metrics, Data, and Traces. Option D. Resources, Logs, and Tracing. Pause the video now if you want time to think about the answer.
The correct answer is A. Metrics, Logs, and Traces. The three pillars of observability are Metrics, Logs, and Traces. Metrics provide quantitative measurements, logs offer detailed event records, and traces track requests across distributed systems. This is the industry-standard framework for achieving observability. Now, why are the other options incorrect? Option B is incorrect. Spans are components of traces, not a separate pillar of observability. Option C is incorrect. Data is too vague and not part of the formal three-pillar framework. Option D is incorrect. Resources and Tracing are not the correct terminology for the three pillars. Therefore, A, Metrics, Logs, and Traces, is the correct answer.
Play from 38:13 Question 25. Which component of the Kubernetes architecture is responsible for integration with the CRI container runtime? Here are the options. Option A. kubeadm. Option B. kubelet. Option C. kube-aplserver. Option D. kubectl. Pause the video now if you want time to think about the answer.
The correct answer is B. kubelet. The kubelet is the node agent responsible for managing pods and interfacing with the Container Runtime Interface (CRI). It communicates with the container runtime to pull images, create containers, and manage pod lifecycle. The kubelet acts as the bridge between Kubernetes and the container runtime. Now, why are the other options incorrect? Option A is incorrect. kubeadm is a cluster initialization tool, not responsible for CRI integration. Option C is incorrect. kube-apiserver is the API endpoint for the control plane, not responsible for container runtime integration. Option D is incorrect. kubectl is a command-line client for interacting with the cluster, not a component that integrates with CRI. Therefore, B, kubelet, is the correct answer.
Play from 39:38 Question 26. Which of the following options includes valid API versions? Here are the options. Option A. alpha1v1, beta3v3, v2. Option B. alpha1, beta3, v2. Option C. v1alpha1, v2beta3, v2. Option D. v1alpha1, v2beta3, 2.0. Pause the video now if you want time to think about the answer.
The correct answer is C. v1alpha1, v2beta3, v2. Valid Kubernetes API versions follow the pattern of a version number optionally followed by a stability level suffix. The format is 'v[number][stage][stage-number]' such as v1alpha1, v2beta3, or v2. Option C correctly shows three valid examples: v1alpha1 (version 1, alpha stage 1), v2beta3 (version 2, beta stage 3), and v2 (stable version 2). Now, why are the other options incorrect? Option A is incorrect. alpha1v1 and beta3v3 have the version and stage in the wrong order; Kubernetes uses stage before the stage number. Option B is incorrect. alpha1, beta3, and v2 are invalid because they lack the leading version number that must precede the stage designation. Option D is incorrect. 2.0 uses dot notation and lacks a leading 'v', violating Kubernetes API version naming conventions which require 'v' prefix and no dots. Therefore, C, v1alpha1, v2beta3, v2, is the correct answer.
Play from 41:34 Question 27. What does the livenessProbe in Kubernetes help detect? Here are the options. Option A. When a container has started successfully. Option B. When a container is unresponsive. Option C. When a container is ready to serve traffic. Option D. When a container exceeds resource limits. Pause the video now if you want time to think about the answer.
The correct answer is B. When a container is unresponsive. The livenessProbe detects when a container has become unresponsive or deadlocked and is no longer functioning correctly. If the liveness probe fails, Kubernetes restarts the container to recover from the unresponsive state. Now, why are the other options incorrect? Option A is incorrect. startupProbe detects when a container has started successfully, not livenessProbe. Option C is incorrect. readinessProbe determines when a container is ready to serve traffic, not livenessProbe. Option D is incorrect. Resource limits are enforced separately; livenessProbe does not detect resource limit violations. Therefore, B, When a container is unresponsive, is the correct answer.
Play from 43:01 Question 28. How to load and generate data required before the Pod startup? Here are the options. Option A. Use an init container with shared file storage. Option B. Use a PVC volume. Option C. Use a sidecar container with shared volume. Option D. Use another pod with a PVC. Pause the video now if you want time to think about the answer.
The correct answer is A. Use an init container with shared file storage. Init containers are the correct pattern for loading and generating required data before the main pod starts. Init containers run to completion before application containers start, and they can share storage volumes with the main pod. They are specifically designed for setup tasks like data preparation, configuration retrieval, and dependency initialization. Using sidecar containers, separate pods, or just PVC volumes alone doesn't provide the sequential startup guarantee that init containers offer. Now, why are the other options incorrect? Option B is incorrect. A PVC volume alone doesn't execute initialization logic or prepare data. Option C is incorrect. Sidecar containers run alongside the main container, not before it starts. Option D is incorrect. Running another pod doesn't guarantee proper initialization sequencing within the same pod. Therefore, A, Use an init container with shared file storage, is the correct answer.
Play from 44:42 Question 29. What's the most adopted way of conflict resolution and decision-making for the open- source projects under the CNCF umbrella? Here are the options. Option A. Financial Analysis. Option B. Discussion and Voting. Option C. Flipism Technique. Option D. Project Founder Say. Pause the video now if you want time to think about the answer.
The correct answer is B. Discussion and Voting. CNCF projects follow a community-driven approach where conflicts are resolved and decisions are made through discussion among contributors followed by voting mechanisms. This democratic process ensures inclusive decision-making and community consensus rather than relying on financial metrics, random chance, or sole founder authority. Now, why are the other options incorrect? Option A is incorrect. Financial analysis is not relevant to open-source project governance decisions. Option C is incorrect. Flipism (coin flipping) would be inappropriate and unprofessional for serious project decisions. Option D is incorrect. CNCF projects emphasize community governance, not decisions made unilaterally by founders. Therefore, B, Discussion and Voting, is the correct answer.
Play from 46:14 Question 30. Which of the following systems is NOT compatible with the CRI runtime interface standard? Here are the options. Option A. CRI-0. Option B. dockershim. Option C. systemd. Option D. containerd. Pause the video now if you want time to think about the answer.
The correct answer is C. systemd. systemd is an init system and service manager for Linux, not a container runtime implementing the Container Runtime Interface (CRI). CRI-O, containerd, and other CRI- compatible runtimes implement the standard interface for Kubernetes, but systemd does not. Now, why are the other options incorrect? Option A is incorrect. CRI-O is a fully CRI-compliant container runtime specifically designed for Kubernetes. Option B is incorrect. dockershim was a CRI implementation that allowed Docker to work with Kubernetes (though deprecated in newer versions). Option D is incorrect. containerd is a widely-used, CRI-compliant container runtime supported by Kubernetes. Therefore, C, systemd, is the correct answer.
Play from 47:40 Question 31. Which component in Kubernetes is responsible to watch newly created Pods with no assigned node, and selects a node for them to run on? Here are the options. Option A. etcd. Option B. kube controller-manager. Option C. kube proxy. Option D. kube scheduler. Pause the video now if you want time to think about the answer.
The correct answer is D. kube scheduler. The kube-scheduler is the Kubernetes control plane component specifically responsible for watching newly created Pods that have no assigned node and selecting an appropriate node for them to run on based on resource requirements and scheduling policies. Now, why are the other options incorrect? Option A is incorrect. etcd is the key-value store for cluster data, not responsible for pod scheduling. Option B is incorrect. kube-controller-manager runs various controllers but scheduling is delegated to kube-scheduler. Option C is incorrect. kube-proxy handles network routing and service proxying, not pod scheduling. Therefore, D, kube scheduler, is the correct answer.
Play from 49:05 Question 32. Which CNCF project is primarily used as a high-performance proxy for microservices, handling service-to-service communication, load balancing, and observability in service meshes? Here are the options. Option A. Helm. Option B. Fluentd. Option C. Envoy. Option D. Prometheus. Pause the video now if you want time to think about the answer.
The correct answer is C. Envoy. Envoy is the CNCF proxy project specifically designed for service-to-service communication, load balancing, and observability in service meshes. It is widely used as the data plane in Istio and other service mesh implementations, providing advanced traffic management and observability features. Now, why are the other options incorrect? Option A is incorrect. Helm is a package manager for Kubernetes, not a proxy for microservices communication. Option B is incorrect. Fluentd is a log aggregation and forwarding tool, not a service proxy. Option D is incorrect. Prometheus is a monitoring and metrics collection system, not a proxy for inter-service communication. Therefore, C, Envoy, is the correct answer.
Play from 50:34 Question 33. Which command lists the running containers in the current Kubernetes namespace? Here are the options. Option A. kubectl get pods. Option B. kubectl ls. Option C. kubectl ps. Option D. kubectl show pods. Pause the video now if you want time to think about the answer.
The correct answer is A. kubectl get pods. The command `kubectl get pods` lists all running pods in the current namespace. This is the standard Kubernetes command for viewing pod status and information. The get subcommand with pods resource type is the correct syntax. Now, why are the other options incorrect? Option B is incorrect. kubectl ls is not a valid kubectl command. Option C is incorrect. kubectl ps is not a valid kubectl command (ps is a Linux command, not a kubectl subcommand). Option D is incorrect. kubectl show pods is not a valid kubectl command; the correct command is kubectl get pods. Therefore, A, kubectl get pods, is the correct answer.
