Kubernetes Practice Questions & Quiz

In Kubernetes, which resource is typically used to maintain the desired number of Pod replicas and handle rolling updates?

Answer: Deployment

A Deployment manages ReplicaSets to maintain the desired number of Pods and supports rolling updates and rollbacks for common workloads.

In Kubernetes, which resource provides a stable virtual IP or DNS name for a group of Pods and abstracts the communication target?

Answer: Service

A Service provides a stable network endpoint for Pods selected by labels, regardless of Pod replacement or rescheduling.

In Kubernetes, which resource is suitable for passing non-sensitive application settings to Pods?

Answer: ConfigMap

A ConfigMap is used to pass non-sensitive configuration data, such as configuration files and environment variables, to containers.

In Kubernetes, which resource is used to handle sensitive information such as passwords and tokens?

Answer: Secret

A Secret is the Kubernetes resource for sensitive information. In practice, RBAC, encryption, and external secret management should also be considered.

What is the main purpose of a Kubernetes livenessProbe?

Answer: To check whether a container is alive and restart it if it is unhealthy

A livenessProbe is a health check used to restart a container when the application becomes stuck or unhealthy. It has a different role from a readinessProbe.

In Kubernetes, which resource is commonly used as an HTTP/HTTPS entry point that routes traffic to Services based on host names or paths?

Answer: Ingress

An Ingress defines external HTTP/HTTPS routing rules. An Ingress Controller is required to make those rules work in a cluster.

In Kubernetes, what is used as the runtime identity assigned to a Pod for RBAC and cloud integration?

Answer: ServiceAccount

A ServiceAccount acts as the identity a Pod uses when accessing the Kubernetes API or external cloud resources.

You want to list the status of Pods in the current Namespace. Which basic command is appropriate?

Answer: kubectl get pods

kubectl get pods lists Pods in the current Namespace and shows fields such as READY, STATUS, and RESTARTS. It is commonly used as the first step in troubleshooting.

A specific Pod is failing to start. You want to inspect details such as events, environment variables, volumes, and probe settings. Which command is appropriate?

Answer: kubectl describe pod <pod-name>

kubectl describe pod displays Pod details, container state, and recent events. It is useful for investigating causes such as ImagePullBackOff or probe failures.

You want to inspect the standard output logs of an application container. For a single-container Pod, which basic command is used?

Answer: kubectl logs <pod-name>

kubectl logs <pod-name> displays logs from a container in a Pod. For multi-container Pods, use -c <container-name> to select the target container.

You want to temporarily open a shell inside a Pod to inspect files and environment variables. Which command is commonly used?

Answer: kubectl exec -it <pod-name> -- sh

kubectl exec runs a command inside a container. -it is used for interactive sessions, and the command to run inside the container follows --.

You want to apply a modified Deployment manifest named deployment.yaml to the cluster. Which command fits declarative management?

Answer: kubectl apply -f deployment.yaml

kubectl apply -f declaratively applies YAML or other manifest files to the cluster. It is commonly used when managing configuration changes over time.

You want to list Pods in the dev Namespace. Which command is appropriate?

Answer: kubectl get pods -n dev

Use -n or --namespace to specify a Namespace. --context selects a kubectl context such as a cluster and user, not a Namespace.

You want to temporarily change the replica count of Deployment web to 3. Which command is appropriate?

Answer: kubectl scale deployment web --replicas=3

kubectl scale changes the replica count for resources such as Deployments and ReplicaSets. In GitOps-style operations, permanent changes should also be reflected in manifests.

You want to check whether the update of Deployment api is progressing successfully. Which command checks rollout status?

Answer: kubectl rollout status deployment/api

kubectl rollout status deployment/api checks the rollout progress of a Deployment. It is useful as an initial check when an update appears stuck.

You want to delete the unused Namespace sandbox, noting that resources inside it will also be removed. Which command is used?

Answer: kubectl delete namespace sandbox

kubectl delete namespace sandbox deletes the Namespace. Many resources inside the Namespace are also deleted, so verify the target environment before running it.

Before operating, you want to confirm which cluster, user, and Namespace kubectl currently targets. Which command is appropriate?

Answer: kubectl config current-context and kubectl config view --minify

kubectl config current-context shows the current context name. kubectl config view --minify displays configuration narrowed to the current context, including cluster, user, and Namespace-related settings.

You need to tell the Scheduler how much CPU a Pod needs while also setting the container's maximum CPU usage. Which pair should you configure?

