All 75 Kubernetes quiz questions below come with a short explanation, visible right on the page — no sign-in needed. They're grouped by beginner and intermediate levels and 18 subtopics, so you can revise one part at a time. Choose Try Kubernetes quiz above to take a scored run and review the questions you got wrong.
What the Kubernetes quiz covers
Deployment & Rollout13
Pod & Workload10
Config & Secret8
Resources & Scheduling7
Service & Networking7
Probes & Health6
Storage & State5
kubectl4
Pod3
Networking2
Node2
Workload2
Autoscaling1
Configuration1
Deployment1
Image1
Manifest1
Scheduling1
Beginner level — 20 Kubernetes questions
Question 1·Pod & Workload
What is a Pod in Kubernetes?
A.A physical or virtual machine in the cluster
B.A group of Services bundled to share network configuration
C.The smallest deployable unit — one or more containers sharing a network namespace
D.Another name for a container in Kubernetes, with exactly one container per Pod
Answer: C
A Pod is the smallest unit Kubernetes schedules. It wraps one or more containers sharing an IP, ports, and optionally volumes — so containers in the same Pod reach each other via localhost. A Pod is ephemeral: if it dies it is replaced with a new one on a different IP, never resurrected.
What does a Deployment do that creating Pods directly cannot?
A.It gives the Pod a fixed IP address that never changes
B.It lets the Pod write durable data to disk
C.It maintains the desired replica count
D.It raises the Pod's CPU and memory limits
Answer: C
A Deployment keeps the desired number of Pods running and recreates them when they die. It also handles upgrades: change the image and new Pods come up gradually while old ones drain, with rollback possible if the new version is broken. A bare Pod just dies.
B.It gives a group of Pods a stable address and DNS name
C.It allocates a shared disk for the Pods
D.It limits requests per second to the application
Answer: B
A Pod gets a new IP every time it is recreated, so it can't be called directly. A Service gives a group of Pods (selected by labels) a virtual IP and a stable DNS name, then load balances requests to the ready Pods.
A.A ConfigMap works in one namespace while a Secret is cluster-wide
B.A ConfigMap can be attached as environment variables while a Secret can only be mounted as files
C.A Secret is end-to-end encrypted so even a cluster admin cannot read it
D.A Secret is for sensitive data: base64-stored, encryptable in etcd, tightened with RBAC
Answer: D
Both inject configuration into Pods without rebuilding the image. A ConfigMap holds ordinary data, a Secret holds sensitive data — Secrets store base64, support encryption at rest, and should be tightened with RBAC. Note: base64 is NOT encryption.
A.Grouping Nodes with the same hardware configuration
B.Splitting the cluster into completely separate physical networks
C.Splitting the cluster into logical namespaces to separate resources
D.Assigning a public domain name to an internet-facing service
Answer: C
Namespaces split resources within the same cluster into logical spaces — a resource name only needs to be unique within its namespace. It is the scope for RBAC and ResourceQuota. Note: it does NOT isolate the network by itself; for that you need NetworkPolicy.
What are labels and selectors used for in Kubernetes?
A.Labels are key-value pairs attached to resources; a selector is an expression filtering by label
B.Selectors are only for kubectl get when filtering manually
C.Labels replace namespaces for separating resources
D.A label is a display name on the dashboard with no operational effect
Answer: A
Labels are key–value metadata attached to resources. Selectors filter by label. This is the glue of Kubernetes: a Service finds Pods via a selector, and a Deployment claims its Pods via a selector. A mismatch between label and selector is the number-one reason a Service has no endpoints.
You need a log-collection agent running on EVERY Node in the cluster. Which workload type fits?
A.A DaemonSet — exactly one replica per Node, including new Nodes
B.A StatefulSet, because the agent needs a stable identity
C.A Deployment with replicas equal to the current Node count
D.A CronJob running every minute to make sure the agent is alive
Answer: A
DaemonSet. It places exactly one Pod on every eligible Node, automatically adds one when a new Node joins and cleans up when a Node leaves the cluster. Use it for log-collection agents, monitoring, network plugins — anything that must be present on every machine.