Play from 51:59 Question 34. What is the Kubernetes object used for running a recurring workload? Here are the options. Option A. Job. Option B. Batch. Option C. DaemonSet. Option D. CronJob. Pause the video now if you want time to think about the answer.
The correct answer is D. CronJob. CronJob is the Kubernetes object specifically designed for running recurring workloads on a scheduled basis. It follows the cron syntax to define when jobs should be executed repeatedly, similar to cron jobs in Unix/Linux systems. Now, why are the other options incorrect? Option A is incorrect. Job is used for running one-time or batch workloads that complete once, not recurring workloads. Option B is incorrect. Batch is not a Kubernetes workload object; batch jobs are managed through the Job object. Option C is incorrect. DaemonSet ensures a pod runs on every node, but it is not used for scheduling recurring workloads at specific times. Therefore, D, CronJob, is the correct answer.
Play from 53:22 Question 35. Which of the following Pod Security Standards enforces the most restrictive settings, designed for security-critical workloads? Here are the options. Option A. Unrestricted. Option B. Restricted. Option C. Privileged. Option D. Baseline. Pause the video now if you want time to think about the answer.
The correct answer is B. Restricted. Kubernetes Pod Security Standards defines three levels: Privileged (least restrictive), Baseline (moderate restrictions), and Restricted (most restrictive). The Restricted standard enforces the most stringent security controls, including disallowing privilege escalation, requiring non-root users, restricting capabilities, and enforcing read-only filesystems - making it suitable for security-critical workloads. Now, why are the other options incorrect? Option A is incorrect. Unrestricted is not an official Pod Security Standard level. Option C is incorrect. Privileged is the least restrictive standard, allowing nearly all security-sensitive settings. Option D is incorrect. Baseline is moderately restrictive but less strict than Restricted. Therefore, B, Restricted, is the correct answer.
Play from 54:52 Question 36. What fields must exist in any Kubernetes object (e.g. YAML) file? Here are the options. Option A. apiVersion, kind, metadata. Option B. kind, namespace, data. Option C. apiVersion, metadata, namespace. Option D. kind, metadata, data. Pause the video now if you want time to think about the answer.
The correct answer is A. apiVersion, kind, metadata. Every Kubernetes object manifest requires three essential top-level fields: apiVersion (specifies the API version), kind (specifies the object type), and metadata (contains object identification information like name and namespace). These three fields are mandatory and form the foundation of any valid Kubernetes YAML configuration. Now, why are the other options incorrect? Option B is incorrect. namespace is not a top-level required field; it belongs inside metadata Option C is incorrect. namespace is not a top-level required field; it is optional and contained within metadata Option D is incorrect. data is not a top-level required field and only appears in specific object types like ConfigMaps and Secrets Therefore, A, apiVersion, kind, metadata, is the correct answer.
Play from 56:31 Question 37. A Kubernetes _____ is an abstraction that defines a logical set of Pods and a policy by which to access them. Here are the options. Option A. Selector. Option B. Controller. Option C. Service. Option D. Job. Pause the video now if you want time to think about the answer.
The correct answer is C. Service. A Kubernetes Service is the abstraction that defines a logical set of Pods and a policy by which to access them. Services provide stable endpoints and load balancing for accessing groups of pods, enabling network communication and service discovery. Now, why are the other options incorrect? Option A is incorrect. A Selector is a mechanism used within Services to identify which pods to target, but it is not itself the abstraction that defines access policy. Option B is incorrect. A Controller manages pod replicas and reconciliation but does not define network access policies or serve as an endpoint for accessing pods. Option D is incorrect. A Job is a workload object for running pods to completion, not an abstraction for defining logical pod sets and access policies. Therefore, C, Service, is the correct answer.
Play from 58:03 Question 38. What is the order of 4C’s in Cloud Native Security, starting with the layer that a user has the most control over? Here are the options. Option A. Cloud -> Container -> Cluster -> Code. Option B. Container -> Cluster -> Code -> Cloud. Option C. Cluster -> Container -> Code -> Cloud. Option D. Code -> Container -> Cluster -> Cloud. Pause the video now if you want time to think about the answer.
The correct answer is D. Code -> Container -> Cluster -> Cloud. The 4Cs of Cloud Native Security are ordered from most to least user control: Code (application code), Container (container images and runtime), Cluster (Kubernetes infrastructure), and Cloud (cloud provider infrastructure). Users have the most direct control over their own code and progressively less control moving outward to infrastructure layers managed by cloud providers. Now, why are the other options incorrect? Option A is incorrect. This reverses the order, placing Cloud first when it should be last as the layer with least user control. Option B is incorrect. This ordering does not follow the principle of user control, starting with containers rather than code. Option C is incorrect. This ordering incorrectly places Cluster first, when Code is the innermost layer users control directly. Therefore, D, Code -> Container -> Cluster -> Cloud, is the correct answer.
Play from 59:53 Question 39. Which of the following resources helps in managing a stateless application workload on a Kubernetes cluster? Here are the options. Option A. DaemonSet. Option B. StatefulSet. Option C. kubectl. Option D. Deployment. Pause the video now if you want time to think about the answer.
The correct answer is D. Deployment. Deployment is the standard Kubernetes resource for managing stateless application workloads. It provides declarative updates, scaling, and rolling deployments for pods that do not require persistent state or stable identity. Deployments are the most common choice for stateless applications. Now, why are the other options incorrect? Option A is incorrect. DaemonSet ensures one pod runs on every node, not for managing general stateless workloads. Option B is incorrect. StatefulSet is designed for stateful applications requiring stable pod identities and persistent storage. Option C is incorrect. kubectl is a command-line tool for interacting with Kubernetes, not a resource for managing workloads. Therefore, D, Deployment, is the correct answer.
Play from 1:01:18 Question 40. What is a best practice to minimize the container image size? Here are the options. Option A. Use a DockerFile. Option B. Use multistage builds. Option C. Build images with different tags. Option D. Add a build.sh script. Pause the video now if you want time to think about the answer.
The correct answer is B. Use multistage builds. Multistage builds are a best practice for minimizing container image size. They allow you to use multiple FROM statements in a single Dockerfile, enabling you to build in one stage and copy only the necessary artifacts to the final stage, leaving behind build tools and dependencies that are no longer needed in the runtime image. Now, why are the other options incorrect? Option A is incorrect. Using a Dockerfile is necessary for building images but does not inherently minimize size. Option C is incorrect. Different image tags do not reduce the image size; they are just different references to images. Option D is incorrect. A build.sh script is an optional build automation tool but is not a best practice for minimizing image size. Therefore, B, Use multistage builds, is the correct answer.
Play from 1:02:47 Question 41. Which of the following workload require a headless service while deploying into the namespace? Here are the options. Option A. StatefulSet. Option B. CronJob. Option C. Deployment. Option D. DaemonSet. Pause the video now if you want time to think about the answer.
The correct answer is A. StatefulSet. StatefulSets require a headless service to maintain stable network identities for their pods, enabling pod-to-pod communication and persistent ordering. StatefulSets are designed for applications that need stable hostnames and ordinal indices. Deployments and DaemonSets manage pods without requiring headless services, and CronJobs are one-off batch workloads that don't need stable pod identity. Now, why are the other options incorrect? Option B is incorrect. CronJobs run periodic batch jobs and don't require headless services. Option C is incorrect. Deployments manage stateless replicas and use standard services for load balancing. Option D is incorrect. DaemonSets run one pod per node but don't require headless services for functionality. Therefore, A, StatefulSet, is the correct answer.
Play from 1:04:15 Question 42. What is the name of the lightweight Kubernetes distribution built for IoT and edge computing? Here are the options. Option A. OpenShift. Option B. k3s. Option C. RKE. Option D. k1s. Pause the video now if you want time to think about the answer.
The correct answer is B. k3s. k3s is a lightweight, certified Kubernetes distribution specifically designed for IoT and edge computing environments. It reduces memory and CPU requirements while maintaining full Kubernetes compatibility. Now, why are the other options incorrect? Option A is incorrect. OpenShift is an enterprise Kubernetes platform, not a lightweight distribution. Option C is incorrect. RKE (Rancher Kubernetes Engine) is a full Kubernetes installer, not a lightweight edge distribution. Option D is incorrect. k1s is not a recognized Kubernetes distribution. Therefore, B, k3s, is the correct answer.
Play from 1:05:30 Question 43. What methods can you use to scale a deployment? Here are the options. Option A. With kubectl edit deployment exclusively. Option B. With kubectl scale-up deployment exclusively. Option C. With kubectl scale deployment and kubectl edit deployment. Option D. With kubectl scale deployment exclusively. Pause the video now if you want time to think about the answer.