Answer: requests and limits

Requests are used as scheduling requirements, while limits cap the resources a container may consume.

An application is running but temporarily cannot serve requests because its database connection is down. Which probe removes the Pod from Service endpoints without restarting it?

Answer: readinessProbe

When readiness fails, the Pod becomes unready and is normally removed from Service endpoints without restarting its container.

Which resource is commonly used to automatically change a Deployment's Pod count based on CPU utilization?

Answer: HorizontalPodAutoscaler

A HorizontalPodAutoscaler adjusts the target workload's replica count using metrics such as CPU utilization.

During a voluntary Node drain, at least two web application Pods should remain available. What should you configure?

Answer: minAvailable in a PodDisruptionBudget

A PodDisruptionBudget limits how many Pods may be unavailable during voluntary disruptions such as drain; it does not prevent involuntary failures.

In one Namespace, inbound Pod traffic should be denied unless explicitly allowed. What is the basic approach?

Answer: Create a default-deny NetworkPolicy and allow required traffic with additional policies

With a NetworkPolicy-capable CNI, select Pods with a default-deny ingress policy and add policies that permit only required sources and ports.

You want to package multiple Kubernetes manifests and distribute them with reusable, configurable values. What is the central Helm unit for this?

Answer: Chart

A Helm chart packages Kubernetes resource templates and default values. Environment-specific differences are usually handled through values.

You deploy the same Helm chart to dev and prod, but prod needs different replica counts and image tags. What is commonly edited or supplied?

Answer: values.yaml or an additional values file

Helm renders templates using values. Environment-specific differences are commonly supplied through values.yaml, extra values files, or --set.

You want to deploy a chart from a repository for the first time and manage it as a Helm release. Which basic command is appropriate?

Answer: helm install

helm install creates resources from a chart and records them as a named release. helm repo update only refreshes local repository indexes.

You need to update an existing Helm release with a new chart version or values. Which command should you use?

Answer: helm upgrade

helm upgrade updates an existing release with a chart and values. With --install, it can install the release if it does not already exist.

You want to inspect the Kubernetes manifests rendered from a Helm template without applying them to the cluster. What is appropriate?

Answer: helm template

helm template renders a chart locally and prints the generated YAML, which is useful for CI checks and review.

A Helm release update failed and you want to return to a previous good revision. Which command is used?

Answer: helm rollback

helm rollback returns a release to a specified revision. helm history helps identify the revision to use.

In a Helm chart, which file describes chart metadata such as the chart API version and application version?

Answer: Chart.yaml

Chart.yaml contains chart metadata such as name, version, and appVersion. values.yaml contains default values passed to templates.

You want to remove a Helm release and normally delete the Kubernetes resources created from its chart. Which command is used?

Answer: helm uninstall

helm uninstall removes a release and normally deletes the Kubernetes resources managed by that release.

You want to temporarily prevent new Pods from being scheduled onto a Node without immediately evicting existing Pods. Which kubectl action is appropriate?

Answer: kubectl cordon

cordon marks a Node unschedulable for new Pods. drain is used when existing Pods should be evicted.

You want to restart a Deployment's Pods in order without changing the manifest. Which command is commonly used?

Answer: kubectl rollout restart deployment/<name>

kubectl rollout restart triggers a rolling restart by updating the Pod template for workloads such as Deployments.

You want to check whether a Deployment rollout is progressing or stuck. Which command is commonly used?

Answer: kubectl rollout status deployment/<name>

rollout status checks completion and progress for rollouts such as Deployments. describe and logs help investigate failures.

You want to limit total CPU and memory consumption per Namespace to prevent a team from overusing shared cluster resources. Which resource is used?

Answer: ResourceQuota

A ResourceQuota sets limits on aggregate resource counts and CPU or memory requests within a Namespace.

You want to minimize each application's permissions when its Pod accesses the Kubernetes API. Which Kubernetes resource should you associate first?

Answer: ServiceAccount

A Pod can be associated with a ServiceAccount. Permissions are granted with Role or ClusterRole bindings using least privilege.

You want to allow a user to list Pods only within one Namespace, without granting cluster-wide permissions. Which combination is appropriate?

Answer: Role and RoleBinding

For Namespace-scoped permissions, define a Role and bind it with a RoleBinding in that Namespace. ClusterRoleBinding grants broader scope.

