Linux Foundation KCNA Practice Questions with Explanations

Correct answer: A

runC is the reference implementation of the OCI runtime specification and is the native, officially OCI-compliant container runtime. It is the most widely used OCI-compliant runtime and serves as the standard for container execution. While kata-containers and gvisor are also container runtimes, they are not the native OCI runtime reference implementation.

Why the other options are wrong:

• B. runV does not exist as a standard container runtime.
• C. Kata Containers is a runtime that provides lightweight virtual machines but is not the native OCI reference implementation.
• D. gVisor is a sandbox runtime but is not the native OCI runtime reference implementation.

Correct answer: B

Deployment is the recommended API object for running scalable, stateless applications in Kubernetes. Deployments provide declarative updates for Pods and ReplicaSets, making it easy to manage replicas, perform rolling updates, and handle scaling. ReplicaSets are lower-level and typically managed by Deployments, DaemonSets are for node-level workloads, and Pods are the basic unit but not suitable for managing scalability directly.

Why the other options are wrong:

• A. ReplicaSet is a lower-level construct typically managed by Deployments rather than used directly.
• C. DaemonSet ensures a Pod runs on every node, not suitable for general scalable stateless applications.
• D. Pod is the basic unit but provides no scaling or management capabilities on its own.

Correct answer: D

The CronJob controller component creates a Job object when the scheduled time arrives. The Job controller then creates a Pod based on that Job specification, and the Job controller waits until the Pod completes execution. This two-level hierarchy (CronJob → Job → Pod) is the proper architecture in Kubernetes. The kubelet does not watch for CronJobs, and the kube-scheduler is not primarily responsible for CronJob management.

Why the other options are wrong:

• A. Kubelet does not watch API Server for CronJob objects; the CronJob controller does.
• B. Kube-scheduler is not responsible for watching CronJob objects; the CronJob controller is.
• C. The CronJob controller creates a Job, not a Pod directly; the Job controller then creates the Pod.

Correct answer: D

Kubelet is an agent that runs on each node in a Kubernetes cluster and ensures that containers are running in Pods as expected. It communicates with the API server, manages the Pod lifecycle, mounts volumes, and reports node status. Option A describes a dashboard (Kubernetes Dashboard), Option B describes kube-proxy, and Option C describes kube-scheduler.

Why the other options are wrong:

• A. A dashboard is the Kubernetes Dashboard or similar management UI, not the kubelet.
• B. kube-proxy is the network proxy component that implements the Service concept.
• C. Kube-scheduler selects nodes for newly created Pods; the kubelet ensures containers run on the node.

Correct answer: B

The default authorization mode for the Kubernetes API server is AlwaysAllow, which permits all requests without any authorization checks. This is the permissive default, though it is typically overridden with more restrictive modes like RBAC in production environments. While RBAC is recommended for security, AlwaysAllow remains the actual default if not explicitly configured.

Why the other options are wrong:

• A. RBAC is a recommended mode but is not the default; it must be explicitly configured.
• C. AlwaysDeny is overly restrictive and is never a default; it would block all requests.
• D. ABAC (Attribute-Based Access Control) is an older authorization mode but is not the default.

Correct answer: B

The Kubernetes Cluster Autoscaler is the most cost-effective solution for burst workloads. It automatically scales the number of nodes up or down based on resource requests and actual usage, ensuring you only pay for the compute resources you need during the Monday batch processing, and the nodes scale down when the jobs complete. Option A wastes resources by keeping nodes constantly running, Option C commits to fixed spending unnecessarily, and Option D addresses scheduling priority rather than cost optimization.

Why the other options are wrong:

• A. Maintaining a fixed group of nodes 24/7 is wasteful when you only need them one day per week.
• C. Reserved instances reduce per-unit cost but don't eliminate the cost of idle resources.
• D. PriorityClasses ensure jobs complete on time but do not address cost optimization or resource scaling.

