70 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
View recommended Kubernetes resources →
In Kubernetes, which resource is typically used to maintain the desired number of Pod replicas and handle rolling updates?
Answer: Deployment
A Deployment manages ReplicaSets to maintain the desired number of Pods and supports rolling updates and rollbacks for common workloads.
In Kubernetes, which resource provides a stable virtual IP or DNS name for a group of Pods and abstracts the communication target?
Answer: Service
A Service provides a stable network endpoint for Pods selected by labels, regardless of Pod replacement or rescheduling.
In Kubernetes, which resource is suitable for passing non-sensitive application settings to Pods?
Answer: ConfigMap
A ConfigMap is used to pass non-sensitive configuration data, such as configuration files and environment variables, to containers.
In Kubernetes, which resource is used to handle sensitive information such as passwords and tokens?
Answer: Secret
A Secret is the Kubernetes resource for sensitive information. In practice, RBAC, encryption, and external secret management should also be considered.
What is the main purpose of a Kubernetes livenessProbe?
Answer: To check whether a container is alive and restart it if it is unhealthy
A livenessProbe is a health check used to restart a container when the application becomes stuck or unhealthy. It has a different role from a readinessProbe.
In Kubernetes, which resource is commonly used as an HTTP/HTTPS entry point that routes traffic to Services based on host names or paths?
Answer: Ingress
An Ingress defines external HTTP/HTTPS routing rules. An Ingress Controller is required to make those rules work in a cluster.
In Kubernetes, what is used as the runtime identity assigned to a Pod for RBAC and cloud integration?
Answer: ServiceAccount
A ServiceAccount acts as the identity a Pod uses when accessing the Kubernetes API or external cloud resources.
You want to list the status of Pods in the current Namespace. Which basic command is appropriate?
Answer: kubectl get pods
kubectl get pods lists Pods in the current Namespace and shows fields such as READY, STATUS, and RESTARTS. It is commonly used as the first step in troubleshooting.
A specific Pod is failing to start. You want to inspect details such as events, environment variables, volumes, and probe settings. Which command is appropriate?
Answer: kubectl describe pod <pod-name>
kubectl describe pod displays Pod details, container state, and recent events. It is useful for investigating causes such as ImagePullBackOff or probe failures.
You want to inspect the standard output logs of an application container. For a single-container Pod, which basic command is used?
Answer: kubectl logs <pod-name>
kubectl logs <pod-name> displays logs from a container in a Pod. For multi-container Pods, use -c <container-name> to select the target container.
You want to temporarily open a shell inside a Pod to inspect files and environment variables. Which command is commonly used?
Answer: kubectl exec -it <pod-name> -- sh
kubectl exec runs a command inside a container. -it is used for interactive sessions, and the command to run inside the container follows --.
You want to apply a modified Deployment manifest named deployment.yaml to the cluster. Which command fits declarative management?
Answer: kubectl apply -f deployment.yaml
kubectl apply -f declaratively applies YAML or other manifest files to the cluster. It is commonly used when managing configuration changes over time.
You want to list Pods in the dev Namespace. Which command is appropriate?
Answer: kubectl get pods -n dev
Use -n or --namespace to specify a Namespace. --context selects a kubectl context such as a cluster and user, not a Namespace.
You want to temporarily change the replica count of Deployment web to 3. Which command is appropriate?
Answer: kubectl scale deployment web --replicas=3
kubectl scale changes the replica count for resources such as Deployments and ReplicaSets. In GitOps-style operations, permanent changes should also be reflected in manifests.
You want to check whether the update of Deployment api is progressing successfully. Which command checks rollout status?
Answer: kubectl rollout status deployment/api
kubectl rollout status deployment/api checks the rollout progress of a Deployment. It is useful as an initial check when an update appears stuck.
You want to delete the unused Namespace sandbox, noting that resources inside it will also be removed. Which command is used?
Answer: kubectl delete namespace sandbox
kubectl delete namespace sandbox deletes the Namespace. Many resources inside the Namespace are also deleted, so verify the target environment before running it.
Before operating, you want to confirm which cluster, user, and Namespace kubectl currently targets. Which command is appropriate?
Answer: kubectl config current-context and kubectl config view --minify
kubectl config current-context shows the current context name. kubectl config view --minify displays configuration narrowed to the current context, including cluster, user, and Namespace-related settings.
You need to tell the Scheduler how much CPU a Pod needs while also setting the container's maximum CPU usage. Which pair should you configure?
Answer: requests and limits
Requests are used as scheduling requirements, while limits cap the resources a container may consume.
An application is running but temporarily cannot serve requests because its database connection is down. Which probe removes the Pod from Service endpoints without restarting it?