You want to enforce stronger Pod security settings per Namespace, such as preventing root execution and privileged containers. Which mechanism is commonly used?

Answer: Pod Security Admission

Pod Security Admission applies Pod Security Standards through Namespace labels and can enforce security requirements when Pods are created.

An application needs durable storage while staying decoupled from the actual storage implementation. Which claim resource is referenced by the Pod?

Answer: PersistentVolumeClaim

A Pod references a PVC to request capacity and access modes. A PV is the backing volume, and a StorageClass describes dynamic provisioning.

In a cloud environment, you want storage to be created automatically when a PVC is created and let users choose types such as SSD or HDD. Which resource is mainly used?

Answer: StorageClass

A StorageClass defines the provisioner and parameters for dynamic provisioning. PVCs can reference it to create storage automatically.

A Pod remains Pending. Which command should you first use to inspect reasons such as scheduling failures or unbound PVCs?

Answer: kubectl describe pod <pod>

For Pending Pods, containers often are not running yet. describe shows Events such as scheduling failures, insufficient resources, or unbound PVCs.

A Pod is in CrashLoopBackOff. You want to inspect logs from the previous terminated container instance. Which option is appropriate?

Answer: kubectl logs <pod> --previous

The --previous flag retrieves logs from the terminated container instance before the restart, which is useful for CrashLoopBackOff investigation.

You want external HTTP access to an app and route different hostnames or paths to multiple Services. Which resource is mainly defined?

Answer: Ingress

Ingress defines HTTP/HTTPS entry rules and routes by host or path to Services. An Ingress Controller is required to implement those rules.

A Pod repeatedly restarts and its previous termination reason is OOMKilled. What is the most appropriate thing to review first?

Answer: Review actual memory usage and memory requests/limits, then tune the application or limits

OOMKilled indicates that the container exceeded its available memory. Inspect metrics, usage patterns, requests/limits, and possible leaks before making an evidence-based adjustment.

A new Pod enters ImagePullBackOff. Which combination should you check first?

Answer: Pod Events, the image name and tag, and registry imagePullSecrets

For ImagePullBackOff, inspect describe Events and distinguish among a missing tag, registry reachability, and registry authentication configuration.

A new Deployment version sharply increases errors, so you need to return quickly to the previous healthy revision. Which command is appropriate?

Answer: kubectl rollout undo deployment/<name>

rollout undo returns a Deployment to an earlier revision. Afterward, verify recovery with rollout status and application metrics.

An application takes several minutes to start, and failing liveness probes restart it repeatedly during startup. What is the appropriate improvement?

Answer: Configure a startupProbe so liveness and readiness checks wait until startup succeeds

A startupProbe detects completion of slow initialization and suppresses liveness/readiness checks until it succeeds, while retaining normal health checks afterward.

In a cluster spanning three availability zones, you want to prevent an application's Pods from concentrating in one zone. Which setting is appropriate?

Answer: Configure topologySpreadConstraints using the zone label

topologySpreadConstraints controls skew of matching Pods across topology domains such as zones.

A Service ClusterIP has no responding backends, and its EndpointSlice shows no endpoints. What should you check first?

Answer: Whether the Service selector matches the target Pod labels

If selectors do not match Pod labels, the Service selects no backends and Pod IPs do not appear in its EndpointSlice.

Only DNS resolution of api.backend.svc.cluster.local fails from a Pod. Which troubleshooting step is appropriate?

Answer: Run a DNS lookup from the Pod and check the Service name, Namespace, and CoreDNS health

For cluster DNS issues, inspect lookup results in the caller Pod, verify the Service name and Namespace in the FQDN, then check CoreDNS Pods, logs, and Service.

You need to expand a PVC used by a running application. Which prerequisite should you mainly verify?

Answer: The StorageClass allows expansion and the CSI driver or provisioner supports it

PVC expansion requires allowVolumeExpansion on the StorageClass plus driver and storage-platform support. Also verify filesystem expansion requirements.

You need to operate a data store whose replicas require stable names and individual persistent volumes. Which workload is appropriate?

Answer: StatefulSet

A StatefulSet gives Pods stable ordinal identities and can manage a dedicated PVC per replica through volumeClaimTemplates.

For a typical Linux container, you want the runtime's default profile to restrict unnecessary system calls. What should you set in securityContext?

Answer: seccompProfile.type: RuntimeDefault

RuntimeDefault uses the container runtime's default seccomp profile to restrict system calls. Test workload compatibility before enforcement.