Mixed Deck — All KCNA Topics Flashcards
100 cards from real KCNA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 20 Mixed Deck — All KCNA Topics flashcards as text
Which CSI operation is responsible for attaching a volume to a node before it is mounted to a Pod?
Answer: ControllerPublishVolume
ControllerPublishVolume is the CSI call that attaches a volume to a node, which must happen before NodeStageVolume or NodePublishVolume mount it.
A storage administrator wants a PV to only be bound to a specific PVC before it is created. Which mechanism achieves this?
Answer: Pre-populating the claimRef field on the PV with the target PVC details
Pre-setting the claimRef on a PV with the namespace and name of the intended PVC ensures only that PVC can bind to it during static provisioning.
What is the effect of setting `preemptionPolicy: Never` on a PriorityClass?
Answer: Pods with this class will not preempt lower-priority pods even if resources are unavailable
`preemptionPolicy: Never` prevents pods in this PriorityClass from evicting lower-priority pods, though they are still queued ahead of them.
In the Backends for Frontends (BFF) pattern, what is the purpose of creating separate backends for different client types?
Answer: To tailor API responses and logic specifically for each client's needs
BFF creates dedicated backend services for each client type (mobile, web, etc.) allowing each to be optimized independently without compromising others.
Which field controls the order in which containers within a StatefulSet are started and stopped?
Answer: podManagementPolicy
The `podManagementPolicy` field (OrderedReady or Parallel) controls how StatefulSet Pods are created, updated, and deleted.
Which Kubernetes object is created automatically when dynamic provisioning is triggered by a PVC?
Answer: PersistentVolume
When a PVC references a StorageClass with a provisioner, Kubernetes dynamically creates a PersistentVolume object and binds it to the PVC.
Which field enables a Pod to run as a specific user ID at the container level?
Answer: securityContext.runAsUser
Setting `securityContext.runAsUser` in a container spec makes the container process run as the specified UID.
What status will a PVC show if no PersistentVolume matches its requirements and no dynamic provisioner is configured?
Answer: Pending
A PVC that cannot be bound to a matching PV stays in Pending status until a suitable volume becomes available.
In KCNA practice, what is the purpose of vulnerability scanning?
Answer: To identify weaknesses before attackers do
Vulnerability scanning proactively identifies security weaknesses in systems and applications so they can be remediated before exploitation.
Which OpenTelemetry component acts as a central agent that receives, processes, and exports telemetry data from multiple sources?
Answer: OTel Collector
The OpenTelemetry Collector is a vendor-agnostic proxy that receives telemetry from applications, processes it (filter, transform, batch), and exports it to backends.
Which pod scheduling feature ensures that two pods of the same application never land on the same node?
Answer: Pod anti-affinity with requiredDuringSchedulingIgnoredDuringExecution
Hard pod anti-affinity (`required...`) enforces that matching pods are never co-located on the same topology domain such as a node.
Which CNCF project provides a vendor-neutral observability framework for generating, collecting, and exporting telemetry data?
Answer: OpenTelemetry
OpenTelemetry (OTel) is the CNCF standard for instrumenting, generating, collecting, and exporting telemetry (metrics, logs, traces) in a vendor-neutral way.
What is the purpose of Kubernetes service discovery?
Answer: To facilitate communication between pods and services
Kubernetes service discovery allows applications running in pods to find and communicate with other services within the cluster without needing to know their specific IP addresses. It achieves this by assigning stable network identities (DNS names and virtual IPs) to services, abstracting away the dynamic nature of pod IPs.
What Kubernetes resource type is most commonly used to deploy a log collector (like Fluent Bit) on every node in a cluster?
Answer: DaemonSet
A DaemonSet ensures that one pod runs on every (or selected) node, making it ideal for node-level log collection agents.
Which approach best demonstrates mastery of monitoring and logging in KCNA practice?
Answer: Applying principles to novel situations with sound judgment
True mastery involves understanding underlying principles well enough to apply them to new and unfamiliar situations with professional judgment.
In KCNA certification, what is the purpose of automated testing?
Answer: To catch regressions and verify functionality continuously
Automated testing catches regressions early and verifies that functionality works as expected, providing confidence in code changes.
In a StatefulSet, pods are scheduled with what naming convention?
Answer: -
StatefulSet pods are named with a stable, predictable pattern of `-0`, `-1`, etc., providing identity that persists across rescheduling.
In KCNA practice, what is the best approach to quality improvement in monitoring and logging?
Answer: Use data-driven methods with measurable outcomes
Data-driven quality improvement with measurable outcomes ensures that changes actually produce the intended improvements and can be verified.
What does the Helm function `tpl` allow you to do inside templates?
Answer: Render a string as a Helm template, enabling dynamic values
The `tpl` function processes a string value as a Go template, which lets values in values.yaml themselves contain template expressions.
In Kubernetes, what is the purpose of a Namespace?
Answer: Partitions cluster resources between multiple users or teams
Namespaces provide a mechanism to divide cluster resources between multiple users, teams, or projects with logical isolation.