>_SecOpsLog_
Back to the course
Test yourself

Kubernetes fundamentals

Final exam · 57 questions · answers explained as you pick
First steps
10 questions
01What problem does Kubernetes mainly solve?
Incorrect — you write the code; Kubernetes runs it.
Correct — that is exactly what an orchestrator does.
Incorrect — that is a build step (Docker/CI) before Kubernetes.
Incorrect — unrelated to Kubernetes.
02What is the difference between an image and a container?
Incorrect — they are different: a recipe vs a running instance.
Correct — you start many containers from one image.
Incorrect — size is not the distinction.
Incorrect — it is the other way around.
03Which part of a cluster actually runs your containers?
Incorrect — it decides and stores state, but runs no workloads.
Correct — pods run on the workers.
Incorrect — that is the state store.
Incorrect — that is the client tool you type into.
04How do you normally talk to a cluster?
Incorrect — you rarely touch nodes directly.
Correct — kubectl is the remote control.
Incorrect — never edit etcd by hand.
Incorrect — the kubelet uses that, not you.
05A pod shows STATUS: Pending. That usually means it is…
Incorrect — that would show CrashLoopBackOff.
Correct — describe the pod to see why it has not scheduled.
Incorrect — that would be OOMKilled.
Incorrect — that would be Completed.
06What does "declarative" mean in Kubernetes?
Incorrect — that is the imperative style.
Correct — the reconcile loop does the work.
Incorrect — the UI is optional and unrelated.
Incorrect — the opposite — the cluster continuously reconciles.
07The control plane is best described as the cluster’s…
Correct — API server, scheduler, controllers, and etcd live here.
Incorrect — that is the worker nodes.
Incorrect — not a component role.
Incorrect — unrelated.
08What is etcd’s job?
Incorrect — containers run on nodes via the kubelet.
Incorrect — that is a Service / proxy.
Correct — it is the single source of truth for every object.
Incorrect — that happens in CI, not etcd.
09You want to see why a pod will not start. The best command is…
Incorrect — that removes it without telling you why.
Correct — the Events at the bottom explain scheduling/pull/probe problems.
Incorrect — that changes replica count, not diagnosis.
Incorrect — that submits changes; it does not explain failures.
10The reconcile loop means Kubernetes…
Correct — this is why deleted pods come back and rollouts self-drive.
Incorrect — it keeps state matched continuously.
Incorrect — self-healing is automatic.
Incorrect — it runs constantly.
10 questions · explanations appear as you answer
Running your app
10 questions
01What is the smallest thing Kubernetes schedules?
Incorrect — containers live inside pods.
Correct — the pod is the unit Kubernetes places on a node.
Incorrect — nodes are machines, not scheduled workloads.
Incorrect — it manages pods; it is not itself scheduled.
02What keeps a set number of identical pods running?
Incorrect — it places pods, it does not count them.
Correct — matching a count is its entire job.
Incorrect — that runs pods on one node.
Incorrect — that routes traffic, not replica count.
03For a normal stateless app, which object do you use?
Incorrect — a bare pod does not self-heal.
Correct — it manages ReplicaSets and adds updates and rollback.
Incorrect — you let a Deployment manage it for you.
Incorrect — that holds configuration, not the app.
04How do you run more copies of an app?
Incorrect — unrelated to copy count.
Correct — kubectl scale, and the ReplicaSet catches up.
Incorrect — never edit etcd directly.
Incorrect — that does not add copies.
05You delete a pod managed by a Deployment. What happens?
Incorrect — only bare pods stay gone.
Correct — self-healing restores the desired count.
Incorrect — deleting a pod does not delete its owner.
Incorrect — unrelated.
06A new version is broken. How do you get back to the last good one?
Incorrect — no rebuild is needed.
Correct — it restores the previous ReplicaSet instantly.
Incorrect — that destroys everything.
Incorrect — unrelated to rollback.
07The ownership chain for a stateless app is…
Incorrect — that reverses it; you drive the top, not the bottom.
Correct — you manage the Deployment; it drives the rest.
Incorrect — not an ownership chain.
Incorrect — not how ownership works.
08A rolling update avoids downtime by…
Correct — traffic is always served during the swap.
Incorrect — that is the Recreate strategy, which has a gap.
Incorrect — nodes are not part of a rollout.
Incorrect — pods are replaced, not edited.