Correct answer: A

A Headless Service is a Kubernetes service that has no cluster IP address assigned to it. It is created by setting clusterIP: None in the service specification and is useful for stateful applications where you need direct Pod-to-Pod communication rather than load balancing through a single cluster IP. The other options are not standard Kubernetes terminology.

Why the other options are wrong:

• B. Nodeless Service is not a recognized Kubernetes service type.
• C. IPLess Service is not the correct term; the proper term is Headless Service.
• D. Specless Service is not a recognized Kubernetes service type or concept.

Correct answer: D

CI/CD stands for Continuous Integration / Continuous Deployment. Continuous Integration refers to automatically building and testing code changes, while Continuous Deployment refers to automatically releasing validated changes to production. This is the standard industry definition used across software development and DevOps practices.

Why the other options are wrong:

• A. Information and Development are not the correct expansions; CI stands for Continuous Integration.
• B. While Continuous Integration is correct, the second term is Deployment, not Development.
• C. Cloud Integration and Cloud Development are not the correct expansions for CI/CD.

Correct answer: D

By default, Kubernetes Secrets are stored with base64 encoding in the etcd backend. Base64 is an encoding scheme, not encryption-it is easily reversible and provides no cryptographic protection. This is why additional security measures like encryption at rest are recommended for production clusters.

Why the other options are wrong:

• A. AES symmetric encryption is not applied by default; it must be explicitly configured.
• B. While base64 is not encryption, the data is technically encoded, not stored in plain text.
• C. SHA256 hashing is not used for Secrets storage; hashing is one-way and inappropriate for retrievable secret values.

Correct answer: B

kube-proxy is a network proxy that runs on each node and is responsible for forwarding traffic to the correct endpoints behind Services. It implements network routing rules to enable Service discovery and load balancing across pod endpoints.

Why the other options are wrong:

• A. Ingress resources are managed by an Ingress controller, not kube-proxy.
• C. kube-proxy is not responsible for managing egress traffic from nodes.
• D. API server access is managed by the Kubernetes control plane and authentication mechanisms, not kube-proxy.

Correct answer: C

According to the Kubernetes deprecation policy, stable API elements must remain supported for a minimum of 12 months after deprecation is announced. This ensures users have adequate time to migrate to replacement APIs.

Why the other options are wrong:

• A. 9 months is shorter than the required minimum support period.
• B. While 24 months provides extended support, 12 months is the stated minimum requirement.
• D. 6 months is insufficient time for users to plan and execute migration strategies.

Correct answer: B

k3s is a lightweight, certified Kubernetes distribution specifically designed for IoT and edge computing environments. It reduces memory and CPU requirements while maintaining full Kubernetes compatibility.

Why the other options are wrong:

• A. OpenShift is an enterprise Kubernetes platform, not a lightweight distribution.
• C. RKE (Rancher Kubernetes Engine) is a full Kubernetes installer, not a lightweight edge distribution.
• D. k1s is not a recognized Kubernetes distribution.

Correct answer: B

Cluster Autoscaler automatically adjusts the number of nodes in a cluster based on demand and resource availability. It adds nodes when pods cannot be scheduled and removes underutilized nodes to optimize resource usage.

Why the other options are wrong:

• A. Node Autoscaler is not the correct Kubernetes terminology.
• C. Horizontal Pod Autoscaler scales the number of pod replicas, not the number of nodes.
• D. Vertical Pod Autoscaler adjusts CPU and memory requests for pods, not node count.

Correct answer: B

Open Policy Agent (OPA) is a policy engine that integrates with Kubernetes through admission webhooks. It validates requests and enforces policies based on Rego language rules, enabling fine-grained access control and security policies.

Why the other options are wrong:

• A. OPA policies are written in Rego, not Python.
• C. Policies can be tested locally before deployment using OPA's testing framework.
• D. OPA is a general-purpose policy engine used in many contexts beyond Kubernetes.

Correct answer: B

IaC stands for Infrastructure as Code, a practice in cloud native development where infrastructure configuration is defined and managed through code files rather than manual processes, enabling version control and automation.

