---
title: "Kubernetes Advanced: Production Operations & Scaling"
description: "Master Kubernetes at scale: stateful applications, networking, storage, security policies, autoscaling, and production troubleshooting."
author: "Mohammad Abu Mattar"
canonical: https://mkabumattar.com/quizzes/post/kubernetes-advanced-quiz
---

# Kubernetes Advanced: Production Operations & Scaling

Welcome to the Kubernetes Advanced Quiz! This quiz is designed to test your knowledge of Kubernetes concepts related to production operations and scaling. Each question will challenge your understanding of key Kubernetes features and best practices for running applications at scale. Good luck!

## Questions

### 1. What is a StatefulSet?

- **A controller for applications requiring stable network IDs and persistent storage** ✅
  - StatefulSet: ordinal names, persistent identity. For stateful apps: databases, caches.
- A workload resource for stateless applications that scale horizontally across nodes
  - This describes a standard Deployment.
- A security policy that enforces immutable root filesystems for sensitive containers
  - This refers to a SecurityContext or Pod Security Standard.
- A node-level agent that ensures specific pods run on every single cluster node
  - This describes a DaemonSet.

**Hint:** Think about ordered deployment.

### 2. What is a PersistentVolume (PV)?

- **A cluster-level storage resource provisioned by an administrator or provisioner** ✅
  - PV: cluster-wide resource. PVC: pod-level request. Decouples storage.
- A namespace-scoped request for storage made by a developer or application
  - This describes a PersistentVolumeClaim (PVC).
- A temporary storage area that is deleted when a pod is removed from a node
  - This describes an emptyDir volume.
- A configuration object that stores binary data for encrypted secrets
  - This describes a Kubernetes Secret.

**Hint:** Think about storage abstraction.

### 3. What is a PersistentVolumeClaim (PVC)?

- **A request for storage by a user that consumes specific PersistentVolume resources** ✅
  - PVC: pod consumes storage, abstracted from implementation.
- A physical disk attached to a worker node via a cloud provider interface
  - This describes the underlying infrastructure, not the claim object.
- A global storage class that defines the IOPS and throughput of a backend
  - This describes a StorageClass.
- A backup snapshot of a running volume taken for disaster recovery purposes
  - This refers to a VolumeSnapshot.

**Hint:** Think about storage request.

### 4. What is a StorageClass?

- **An object that enables dynamic provisioning of volumes based on defined profiles** ✅
  - StorageClass: AWS EBS, Azure Disk, GCP Persistent Disk. Automatic provisioning.
- A manual list of available hardware drives connected to the control plane
  - Kubernetes abstracts hardware; this is not a manual drive list.
- A networking layer that prioritizes storage traffic over application traffic
  - StorageClass is related to volume provisioning, not network prioritization.
- A resource quota that limits the total amount of disk space in a namespace
  - Quotas are managed via ResourceQuota objects.

**Hint:** Think about dynamic provisioning.

### 5. What is a Service in Kubernetes?

- **An abstraction that defines a logical set of pods and a policy to access them** ✅
  - Service: ClusterIP (internal), NodePort (external), LoadBalancer (cloud).
- A runtime container environment used to execute application logic
  - This describes a Pod or Container.
- A dedicated hardware appliance used for encrypting inter-pod traffic
  - Services are software abstractions within the Kubernetes API.
- A background process that monitors node health and reports to the API server
  - This describes the Kubelet.

**Hint:** Think about load balancing.

### 6. What is Ingress?

- **An API object that manages external access to services, typically HTTP/HTTPS** ✅
  - Ingress: define rules, controller implements. Simplify external access.
- A low-level firewall rule that blocks traffic between internal namespaces
  - This describes a NetworkPolicy.
- A tool for importing external database records into a Kubernetes cluster
  - Ingress refers to network traffic, not data migration.
- A gateway that only allows traffic to flow out of the cluster to the internet
  - This describes an Egress gateway or NAT gateway.