The correct answer is C. With kubectl scale deployment and kubectl edit deployment. There are two primary methods to scale a Deployment: kubectl scale can directly set the replica count, and kubectl edit allows modification of the deployment specification including the replicas field. Both methods are valid and commonly used. Now, why are the other options incorrect? Option A is incorrect. kubectl edit is one method but not the only method; kubectl scale provides a more direct approach. Option B is incorrect. kubectl scale-up does not exist as a command; the correct command is kubectl scale with the --replicas flag. Option D is incorrect. kubectl scale is one valid method, but kubectl edit is also a valid alternative approach. Therefore, C, With kubectl scale deployment and kubectl edit deployment, is the correct answer.
Play from 1:07:10 Question 44. If kubectl is failing to retrieve information from the cluster, where can you find pod logs to troubleshoot? Here are the options. Option A. /var/log/pods/. Option B. ~/.kube/config. Option C. /var/log/k8s/. Option D. /etc/kubernetes/. Pause the video now if you want time to think about the answer.
The correct answer is A. /var/log/pods/. Pod logs in Kubernetes are stored in the `/var/log/pods/` directory on the node where the pod is running. This directory contains the container logs for all pods, organized by namespace and pod name. This is the standard location for troubleshooting pod issues when kubectl log retrieval fails. The other paths contain kubeconfig, Kubernetes configuration, or don't exist as standard log locations. Now, why are the other options incorrect? Option B is incorrect. ~/.kube/config is the kubeconfig file for kubectl configuration, not pod logs. Option C is incorrect. /var/log/k8s/ is not a standard Kubernetes pod log directory. Option D is incorrect. /etc/kubernetes/ contains Kubernetes component configuration files, not pod logs. Therefore, A, /var/log/pods/, is the correct answer.
Play from 1:08:59 Question 45. What happens if a container runtime is missing on Kubernetes worker nodes? Here are the options. Option A. kubelet can not communicate with kube-api-server. Option B. Nodes can not communicate with each other. Option C. kubelet can not launch Pods. Option D. Pods can not communicate with each other. Pause the video now if you want time to think about the answer.
The correct answer is C. kubelet can not launch Pods. The kubelet is the primary node agent that communicates with the container runtime to launch and manage Pods. Without a container runtime (like Docker, containerd, or CRI-O), the kubelet cannot create or run containers, even if it successfully communicates with the API server. The node becomes unable to schedule and execute workloads. Now, why are the other options incorrect? Option A is incorrect. Kubelet can still communicate with kube-api-server even without a container runtime; the problem is at the execution layer. Option B is incorrect. Node-to-node communication occurs at the network level and is independent of the container runtime. Option D is incorrect. Pod-to-Pod networking is handled by the cluster networking layer, not the container runtime directly. Therefore, C, kubelet can not launch Pods, is the correct answer.
Play from 1:10:39 Question 46. Which key-value store is used to persist Kubernetes cluster data? Here are the options. Option A. etcd. Option B. ZooKeeper. Option C. ControlPlaneStore. Option D. Redis. Pause the video now if you want time to think about the answer.
The correct answer is A. etcd. etcd is the key-value store used by Kubernetes to persist all cluster data, including configuration, state, and metadata. It serves as the single source of truth for the cluster and is critical to Kubernetes' operation. Now, why are the other options incorrect? Option B is incorrect. ZooKeeper is a coordination service used by other systems but is not the store used by Kubernetes for cluster data persistence. Option C is incorrect. ControlPlaneStore is not a real Kubernetes component; etcd is the actual key-value store used by the control plane. Option D is incorrect. Redis is an in-memory data store sometimes used for caching but is not Kubernetes' primary persistent cluster data store. Therefore, A, etcd, is the correct answer.
Play from 1:12:06 Question 47. Which item is a Kubernetes node component? Here are the options. Option A. kube-scheduler. Option B. kubectl. Option C. kube-proxy. Option D. etcd. Pause the video now if you want time to think about the answer.
The correct answer is C. kube-proxy. kube-proxy is a node component that runs on every node and manages network connectivity for Kubernetes services. It handles service networking, load balancing, and IP table management at the node level to enable service-to-pod communication. Now, why are the other options incorrect? Option A is incorrect. kube-scheduler is a control plane component, not a node component. Option B is incorrect. kubectl is a command-line client tool for interacting with Kubernetes, not a node component. Option D is incorrect. etcd is a control plane component that stores cluster data, not a node component. Therefore, C, kube-proxy, is the correct answer.
Play from 1:13:28 Question 48. What helps an organization to deliver software more securely at a higher velocity? Here are the options. Option A. Kubernetes. Option B. apt-get. Option C. Docker Images. Option D. CI/CD Pipeline. Pause the video now if you want time to think about the answer.
The correct answer is D. CI/CD Pipeline. A CI/CD Pipeline (Continuous Integration/Continuous Deployment) is the foundational practice that enables organizations to deliver software more securely and at higher velocity. It automates testing, security scanning, and deployment processes, reducing manual errors and enabling rapid, safe releases. Now, why are the other options incorrect? Option A is incorrect. Kubernetes is a container orchestration platform that helps manage deployment and scaling but does not inherently establish secure, faster delivery practices. Option B is incorrect. apt-get is a package manager for Linux systems and has no direct relationship to secure or accelerated software delivery methodology. Option C is incorrect. Docker Images are containers for packaging applications but are a tool within the pipeline, not the methodology that drives secure velocity. Therefore, D, CI/CD Pipeline, is the correct answer.
Play from 1:15:12 Question 49. Which Kubernetes-native deployment strategy supports zero-downtime updates of a workload? Here are the options. Option A. Canary. Option B. Recreate. Option C. BlueGreen. Option D. RollingUpdate. Pause the video now if you want time to think about the answer.
The correct answer is D. RollingUpdate. RollingUpdate is the default Kubernetes-native deployment strategy that supports zero- downtime updates. It gradually replaces old Pods with new ones, ensuring that some Pods are always running and available to serve traffic. This gradual transition maintains service availability throughout the update process. Canary and BlueGreen are patterns that can be implemented but are not built-in Kubernetes strategies, and Recreate causes downtime. Now, why are the other options incorrect? Option A is incorrect. Canary is a deployment pattern, not a native Kubernetes strategy, and typically requires manual setup. Option B is incorrect. Recreate terminates all Pods before creating new ones, causing downtime. Option C is incorrect. BlueGreen is a deployment pattern, not a built-in Kubernetes strategy, and requires manual implementation. Therefore, D, RollingUpdate, is the correct answer.
Play from 1:16:51 Question 50. How to create a headless service? Here are the options. Option A. By specifying .spec.ClusterIP: headless. Option B. By specifying .spec.clusterIP: None. Option C. By specifying .spec.ClusterIP: 0.0.0.0. Option D. By specifying .spec.ClusterIP: localhost. Pause the video now if you want time to think about the answer.
The correct answer is B. By specifying .spec.clusterIP: None. A headless service in Kubernetes is created by setting .spec.clusterIP: None in the Service manifest. This prevents Kubernetes from assigning a cluster IP and instead returns the Pod IPs directly through DNS, enabling direct Pod-to-Pod communication for stateful applications and service discovery patterns. Now, why are the other options incorrect? Option A is incorrect. The correct field is lowercase 'clusterIP', not 'ClusterIP', and the value should be 'None', not 'headless'. Option C is incorrect. Setting clusterIP to 0.0.0.0 does not create a headless service; None is the correct value. Option D is incorrect. Setting clusterIP to localhost does not create a headless service; the correct value is None. Therefore, B, By specifying .spec.clusterIP: None, is the correct answer.
Play from 1:18:36 Question 51. Which GitOps engine can be used to orchestrate parallel jobs on Kubernetes? Here are the options. Option A. Jenkins X. Option B. Flagger. Option C. Flux. Option D. Argo Workflows. Pause the video now if you want time to think about the answer.
The correct answer is D. Argo Workflows. Argo Workflows is the GitOps engine specifically designed to orchestrate parallel jobs and complex workflows on Kubernetes. It provides a declarative way to define and execute multi-step workflows with parallel execution capabilities. Now, why are the other options incorrect? Option A is incorrect. Jenkins X is a CI/CD platform but not primarily a GitOps engine for parallel job orchestration. Option B is incorrect. Flagger is a progressive delivery tool focused on canary deployments, not job orchestration. Option C is incorrect. Flux is a GitOps tool for continuous deployment but is not specialized for orchestrating parallel jobs. Therefore, D, Argo Workflows, is the correct answer.
Play from 1:20:02 Question 52. What is the Kubernetes abstraction that allows groups of Pods to be exposed inside a Kubernetes cluster? Here are the options. Option A. Service. Option B. Deployment. Option C. Unit. Option D. Daemon. Pause the video now if you want time to think about the answer.
The correct answer is A. Service. A Service is the Kubernetes abstraction that provides a stable network endpoint to expose a group of Pods. Services enable discovery and load balancing of Pods within the cluster, allowing other Pods to communicate with them using a consistent DNS name and IP address regardless of Pod changes. Now, why are the other options incorrect? Option B is incorrect. Deployment manages Pod replicas and updates but does not directly expose them for network communication. Option C is incorrect. Unit is not a standard Kubernetes resource abstraction. Option D is incorrect. DaemonSet ensures Pods run on nodes but is not the abstraction for exposing Pod groups to the cluster. Therefore, A, Service, is the correct answer.