Why the other options are wrong:

• A. Infrastructure and Code is not the correct expansion.
• C. Infrastructure above Code is not a recognized term.
• D. Infrastructure across Code is not the correct expansion.

Correct answer: D

Serverless computing abstracts away infrastructure management entirely. Developers focus solely on code and business logic while the platform handles capacity provisioning, scaling, deployment, fault tolerance, and operating system management.

Why the other options are wrong:

• A. Docker Swarm requires developers to manage container orchestration and cluster resources.
• B. Kubernetes requires developers to manage deployments, scaling, and cluster topology.
• C. Mesos still requires understanding of resource management and cluster administration.

Correct answer: B

Dynamic scheduling is a core characteristic of container orchestration platforms like Kubernetes. Orchestration systems automatically schedule containers across clusters based on resource requirements, constraints, and availability. Application message distribution relates to service mesh functionality, deploying JAR files is an application- specific concern unrelated to orchestration, and virtual machine distribution is infrastructure management rather than container orchestration.

Why the other options are wrong:

• A. Message distribution is handled by service meshes or message brokers, not orchestration engines.
• C. JAR file deployment is an application packaging concern, not a characteristic of orchestration.
• D. VM distribution is infrastructure provisioning, distinct from container orchestration.

Correct answer: A

StatefulSets require a headless service to maintain stable network identities for their pods, enabling pod-to-pod communication and persistent ordering. StatefulSets are designed for applications that need stable hostnames and ordinal indices. Deployments and DaemonSets manage pods without requiring headless services, and CronJobs are one-off batch workloads that don't need stable pod identity.

Why the other options are wrong:

• B. CronJobs run periodic batch jobs and don't require headless services.
• C. Deployments manage stateless replicas and use standard services for load balancing.
• D. DaemonSets run one pod per node but don't require headless services for functionality.

Correct answer: B

Helm is a package manager for Kubernetes applications that uses charts to define, install, and manage complex Kubernetes deployments. It provides templating, versioning, and dependency management for Kubernetes resources. Kubernetes dashboards are separate tools like the Kubernetes Dashboard, custom schedulers are scheduler plugins rather than Helm's function, and end-to-end testing frameworks serve different purposes.

Why the other options are wrong:

• A. Kubernetes Dashboard is the open-source UI for Kubernetes, not Helm.
• C. Helm is a package manager, not a custom scheduler.
• D. End-to-end testing projects are separate from Helm's package management role.

Correct answer: D

The `-f` flag in `kubectl logs -f test-container-1` enables follow mode, displaying logs in real time as they are generated. The `-p` flag retrieves previous pod logs after a restart, `-c` selects a specific container by name, and `-l` is not a valid kubectl logs option for the given context.

Why the other options are wrong:

• A. The `-p` flag shows logs from a previous pod instance, not real-time streaming.
• B. The `-c` flag selects a container but doesn't stream logs in real time.
• C. The `-l` flag is not a standard kubectl logs option for this purpose.

Correct answer: A

Init containers are the correct pattern for loading and generating required data before the main pod starts. Init containers run to completion before application containers start, and they can share storage volumes with the main pod. They are specifically designed for setup tasks like data preparation, configuration retrieval, and dependency initialization. Using sidecar containers, separate pods, or just PVC volumes alone doesn't provide the sequential startup guarantee that init containers offer.

Why the other options are wrong:

• B. A PVC volume alone doesn't execute initialization logic or prepare data.
• C. Sidecar containers run alongside the main container, not before it starts.
• D. Running another pod doesn't guarantee proper initialization sequencing within the same pod.

Correct answer: D

GitOps tools like Argo CD and Flux implement continuous reconciliation by comparing the desired state defined in a Git repository against the actual production state. They automatically detect drift and either notify operators or take corrective actions. This provides declarative infrastructure management with Git as the single source of truth. While they may create pull requests for dependencies, this is an optional feature not core functionality, and they do track changes but don't replace human operations entirely.