Answer: readinessProbe
When readiness fails, the Pod becomes unready and is normally removed from Service endpoints without restarting its container.
Which resource is commonly used to automatically change a Deployment's Pod count based on CPU utilization?
Answer: HorizontalPodAutoscaler
A HorizontalPodAutoscaler adjusts the target workload's replica count using metrics such as CPU utilization.
During a voluntary Node drain, at least two web application Pods should remain available. What should you configure?
Answer: minAvailable in a PodDisruptionBudget
A PodDisruptionBudget limits how many Pods may be unavailable during voluntary disruptions such as drain; it does not prevent involuntary failures.
In one Namespace, inbound Pod traffic should be denied unless explicitly allowed. What is the basic approach?
Answer: Create a default-deny NetworkPolicy and allow required traffic with additional policies
With a NetworkPolicy-capable CNI, select Pods with a default-deny ingress policy and add policies that permit only required sources and ports.
You want to package multiple Kubernetes manifests and distribute them with reusable, configurable values. What is the central Helm unit for this?
Answer: Chart
A Helm chart packages Kubernetes resource templates and default values. Environment-specific differences are usually handled through values.
You deploy the same Helm chart to dev and prod, but prod needs different replica counts and image tags. What is commonly edited or supplied?
Answer: values.yaml or an additional values file
Helm renders templates using values. Environment-specific differences are commonly supplied through values.yaml, extra values files, or --set.
You want to deploy a chart from a repository for the first time and manage it as a Helm release. Which basic command is appropriate?
Answer: helm install
helm install creates resources from a chart and records them as a named release. helm repo update only refreshes local repository indexes.
You need to update an existing Helm release with a new chart version or values. Which command should you use?
Answer: helm upgrade
helm upgrade updates an existing release with a chart and values. With --install, it can install the release if it does not already exist.
You want to inspect the Kubernetes manifests rendered from a Helm template without applying them to the cluster. What is appropriate?
Answer: helm template
helm template renders a chart locally and prints the generated YAML, which is useful for CI checks and review.
A Helm release update failed and you want to return to a previous good revision. Which command is used?
Answer: helm rollback
helm rollback returns a release to a specified revision. helm history helps identify the revision to use.
In a Helm chart, which file describes chart metadata such as the chart API version and application version?
Answer: Chart.yaml
Chart.yaml contains chart metadata such as name, version, and appVersion. values.yaml contains default values passed to templates.
You want to remove a Helm release and normally delete the Kubernetes resources created from its chart. Which command is used?
Answer: helm uninstall
helm uninstall removes a release and normally deletes the Kubernetes resources managed by that release.
You want to temporarily prevent new Pods from being scheduled onto a Node without immediately evicting existing Pods. Which kubectl action is appropriate?
Answer: kubectl cordon
cordon marks a Node unschedulable for new Pods. drain is used when existing Pods should be evicted.
You want to restart a Deployment's Pods in order without changing the manifest. Which command is commonly used?
Answer: kubectl rollout restart deployment/<name>
kubectl rollout restart triggers a rolling restart by updating the Pod template for workloads such as Deployments.
You want to check whether a Deployment rollout is progressing or stuck. Which command is commonly used?
Answer: kubectl rollout status deployment/<name>
rollout status checks completion and progress for rollouts such as Deployments. describe and logs help investigate failures.
You want to limit total CPU and memory consumption per Namespace to prevent a team from overusing shared cluster resources. Which resource is used?
Answer: ResourceQuota
A ResourceQuota sets limits on aggregate resource counts and CPU or memory requests within a Namespace.
You want to minimize each application's permissions when its Pod accesses the Kubernetes API. Which Kubernetes resource should you associate first?
Answer: ServiceAccount
A Pod can be associated with a ServiceAccount. Permissions are granted with Role or ClusterRole bindings using least privilege.
You want to allow a user to list Pods only within one Namespace, without granting cluster-wide permissions. Which combination is appropriate?
Answer: Role and RoleBinding
For Namespace-scoped permissions, define a Role and bind it with a RoleBinding in that Namespace. ClusterRoleBinding grants broader scope.
You want to enforce stronger Pod security settings per Namespace, such as preventing root execution and privileged containers. Which mechanism is commonly used?
Answer: Pod Security Admission
Pod Security Admission applies Pod Security Standards through Namespace labels and can enforce security requirements when Pods are created.
An application needs durable storage while staying decoupled from the actual storage implementation. Which claim resource is referenced by the Pod?
Answer: PersistentVolumeClaim
A Pod references a PVC to request capacity and access modes. A PV is the backing volume, and a StorageClass describes dynamic provisioning.