Play from 1:21:26 Question 53. What are the two steps performed by the kube-scheduler to select a node to schedule a pod? Here are the options. Option A. Grouping and placing. Option B. Filtering and selecting. Option C. Filtering and scoring. Option D. Scoring and creating. Pause the video now if you want time to think about the answer.
The correct answer is C. Filtering and scoring. The kube-scheduler uses a two-step process: filtering removes nodes that don't meet pod requirements (resource requests, node selectors, tolerations, etc.), and scoring ranks the remaining nodes to select the best fit. This ensures pods are placed on suitable nodes efficiently. Now, why are the other options incorrect? Option A is incorrect. Grouping and placing is not the correct terminology for the scheduler's workflow. Option B is incorrect. Filtering and selecting is close but 'scoring' is the more precise second step than 'selecting'. Option D is incorrect. Scoring and creating reverses the order and incorrectly includes 'creating' which is not part of the scheduling algorithm. Therefore, C, Filtering and scoring, is the correct answer.
Play from 1:22:51 Question 54. Which storage operator in Kubernetes can help the system to self-scale, self-heal, etc? Here are the options. Option A. Rook. Option B. Kubernetes. Option C. Helm. Option D. Container Storage Interface (CSI). Pause the video now if you want time to think about the answer.
The correct answer is A. Rook. Rook is a storage operator for Kubernetes that automates the deployment and management of distributed storage systems like Ceph. It enables self-scaling, self-healing, and self-managing capabilities, allowing storage infrastructure to adapt automatically to cluster needs and recover from failures without manual intervention. Now, why are the other options incorrect? Option B is incorrect. Kubernetes itself is the container orchestration platform, not a storage operator. Option C is incorrect. Helm is a package manager for Kubernetes applications, not a storage operator. Option D is incorrect. Container Storage Interface (CSI) is a standard interface for storage plugins, not an operator that provides self-scaling and self-healing capabilities. Therefore, A, Rook, is the correct answer.
Play from 1:24:24 Question 55. What Linux namespace is shared by default by containers running within a Kubernetes Pod? Here are the options. Option A. Host Network. Option B. Network. Option C. Process ID. Option D. Process Name. Pause the video now if you want time to think about the answer.
The correct answer is B. Network. Containers within a Kubernetes Pod share the Network namespace by default, allowing them to communicate over localhost and share network interfaces. This is one of the defining characteristics of a Pod as an atomic unit. Now, why are the other options incorrect? Option A is incorrect. Host Network is not shared by default; pods have their own isolated network namespace unless explicitly configured with `hostNetwork: true`. Option C is incorrect. Process ID namespace is not shared by default; each container has its own PID namespace unless the pod explicitly enables shared PID with `shareProcessNamespace: true`. Option D is incorrect. Process Name is not a Linux namespace; the correct term is Process ID (PID) namespace, which is not shared by default in pods. Therefore, B, Network, is the correct answer.
Play from 1:25:57 Question 56. In a cloud native world, what does the IaC abbreviation stands for? Here are the options. Option A. Infrastructure and Code. Option B. Infrastructure as Code. Option C. Infrastructure above Code. Option D. Infrastructure across Code. Pause the video now if you want time to think about the answer.
The correct answer is B. Infrastructure as Code. IaC stands for Infrastructure as Code, a practice in cloud native development where infrastructure configuration is defined and managed through code files rather than manual processes, enabling version control and automation. Now, why are the other options incorrect? Option A is incorrect. Infrastructure and Code is not the correct expansion. Option C is incorrect. Infrastructure above Code is not a recognized term. Option D is incorrect. Infrastructure across Code is not the correct expansion. Therefore, B, Infrastructure as Code, is the correct answer.
Play from 1:27:14 Question 57. What is the default deployment strategy in Kubernetes? Here are the options. Option A. Rolling update. Option B. Blue/Green deployment. Option C. Canary deployment. Option D. Recreate deployment. Pause the video now if you want time to think about the answer.
The correct answer is A. Rolling update. The default deployment strategy in Kubernetes is Rolling Update. When a Deployment is updated, Kubernetes gradually replaces old Pods with new ones, ensuring that some Pods are always running and available during the update process. This minimizes downtime and ensures service continuity by default. Now, why are the other options incorrect? Option B is incorrect. Blue/Green deployment is not the default strategy; it requires manual configuration and is more complex to implement. Option C is incorrect. Canary deployment is not the default strategy; it requires additional tooling and configuration to gradually roll out changes to a subset of users. Option D is incorrect. Recreate deployment is available but not the default; it terminates all Pods before creating new ones, causing downtime. Therefore, A, Rolling update, is the correct answer.
Play from 1:28:47 Question 58. In the Kubernetes platform, which component is responsible for running containers? Here are the options. Option A. etcd. Option B. CRI-O. Option C. cloud-controller-manager. Option D. kube-controller-manager. Pause the video now if you want time to think about the answer.
The correct answer is B. CRI-O. CRI-O is a container runtime interface implementation specifically designed to run containers in Kubernetes environments. It directly interfaces with the container runtime to manage container lifecycle, making it the component responsible for actually executing containers. Now, why are the other options incorrect? Option A is incorrect. etcd is a distributed key-value store for cluster state, not a container runtime. Option C is incorrect. cloud-controller-manager manages cloud provider-specific resources, not containers. Option D is incorrect. kube-controller-manager runs controller processes but does not directly run containers. Therefore, B, CRI-O, is the correct answer.
Play from 1:30:13 Question 59. Which of these commands is used to retrieve the documentation and field definitions for a Kubernetes resource? Here are the options. Option A. kubectl explain. Option B. kubectl api-resources. Option C. kubectl get --help. Option D. kubectl show. Pause the video now if you want time to think about the answer.
The correct answer is A. kubectl explain. kubectl explain retrieves detailed documentation and field definitions for Kubernetes resources, allowing users to understand the structure and available fields for any resource type. This is the standard command for inline API reference documentation. Now, why are the other options incorrect? Option B is incorrect. kubectl api-resources lists available resource types but does not show field definitions. Option C is incorrect. kubectl get --help shows help for the get command syntax, not resource field documentation. Option D is incorrect. kubectl show is not a standard kubectl command for retrieving resource documentation. Therefore, A, kubectl explain, is the correct answer.
Play from 1:31:43 Question 60. What service account does a Pod use in a given namespace when the service account is not specified? Here are the options. Option A. admin. Option B. sysadmin. Option C. root. Option D. default. Pause the video now if you want time to think about the answer.
The correct answer is D. default. When a Pod does not specify a service account, it automatically uses the 'default' service account in that namespace. Every namespace in Kubernetes has a default service account created automatically. This allows Pods to authenticate with the API server without explicitly specifying credentials, though the default account has minimal permissions by default. Now, why are the other options incorrect? Option A is incorrect. There is no 'admin' service account created by default in namespaces. Option B is incorrect. There is no 'sysadmin' service account created by default in namespaces. Option C is incorrect. There is no 'root' service account in Kubernetes; 'default' is the correct default account. Therefore, D, default, is the correct answer.
Play from 1:33:01 Question 61. Which option best represents the Pod Security Standards ordered from most permissive to most restrictive? Here are the options. Option A. Privileged, Restricted, Baseline. Option B. Baseline, Restricted, Privileged. Option C. Baseline, Privileged, Restricted. Option D. Privileged, Baseline, Restricted. Pause the video now if you want time to think about the answer.
The correct answer is D. Privileged, Baseline, Restricted. Pod Security Standards are ordered from most permissive to most restrictive as: Privileged, Baseline, Restricted. Privileged allows all features without restrictions, Baseline provides reasonable defaults blocking known privilege escalations, and Restricted enforces security best practices with minimal required permissions. Option A reverses the middle two standards. Option B reverses the order entirely. Option C places Privileged in the middle which is incorrect. Now, why are the other options incorrect? Option A is incorrect. This reverses Restricted and Baseline; the correct order has Baseline before Restricted. Option B is incorrect. This completely reverses the order from most restrictive to most permissive. Option C is incorrect. This incorrectly places Privileged in the middle of the ordering. Therefore, D, Privileged, Baseline, Restricted, is the correct answer.
Play from 1:34:45 Question 62. What Kubernetes control plane component exposes the programmatic interface used to create, manage and interact with the Kubernetes objects? Here are the options. Option A. kube-controller-manager. Option B. kube-proxy. Option C. kube-apiserver. Option D. etcd. Pause the video now if you want time to think about the answer.
The correct answer is C. kube-apiserver. kube-apiserver is the central control plane component that exposes the Kubernetes API, which is the programmatic interface used to create, read, update, and delete all Kubernetes objects. All cluster operations and management occur through this API. Now, why are the other options incorrect? Option A is incorrect. kube-controller-manager runs controller processes but does not expose the primary API interface. Option B is incorrect. kube-proxy manages network routing and does not expose the Kubernetes API. Option D is incorrect. etcd is a data store that persists cluster state but does not expose the API itself. Therefore, C, kube-apiserver, is the correct answer.