Why the other options are wrong:

• A. While GitOps creates audit trails, this is a benefit not the core functionality.
• B. GitOps tools augment rather than replace human operations and oversight.
• C. Automated dependency update pull requests are optional features, not core functionality.

Correct answer: C

DaemonSet is the Kubernetes workload resource that ensures a copy of a Pod runs on all nodes (or a selected subset) in a cluster. It automatically creates and manages one pod per node, making it ideal for node-level logging, monitoring, and networking agents. ReplicaSets maintain a fixed number of replicas, StatefulSets manage stateful applications with identity, and Deployments manage stateless replicas.

Why the other options are wrong:

• A. ReplicaSets maintain a specified number of replicas across the cluster, not one per node.
• B. StatefulSets are for stateful applications needing identity and ordering, not universal node deployment.
• D. Deployments manage stateless replica sets without ensuring one pod per node.

Correct answer: A

CRD stands for Custom Resource Definition, which is the mechanism for extending the Kubernetes API with custom resource types. CRDs allow users to define new Kubernetes objects and manage them like native resources. The other options contain incorrect expansions with irrelevant terms like 'Restricted' or 'RUST' which are not related to Kubernetes API extensions.

Why the other options are wrong:

• B. CRD does not stand for 'Custom Restricted Definition'.
• C. RUST is not part of Kubernetes API extension terminology.
• D. RUST is a programming language not related to Custom Resource Definitions.

Correct answer: A

SIG stands for Special Interest Group. These are the primary organizational units within the Kubernetes project where community members collaborate on specific areas like networking, storage, security, and other core components. SIGs are responsible for the design, implementation, and maintenance of various Kubernetes features.

Why the other options are wrong:

• B. Software Installation Guide is not related to Kubernetes project organization.
• C. Support and Information Group is not the correct term used in the Kubernetes community.
• D. Strategy Implementation Group does not describe the function or structure of Kubernetes SIGs.

Correct answer: D

The 4Cs of Cloud Native Security are ordered from most to least user control: Code (application code), Container (container images and runtime), Cluster (Kubernetes infrastructure), and Cloud (cloud provider infrastructure). Users have the most direct control over their own code and progressively less control moving outward to infrastructure layers managed by cloud providers.

Why the other options are wrong:

• A. This reverses the order, placing Cloud first when it should be last as the layer with least user control.
• B. This ordering does not follow the principle of user control, starting with containers rather than code.
• C. This ordering incorrectly places Cluster first, when Code is the innermost layer users control directly.

Correct answer: C

runsc (gVisor) and kata (Kata Containers) are container runtimes that provide additional sandboxed isolation beyond standard container isolation. Both offer elevated security through virtualization or lightweight VM approaches, protecting the host kernel from container escapes. They are suitable for untrusted workloads requiring stronger isolation than traditional runtimes.

Why the other options are wrong:

• A. runc is the standard OCI runtime (not sandboxed), and cgroups are resource limiting mechanisms, not runtimes.
• B. docker and containerd are standard container runtimes that use runc; they do not provide the enhanced sandboxed isolation of gVisor or Kata.
• D. crun and cri-o are alternative standard runtimes without the additional sandboxed isolation features needed for enhanced security.

Correct answer: C

Service Mesh Interface (SMI) is the standard specification for service meshes in Kubernetes. It provides a common API for developers to define traffic management, security policies, and observability across different service mesh implementations, enabling portability between mesh solutions like Istio, Linkerd, and Consul.

Why the other options are wrong:

• A. Service Mesh Specification (SMS) is not the recognized standard term in the cloud native ecosystem.
• B. Service Mesh Technology (SMT) is not an established standard for service meshes.
• D. Service Mesh Function (SMF) is not the correct standard for service mesh specifications in Kubernetes.

Correct answer: D

Ingress is a Kubernetes API object that manages external access to services within a cluster, typically providing HTTP and HTTPS routing. It acts as a layer on top of Services to expose routes from outside the cluster to internal services, enabling external clients to reach applications running inside the cluster.