In a cloud environment, you want storage to be created automatically when a PVC is created and let users choose types such as SSD or HDD. Which resource is mainly used?
Answer: StorageClass
A StorageClass defines the provisioner and parameters for dynamic provisioning. PVCs can reference it to create storage automatically.
A Pod remains Pending. Which command should you first use to inspect reasons such as scheduling failures or unbound PVCs?
Answer: kubectl describe pod <pod>
For Pending Pods, containers often are not running yet. describe shows Events such as scheduling failures, insufficient resources, or unbound PVCs.
A Pod is in CrashLoopBackOff. You want to inspect logs from the previous terminated container instance. Which option is appropriate?
Answer: kubectl logs <pod> --previous
The --previous flag retrieves logs from the terminated container instance before the restart, which is useful for CrashLoopBackOff investigation.
You want external HTTP access to an app and route different hostnames or paths to multiple Services. Which resource is mainly defined?
Answer: Ingress
Ingress defines HTTP/HTTPS entry rules and routes by host or path to Services. An Ingress Controller is required to implement those rules.
A Pod repeatedly restarts and its previous termination reason is OOMKilled. What is the most appropriate thing to review first?
Answer: Review actual memory usage and memory requests/limits, then tune the application or limits
OOMKilled indicates that the container exceeded its available memory. Inspect metrics, usage patterns, requests/limits, and possible leaks before making an evidence-based adjustment.
A new Pod enters ImagePullBackOff. Which combination should you check first?
Answer: Pod Events, the image name and tag, and registry imagePullSecrets
For ImagePullBackOff, inspect describe Events and distinguish among a missing tag, registry reachability, and registry authentication configuration.
A new Deployment version sharply increases errors, so you need to return quickly to the previous healthy revision. Which command is appropriate?
Answer: kubectl rollout undo deployment/<name>
rollout undo returns a Deployment to an earlier revision. Afterward, verify recovery with rollout status and application metrics.
An application takes several minutes to start, and failing liveness probes restart it repeatedly during startup. What is the appropriate improvement?
Answer: Configure a startupProbe so liveness and readiness checks wait until startup succeeds
A startupProbe detects completion of slow initialization and suppresses liveness/readiness checks until it succeeds, while retaining normal health checks afterward.
In a cluster spanning three availability zones, you want to prevent an application's Pods from concentrating in one zone. Which setting is appropriate?
Answer: Configure topologySpreadConstraints using the zone label
topologySpreadConstraints controls skew of matching Pods across topology domains such as zones.
A Service ClusterIP has no responding backends, and its EndpointSlice shows no endpoints. What should you check first?
Answer: Whether the Service selector matches the target Pod labels
If selectors do not match Pod labels, the Service selects no backends and Pod IPs do not appear in its EndpointSlice.
Only DNS resolution of api.backend.svc.cluster.local fails from a Pod. Which troubleshooting step is appropriate?
Answer: Run a DNS lookup from the Pod and check the Service name, Namespace, and CoreDNS health
For cluster DNS issues, inspect lookup results in the caller Pod, verify the Service name and Namespace in the FQDN, then check CoreDNS Pods, logs, and Service.
You need to expand a PVC used by a running application. Which prerequisite should you mainly verify?
Answer: The StorageClass allows expansion and the CSI driver or provisioner supports it
PVC expansion requires allowVolumeExpansion on the StorageClass plus driver and storage-platform support. Also verify filesystem expansion requirements.
You need to operate a data store whose replicas require stable names and individual persistent volumes. Which workload is appropriate?
Answer: StatefulSet
A StatefulSet gives Pods stable ordinal identities and can manage a dedicated PVC per replica through volumeClaimTemplates.
For a typical Linux container, you want the runtime's default profile to restrict unnecessary system calls. What should you set in securityContext?
Answer: seccompProfile.type: RuntimeDefault
RuntimeDefault uses the container runtime's default seccomp profile to restrict system calls. Test workload compatibility before enforcement.
A CPU-based HPA shows <unknown> for TARGETS and does not change the replica count. What should you check first?
Answer: Metrics API availability and CPU requests on the target containers
A utilization-based HPA needs metrics from the Metrics API and resource requests as the utilization baseline. Also inspect HPA describe events.
For a CronJob that runs every five minutes, you do not want a new Job to start while the previous run is still active. Which setting should you use?
Answer: concurrencyPolicy: Forbid
With concurrencyPolicy set to Forbid, a CronJob skips starting a new Job when the previous run is still active. Monitor runtime relative to the schedule interval.
When a Job's Pods keep failing, you want the Job to stop after a bounded number of retries. What should you mainly configure?
Answer: backoffLimit
A Job's backoffLimit controls the retry limit after failures. Consider activeDeadlineSeconds as well when the execution also needs a time limit.