How do kubectl get pod <name> and kubectl describe pod <name> differ?
A.get reads from the Node while describe reads from etcd
B.get prints a summary table; describe prints full detail, including Events
C.describe only works for Pods while get works for every resource type
D.get shows the container's logs while describe does not
Answer: B
get gives a quick table view. describe gives detailed configuration plus the Events section — where the reason a Pod was not scheduled, an image pull failure, or a broken probe is recorded. When something goes wrong, describe is almost always the second command after get.
What is the relationship between a Node, a Pod and a container?
A.Node and Pod are two names for the same thing
B.Each Node can run only one Pod
C.A Node is a machine (physical or virtual) in the cluster
D.A Node is inside a Pod and a Pod is inside a container
Answer: C
A cluster consists of many Nodes (machines). Each Node runs many Pods. Each Pod wraps one or more containers sharing an IP and volumes. In addition, the cluster has a control plane (API server, scheduler, controller manager, etcd) that coordinates everything.
A Deployment specifies image: myapp:latest. Why is that a poor choice in production?
A.You do not know which bytes are running, and rollbacks are unreliable
B.Kubernetes does not support the latest tag
C.The latest tag makes the image download more slowly than other tags
D.latest must be used together with imagePullPolicy: Never
Answer: A
latest is a mutable tag — it points to whatever image happens to be current. Consequences: you do not know what production is running, rollout undo can roll back to that same tag so nothing changes, and Pods created at different times can run two different versions.
It shows what the process inside the container writes to stdout and stderr. That's why apps on Kubernetes should log to stdout/stderr instead of to a file — files inside the container can't be retrieved with this command.
B.A ReplicaSet creates and manages the Deployments
C.A ReplicaSet is the older object that has been replaced
D.The two are entirely independent of each other
Answer: A
A Deployment creates and manages ReplicaSets, and a ReplicaSet maintains the desired number of Pods. Each revision of the Deployment corresponds to its own ReplicaSet — that's what makes rolling back to a previous version work.
B.Restarting the container with a different command
C.Creating a new Pod for debugging
D.Running a command on the Node hosting the Pod
Answer: A
It runs a command inside a running container, and the two flags open an interactive session with a TTY allocated. This is the fastest way to inspect files, environment variables, and network state from inside the container.
What do apiVersion and kind indicate in a manifest?
A.The Kubernetes version of the running cluster
B.The resource type and the API version
C.How the API server authenticates the sender
D.The version of the application being deployed
Answer: B
kind tells you the resource type — Pod, Service, Deployment — while apiVersion tells you the API group and version that describes it. The API server uses these two fields to pick the schema for validating and storing the resource.
They share network space — so they can reach each other via localhost addresses and must not duplicate ports — and attached volumes. The root filesystem is separate; each container pulls from its own image.
What does kubectl port-forward svc/api 8080:80 do?
A.It opens a path from your machine to the service
B.It publishes the service to the internet on that port
C.It forwards traffic between two Pods
D.It changes the port the service listens on in the cluster
Answer: A
It opens a temporary tunnel from your local machine to a service in the cluster, going through the API server. This lets you access an internal service for testing without exposing it to the internet.
Why should applications not call a Pod IP directly?
A.A Pod's IP changes every time it is recreated
B.A Pod's IP only works within the same Node
C.Calling by IP is slower than calling by service name
D.Kubernetes blocks direct connections between Pods
Answer: A
Because Pod IPs change every time a Pod is recreated — on updates, Node failures, or scaling. A hardcoded address points at nothing after the first replacement. The correct way is to call the Service name.
What values does a Pod restartPolicy take, and what is the default?
A.Always, OnFailure and Never — the default is Always
B.OnFailure and Never — the default is OnFailure
C.Enabled and Disabled — the default is Enabled
D.Always and Never — the default is Never
Answer: A
Three values: always restart (the default), only on failure, and never. The default suits continuously running services; one-off jobs that run and finish need one of the other two values.