Play from 1:36:13 Question 63. Which of the following is a feature Kubernetes provides by default as a container orchestration tool? Here are the options. Option A. A portable operating system. Option B. File system redundancy. Option C. A container image registry. Option D. Automated rollouts and rollbacks. Pause the video now if you want time to think about the answer.
The correct answer is D. Automated rollouts and rollbacks. Kubernetes provides automated rollouts and rollbacks as a default feature of container orchestration. This allows users to update applications with automatic rollback capabilities if issues are detected, managing application versions and deployments seamlessly without requiring external tooling. Now, why are the other options incorrect? Option A is incorrect. Kubernetes does not provide or install a portable operating system; it runs on existing operating systems. Option B is incorrect. File system redundancy is not a default Kubernetes feature; it requires external storage solutions. Option C is incorrect. A container image registry is not provided by default; users must set up or integrate external registries like Docker Hub or private registries. Therefore, D, Automated rollouts and rollbacks, is the correct answer.
Play from 1:37:48 Question 64. By default, Pods are non-isolated and accept traffic from any source. When a NetworkPolicy selects a Pod, it becomes isolated. How are multiple NetworkPolicies applied to the same Pod handled in Kubernetes? Here are the options. Option A. restricted. Option B. additive. Option C. conflicting. Option D. hierarchical. Pause the video now if you want time to think about the answer.
The correct answer is B. additive. When multiple NetworkPolicies select the same Pod, they are combined in an additive manner. All matching policies apply together, and traffic is allowed only if at least one policy permits it. This design allows multiple independent policies to coexist without conflicts, with the union of all permissions taking effect. Now, why are the other options incorrect? Option A is incorrect. Restricted does not describe how multiple policies are combined. Option C is incorrect. NetworkPolicies do not conflict; they work together additively. Option D is incorrect. There is no hierarchical ordering of NetworkPolicies; all applicable ones take effect simultaneously. Therefore, B, additive, is the correct answer.
Play from 1:39:20 Question 65. At which layer would distributed tracing be implemented in a cloud native deployment? Here are the options. Option A. Network. Option B. Application. Option C. Database. Option D. Infrastructure. Pause the video now if you want time to think about the answer.
The correct answer is B. Application. Distributed tracing is implemented at the application layer because it requires instrumenting application code to track requests as they traverse multiple services. This enables visibility into request flows, latency, and dependencies across distributed systems. Now, why are the other options incorrect? Option A is incorrect. Network layer tracing does not capture application-level request flows and dependencies. Option C is incorrect. Database layer tracing is too low-level for distributed request tracing across services. Option D is incorrect. Infrastructure layer does not provide sufficient visibility into application request flows. Therefore, B, Application, is the correct answer.
Play from 1:40:43 Question 66. Which mechanism can be used to automatically adjust the amount of resources for an application? Here are the options. Option A. Horizontal Pod Autoscaler (HPA). Option B. Kubernetes Event-driven Autoscaling (KEDA). Option C. Cluster Autoscaler. Option D. Vertical Pod Autoscaler (VPA). Pause the video now if you want time to think about the answer.
The correct answer is A. Horizontal Pod Autoscaler (HPA). The Horizontal Pod Autoscaler (HPA) automatically adjusts the number of pods based on observed metrics like CPU utilization or memory usage, making it the primary mechanism for automatically adjusting resources for applications. It scales the number of replicas horizontally. Now, why are the other options incorrect? Option B is incorrect. KEDA handles event-driven autoscaling, not automatic resource adjustment based on metrics. Option C is incorrect. Cluster Autoscaler scales the cluster nodes themselves, not application resources. Option D is incorrect. Vertical Pod Autoscaler adjusts CPU and memory requests/limits but does not automatically manage overall resource allocation in the typical sense the question asks. Therefore, A, Horizontal Pod Autoscaler (HPA), is the correct answer.
Play from 1:42:25 Question 67. What is Flux constructed with? Here are the options. Option A. GitLab Environment Toolkit. Option B. GitOps Toolkit. Option C. Helm Toolkit. Option D. GitHub Actions Toolkit. Pause the video now if you want time to think about the answer.
The correct answer is B. GitOps Toolkit. Flux is constructed with the GitOps Toolkit, which provides the foundational components and controllers needed to implement GitOps patterns in Kubernetes. The GitOps Toolkit enables declarative infrastructure management through Git repositories. Now, why are the other options incorrect? Option A is incorrect. GitLab Environment Toolkit is not related to Flux's construction. Option C is incorrect. Helm Toolkit is separate from Flux; while they can be integrated, Flux is built on GitOps Toolkit. Option D is incorrect. GitHub Actions Toolkit is not the foundation for Flux. Therefore, B, GitOps Toolkit, is the correct answer.
Play from 1:43:44 Question 68. What does SBOM stand for? Here are the options. Option A. Software Bill of Materials. Option B. Software Bill Operations Management. Option C. System Bill of Materials. Option D. Security Baseline for Open Source Management. Pause the video now if you want time to think about the answer.
The correct answer is A. Software Bill of Materials. SBOM stands for Software Bill of Materials. It is a formal list of components, libraries, and dependencies included in a software product, used for security and compliance purposes to track what is included in an application. Now, why are the other options incorrect? Option B is incorrect. Software Bill Operations Management is not the correct expansion of SBOM. Option C is incorrect. System Bill of Materials is incorrect; it is specifically Software, not System. Option D is incorrect. Security Baseline for Open Source Management does not match the SBOM acronym. Therefore, A, Software Bill of Materials, is the correct answer.
Play from 1:45:11 Question 69. What components are common in a service mesh? Here are the options. Option A. tracing and log storage. Option B. circuit breaking and Pod scheduling. Option C. data plane and runtime plane. Option D. service proxy and control plane. Pause the video now if you want time to think about the answer.
The correct answer is D. service proxy and control plane. A service mesh comprises two primary components: the data plane (service proxies like Envoy that handle actual traffic) and the control plane (which manages and configures the proxies through APIs and policies). Together these enable traffic management, security, and observability across microservices. Now, why are the other options incorrect? Option A is incorrect. Tracing and log storage are observability tools used with service meshes but not core components of the mesh architecture itself. Option B is incorrect. Circuit breaking is a feature enabled by service meshes, but Pod scheduling is a Kubernetes scheduler function, not a mesh component. Option C is incorrect. Runtime plane is not a standard component of service mesh architecture; the correct terms are data plane and control plane. Therefore, D, service proxy and control plane, is the correct answer.
Play from 1:46:51 Question 70. What is ephemeral storage? Here are the options. Option A. Storage space that need not persist across restarts. Option B. Storage that may grow dynamically. Option C. Storage used by multiple consumers (e.g. multiple Pods). Option D. Storage that is always provisioned locally. Pause the video now if you want time to think about the answer.
The correct answer is A. Storage space that need not persist across restarts. Ephemeral storage refers to temporary storage space that does not persist across container or pod restarts. It is cleaned up when a pod terminates, making it suitable for caches, temporary files, and data that does not need to survive a restart. Now, why are the other options incorrect? Option B is incorrect. Dynamic growth is not the defining characteristic of ephemeral storage. Option C is incorrect. Ephemeral storage can be used by individual pods; sharing across multiple pods is not required. Option D is incorrect. Ephemeral storage may be local or network-based; local provisioning is not mandatory. Therefore, A, Storage space that need not persist across restarts, is the correct answer.
Play from 1:48:20 Question 71. Which Kubernetes feature would you use to guard against split brain scenarios with your distributed application? Here are the options. Option A. Replication controllers. Option B. Consensus protocols. Option C. Rolling updates. Option D. StatefulSet. Pause the video now if you want time to think about the answer.
The correct answer is D. StatefulSet. StatefulSet provides ordered, stable pod identities and persistent storage, which are essential for distributed applications that require consensus mechanisms to prevent split- brain scenarios. StatefulSets ensure deterministic pod naming and ordered startup/shutdown, allowing applications like databases and clustered systems to maintain consistency and coordinate properly. Replication controllers and rolling updates do not address consensus; consensus protocols are the mechanism StatefulSets enable. Now, why are the other options incorrect? Option A is incorrect. Replication controllers only manage pod replicas; they do not prevent split-brain scenarios Option B is incorrect. While consensus protocols are the mechanism used, this is not a Kubernetes feature but rather what applications implement using StatefulSet Option C is incorrect. Rolling updates manage deployment strategy; they do not address split-brain prevention Therefore, D, StatefulSet, is the correct answer.
Play from 1:50:05 Question 72. What is the role of a NetworkPolicy in Kubernetes? Here are the options. Option A. The ability to cryptic and obscure all traffic. Option B. The ability to classify the Pods as isolated and non isolated. Option C. The ability to prevent loopback or incoming host traffic. Option D. The ability to log network security events. Pause the video now if you want time to think about the answer.
