Kubernetes and Cloud Native Associate (KCNA) — Questions and Answers

Question 1: Which Kubernetes resource replaced Endpoints for improved scalability, especially in large clusters?

EndpointSlice (Correct answer)
PodSlice
ServiceSlice
NetworkEndpoint

Correct answer: EndpointSlice

EndpointSlice shards endpoint data into smaller chunks (default 100 endpoints per slice), reducing the size of watch events and etcd load compared to monolithic Endpoints objects.

Question 2: Which Ingress path type ensures that only exact URL matches trigger the routing rule?

ImplementationSpecific
Prefix
Exact (Correct answer)
Wildcard

Correct answer: Exact

pathType: Exact routes traffic only when the request path matches the specified path character-for-character with no prefix matching.

Question 3: How does a Kubernetes HorizontalPodAutoscaler (HPA) determine when to scale?

By monitoring node CPU temperature
By checking the number of pending PVCs
By observing Pod metrics such as CPU or memory utilization (Correct answer)
By counting failed HTTP requests at the ingress

Correct answer: By observing Pod metrics such as CPU or memory utilization

HPA scales the number of Pod replicas based on observed metrics like CPU or custom metrics compared to target thresholds.

Question 4: In Kubernetes Container Orchestration practice, what is the best approach to quality improvement in monitoring and logging?

Use data-driven methods with measurable outcomes (Correct answer)
Make changes without measuring results
Copy what other organizations do without analysis
Wait for problems to occur before acting

Correct answer: Use data-driven methods with measurable outcomes

Data-driven quality improvement with measurable outcomes ensures that changes actually produce the intended improvements and can be verified.

Question 5: The contents of a Kubernetes Pod always run in

Depends upon implementation
Depends upon resources
shared context (Correct answer)
exclusive context

Correct answer: shared context

A Kubernetes Pod is the smallest deployable unit and represents a single instance of a running process. All containers within a single Pod share the same network namespace, IP address, and storage volumes. This means they operate in a shared context, allowing them to communicate with each other via `localhost` and share data efficiently.

Question 6: Which annotation is commonly used to specify which Ingress Controller class should handle a particular Ingress resource (pre-1.18 style)?

networking.k8s.io/class
kubernetes.io/controller-name
kubernetes.io/ingress.class (Correct answer)
ingress.kubernetes.io/controller

Correct answer: kubernetes.io/ingress.class

The kubernetes.io/ingress.class annotation was the original way to assign an Ingress to a specific controller; from 1.18+ the spec.ingressClassName field is preferred.

Question 7: Which resource type is best suited for running a batch job that should execute once and complete?

StatefulSet
Deployment
DaemonSet
Job (Correct answer)

Correct answer: Job

A Job creates one or more Pods and ensures they run to successful completion.

Question 8: Which metric is most useful for evaluating program effectiveness in Kubernetes Container Orchestration?

Amount of money spent
Number of staff involved
Number of meetings held
Outcome-based performance indicators (Correct answer)

Correct answer: Outcome-based performance indicators

Outcome-based performance indicators directly measure whether the program is achieving its intended results and goals.

Question 9: A Pod has `restartPolicy: OnFailure`. Under which condition will Kubernetes NOT restart a container?

When the node runs out of memory
When the container exits with exit code 0 (success) (Correct answer)
When the liveness probe fails
When the container exits with a non-zero exit code

Correct answer: When the container exits with exit code 0 (success)

OnFailure only restarts containers that exit with a non-zero exit code; a successful exit (code 0) is treated as completion and not restarted.

Question 10: Which file in a Helm chart defines the minimum Helm version required to use it?

Chart.yaml (Correct answer)
.helmignore
requirements.yaml
values.yaml

Correct answer: Chart.yaml

The `kubeVersion` and `helmVersion` constraints are specified in `Chart.yaml` using SemVer range syntax.

Question 11: What does the 'subPath' field in a volumeMount allow you to do?