**Hint:** Think about HTTP routing.

### 7. What is a ConfigMap?

- **An API object used to store non-confidential data in key-value pairs** ✅
  - ConfigMap: mounted as volumes or environment. Avoid in code.
- A secure vault for storing encrypted certificates and SSH keys
  - This describes a Secret.
- A visual map of the cluster architecture shown in the dashboard
  - ConfigMap is a data storage object, not a visual diagram.
- A script that automatically configures the Linux kernel on worker nodes
  - This describes node initialization or a DaemonSet agent.

**Hint:** Think about configuration.

### 8. What is a Secret?

- **An object for storing sensitive information like passwords or API tokens** ✅
  - Secret: should use EncryptionAtRest. Docker config secrets too.
- A fully encrypted database that replaces ConfigMaps for all application data
  - Secrets are not a database replacement and are only base64 encoded by default.
- A hidden namespace that is invisible to unauthorized cluster users
  - Namespaces cannot be hidden; access is controlled via RBAC.
- An authentication token used specifically for accessing the cloud provider GUI
  - Kubernetes Secrets are for use within the cluster by pods and services.

**Hint:** Think about sensitive data.

### 9. What is RBAC (Role-Based Access Control)?

- **A method for regulating access to the Kubernetes API based on individual roles** ✅
  - RBAC: least privilege principle. ServiceAccount per app.
- A system for automatically assigning CPU resources to high-priority users
  - This refers to PriorityClasses and Scheduling.
- A network filter that blocks requests based on the user’s geographic location
  - This is a Geo-IP firewall feature, not RBAC.
- A hardware-based authentication system using physical security keys
  - RBAC is a software authorization framework within Kubernetes.

**Hint:** Think about permission control.

### 10. What is a NetworkPolicy?

- **A specification of how groups of pods are allowed to communicate with each other** ✅
  - NetworkPolicy: micro-segmentation, defense in depth. Requires CNI support.
- A global setting that enables internet access for all pods in a cluster
  - NetworkPolicies are typically used to restrict, not globally enable, traffic.
- A configuration for the physical routers connecting the cluster to the rack
  - NetworkPolicies are software-defined rules at the pod level.
- A protocol for automatically assigning IP addresses to new worker nodes
  - This describes DHCP or a cloud IPAM.

**Hint:** Think about traffic rules.

### 11. What is a Pod Disruption Budget (PDB)?

- **A limit on the number of pods that can be down simultaneously during voluntary disruptions** ✅
  - PDB: drain operations respect PDB. Ensure availability during upgrades.
- A financial limit on how much a team can spend on cloud resources per month
  - This describes a cloud billing quota, not a PDB.
- A technical constraint that prevents pods from running longer than 24 hours
  - This would describe a TTL or MaxAge policy, not a disruption budget.
- A storage limit that prevents pods from writing too much data to a shared volume
  - This is managed via ephemeral-storage limits or quotas.

**Hint:** Think about availability during maintenance.

### 12. What is Horizontal Pod Autoscaler (HPA)?

- **A system that automatically scales the number of pod replicas based on metrics** ✅
  - HPA: metrics query interval, scale-up/down delays. Smooth scaling.
- A tool that increases the CPU and RAM of a single pod as load increases
  - This describes a Vertical Pod Autoscaler (VPA).
- A hardware load balancer that distributes traffic across multiple cloud regions
  - HPA is an internal Kubernetes controller, not external hardware.
- A script that moves pods from older nodes to newer nodes during an upgrade
  - This describes a cluster "drain" or "eviction" process.