The correct answer is B. The ability to classify the Pods as isolated and non isolated. NetworkPolicy in Kubernetes is used to define which Pods can communicate with each other and with other network endpoints. It classifies Pods into isolated and non-isolated categories by allowing administrators to specify ingress and egress rules. This provides network segmentation at the Pod level without encrypting traffic, and it applies to allowed communication paths rather than blocking host traffic or logging events. Now, why are the other options incorrect? Option A is incorrect. NetworkPolicy does not encrypt or obscure traffic; it controls connectivity rules. Option C is incorrect. NetworkPolicy doesn't specifically prevent loopback or incoming host traffic; it manages Pod-to-Pod communication. Option D is incorrect. NetworkPolicy enforces connectivity rules but does not inherently log security events. Therefore, B, The ability to classify the Pods as isolated and non isolated, is the correct answer.
Play from 1:51:54 Question 73. What is the name of the Kubernetes resource used to expose an application? Here are the options. Option A. Port. Option B. Service. Option C. DNS. Option D. Deployment. Pause the video now if you want time to think about the answer.
The correct answer is B. Service. A Service is the Kubernetes resource used to expose applications. Services provide stable network endpoints for accessing Pods, enabling load balancing, service discovery, and network abstraction regardless of underlying Pod changes. Now, why are the other options incorrect? Option A is incorrect. Port is a networking concept, not a Kubernetes resource for exposing applications. Option C is incorrect. DNS is a mechanism that Services may use for discovery, but it is not the resource itself. Option D is incorrect. Deployment manages Pods but does not directly expose applications; Services are used to expose what Deployments create. Therefore, B, Service, is the correct answer.
Play from 1:53:17 Question 74. Which of the following is a lightweight tool that manages traffic flows between services, enforces access policies, and aggregates telemetry data, all without requiring changes to application code? Here are the options. Option A. NetworkPolicy. Option B. Linkerd. Option C. kube-proxy. Option D. Nginx. Pause the video now if you want time to think about the answer.
The correct answer is B. Linkerd. Linkerd is a lightweight service mesh that manages traffic between services, enforces policies, and collects telemetry without requiring application code changes. It operates at the infrastructure layer using sidecar proxies to transparently intercept and manage service-to-service communication. Now, why are the other options incorrect? Option A is incorrect. NetworkPolicy is a Kubernetes resource for network access control but does not aggregate telemetry or manage traffic flows at the service mesh level. Option C is incorrect. kube-proxy handles basic network routing but lacks the sophisticated traffic management, policy enforcement, and telemetry aggregation of a service mesh. Option D is incorrect. Nginx is a web server and reverse proxy but is not a service mesh designed for managing inter-service communication and telemetry in Kubernetes. Therefore, B, Linkerd, is the correct answer.
Play from 1:54:58 Question 75. Which cloud native tool keeps Kubernetes clusters in sync with sources of configuration (like Git repositories), and automates updates to configuration when there is new code to deploy? Here are the options. Option A. Flux and ArgoCD. Option B. GitOps Toolkit. Option C. Linkerd and Istio. Option D. Helm and Kustomize. Pause the video now if you want time to think about the answer.
The correct answer is A. Flux and ArgoCD. Flux and ArgoCD are the primary cloud-native tools that keep Kubernetes clusters synchronized with configuration sources like Git repositories and automate updates when new code is deployed. Both are GitOps operators that continuously reconcile cluster state with desired state defined in version-controlled repositories. Now, why are the other options incorrect? Option B is incorrect. GitOps Toolkit is a component or framework but not the primary tool name; Flux and ArgoCD are the actual GitOps tools. Option C is incorrect. Linkerd and Istio are service mesh tools for managing inter-service communication, not for Git-based cluster synchronization. Option D is incorrect. Helm and Kustomize are package managers and templating tools for Kubernetes manifests, not GitOps synchronization tools. Therefore, A, Flux and ArgoCD, is the correct answer.
Play from 1:56:45 Question 76. Which persona is normally responsible for defining, testing, and running an incident management process? Here are the options. Option A. Site Reliability Engineers. Option B. Project Managers. Option C. Application Developers. Option D. Quality Engineers. Pause the video now if you want time to think about the answer.
The correct answer is A. Site Reliability Engineers. Site Reliability Engineers (SREs) are normally responsible for defining, testing, and running incident management processes. SREs focus on reliability, availability, and operational excellence, which includes designing runbooks, establishing escalation procedures, conducting incident drills, and continuously improving incident response through post-mortems and automation. Now, why are the other options incorrect? Option B is incorrect. Project Managers typically focus on scheduling, resource allocation, and project timelines, not incident management processes. Option C is incorrect. Application Developers focus on writing code; while they participate in incidents, they do not typically own the incident management process definition. Option D is incorrect. Quality Engineers focus on testing and quality assurance; incident management process ownership falls outside their typical domain. Therefore, A, Site Reliability Engineers, is the correct answer.
Play from 1:58:33 Question 77. Kubernetes ___ allows you to automatically manage the number of nodes in your cluster to meet demand. Here are the options. Option A. Node Autoscaler. Option B. Cluster Autoscaler. Option C. Horizontal Pod Autoscaler. Option D. Vertical Pod Autoscaler. Pause the video now if you want time to think about the answer.
The correct answer is B. Cluster Autoscaler. Cluster Autoscaler automatically adjusts the number of nodes in a cluster based on demand and resource availability. It adds nodes when pods cannot be scheduled and removes underutilized nodes to optimize resource usage. Now, why are the other options incorrect? Option A is incorrect. Node Autoscaler is not the correct Kubernetes terminology. Option C is incorrect. Horizontal Pod Autoscaler scales the number of pod replicas, not the number of nodes. Option D is incorrect. Vertical Pod Autoscaler adjusts CPU and memory requests for pods, not node count. Therefore, B, Cluster Autoscaler, is the correct answer.
Play from 1:59:56 Question 78. Which of these components is part of the Kubernetes Control Plane? Here are the options. Option A. coredns. Option B. cloud-controller-manager. Option C. kube-proxy. Option D. kubelet. Pause the video now if you want time to think about the answer.
The correct answer is B. cloud-controller-manager. The cloud-controller-manager is a Control Plane component that runs cloud-provider- specific control loops, managing cloud resources and integrating with cloud provider APIs. It is part of the core control plane. Now, why are the other options incorrect? Option A is incorrect. coredns is an add-on/DNS service running in the cluster, not a core Control Plane component. Option C is incorrect. kube-proxy is a node component running on worker nodes, not part of the Control Plane. Option D is incorrect. kubelet is a node agent running on each worker node, not a Control Plane component. Therefore, B, cloud-controller-manager, is the correct answer.
Play from 2:01:15 Question 79. Which of the following commands could a cluster administrator use to prevent Pod scheduling in a node temporarily, for maintenance purposes? Here are the options. Option A. kubectl cordon. Option B. kubectl annotate. Option C. kubectl label. Option D. kubectl taint. Pause the video now if you want time to think about the answer.
The correct answer is A. kubectl cordon. The kubectl cordon command prevents new Pods from being scheduled on a node while allowing existing Pods to continue running, making it the appropriate choice for temporary node maintenance. This marks the node as unschedulable without removing existing workloads, ensuring a graceful transition during maintenance windows. Now, why are the other options incorrect? Option B is incorrect. kubectl annotate adds metadata to resources but does not affect scheduling. Option C is incorrect. kubectl label modifies resource labels but does not prevent Pod scheduling. Option D is incorrect. kubectl taint adds a taint that repels Pods, but cordon is the standard command specifically designed for maintenance-mode scheduling prevention. Therefore, A, kubectl cordon, is the correct answer.
Play from 2:02:51 Question 80. How can you monitor the progress for an updated Deployment/DaemonSets/StatefulSets? Here are the options. Option A. kubectl rollout watch. Option B. kubectl rollout progress. Option C. kubectl rollout state. Option D. kubectl rollout status. Pause the video now if you want time to think about the answer.
The correct answer is D. kubectl rollout status. kubectl rollout status is the correct command to monitor the progress of Deployments, DaemonSets, and StatefulSets. It displays the current status of the rollout, including how many replicas are ready and updated. The other options (watch, progress, state) are not valid kubectl rollout subcommands. Now, why are the other options incorrect? Option A is incorrect. kubectl rollout watch is not a valid subcommand; you would use kubectl rollout status or kubectl get with --watch flag instead. Option B is incorrect. kubectl rollout progress does not exist as a valid kubectl subcommand. Option C is incorrect. kubectl rollout state is not a valid kubectl subcommand for checking rollout progress. Therefore, D, kubectl rollout status, is the correct answer.
Play from 2:04:23 Question 81. Which tools enable Kubernetes HorizontalPodAutoscalers to use custom, application- generated metrics to trigger scaling events? Here are the options. Option A. Prometheus and the prometheus-adapter. Option B. Graylog and graylog-autoscaler metrics. Option C. Graylog and the kubernetes-adapter. Option D. Grafana and Prometheus. Pause the video now if you want time to think about the answer.