A.Storing the manifests that have been applied to the cluster
B.Configuring the default resources for new Pods
C.Storing cluster details and switching between clusters
D.Defining users' permissions in the cluster
Answer: C
The kubeconfig file stores cluster endpoints, credentials, and the default namespace. Each context is that triple, so working with multiple clusters just means switching context instead of retyping parameters on every command.
Scaling a Deployment from 3 to 5 replicas — which fits declarative workflow?
A.Edit the resource in place with the edit command
B.Run the scale command directly against the cluster
C.Edit the manifest in the repository and reapply it
D.Delete the Deployment and recreate it with the new count
Answer: C
Edit the manifest in the repository and re-apply it. A direct scale command gives an immediate result but creates drift: the next manifest apply reverts the replica count to the old value, and nobody understands why.
How do liveness and readiness probes differ in what happens when they fail?
A.Liveness failure → restart the container; readiness failure → remove it from the Service
B.A readiness failure means the Pod is deleted and recreated
C.Liveness runs once at startup while readiness runs continuously
D.Both restart the container, differing only in check frequency
Answer: A
Liveness answers "is the process still alive?" — on failure the container restarts. Readiness answers "is it ready to receive requests?" — on failure it is removed from the Service while the container keeps running. Confusing the two causes unnecessary restart loops.
A.The two are the same, limits is just the old name for requests
B.requests is the hard ceiling while limits is a recommendation
C.requests is the guaranteed amount used for scheduling; limits is a hard ceiling
D.Exceeding the memory limits only slows the Pod down rather than killing it
Answer: C
requests is the guaranteed level, used by the scheduler to find a Node with enough room. limits is the ceiling. Exceeding the CPU limit throttles the container instead of killing it; exceeding the memory limit gets it killed by the kernel with exit code 137, because memory can't be compressed.
With 10 HTTP services needing internet access, why is an Ingress usually better than 10 LoadBalancer Services?
A.Many services share ONE entry point, routed by host and path
B.LoadBalancer only works for internal services and cannot face the internet
C.Ingress is faster because it bypasses the Service layer
D.Ingress automatically encrypts all traffic between Pods in the cluster
Answer: A
Each LoadBalancer Service usually costs one load balancer and one public IP — 10 services means 10× the cost. An Ingress gives all of them a single entry point, routes by domain and path, and centralizes TLS certificate management.
A Pod is in CrashLoopBackOff. What does that mean?
A.The Pod is waiting for a PersistentVolume to be provisioned
B.No Node has enough resources to schedule the Pod
C.The container starts and exits repeatedly, with kubelet waiting longer each time
D.The image could not be pulled from the registry
Answer: C
The container keeps starting and dying, over and over. The kubelet increases the wait between attempts (10s, 20s, 40s… up to 5 minutes). The logs of the currently running container are usually empty — use kubectl logs <pod> --previous to read the logs of the run that just died.
Why should a database run as a StatefulSet rather than a Deployment?
A.A StatefulSet backs the data up automatically on a schedule
B.Each Pod gets a stable identity and its own disk
C.A StatefulSet is faster because it skips the ReplicaSet layer
D.A Deployment cannot attach a volume to its Pods
Answer: B
A StatefulSet gives Pods stable, ordered names (db-0, db-1), each with its own PersistentVolumeClaim that follows it. If a Pod dies and is recreated, it is still db-0 and still attached to the same old disk. With a Deployment, Pod names are random and there is no such binding.
Question 6·Deployment & Rollout· select all that apply
Which statements about a Deployment rolling update are correct? (select all that apply)
A.Rolling back with kubectl rollout undo also restores the database's data to its pre-deployment state
B.During the rollout the old and new versions run side by side — so the application must be backward compatible, especially with the database schema
C.The readiness probe decides when a new Pod counts as ready for the rollout to continue — without it Kubernetes treats the Pod as ready the moment the container runs, and may send traffic to a Pod that has not finished starting
D.maxSurge and maxUnavailable control the transition rate — how many extra Pods may be created and how many may be missing during the update
Answer: B, C, D
maxSurge/maxUnavailable control the pace; two versions run side by side, so they must be backward compatible; the readiness probe is what actually makes the rollout zero-downtime. A rollback only reverts the code version — not data or schema.