**Hint:** Think about auto-scaling.

### 13. What is Vertical Pod Autoscaler (VPA)?

- **A system that automatically sets resource requests and limits based on actual usage** ✅
  - VPA: prevents over-provisioning, ensures efficiency. Complements HPA.
- A controller that adds more worker nodes to the cluster when pods are pending
  - This describes the Cluster Autoscaler.
- A feature that increases the network bandwidth of pods during peak hours
  - VPA manages CPU and Memory, not network bandwidth.
- A manual tool used by developers to restart pods that are running out of memory
  - VPA is an automated system, not a manual restart tool.

**Hint:** Think about resource sizing.

### 14. What is a DaemonSet in Kubernetes?

- **A controller ensuring that all (or some) nodes run a copy of a specific pod** ✅
  - DaemonSet: logging (Fluentd), monitoring (Prometheus node-exporter), networking agents. One pod per node.
- A scheduled task that runs once per day to clean up system logs
  - This describes a CronJob.
- A set of high-priority pods that always run on the control plane nodes
  - DaemonSets usually run on worker nodes, though they can be filtered via taints.
- A collection of nodes that are dedicated to running third-party databases
  - This describes a Node Pool or a dedicated Namespace.

**Hint:** Runs on which nodes?

### 15. What are Jobs and CronJobs in Kubernetes?

- **Resources for running tasks to completion, either once or on a recurring schedule** ✅
  - Job: batch processing, backups, migrations. CronJob: scheduled jobs (backup at 2am, reports daily). kubectl describe job.
- Objects that monitor application logs and send alerts to a central dashboard
  - This describes a logging/monitoring stack like ELK or Prometheus.
- Internal controllers that manage the lifecycle of long-running web servers
  - This describes a Deployment or ReplicaSet.
- System processes that clean up unused Docker images from node storage
  - This is typically handled by the Kubelet garbage collection.

**Hint:** Think about batch work patterns.

### 16. What is ResourceQuota in Kubernetes?

- **A constraint that limits aggregate resource consumption per namespace** ✅
  - ResourceQuota: prevent resource exhaustion. Multi-tenancy enforcement. kubectl get resourcequota. Set requests/limits on all pods.
- A pricing model where users pay for the exact amount of CPU they consume
  - ResourceQuota is a technical limit, not a financial billing model.
- A tool for measuring the energy efficiency of different cluster nodes
  - This refers to sustainability monitoring, not resource quotas.
- A limit on the number of concurrent users that can access a specific service
  - ResourceQuota limits Kubernetes API objects and resources, not end-users.

**Hint:** Namespaces and limits?

### 17. What is LimitRange in Kubernetes?

- **A policy to constrain resource allocations (limits/requests) for pods in a namespace** ✅
  - LimitRange: prevents OOM pods, runaway requests. Complements ResourceQuota. Works namespace-wide. kubectl apply -f limitrange.yaml.
- A networking rule that defines the range of IP addresses for a service
  - This describes a Service CIDR or Pod CIDR.
- An extension that allows pods to access a wider range of hardware GPUs
  - This describes Device Plugins.
- A setting that defines how far a pod can be moved during a cluster rebalance
  - This is not a feature of LimitRange.

**Hint:** Per-pod or per-container defaults?

### 18. What are Taints and Tolerations?

- **A mechanism allowing nodes to repel pods unless the pods have a matching toleration** ✅
  - Taints: NoSchedule (no toleration = no pod), NoExecute (evict existing). Use case: GPU nodes, dedicated hardware. kubectl taint node.
- A method for marking corrupted pods so they can be deleted by the controller
  - This describes health checks or the Node Problem Detector.
- A naming convention for identifying nodes that belong to a specific cloud provider
  - This describes Node Labels.
- A system for encrypting traffic between pods using mutual TLS
  - This describes a Service Mesh feature.