Restrict volume access to a specific namespace path
Create nested mount points within the same volume
Share a volume subdirectory between two containers
Mount only a specific subdirectory or file from a volume into a container (Correct answer)

Correct answer: Mount only a specific subdirectory or file from a volume into a container

subPath lets you mount a specific file or directory within a volume into the container rather than the entire volume root.

Question 12: Which command shows all Helm releases across all namespaces?

helm ls --global
helm status --all-namespaces
helm list --all
helm list -A (Correct answer)

Correct answer: helm list -A

`helm list -A` (or `--all-namespaces`) lists releases from every namespace in the cluster.

Question 13: A Pod is in the `Terminating` state for a long time. What is the most likely cause?

The Pod has no resource limits set
The Pod's image cannot be pulled
The node has insufficient CPU
A finalizer is blocking deletion or the container is ignoring SIGTERM (Correct answer)

Correct answer: A finalizer is blocking deletion or the container is ignoring SIGTERM

A stuck Terminating state is typically caused by a finalizer that has not been removed or a container that does not handle SIGTERM within the grace period.

Question 14: In Kubernetes, which of the following is an agent that runs on each node in the cluster?

None of the above (Correct answer)
kube-controller-manager
etcd
kube-scheduler

Correct answer: None of the above

The kubelet is the primary agent that runs on each node in a Kubernetes cluster, ensuring that containers are running in a Pod. Options A, B, and C (etcd, kube-scheduler, kube-controller-manager) are all control plane components that typically run on master nodes, not worker nodes as agents. Therefore, 'None of the above' is the correct choice as kubelet is not listed.

Question 15: Which NetworkPolicy policyType would you specify to restrict outbound traffic from selected pods?

ClusterPolicy
Bidirectional
Ingress
Egress (Correct answer)

Correct answer: Egress

Setting policyTypes to include Egress in a NetworkPolicy allows you to define rules that restrict or permit outgoing traffic from the selected pods.

Question 16: Which skill is most critical for effective pod management?

Speed of decision-making
Technical expertise alone
Communication and stakeholder engagement (Correct answer)
Individual work preferences

Correct answer: Communication and stakeholder engagement

Communication and stakeholder engagement are essential because management success depends on effectively coordinating with and influencing others.

Question 17: What does the 'kubectl rollout undo deployment/<name>' command do?

Pauses the rollout of a new Deployment version
Reverts the Deployment to its previous revision (Correct answer)
Scales the Deployment down to zero replicas
Deletes the most recent Deployment revision

Correct answer: Reverts the Deployment to its previous revision

kubectl rollout undo rolls back a Deployment to the previously deployed revision, restoring the old Pod template.

Question 18: Which professional attribute is most valued in storage solutions within the Kubernetes Container Orchestration field?

Working in isolation
Prioritizing personal convenience
Accountability and commitment to standards (Correct answer)
Avoiding challenging situations

Correct answer: Accountability and commitment to standards

Accountability and commitment to professional standards build trust and ensure consistent, high-quality practice.

Question 19: What is the primary advantage of the 'Immutable Infrastructure' pattern when deploying containerized applications?

Containers can be patched in-place without restarts, reducing downtime
Pod specs cannot be changed after a Deployment is created
Kubernetes prevents all writes to container filesystems by default
Servers and containers are never modified after deployment; updates replace them entirely (Correct answer)

Correct answer: Servers and containers are never modified after deployment; updates replace them entirely

Immutable Infrastructure means any change produces a new artifact (container image) deployed as a replacement, eliminating configuration drift.

Question 20: Which Cluster Autoscaler behavior causes it to scale down a node group even if pods on the node are not reschedulable?

--balance-similar-node-groups=true
--skip-nodes-with-local-storage=false (Correct answer)
--expander=random
--scale-down-unneeded-time=0

Correct answer: --skip-nodes-with-local-storage=false

By default, Cluster Autoscaler won't remove nodes with pods using local storage; setting this flag to false overrides that safety check.

Question 21: Which approach is recommended for troubleshooting networking services issues?