A Pod is Pending and kubectl describe reports FailedScheduling. What is the most common cause?
A.No Service has been created so the Pod has no address
B.The Pod's image is broken so it cannot start
C.The liveness probe failed on its first attempt
D.No Node has enough resources or satisfies the Pod's constraints
Answer: D
The scheduler could not find a suitable Node. Two groups of causes: insufficient resources (total requests on the Node are already full) or unsatisfied constraints (nodeSelector, affinity, taint, or a PVC that cannot be attached). kubectl describe pod states the reason for each rejected Node.
How do a PersistentVolume (PV) and a PersistentVolumeClaim (PVC) relate?
A.A PV belongs to a Pod and a PVC belongs to a Node
B.A PVC is a backup of a PV
C.A PVC is a storage REQUEST declared by the developer side
D.PV and PVC are two names for the same resource
Answer: C
A PVC is the request ("I need 20Gi, writable from one Node"), and a PV is the actual disk that satisfies it. With a StorageClass, the PV is provisioned automatically when the PVC appears. This two-layer split means the application manifest does not need to know what the underlying storage infrastructure is.
You edit a ConfigMap value that a Pod consumes as an environment variable. Does the Pod pick up the new value?
A.Yes, environment variables are kept in sync with the ConfigMap continuously
B.Yes, but only after re-running kubectl apply on the Deployment
C.No — environment variables are read once at startup
D.No, and a file mount does not update either
Answer: C
No. Environment variables are fixed at container startup. To apply it you must recreate the Pod: kubectl rollout restart deployment/<name>. If the ConfigMap is mounted as a file, the file contents do update on their own (with about a minute of delay), but the application has to re-read the file itself.
How does kubectl apply differ from kubectl create?
A.create is for YAML files while apply is for command-line arguments
B.create creates and errors if it exists; apply creates or updates
C.apply can only update Deployments; other resource types need create
D.They are the same, apply is just the new name for create
Answer: B
create errors out if the resource already exists. apply creates or updates depending on state, and running it any number of times yields the same result. That is why apply is the choice for CI/CD and GitOps — the YAML file in Git is the source of truth.
A.Marking a Node that is having problems so the system skips it
B.Limiting the resources a Pod may use on a Node
C.A Pod picks a Node with matching labels to run on
D.A Node refuses Pods unless the Pod tolerates the taint
Answer: D
Node pushes Pods away: it rejects every Pod except those declaring they tolerate that taint. This is the opposite direction of label-based selection, where the Pod actively chooses the node.
A.Preferring to place related Pods on the same Node
B.Preventing two different Deployments from running in the same namespace
C.Spreading replicas across Nodes so the workload survives losing one
D.Limiting the maximum number of Pods per Node
Answer: C
Spreading replicas across multiple nodes or zones so losing one node doesn't take down the whole service. Without it, the scheduler can place all three replicas on the same node.
How do ClusterIP, NodePort and LoadBalancer service types differ?
A.By protocol: TCP, UDP and HTTP
B.By reachability scope: inside the cluster, through the Node, or an external LB
C.By whether the service supports TLS
D.By the load distribution algorithm across Pods
Answer: B
By scope of access. The first is only reachable inside the cluster. The middle one opens a port on every node. The last asks the cloud provider to create an external load balancer — and it costs money for each service.
B.The Gateway API separates the roles and standardizes what used to be annotations
C.The Gateway API is only for internal cluster traffic
D.Ingress supports more protocols than the Gateway API
Answer: B
The newer mechanism separates roles — cluster admins declare the entry points, app teams declare routes — and standardizes features the older mechanism had to express through per-controller annotations.