09A DaemonSet is for…
Incorrect — that is a Deployment/ReplicaSet.
Incorrect — that is a Job.
Correct — it adds a pod as nodes join.
Incorrect — that is a ConfigMap.
10A one-off task that should run to completion uses a…
Incorrect — a Deployment keeps pods running forever.
Correct — a Job runs pods to completion and tracks success.
Incorrect — a Service routes traffic; it runs nothing.
Incorrect — that holds data, not tasks.
10 questions · explanations appear as you answer
Configuring your app
10 questions
01What are labels used for?
Incorrect — labels are plain metadata, not security.
Correct — Services and Deployments match on labels.
Incorrect — that is the resources field.
Incorrect — names are separate from labels.
02A readiness probe fails. What does Kubernetes do?
Incorrect — that is what liveness does.
Correct — readiness gates traffic so it can recover.
Incorrect — it is not deleted.
Incorrect — it stays put to recover.
03A liveness probe fails. What does Kubernetes do?
Incorrect — it does act — it restarts.
Correct — liveness asks "is it still alive?"
Incorrect — unrelated.
Incorrect — unrelated.
04A ConfigMap is meant to hold…
Incorrect — those belong in a Secret.
Correct — so one image runs in every environment.
Incorrect — images live in a registry.
Incorrect — IPs are assigned at runtime.
05By default, a Kubernetes Secret is…
Incorrect — only if you enable encryption at rest.
Correct — it is reversible by anyone who can read it.
Incorrect — it is persisted in etcd.
Incorrect — pods can mount and read it.
06You edit a ConfigMap that pods read as environment variables. The running pods…
Incorrect — env vars are read once, at container start.
Correct — run kubectl rollout restart to apply the change.
Incorrect — they keep running with the old values.
Incorrect — unrelated.
07A safer way for a pod to consume a Secret is…
Correct — a file is read only by code that opens it.
Incorrect — env leaks through crash dumps and child processes.
Incorrect — never bake secrets into an image.
Incorrect — labels are visible metadata.
08A Service finds its pods using…
Incorrect — IPs change; that is why selectors exist.
Incorrect — nodes are not how a Service targets pods.
Correct — the Service routes to pods whose labels match.
Incorrect — unrelated to routing.
09Resource requests tell the scheduler…
Incorrect — that is a limit, not a request.
Correct — placement is based on requests.
Incorrect — that is the Deployment replica count.
Incorrect — that is nodeSelector/affinity.
10What does a startup/readiness gate protect against?
Correct — readiness keeps it out of the Service until it passes.
Incorrect — that is limits, not probes.
Incorrect — unrelated.
Incorrect — unrelated.
10 questions · explanations appear as you answer
Connecting your app
10 questions
01Why should you not connect to a pod’s IP directly?
Incorrect — speed is not the issue.
Correct — so you talk to a stable Service instead.
Incorrect — pods do have IPs — they just change.
Incorrect — unrelated.
02What does a Service give you?
Incorrect — unrelated.
Correct — the fixed front door for a changing set of pods.
Incorrect — that is a PVC.
Incorrect — unrelated.
03What is the default Service type?
Incorrect — that exposes the app externally; it is not the default.
Correct — the right default for pod-to-pod traffic.
Incorrect — not the default.
Incorrect — Ingress is not a Service type.
04Which Service type asks the environment for an external IP?
Incorrect — internal-only.
Correct — it provisions a real external IP.
Incorrect — it returns pod IPs, not an external one.
Incorrect — it opens a node port, not a provisioned IP.
05What does cluster DNS let your app do?
Incorrect — unrelated.
Correct — CoreDNS resolves the name to the Service.
Incorrect — that is the autoscaler.
Incorrect — unrelated.
06An Ingress does nothing until you also have…
Incorrect — avoiding that is the point of Ingress.
Correct — a controller (like nginx) acts on the rules.
Incorrect — unrelated.
Incorrect — unrelated to HTTP routing.
07NodePort exposes a Service by…
Incorrect — that is LoadBalancer.
Incorrect — NodePort does not create DNS.
Correct — reach the app at any node IP on that port.
Incorrect — unrelated to exposure.
08An Ingress is mainly for…
Correct — one address, many backends, with TLS.
Incorrect — that is PV/PVC.
Incorrect — that is a Deployment.
Incorrect — that is the cluster autoscaler.
09Inside the cluster, one Service reaches another by…
Incorrect — those change; use the name.