You want one log collection agent on every selected Node, including Nodes added later. Which workload is appropriate?
Answer: DaemonSet
A DaemonSet places a Pod on every matching Node, making it suitable for resident logging, monitoring, and networking agents.
GPU Nodes have the taint dedicated=gpu:NoSchedule. What is minimally required to make a GPU workload eligible for scheduling there?
Answer: Add a matching toleration to the Pod
A matching toleration is required to schedule a new Pod onto a Node with a NoSchedule taint. A toleration alone does not force placement there, so node affinity is commonly added.
A Pod must run only on Nodes carrying a particular compliance label. Which setting expresses flexible label requirements?
Answer: nodeAffinity with requiredDuringSchedulingIgnoredDuringExecution
Required node affinity permits scheduling only when the Node label requirements match. IgnoredDuringExecution means a later label change does not automatically evict the Pod.
When cluster resources are scarce, you want critical system Pods to be scheduled ahead of lower-priority Pods. Which mechanism should you use?
Answer: Create a PriorityClass and set priorityClassName on the Pod
PriorityClass represents Pod scheduling priority. Depending on configuration, lower-priority Pods may be preempted for higher-priority Pods, so assess the impact.
Before the main container starts, a configuration generation step must complete successfully; if it fails, the main container must not start. What should you use?
Answer: An init container
Init containers run sequentially before application containers, which start only after all init containers succeed. Generated files can be passed through a shared volume.
Within a Namespace, you want defaults for omitted requests and limits and constraints on minimum and maximum values per container. Which resource should you use?
Answer: LimitRange
A LimitRange defines default requests and limits plus minimum and maximum values for objects such as containers in a Namespace. Use ResourceQuota for aggregate Namespace limits.
You want a Pod to receive the Guaranteed QoS class. What resource configuration is required for CPU and memory?
Answer: Set CPU and memory requests and limits for every container, with each request equal to its limit
Guaranteed QoS requires CPU and memory requests and limits on every container, with the request equal to the limit for each resource.
A container writes many temporary files, and you need to manage eviction risk from Node disk pressure. Which resource should you configure and monitor?
Answer: ephemeral-storage requests and limits
Local ephemeral storage supports ephemeral-storage requests and limits. Monitor usage from emptyDir, writable layers, logs, and Node DiskPressure.
A value is stored as base64 under data in a Secret manifest. Which security statement is correct?
Answer: Base64 is encoding, not encryption, so controls such as RBAC and encryption at rest are still needed
Base64 is a reversible representation and provides no confidentiality. Combine least-privilege RBAC, etcd encryption at rest, external secret management, and repository hygiene.
A ClusterRole already exists, and you need to grant a user permission to read Nodes across the cluster. Which resource binds it cluster-wide?
Answer: ClusterRoleBinding
A ClusterRoleBinding grants ClusterRole permissions to subjects cluster-wide. Nodes are cluster-scoped, so a RoleBinding limited to one Namespace does not satisfy the requirement.
You need to investigate afterward who read or changed Secrets through the Kubernetes API. What should you primarily enable and collect?
Answer: Record API Server audit logs with an appropriate audit policy
Kubernetes audit logs can record the subject, action, object, and result of API requests. Design the audit policy, retention, and access controls without exposing Secret values.
You need stable DNS names such as pod-0.service.namespace.svc for direct access to individual StatefulSet Pods. Which Service setting should accompany it?
Answer: A headless Service with clusterIP: None
Combining a StatefulSet with a headless Service provides DNS records based on stable Pod names. This differs from load balancing through one virtual IP.
In a Namespace with default-deny egress, an application must connect to an approved external API by name. Which additional allowance is commonly overlooked?
Answer: Egress required for name resolution, such as UDP/TCP port 53 to cluster DNS
With default-deny egress, traffic to cluster DNS such as CoreDNS must be allowed in addition to the external API. Verify the NetworkPolicy capabilities of the CNI.
During an update of a three-replica Deployment, you want at least three Pods available and permit one temporary extra Pod. Which settings should you use?
Answer: maxUnavailable: 0 and maxSurge: 1
maxUnavailable 0 prevents a drop in available replicas, while maxSurge 1 permits one Pod above the desired count temporarily. The cluster must have spare capacity.
When a Pod terminates, it should stop accepting new work and finish in-flight requests before the process exits. Which design should you primarily combine?
Answer: SIGTERM handling, a suitable preStop hook, and sufficient terminationGracePeriodSeconds
Kubernetes normally sends SIGTERM and forcefully terminates the container after the grace period. Design application SIGTERM handling, any needed preStop hook, and a grace period long enough for draining.