The correct answer is A. Prometheus and the prometheus-adapter. Prometheus and the prometheus-adapter together enable HorizontalPodAutoscalers to use custom, application-generated metrics for triggering scaling events. Prometheus collects the custom metrics from applications, and the prometheus-adapter exposes these metrics in a format that Kubernetes HPA can query and use for scaling decisions. Now, why are the other options incorrect? Option B is incorrect. Graylog is a log management tool, not a metrics system, and there is no standard graylog-autoscaler metrics tool for this purpose. Option C is incorrect. Graylog is for log aggregation, not metrics collection, and kubernetes-adapter is not a real component for this use case. Option D is incorrect. While Grafana and Prometheus work together for visualization, Grafana alone does not enable HPA; the prometheus-adapter is the critical component. Therefore, A, Prometheus and the prometheus-adapter, is the correct answer.
Play from 2:06:10 Question 82. What is the primary purpose of an Ingress resource in Kubernetes? Here are the options. Option A. To monitor the health status of application Pods. Option B. To expose internal services to external web traffic. Option C. To store configuration data used by applications. Option D. To manage persistent volumes for application data. Pause the video now if you want time to think about the answer.
The correct answer is B. To expose internal services to external web traffic. An Ingress resource in Kubernetes is designed to expose HTTP/HTTPS services running inside the cluster to external traffic. It acts as an entry point and provides routing, SSL/TLS termination, and load balancing for external clients accessing internal services. Now, why are the other options incorrect? Option A is incorrect. Pod health monitoring is handled by Liveness and Readiness probes, not Ingress resources. Option C is incorrect. Configuration data is stored in ConfigMaps and Secrets, not Ingress resources. Option D is incorrect. Persistent volumes and PersistentVolumeClaims manage storage, not Ingress resources. Therefore, B, To expose internal services to external web traffic, is the correct answer.
Play from 2:07:50 Question 83. Prometheus has 4 core metric types: Summary, Histogram, Gauge. What is the 4th metric type? Here are the options. Option A. Sampler. Option B. Counter. Option C. Final. Option D. Total. Pause the video now if you want time to think about the answer.
The correct answer is B. Counter. The four core Prometheus metric types are Counter, Gauge, Histogram, and Summary. Counter is a monotonically increasing value used to track cumulative totals like requests served or errors encountered. Now, why are the other options incorrect? Option A is incorrect. Sampler is not a Prometheus metric type. Option C is incorrect. Final is not a Prometheus metric type. Option D is incorrect. Total is not a Prometheus metric type; while Counters track totals, 'Total' is not the official name of a metric type. Therefore, B, Counter, is the correct answer.
Play from 2:09:04 Question 84. What is the reference implementation of the OCI runtime specification? Here are the options. Option A. lxc. Option B. cri-o. Option C. runc. Option D. docker. Pause the video now if you want time to think about the answer.
The correct answer is C. runc. runc is the reference implementation of the OCI (Open Container Initiative) runtime specification. It is the standard, minimal implementation that other container runtimes are based on or compatible with. Now, why are the other options incorrect? Option A is incorrect. lxc is a container technology but not the OCI reference implementation. Option B is incorrect. cri-o is a container runtime that uses runc but is not the reference implementation itself. Option D is incorrect. Docker uses containerd and runc internally but is not the OCI reference implementation. Therefore, C, runc, is the correct answer.
Play from 2:10:24 Question 85. What factors influence the Kubernetes scheduler when it places Pods on nodes? Here are the options. Option A. Pod memory requests, node taints, and Pod affinity. Option B. Pod labels, node labels, and request labels. Option C. Node taints, node level, and Pod priority. Option D. Pod priority, container command, and node labels. Pause the video now if you want time to think about the answer.
The correct answer is A. Pod memory requests, node taints, and Pod affinity. The Kubernetes scheduler considers multiple factors when placing Pods on nodes, including Pod resource requests (like memory), node taints (which can repel Pods), and Pod affinity rules (which can attract Pods to specific nodes). These are the primary scheduling constraints. Now, why are the other options incorrect? Option B is incorrect. While labels are used in scheduling, the core scheduling factors are resource requests, taints, and affinity rules rather than just labels. Option C is incorrect. Node level is not a standard scheduling factor; the scheduler uses taints, tolerations, and affinity instead. Option D is incorrect. Container command does not influence Pod scheduling; the scheduler primarily considers resource requests, taints, affinity, and priority. Therefore, A, Pod memory requests, node taints, and Pod affinity, is the correct answer.
Play from 2:12:05 Question 86. Which of the following capabilities are you allowed to add to a container using the Restricted policy? Here are the options. Option A. CHOWN. Option B. SYS_CHROOT. Option C. SETUID. Option D. NET_BIND_SERVICE. Pause the video now if you want time to think about the answer.
The correct answer is D. NET_BIND_SERVICE. NET_BIND_SERVICE is a Linux capability that allows binding to ports below 1024 and is allowed under the Restricted pod security policy. The Restricted policy prevents most dangerous capabilities but permits NET_BIND_SERVICE as it's necessary for legitimate workloads. Now, why are the other options incorrect? Option A is incorrect. CHOWN is not allowed in the Restricted policy as it could allow privilege escalation. Option B is incorrect. SYS_CHROOT is not allowed in the Restricted policy as it could enable container escape. Option C is incorrect. SETUID is not allowed in the Restricted policy as it permits changing the effective user ID. Therefore, D, NET_BIND_SERVICE, is the correct answer.
Play from 2:13:37 Question 87. In the DevOps framework and culture, who builds, automates, and offers continuous delivery tools for developer teams? Here are the options. Option A. Application Users. Option B. Application Developers. Option C. Platform Engineers. Option D. Cluster Operators. Pause the video now if you want time to think about the answer.
The correct answer is C. Platform Engineers. Platform Engineers are responsible for building, automating, and offering continuous delivery tools and infrastructure that enable developer teams to deploy and manage applications efficiently. They bridge the gap between development and operations by creating self-service platforms and CI/CD pipelines. Now, why are the other options incorrect? Option A is incorrect. Application Users consume the applications built by development teams but do not build delivery tools. Option B is incorrect. Application Developers write application code and may use the tools provided by Platform Engineers, but do not typically build the CI/CD infrastructure itself. Option D is incorrect. Cluster Operators manage the operational aspects of clusters but are not primarily focused on building and automating continuous delivery tools for developer teams. Therefore, C, Platform Engineers, is the correct answer.
Play from 2:15:17 Question 88. What feature must a CNI support to control specific traffic flows for workloads running in Kubernetes? Here are the options. Option A. Border Gateway Protocol. Option B. IP Address Management. Option C. Pod Security Policy. Option D. Network Policies. Pause the video now if you want time to think about the answer.
The correct answer is D. Network Policies. CNI (Container Network Interface) plugins must support Network Policies to control and restrict specific traffic flows between pods and services in Kubernetes. Network Policies allow fine-grained ingress and egress rules that determine which workloads can communicate with each other, providing microsegmentation within clusters. Now, why are the other options incorrect? Option A is incorrect. Border Gateway Protocol is used for external routing between autonomous systems, not for controlling intra-cluster traffic Option B is incorrect. IP Address Management handles IP allocation to pods but does not control traffic flows Option C is incorrect. Pod Security Policy (now deprecated) controls pod security contexts but does not manage traffic flows between workloads Therefore, D, Network Policies, is the correct answer.
Play from 2:16:56 Question 89. What Kubernetes component handles network communications inside and outside of a cluster, using operating system packet filtering if available? Here are the options. Option A. kube-proxy. Option B. kubelet. Option C. etcd. Option D. kube-controller-manager. Pause the video now if you want time to think about the answer.
The correct answer is A. kube-proxy. kube-proxy manages network rules and packet forwarding to implement Services in Kubernetes. It handles routing traffic to appropriate endpoints and uses operating system packet filtering mechanisms (like iptables or IPVS) to direct traffic both within the cluster and to external services. Now, why are the other options incorrect? Option B is incorrect. kubelet manages container lifecycle on nodes but does not handle cluster-wide network communications. Option C is incorrect. etcd stores cluster state and configuration data, not network communications. Option D is incorrect. kube-controller-manager runs controller logic but does not handle network packet filtering. Therefore, A, kube-proxy, is the correct answer.
Play from 2:18:30 Question 90. Kubernetes Secrets are specifically intended to hold confidential data. Which API object should be used to hold non-confidential data? Here are the options. Option A. CSI. Option B. RBAC. Option C. CNI. Option D. ConfigMaps. Pause the video now if you want time to think about the answer.
The correct answer is D. ConfigMaps. ConfigMaps are the appropriate Kubernetes API object designed to store non-confidential configuration data in key-value pairs. Unlike Secrets which are intended for sensitive data, ConfigMaps are optimized for general application configuration that does not require encryption or special handling. CSI is a storage interface specification, RBAC is for access control, and CNI is a networking specification, none store application data. Now, why are the other options incorrect? Option A is incorrect. CSI (Container Storage Interface) is a specification for storage drivers, not a data storage object. Option B is incorrect. RBAC (Role-Based Access Control) manages permissions and access, not application data storage. Option C is incorrect. CNI (Container Network Interface) is a networking plugin specification, not for data storage. Therefore, D, ConfigMaps, is the correct answer.