Why the other options are wrong:

• A. Ingress is not used for tracking network endpoints; that is the function of Endpoints and Service objects.
• B. Ingress is not a Service type; it is a separate API resource that works with Services (which can be NodePort, ClusterIP, or LoadBalancer type).
• C. Ingress is not a network policy; that function is served by NetworkPolicy objects which define inter-Pod communication rules.

Correct answer: A

Cloud native service discovery is the mechanism that enables applications and microservices to dynamically locate and communicate with each other on a network without hardcoded addresses. In Kubernetes, this is typically handled through DNS-based discovery using service names, allowing decoupled, scalable architectures where services can be added, removed, or migrated transparently.

Why the other options are wrong:

• B. MAC address discovery is network-layer functionality (ARP), not service discovery.
• C. Automatic IP address assignment describes DHCP, not service discovery for applications.
• D. Domain name to IP resolution describes DNS, which is a tool used in service discovery but not service discovery itself.

Correct answer: D

A service mesh comprises two primary components: the data plane (service proxies like Envoy that handle actual traffic) and the control plane (which manages and configures the proxies through APIs and policies). Together these enable traffic management, security, and observability across microservices.

Why the other options are wrong:

• A. Tracing and log storage are observability tools used with service meshes but not core components of the mesh architecture itself.
• B. Circuit breaking is a feature enabled by service meshes, but Pod scheduling is a Kubernetes scheduler function, not a mesh component.
• C. Runtime plane is not a standard component of service mesh architecture; the correct terms are data plane and control plane.

Correct answer: A

Rook is a storage operator for Kubernetes that automates the deployment and management of distributed storage systems like Ceph. It enables self-scaling, self-healing, and self-managing capabilities, allowing storage infrastructure to adapt automatically to cluster needs and recover from failures without manual intervention.

Why the other options are wrong:

• B. Kubernetes itself is the container orchestration platform, not a storage operator.
• C. Helm is a package manager for Kubernetes applications, not a storage operator.
• D. Container Storage Interface (CSI) is a standard interface for storage plugins, not an operator that provides self-scaling and self-healing capabilities.

Correct answer: A

Every Kubernetes object manifest requires three essential top-level fields: apiVersion (specifies the API version), kind (specifies the object type), and metadata (contains object identification information like name and namespace). These three fields are mandatory and form the foundation of any valid Kubernetes YAML configuration.

Why the other options are wrong:

• B. namespace is not a top-level required field; it belongs inside metadata
• C. namespace is not a top-level required field; it is optional and contained within metadata
• D. data is not a top-level required field and only appears in specific object types like ConfigMaps and Secrets

Correct answer: B

Site Reliability Engineers focus on operational aspects of systems including monitoring, observability, and reliability metrics. Creating a monitoring baseline for an application directly falls within SRE responsibilities as it establishes the foundation for measuring system health and performance. Options A, C, and D are development, finance, and policy responsibilities respectively, not core SRE functions.

Why the other options are wrong:

• A. Developing new features is a software development responsibility, not SRE
• C. Budgeting decisions are typically finance or management responsibilities, not SRE technical work
• D. Code submission policies are usually set by engineering management or development leads, not SRE

Correct answer: A

When Kubernetes initializes, it automatically creates four default namespaces: default (for user workloads), kube-system (for cluster components), kube-public (for publicly readable data), and kube-node-lease (for node heartbeat lease objects). These are the standard initial namespaces present in every Kubernetes cluster.

Why the other options are wrong:

• B. Incorrect naming conventions; 'system' should be 'kube-system' and missing kube- node-lease
• C. Uses incorrect naming like 'kube-default' instead of 'default' and includes non-existent namespaces
• D. Contains incorrect namespace names that do not exist in Kubernetes

Correct answer: C

A probe in Kubernetes is a diagnostic mechanism that the kubelet performs periodically on containers within pods. Probes check container health through liveness, readiness, and startup checks, enabling Kubernetes to determine if a container is functioning correctly and ready to receive traffic. This is a core container health verification feature.