Correct — CoreDNS resolves it to the ClusterIP.
Incorrect — internal traffic needs no NodePort.
Incorrect — Ingress is for external HTTP, not internal service-to-service.
10A ClusterIP Service is reachable…
Correct — the right default for internal traffic.
Incorrect — that needs LoadBalancer/Ingress.
Incorrect — it works cluster-wide, just not externally.
Incorrect — ClusterIP is not about TLS.
10 questions · explanations appear as you answer
Data & organization
10 questions
01Why does data written inside a container vanish on restart?
Incorrect — it is simply how container filesystems work.
Correct — volumes are how you keep data.
Incorrect — not the reason.
Incorrect — it is wiped, not moved.
02How long does an emptyDir volume last?
Incorrect — it dies with the pod.
Correct — good scratch space, but not durable.
Incorrect — there is no fixed timer.
Incorrect — it is tied to the pod, not the node.
03A PersistentVolumeClaim (PVC) is…
Incorrect — no — it is a storage request.
Correct — the cluster hands you a volume that outlives the pod.
Incorrect — unrelated.
Incorrect — unrelated.
04What does a namespace mainly provide?
Incorrect — unrelated.
Correct — rooms inside the cluster.
Incorrect — unrelated.
Incorrect — unrelated.
05What is a resource "request" used for?
Incorrect — unrelated.
Correct — placement is based on requests.
Incorrect — unrelated.
Incorrect — unrelated.
06A pod with no resource requests set is…
Incorrect — not safe — it becomes BestEffort.
Correct — BestEffort pods are evicted first.
Incorrect — it starts; it is just lowest priority.
Incorrect — requests are unrelated to autoscaling here.
07Durable data that must survive a pod being deleted goes on a…
Incorrect — that dies with the pod.
Incorrect — that holds config, not app data.
Correct — it is independent of any single pod’s lifecycle.
Incorrect — that is wiped on restart.
08A stateful app that needs stable identity and storage per replica uses a…
Incorrect — Deployment pods are interchangeable, not stable-identity.
Correct — it gives ordered, stable names and per-pod storage.
Incorrect — that is one-per-node, not stable-identity replicas.
Incorrect — a Job runs to completion; it is not a long-running stateful app.
09A ResourceQuota on a namespace…
Correct — a budget so one team cannot consume the whole cluster.
Incorrect — quotas are about limits, not encryption.
Incorrect — unrelated.
Incorrect — that is a Service.
10Two teams sharing one cluster are usually separated with…
Incorrect — the runtime is per node, not per team.
Correct — names, access, and budgets scoped per team.
Incorrect — one etcd backs the whole cluster.
Incorrect — images do not isolate teams.
10 questions · explanations appear as you answer
Where to go next
7 questions
01What is the normal object chain for a stateless app?
Incorrect — that is not an ownership chain.
Correct — you manage the Deployment; it drives the rest.
Incorrect — not a chain.
Incorrect — not how it works.
02What is the best next step after learning the fundamentals?
Incorrect — not the fastest way to learn.
Correct — doing beats reading, by far.
Incorrect — unnecessary.
Incorrect — risky without practice.
03Which course goes deeper into running real clusters after this one?
Correct — it covers scheduling, storage, upgrades, backups, and troubleshooting.
Incorrect — you have already done it.
Incorrect — a side topic, not deeper Kubernetes.
Incorrect — administration and CKS both exist.
04Do you need to memorize all Kubernetes YAML?
Incorrect — nobody writes it from memory.
Correct — understanding beats recall.
Incorrect — no single object needs full memorization.
Incorrect — Helm does not change this.
05A fast way to generate a starting manifest is…
Incorrect — never read manifests out of etcd by hand.
Incorrect — slow and error-prone.
Correct — it prints the YAML to save and edit.
Incorrect — nodes do not scaffold manifests.
06Which security-focused course builds on administration?
Correct — NetworkPolicy, RBAC, Pod Security, supply chain, runtime.
Incorrect — that is the beginner start, not the security depth.
Incorrect — related but not the Kubernetes security path.
Incorrect — the security & hardening course exists.
07The single habit that most accelerates learning Kubernetes is…
Incorrect — useful later, not the fastest start.
Correct — hands-on practice cements the concepts.
Incorrect — recall without understanding fades.
Incorrect — you will use YAML constantly; embrace it.
7 questions · explanations appear as you answer