Play from 2:20:19 Question 91. What are the possible options for PolicyTypes when configuring NetworkPolicy? Here are the options. Option A. inbound and outbound. Option B. ingress and egress. Option C. push and pull. Option D. get and put. Pause the video now if you want time to think about the answer.
The correct answer is B. ingress and egress. Kubernetes NetworkPolicy uses the PolicyTypes field with two valid options: 'ingress' (controlling inbound traffic) and 'egress' (controlling outbound traffic). These terms align with network traffic direction terminology used in Kubernetes networking specifications. Now, why are the other options incorrect? Option A is incorrect. inbound and outbound are not the official NetworkPolicy PolicyTypes terminology. Option C is incorrect. push and pull are not valid NetworkPolicy options. Option D is incorrect. get and put are HTTP/REST methods, not NetworkPolicy types. Therefore, B, ingress and egress, is the correct answer.
Play from 2:21:39 Question 92. What is the purpose of the kube-proxy? Here are the options. Option A. The kube-proxy balances network requests to pods. Option B. The kube-proxy maintains network rules on nodes. Option C. The kube-proxy ensures the cluster connectivity with internet. Option D. The kube-proxy maintains the DNS rules of the cluster. Pause the video now if you want time to think about the answer.
The correct answer is B. The kube-proxy maintains network rules on nodes. The kube-proxy is a network proxy that runs on each node and maintains network rules. It implements Kubernetes Services by managing iptables/IPVS rules that enable traffic routing to the correct backend pods. It translates Service abstractions into actual network routing logic. Now, why are the other options incorrect? Option A is incorrect. While kube-proxy enables load balancing through network rules, it is not a traditional load balancer that actively balances requests. Option C is incorrect. kube-proxy handles internal cluster networking and Service routing, not external internet connectivity. Option D is incorrect. DNS rules are managed by CoreDNS or other DNS components, not by kube-proxy. Therefore, B, The kube-proxy maintains network rules on nodes, is the correct answer.
Play from 2:23:15 Question 93. A Kubernetes administrator wants to limit the total memory usage of all Pods in a specific namespace to 4Gi. What should they create to enforce this limit? Here are the options. Option A. Namespace. Option B. LimitRange. Option C. ClusterRole. Option D. ResourceQuota. Pause the video now if you want time to think about the answer.
The correct answer is D. ResourceQuota. ResourceQuota is the Kubernetes resource that enforces aggregate resource consumption limits at the namespace level. It allows administrators to specify maximum total resource usage (CPU, memory, storage, etc.) for all Pods in a namespace, which is exactly what is needed to limit total memory usage to 4Gi across a namespace. Now, why are the other options incorrect? Option A is incorrect. Namespace is a grouping mechanism but does not enforce resource limits by itself. Option B is incorrect. LimitRange sets per-Pod or per-Container limits, not aggregate namespace-level limits. Option C is incorrect. ClusterRole is for RBAC permissions management, not resource consumption limits. Therefore, D, ResourceQuota, is the correct answer.
Play from 2:24:50 Question 94. The cloud native architecture centered around microservices provides a strong system that ensures ______________. Here are the options. Option A. fallback. Option B. resiliency. Option C. failover. Option D. high reachability. Pause the video now if you want time to think about the answer.
The correct answer is B. resiliency. Resiliency is the key characteristic that cloud native microservices architecture ensures. By breaking applications into independent microservices, the system can isolate failures, recover quickly, and continue operating even when individual components fail, making the overall system more resilient and fault-tolerant. Now, why are the other options incorrect? Option A is incorrect. Fallback is a specific recovery strategy but not the primary characteristic ensured by microservices architecture. Option C is incorrect. Failover refers to automatic switching to backup systems, which is a component of resiliency but not the overarching system characteristic. Option D is incorrect. High reachability is not a primary architectural benefit of microservices-based cloud native systems; resiliency is the foundational guarantee. Therefore, B, resiliency, is the correct answer.
Play from 2:26:20 Question 95. Which Kubernetes resource uses immutable: true boolean field? Here are the options. Option A. Deployment. Option B. Pod. Option C. ConfigMap. Option D. ReplicaSet. Pause the video now if you want time to think about the answer.
The correct answer is C. ConfigMap. The immutable field is a boolean property available on ConfigMap and Secret resources that, when set to true, prevents the data from being modified after creation. This ensures configuration data cannot be accidentally or maliciously altered, providing immutability guarantees for sensitive or critical configuration. Deployments, Pods, and ReplicaSets do not have an immutable field. Now, why are the other options incorrect? Option A is incorrect. Deployments do not have an immutable field; they are mutable resources that can be updated. Option B is incorrect. Pods do not have an immutable field; pod specifications can be modified through updates. Option D is incorrect. ReplicaSets do not have an immutable field; they are mutable controller resources. Therefore, C, ConfigMap, is the correct answer.
Play from 2:27:54 Question 96. Which is an industry-standard container runtime with an “emphasis” on simplicity, robustness, and portability? Here are the options. Option A. cri-o. Option B. lxd. Option C. containerd. Option D. kata-runtime. Pause the video now if you want time to think about the answer.
The correct answer is C. containerd. Containerd is an industry-standard container runtime explicitly designed with emphasis on simplicity, robustness, and portability. It is a CNCF graduated project that serves as the underlying runtime for Kubernetes and Docker, providing a minimal, focused implementation for container lifecycle management across different platforms. Now, why are the other options incorrect? Option A is incorrect. CRI-O is a container runtime but is more specifically designed for Kubernetes integration rather than general-purpose portability emphasis. Option B is incorrect. LXD is a container hypervisor for system containers, not an industry-standard application container runtime. Option D is incorrect. Kata-runtime is a hypervisor-based runtime focused on security through virtualization, not emphasizing simplicity and portability as primary design goals. Therefore, C, containerd, is the correct answer.
Play from 2:29:36 Question 97. Which control plane component is responsible for updating the node Ready condition if a node becomes unreachable? Here are the options. Option A. The kube-oroxy. Option B. The node controller. Option C. The kubelct. Option D. The kube-apiserver. Pause the video now if you want time to think about the answer.
The correct answer is B. The node controller. The node controller is the control plane component responsible for monitoring node health and updating the node Ready condition. When a node becomes unreachable, the node controller detects this and updates the node's status accordingly. Now, why are the other options incorrect? Option A is incorrect. kube-proxy manages network rules and service proxying, not node status updates. Option C is incorrect. kubelet runs on nodes and reports status but doesn't update Ready conditions from the control plane. Option D is incorrect. kube-apiserver serves the API but doesn't actively monitor and update node conditions. Therefore, B, The node controller, is the correct answer.
Play from 2:31:00 Question 98. What kubectl command is used to retrieve the resource consumption (CPU and memory) for nodes or Pods? Here are the options. Option A. kubectl cluster-info. Option B. kubectl version. Option C. kubectl top. Option D. kubectl api-resources. Pause the video now if you want time to think about the answer.
The correct answer is C. kubectl top. The kubectl top command is used to retrieve resource consumption metrics (CPU and memory usage) for nodes or Pods. It requires the metrics-server to be installed in the cluster and provides real-time resource utilization data. Now, why are the other options incorrect? Option A is incorrect. kubectl cluster-info displays information about the cluster and its components, not resource consumption metrics. Option B is incorrect. kubectl version shows the version of kubectl and the Kubernetes API server, not resource metrics. Option D is incorrect. kubectl api-resources lists available API resources in the cluster, not resource consumption data. Therefore, C, kubectl top, is the correct answer.
Play from 2:32:29 Question 99. Which one of the following is an open source runtime security tool? Here are the options. Option A. lxd. Option B. containerd. Option C. falco. Option D. gvisor. Pause the video now if you want time to think about the answer.
The correct answer is C. falco. Falco is an open source runtime security tool that detects suspicious behavior and policy violations in containers and Kubernetes environments. It uses eBPF to monitor system calls and provides real-time threat detection and alerting capabilities. Now, why are the other options incorrect? Option A is incorrect. lxd is a container management system, not a runtime security monitoring tool. Option B is incorrect. containerd is a container runtime, not a security monitoring tool. Option D is incorrect. gVisor is a sandbox technology for container isolation, not a runtime security monitoring or alerting tool like Falco. Therefore, C, falco, is the correct answer.
Play from 2:33:48 Question 100. Which command will list the resource types that exist within a cluster? Here are the options. Option A. kubectl api-resources. Option B. kubectl get namespaces. Option C. kubectl api-versions. Option D. curl https://kubectrl/namespaces. Pause the video now if you want time to think about the answer.
The correct answer is A. kubectl api-resources. The `kubectl api-resources` command lists all resource types (such as pods, services, deployments, etc.) that are available and supported within a Kubernetes cluster, including both built-in and custom resources. Now, why are the other options incorrect? Option B is incorrect. kubectl get namespaces lists the namespaces in a cluster, not the resource types available. Option C is incorrect. kubectl api-versions shows the API versions supported, not the individual resource types themselves. Option D is incorrect. This is not a valid kubectl or curl command syntax and would not function to list resources. Therefore, A, kubectl api-resources, is the correct answer.