What is the default NetworkPolicy behaviour in a namespace?
A.Everything is allowed until a policy selects the Pod
B.Only traffic within the same namespace is allowed
C.Only outbound internet traffic is blocked
D.Everything is blocked until an allowing policy is declared
Answer: A
Allow everything — every Pod can reach every other Pod, including in other namespaces. But as soon as one policy selects a Pod, all traffic not explicitly allowed is blocked for that Pod.
A.Declaring a storage type so PVs are created automatically for a PVC
B.Limiting how much capacity each namespace may use
C.Classifying data by sensitivity level
D.Defining how a volume's data is backed up
Answer: A
Declaring a type of storage — SSD, standard disk, shared file system — so the system automatically creates volumes on demand. Without it, an admin has to manually create each volume in advance before apps can use it.
Does deleting a StatefulSet delete its PersistentVolumeClaims?
A.No — PVCs are kept
B.Yes — every child resource is deleted with it
C.It depends on the StorageClass's policy
D.They are only deleted if the StatefulSet has fewer than three replicas
Answer: A
No. The volume claims are retained to protect data — a deliberate safe default. But it also lets orphaned claims pile up and burn storage cost if nobody cleans them up.
B.Yes, but only when the cluster runs on a cloud provider
C.No — only base64; storage-layer encryption must be enabled
D.Not needed because they only live in memory
Answer: C
No. They are only base64-encoded — an encoding for transport, not a security measure, and anyone can decode it. You need to enable encryption at the cluster's storage layer, or use an external secret manager.
B.An account for administrators to log into the cluster
C.A way to group Pods for common management
D.An account for a Pod to reach an external database
Answer: A
It is the Pod's identity when calling the cluster's API server, and it gets permissions through role-based access control. If you don't specify one, the Pod uses the namespace's default account — which is usually granted far too much.
What do maxSurge and maxUnavailable control in a rolling update?
A.How fast new Pods are created, in Pods per second
B.The resource limits during the deployment
C.How many extra Pods may be created and how many may be missing during the update
D.How many times to retry when a new Pod fails to start
Answer: C
The first is how many Pods may be created above the desired replica count; the second is how many Pods may be missing during the update. Setting the latter to zero means the service never loses capacity during a rollout.
How do you roll a Deployment back to a previous version?
A.Restore from a cluster backup
B.Delete the Deployment and recreate it with the old image
C.The rollout undo command — Kubernetes keeps the old ReplicaSets in history
D.It cannot be rolled back; deploy the old version as a new release
Answer: C
Use the deployment's rollback command. Kubernetes keeps old ReplicaSets around, so it just scales the old one up and the new one down. The number of retained revisions is configurable.
What does a PodDisruptionBudget protect a workload from?
A.A rolling update creating too many Pods at once
B.Voluntary operations such as draining a Node taking too many Pods away
C.A Node failing abruptly and losing the Pods
D.A Pod being killed for exceeding its memory limit
Answer: B
Voluntary disruptions — draining a node for maintenance, cluster autoscaling down, node upgrades — that would take out too many Pods at once. It does not protect against involuntary failures like a node dying suddenly.
What does a startup probe solve that a liveness probe cannot?
A.An application needing to check its database connection
B.A slow-starting application being killed too early by liveness
C.An application needing to run migrations before starting
D.An application needing to initialize data before accepting requests
Answer: B
Slow-starting applications — big JVMs, apps that load a lot of data — get killed by the liveness probe before they are ready, creating an endless restart loop.
B.Jobs are for short tasks; CronJobs for long ones
C.A Job runs to completion; a CronJob creates Jobs on a schedule
D.A Job runs on one Node; a CronJob runs on every Node
Answer: C
The first runs Pods to completion and then stops, unlike a regular deployment which keeps Pods running forever. The second creates the first on a schedule, cron-style.
C.Running an auxiliary function alongside the main container
D.Running before the main container and then exiting
Answer: C
Runs a supporting function alongside the main container in the same Pod, sharing the network namespace and volumes. Because of the shared network, the two containers call each other via internal addresses without going through a service.