**Hint:** Node repulsion and pod attraction?

### 19. What is Node Affinity in Kubernetes?

- **A set of rules used by the scheduler to define which nodes a pod can be placed on** ✅
  - Node Affinity: requiredDuringScheduling (hard), preferredDuringScheduling (soft). Replaces nodeSelector. kubectl explain nodeaffinity.
- A feature that automatically joins new worker nodes to an existing cluster
  - This describes cluster bootstrapping or scaling.
- A requirement that all pods in a namespace must use the same CPU architecture
  - Node Affinity is applied per pod/deployment, not strictly per namespace.
- A protocol for syncing time between the control plane and worker nodes
  - This refers to NTP (Network Time Protocol).

**Hint:** Pod placement preferences?

### 20. What is Pod Affinity in Kubernetes?

- **A rule that allows pods to be scheduled based on the labels of pods already on a node** ✅
  - Pod Affinity (co-locate), Pod Anti-Affinity (spread). topologyKey: kubernetes.io/hostname, topology.kubernetes.io/zone. Low-latency, HA.
- A setting that ensures all containers in a pod share the same network stack
  - This is a core characteristic of all Pods, not an Affinity rule.
- A mechanism that automatically groups pods into folders in the Kubernetes UI
  - Kubernetes uses Namespaces and Labels, not folders.
- An optimization that speeds up the transfer of data between containers in a pod
  - Pod Affinity affects scheduling, not internal data transfer speed.

**Hint:** Running pods together or apart?

### 21. What are QoS (Quality of Service) classes in Kubernetes?

- **A classification (Guaranteed, Burstable, BestEffort) that determines eviction priority** ✅
  - QoS determines eviction order under memory pressure (kubelet). Guaranteed: never evicted. BestEffort: evicted first. Set requests/limits.
- A tiered subscription model for different levels of technical support
  - QoS classes are technical scheduling properties, not support tiers.
- A measure of the network latency between different availability zones
  - This refers to network metrics, not QoS classes.
- A ranking system that identifies the most popular services in a cluster
  - This is not a feature of Kubernetes.

**Hint:** Eviction priority during resource pressure?

### 22. What is SecurityContext in Kubernetes?

- **A set of privilege and access control settings for a pod or container** ✅
  - SecurityContext: runAsUser, readOnlyRootFilesystem, allowPrivilegeEscalation, capabilities (drops NET_RAW). Pod and container-level.
- A visual overview of all firewall rules active in the cluster
  - This would be a dashboard view of NetworkPolicies.
- An encryption key used to protect data stored in ConfigMaps
  - ConfigMaps are not encrypted; Secrets can be encrypted at rest.
- A log file that records every failed login attempt to the API server
  - This describes Audit Logging.

**Hint:** User ID, privileged mode, capabilities?

### 23. What is Pod Security Standards (PSS)?

- **A set of predefined security profiles (Privileged, Baseline, Restricted) applied to namespaces** ✅
  - PSS: pod-security.kubernetes.io/enforce labels on namespaces. Baseline (permissive), Restricted (strict). Replaces PSP. kubectl label namespace.
- A hardware standard for securing the physical ports on a worker node
  - PSS is a software-defined security framework for pods.
- A manual checklist for developers to follow before deploying to production
  - PSS is an automated enforcement mechanism within Kubernetes.
- A protocol for rotating SSL certificates across all cluster services
  - This describes Certificate Management (e.g., Cert-Manager).

**Hint:** Cluster-wide pod security enforcement?

### 24. What is Helm in Kubernetes?

- **A package manager that automates the creation and management of Kubernetes applications** ✅
  - Helm: Chart (template package), Release (instantiation), Repository (helm/stable, artifacthub). Database: Bitnami, prometheus-community. helm install my-release my-chart.
- A steering mechanism used to balance traffic between different cloud providers
  - This describes a Global Server Load Balancer (GSLB).
- A lightweight operating system designed to run only Kubernetes worker nodes
  - This describes OSs like Flatcar or Bottlerocket, not Helm.
- A command-line tool used exclusively for viewing pod logs in real-time
  - This describes "kubectl logs" or tools like "stern".