Why the other options are wrong:

• A. Probes are not API monitoring mechanisms; they are container-level diagnostics
• B. There is no 'pre-operational scope' concept in Kubernetes; this is not accurate terminology
• D. Probes are diagnostic health checks, not logging mechanisms

Correct answer: D

StatefulSet provides ordered, stable pod identities and persistent storage, which are essential for distributed applications that require consensus mechanisms to prevent split- brain scenarios. StatefulSets ensure deterministic pod naming and ordered startup/shutdown, allowing applications like databases and clustered systems to maintain consistency and coordinate properly. Replication controllers and rolling updates do not address consensus; consensus protocols are the mechanism StatefulSets enable.

Why the other options are wrong:

• A. Replication controllers only manage pod replicas; they do not prevent split-brain scenarios
• B. While consensus protocols are the mechanism used, this is not a Kubernetes feature but rather what applications implement using StatefulSet
• C. Rolling updates manage deployment strategy; they do not address split-brain prevention

Correct answer: D

CNI (Container Network Interface) plugins must support Network Policies to control and restrict specific traffic flows between pods and services in Kubernetes. Network Policies allow fine-grained ingress and egress rules that determine which workloads can communicate with each other, providing microsegmentation within clusters.

Why the other options are wrong:

• A. Border Gateway Protocol is used for external routing between autonomous systems, not for controlling intra-cluster traffic
• B. IP Address Management handles IP allocation to pods but does not control traffic flows
• C. Pod Security Policy (now deprecated) controls pod security contexts but does not manage traffic flows between workloads

Correct answer: D

Kubernetes DNS provides service discovery within the cluster by maintaining consistent DNS names for Pods and Services. This allows workloads to discover and communicate with each other reliably using DNS names rather than hardcoded IP addresses, which is fundamental to microservices architecture within Kubernetes.

Why the other options are wrong:

• A. Kubernetes DNS serves only internal cluster workloads, not external VMs outside the cluster
• B. Kubernetes DNS is not a general DNS service provider; it is specific to cluster- internal service discovery
• C. IPv6 to IPv4 conversion is not a primary role of Kubernetes DNS

Correct answer: A

The Cloud Controller Manager is the Kubernetes component responsible for interacting with the cloud provider to provision cloud resources, including LoadBalancer type Services. When external-ip is stuck in Pending, the Cloud Controller Manager has failed to communicate with the cloud provider's API to allocate an external IP address, indicating this component is not functioning properly.

Why the other options are wrong:

• B. There is no 'Load Balancer Manager' component in Kubernetes architecture
• C. There is no 'Cloud Architecture Manager' component in Kubernetes
• D. There is no 'Cloud Load Balancer Manager' component in Kubernetes; the correct component is Cloud Controller Manager

Correct answer: D

The four foundational characteristics for building cloud-native applications are Resiliency (ability to recover from failures), Agility (ability to rapidly develop and deploy), Operability (ease of operation and management), and Observability (ability to understand system behavior through monitoring and logging). These are the core pillars defined by the CNCF and cloud-native best practices.

Why the other options are wrong:

• A. Availability is important but not a primary foundational characteristic; Operability covers operational aspects more comprehensively.
• B. Containerd is a container runtime implementation, not a foundational characteristic of cloud-native applications.
• C. Kubernetes is a tool/platform, not a foundational characteristic; cloud-native apps can run on other orchestration systems.

Correct answer: B

CNCF is the official acronym for the Cloud Native Computing Foundation, an open governance foundation hosted by the Linux Foundation that promotes the adoption of cloud-native technologies and best practices.

Why the other options are wrong:

• A. While 'Community' could seem plausible, the correct acronym uses 'Computing' not 'Community'.
• C. The 'N' stands for 'Native', not 'Neutral', and 'Computing' is correct, not 'Neutral Computing'.
• D. This incorrectly uses both 'Neutral' and 'Community', neither of which are correct in the CNCF acronym.