Packages a set of manifests into a parameterized unit so it can be installed across many environments with different values. Without it, each environment needs its own copy of the manifests and they gradually drift apart.
How does the Cluster Autoscaler differ from the HorizontalPodAutoscaler?
A.One adds and removes Nodes; the other adds and removes Pods
B.They do the same thing, differing only by provider
C.One runs inside the cluster; the other outside
D.One goes by CPU; the other by memory
Answer: A
One adds and removes nodes when Pods can't be scheduled or when nodes are underutilized. The other adds and removes Pod replicas based on load metrics. They cooperate: if Pods scale up with insufficient nodes, the Pods stay stuck in Pending.
What did Pod Security Standards replace, and what do they do?
A.They replaced ResourceQuota; they limit resources per namespace
B.They replaced RBAC; they manage user permissions
C.They replaced NetworkPolicy; they control traffic between Pods
D.They replaced PodSecurityPolicy; they apply three policy levels per namespace
Answer: D
Replaces the old Pod security policy mechanism that was removed. It enforces three levels — privileged, baseline, and restricted — per namespace via labels, with three modes: enforce, audit, or warn.
What are the main components of the Kubernetes control plane?
A.kubelet, kube-proxy and the container runtime
B.The Ingress controller and the service mesh
C.The API server, etcd, the scheduler, and the controllers
D.Docker, containerd and CRI-O
Answer: C
The API server is the single entry point, the distributed store holds all state, the scheduler decides which node a Pod runs on, and the controller manager brings actual state in line with desired state.
What order should upgrading a production Kubernetes cluster follow?
A.The Nodes first and then the control plane
B.Control plane first, then each Node; no more than 1 minor
C.Upgrade everything simultaneously to avoid version skew
D.Jump straight to the newest version to save effort
Answer: B
Control plane first, then nodes one at a time, and each time only advance one minor version. Node components may lag behind by a few versions but must never run ahead.
A.The image could not be pulled: wrong name/tag or missing registry credentials
B.The image is so large that it times out
C.The image was pulled but the container did not start
D.The Node has no disk space to store the image
Answer: A
The container image cannot be pulled. Three common causes: wrong name or tag, missing credentials for a private registry, or a registry unreachable from the node. Describing the Pod shows the specific error message.
How do you debug a running pod whose image has no shell?
A.It cannot be debugged; you must rely entirely on the logs
B.SSH into the Node and use the container runtime's tools
C.Use an ephemeral container attached to that Pod
D.Add a shell to the image and redeploy
Answer: C
Use ephemeral containers: a command that attaches an extra container from a different image into the same namespace as the running Pod. It brings diagnostic tools without adding anything to the production image.
How should logs be collected from pods in a cluster?
A.Write the logs to a shared volume and read them from there
B.The application writes to stdout and a per-Node agent reads and forwards it
C.Each application sends its logs to the central system itself
D.Use the log-viewing command when needed rather than collecting
Answer: B
The application writes to standard output, and an agent running on each node reads it and forwards it to a centralized collection system. Logs stored inside the Pod are lost when the Pod is recreated — and that happens constantly in a cluster.
Which metrics should monitoring a Kubernetes cluster cover?
A.Just the number of running Pods per namespace
B.Just the Nodes' CPU and memory
C.Node resources, workload state, and application metrics
D.Just the logs, since logs contain everything
Answer: C
Three layers: node resources, workload state — ready replicas, restart counts, pending Pods — and the application's own metrics such as error rate and latency.
How can a pod restart automatically when a ConfigMap changes?
A.Set an auto-reload option in the ConfigMap declaration
B.Put a ConfigMap hash in an annotation of the Pod template
C.Delete the Pod by hand after each configuration change
D.Kubernetes restarts the Pod automatically when the ConfigMap changes
Answer: B
Compute a hash of the config contents and attach it to the Pod template's annotation. Changing the config changes the hash, the template changes, and the deployment mechanism treats it as a new version and redeploys automatically.