**Hint:** Package management for Kubernetes?

### 25. What are Custom Resource Definitions (CRDs)?

- **A resource that allows users to add their own custom objects to the Kubernetes API** ✅
  - CRD: define custom objects like PostgresDB, Certificate, WebhookPolicy via kubectl apply. Enables declarative third-party tool management.
- A predefined list of standard hardware configurations for cluster nodes
  - This describes Instance Types or Machine Sets.
- A documentation format used to describe how a specific application works
  - CRDs are executable API extensions, not documentation.
- A security rule that restricts which users can create standard pods
  - This is handled by RBAC and Admission Controllers.

**Hint:** Extend Kubernetes API?

### 26. What is a Kubernetes Operator?

- **A method of packaging and managing applications using the Kubernetes API and custom controllers** ✅
  - Operator: Helm + CRD + Controller. Watches CRD instances, automating app lifecycle.
- A human employee responsible for manual cluster maintenance and upgrades
  - In Kubernetes, an "Operator" is an automated software pattern.
- A dedicated terminal window used for executing administrative commands
  - This describes a CLI or Shell, not the Operator pattern.
- A specific type of worker node optimized for high-intensity mathematical operations
  - This describes a GPU node or Compute-Optimized node.

**Hint:** Domain-specific knowledge in software?

### 27. What is a Service Mesh?

- **A dedicated infrastructure layer for managing service-to-service communication** ✅
  - Service Mesh: Envoy sidecar per pod intercepts traffic. Istio, Linkerd. VirtualService, DestinationRule routing.
- A physical mesh network connecting servers in a local data center
  - Service Mesh is a software layer, not a physical network topology.
- A collection of pods that are grouped together for easier monitoring
  - Grouping is done via Labels/Selectors; a Mesh is for traffic control.
- An application-level library that developers must include in their source code
  - Service Mesh uses sidecar proxies to avoid changing application code.

**Hint:** Traffic management and observability sidecar proxy layer?

### 28. What is etcd in Kubernetes?

- **A distributed key-value store used as the backing store for all cluster data** ✅
  - etcd: all API objects stored here (Pods, Services, config). kubeadm managed; snapshot critical for disaster recovery.
- A caching layer that speeds up the delivery of static website images
  - This describes a CDN or Redis cache.
- A logging service that aggregates stdout and stderr from all containers
  - This describes the logging stack (e.g., Fluentd, Loki).
- A specialized container used to bootstrap new nodes into the cluster
  - This describes an "init container" or bootstrapping script.

**Hint:** Cluster state storage and disaster recovery?

### 29. What is the Kubernetes API versioning strategy?

- **A system of Stability Levels (Alpha, Beta, Stable) to manage feature maturity** ✅
  - Alpha: features.k8s.io/feature-gates. Beta: api/v1beta1. v1: stable API. New features beta first.
- A simple counter that increases every time the cluster is updated
  - Versioning reflects stability and deprecation policies, not just update counts.
- A mandatory upgrade path that requires users to use the latest nightly build
  - Stable versions (v1) are recommended for production, not nightly builds.
- A method for tagging docker images based on their release date
  - This refers to Image Tagging, not Kubernetes API versioning.

**Hint:** API stability levels?

### 30. What is Cluster Autoscaling vs HPA?

- **Cluster Autoscaling manages node count, while HPA manages pod replica count** ✅
  - Cluster Autoscaler: watches pending pods, scales cloud infrastructure. All three (CA, HPA, VPA) complement.
- Cluster Autoscaling is for on-premises, and HPA is only for cloud environments
  - Both features are used in cloud; CA is harder to implement on-premises.
- Cluster Autoscaling increases CPU limits, while HPA increases RAM limits
  - HPA and CA deal with quantities (replicas/nodes), not resource limits.
- They are two different names for the same automated scaling process
  - They operate at different layers: infrastructure (nodes) vs. workloads (pods).

**Hint:** Node-level scaling versus pod-level scaling?