Correct answer: A

Namespaces in Kubernetes provide virtual clusters backed by the same physical cluster, allowing multiple isolated environments to coexist. They enable multi-tenancy and provide logical separation of resources within a single Kubernetes cluster.

Why the other options are wrong:

• B. Containers are application packaging units, not virtual clusters; Kubernetes manages containers but they are not virtual clusters themselves.
• C. Hypervisors are virtualization layer mechanisms for virtual machines, not Kubernetes concepts for virtual clusters.
• D. Cgroups are Linux kernel features for resource limiting, not Kubernetes constructs for virtual clustering.

Correct answer: C

The Kubernetes API is the central communication hub that enables all components to interact: end users via kubectl, different parts of the cluster (control plane and worker nodes), and external systems. All Kubernetes operations flow through the API server.

Why the other options are wrong:

• A. kubectl is a client tool that uses the Kubernetes API, but it is not the component enabling communication itself.
• B. AWS Management Console is cloud-provider specific and not a Kubernetes component for cluster communication.
• D. Google Cloud SDK is a cloud provider tool, not a Kubernetes component for internal cluster communication.

Correct answer: A

The `kubectl api-resources` command lists all resource types (such as pods, services, deployments, etc.) that are available and supported within a Kubernetes cluster, including both built-in and custom resources.

Why the other options are wrong:

• B. kubectl get namespaces lists the namespaces in a cluster, not the resource types available.
• C. kubectl api-versions shows the API versions supported, not the individual resource types themselves.
• D. This is not a valid kubectl or curl command syntax and would not function to list resources.

Correct answer: B

The cloud-controller-manager is a Control Plane component that runs cloud-provider- specific control loops, managing cloud resources and integrating with cloud provider APIs. It is part of the core control plane.

Why the other options are wrong:

• A. coredns is an add-on/DNS service running in the cluster, not a core Control Plane component.
• C. kube-proxy is a node component running on worker nodes, not part of the Control Plane.
• D. kubelet is a node agent running on each worker node, not a Control Plane component.

Correct answer: C

systemd is an init system and service manager for Linux, not a container runtime implementing the Container Runtime Interface (CRI). CRI-O, containerd, and other CRI- compatible runtimes implement the standard interface for Kubernetes, but systemd does not.

Why the other options are wrong:

• A. CRI-O is a fully CRI-compliant container runtime specifically designed for Kubernetes.
• B. dockershim was a CRI implementation that allowed Docker to work with Kubernetes (though deprecated in newer versions).
• D. containerd is a widely-used, CRI-compliant container runtime supported by Kubernetes.

Correct answer: B

A key feature of container networks is enabling containers running on separate hosts to communicate with each other. Container networking solutions provide network connectivity across multiple nodes, allowing distributed applications to function as a cohesive system.

Why the other options are wrong:

• A. While load balancing and proxying are features of Kubernetes services, they are not the fundamental key feature of container networking itself.
• C. Communication between containers on the same host is basic Docker networking, not the distinctive key feature of container networks at scale.
• D. Caching remote disk access is a storage concern, not a primary feature of container networking.

Correct answer: D

kubectl rollout status is the correct command to monitor the progress of Deployments, DaemonSets, and StatefulSets. It displays the current status of the rollout, including how many replicas are ready and updated. The other options (watch, progress, state) are not valid kubectl rollout subcommands.

Why the other options are wrong:

• A. kubectl rollout watch is not a valid subcommand; you would use kubectl rollout status or kubectl get with --watch flag instead.
• B. kubectl rollout progress does not exist as a valid kubectl subcommand.
• C. kubectl rollout state is not a valid kubectl subcommand for checking rollout progress.

Correct answer: D

The primary goal of load balancing is to automatically distribute incoming requests across multiple instances of an application to improve performance, availability, and reliability. This prevents any single instance from becoming a bottleneck.

Why the other options are wrong:

• A. While load balancers may provide telemetry about request performance, that is not their core goal.
• B. Load balancing distributes traffic across instances of the same version, not different versions of an application.
• C. Distributing application instances across the cluster is orchestration, not the function of a load balancer.