A.A web interface for administrators to work with the cluster
B.A packaging format replacing Helm
C.A CRD defines a new resource type
D.A script running on a schedule to check the cluster's state
Answer: C
A custom resource definition adds a new resource type to the API, and a controller watches it and reconciles the actual state to match the declared one. It packages human operational knowledge into code that runs continuously.
A.By the name of the Deployment that created those Pods
B.By a label selector
C.By the namespace the Pod belongs to
D.By the port the container is listening on
Answer: B
By label selector, with no knowledge of which workload created the Pod. So changing a Pod's labels removes it from the service immediately — and that is the mechanism behind many deployment techniques.
What is the simplest way to do a canary deployment in Kubernetes?
A.It is impossible without installing a service mesh
B.Two Deployments sharing a common label, with the ratio set by Pod counts
C.One Deployment with two different images
D.Change the image and pause the rollout midway
Answer: B
Two workloads with the same shared label that the service selects, but different version labels. Traffic share follows the Pod count ratio — one new Pod to nine old Pods gives about ten percent.
What are the characteristics of an emptyDir volume?
A.It lives with the Pod and is shared between its containers
B.It always lives in RAM so it is very fast
C.It persists on the Node forever even after the Pod is deleted
D.It can be shared between Pods on the same Node
Answer: A
It lives with the Pod's lifecycle: shareable between containers in the Pod, survives container restarts, but is lost entirely when the Pod is deleted or moved to another node.
A.High-priority Pods are scheduled first and may evict lower-priority ones
B.Low-priority Pods are restarted more often
C.High-priority Pods are given more CPU
D.High-priority Pods start faster
Answer: A
High-priority Pods are scheduled first in the queue, and when the cluster is short on space, the scheduler can evict lower-priority Pods to make room for it.
Should multiple environments be separated by namespace or by separate clusters?
A.A separate cluster for production
B.Namespaces are enough for every environment because they isolate completely
C.Always use a separate cluster for every environment
D.Use one namespace and distinguish by labels
Answer: A
Use a separate cluster for production; namespaces are enough to separate less critical environments. Namespaces isolate at the logical layer — permissions, quotas, names — but Pods still share nodes and the OS kernel.
A.They reject or modify resources before they are written
B.They limit the resources a namespace may use
C.They decide which Node a Pod is scheduled onto
D.They control who may log into the cluster
Answer: A
They block or modify a resource before it is written to the datastore. That lets you enforce organizational rules: require an owner label, ban images from untrusted sources, or inject default security settings.
A Deployment reports full replicas but users still get errors. What do you check?
A.The Pods' restart counts
B.The Service's endpoints and the readiness probe
C.The remaining disk space on the Nodes
D.The cluster's current Kubernetes version
Answer: B
Check the resource that lists the service's endpoints: a Pod that is running but has not passed its readiness probe is not in that list, so the service has no endpoints to send traffic to.
What does a pod being OOMKilled mean, and how is it handled?
A.The application exited itself because of an allocation error
B.The Node ran out of memory so every Pod on it was killed
C.The container exceeded its memory limit and was killed by the kernel
D.The liveness probe failed so the container was restarted
Answer: C
The container exceeded its declared memory limit and was killed by the kernel. The fix is to measure actual usage and adjust the limit — and check whether this is real demand or a memory leak.
A pod must call an external API from a fixed IP. How?
A.Set an environment variable declaring the desired source address
B.A NAT gateway at the cluster's network layer, not declared in the Pod
C.Assign a static IP address to the Pod in its declaration
D.Use a LoadBalancer Service for the outbound traffic
Answer: B
Configure a network address translation gateway at the cluster's network layer so all egress traffic shares the same address. This is infrastructure configuration, not something declared in the Pod — Pod addresses change constantly.
How should a database migration run before deploying a new version?
A.A separate Job run beforehand, compatible with both versions
B.Manually, by connecting to the database directly
C.In an initContainer of every Pod
D.Inside the application at startup
Answer: A
A separate job runs before the deployment, and more importantly: the migration must be compatible with both versions of the application. During a rolling deploy, the old and new versions run against the same schema simultaneously.
How does a Service with clusterIP: None differ from a normal one?
A.It blocks access from outside the namespace
B.It skips the Pods' readiness checks
C.It routes to only one Pod
D.It returns each Pod's own address
Answer: D
It does not assign a virtual address: name resolution returns the list of individual Pod IPs instead of an intermediary address. The caller picks a Pod to connect to — necessary when each replica has a distinct role.
A rolling update stalls at 2 of 5 new Pods. Most common cause?
A.The Deployment declares no resource limits
B.The declared replica count exceeds the number of Nodes
C.The new image is too large
D.The new Pods are not passing the readiness probe
Answer: D
The new Pods are not reporting ready. The update only proceeds once new Pods pass the readiness check, ensuring enough replicas keep serving. If the probe fails, the process stalls right there.
What is the drawback of mounting a ConfigMap file with subPath?
A.It works only with ConfigMaps, not with Secrets
B.The file is read-only and cannot be written
C.Only one file can be mounted per Pod
D.The file does not update when the ConfigMap changes
Answer: D
The file is not updated when the ConfigMap changes — its content is frozen at Pod start time. Mounting the whole directory lets the system refresh content, but that approach overwrites every existing file in the target directory.
A Pod is Evicted due to DiskPressure. What happened?
A.The Pod's image was too large to pull
B.The Pod logged beyond the permitted limit
C.The volume mounted into the Pod is full
D.The Node ran out of disk space and pushed the Pod out
Answer: D
The Node ran out of disk space and protected itself by evicting Pods. Kubernetes picks eviction victims based on requested resource overcommitment and priority, so Pods with no declared resource requests get evicted first.
A Node becomes NotReady. What happens to its Pods?
A.They are moved to another Node without restarting
B.They stay as they are until an operator intervenes
C.They are deleted immediately and recreated on another Node
D.They are deleted after a grace period and recreated elsewhere
Answer: D
After a grace period — by default about five minutes — the Pod is marked for deletion and recreated elsewhere. The grace period exists so a brief loss of connectivity doesn't trigger mass rescheduling.
How does a native sidecar in initContainers differ from a regular one?
A.It does not share volumes with the main container
B.It gets its own resources outside the Pod's quota
C.It starts first and does not hold up the Pod's completion
D.It runs on a different Node from the main container
Answer: C
It starts before the main container and doesn't block the Pod from finishing. A regular container only starts after the main one, and with a Job it keeps running so the Pod never completes.
How do topology spread constraints differ from pod anti-affinity?
A.It can control how much skew is allowed between zones
B.It only applies at Node level rather than at zone level
C.It needs no label selector for the Pods
D.It is evaluated after the Pod has already been scheduled
Answer: A
It can express the maximum acceptable skew between zones — for example, no more than one Pod difference. The other only says co-location is forbidden or separation is preferred, so it can't control evenness at high replica counts.
A Pod reports ErrImagePull from a private registry. What must be configured?
A.Pull the image down and push it into the cluster's internal registry
B.A Secret holding the registry credentials
C.Logging into the registry on your own machine before deploying
D.Network access from the Node to the registry
Answer: B
Create a Secret holding the registry credentials and reference it in the Pod, or attach it to the ServiceAccount the Pod uses. The image puller runs on the Node and needs these credentials; it doesn't use local machine credentials.
How does the VerticalPodAutoscaler differ from the horizontal one?
A.It runs entirely on the Node side rather than in the control plane
B.It only works with stateful workloads
C.It adjusts the number of Nodes in the cluster rather than of Pods
D.It adjusts each Pod's resources
Answer: D
It adjusts the resource requests of each Pod instead of the number of Pods. It suits applications that can't scale horizontally, but applying new values usually requires recreating the Pod, so it causes disruption when there are few replicas.