Use systematic isolation and testing methods (Correct answer)
Replace all components simultaneously
Wait for the problem to resolve itself
Rely solely on past experience

Correct answer: Use systematic isolation and testing methods

Systematic isolation and testing methodically narrows down the root cause, making troubleshooting efficient and accurate.

Question 22: When `minAvailable: 2` is set in a PodDisruptionBudget for a 3-replica deployment, how many pods can a node drain operation evict at once?

2
1 (Correct answer)
3
0

Correct answer: 1

With minAvailable: 2, at least 2 pods must remain available, so only 1 pod (3 - 2) can be disrupted at a time.

Question 23: What is the role of a `sidecar container` in a Pod?

It initializes shared volumes before the main container starts
It monitors the main container and restarts it on failure
It runs alongside the main container to provide supporting functionality like logging or proxying (Correct answer)
It replaces the main container if it fails

Correct answer: It runs alongside the main container to provide supporting functionality like logging or proxying

Sidecar containers share the same network namespace and volumes as the main container, extending its capabilities without modifying its image.

Question 24: What is the risk of running a container with 'privileged: true' in its securityContext?

The container gains near-full access to the host kernel and devices (Correct answer)
The container runs with a read-only filesystem
The container cannot access the network
The container is isolated from other pods on the same node

Correct answer: The container gains near-full access to the host kernel and devices

A privileged container disables most namespace isolation and gives the container nearly the same access to the host as a root process on the node.

Question 25: What Helm built-in object provides access to the chart's metadata like name and version?

.Capabilities
.Chart (Correct answer)
.Values
.Release

Correct answer: .Chart

The `.Chart` object gives access to fields from `Chart.yaml` such as `.Chart.Name`, `.Chart.Version`, and `.Chart.AppVersion`.

Question 26: What does the podSelector field in a NetworkPolicy's spec select?

The nodes where the policy is enforced
The pods in other namespaces to allow traffic from
The pods in the same namespace that the policy applies to (Correct answer)
The service accounts allowed to connect

Correct answer: The pods in the same namespace that the policy applies to

The spec.podSelector field selects the group of pods within the policy's namespace to which the NetworkPolicy rules apply.

Question 27: Which Kubernetes Service type exposes an application using the cloud provider's load balancer?

ExternalName
LoadBalancer (Correct answer)
ClusterIP
NodePort

Correct answer: LoadBalancer

LoadBalancer provisions an external load balancer from the cloud provider and assigns a public IP to the Service.

Question 28: When using Vertical Pod Autoscaler (VPA) in 'Off' mode, what happens?

VPA evicts and restarts pods with new resource values
VPA disables resource requests on the pod
VPA only provides recommendations without applying them (Correct answer)
VPA sets both requests and limits to zero

Correct answer: VPA only provides recommendations without applying them

In 'Off' mode, VPA computes and stores resource recommendations in its status but never modifies or restarts pods.

Question 29: How can you verify what actions a user 'alice' is allowed to perform on pods in the 'staging' namespace?

kubectl get roles -n staging --user=alice
kubectl check rbac alice -n staging --resource=pods
kubectl describe permissions alice -n staging
kubectl auth can-i --list --as=alice -n staging (Correct answer)

Correct answer: kubectl auth can-i --list --as=alice -n staging

kubectl auth can-i --list --as=alice -n staging impersonates alice and lists all allowed actions in the staging namespace.

Question 30: What is the primary role of the Kubernetes Ingress resource?

Provide pod-to-pod encryption
Assign static IPs to pods
Expose HTTP/HTTPS routes from outside the cluster to Services (Correct answer)
Define egress traffic rules

Correct answer: Expose HTTP/HTTPS routes from outside the cluster to Services

An Ingress resource defines rules that route external HTTP and HTTPS traffic to internal cluster Services based on host names and URL paths.

Question 31: In Kubernetes, which of the following is the front end for the Kubernetes control plane?

kube-controller-manager
kube-scheduler
etcd
kube-apiserver (Correct answer)

Correct answer: kube-apiserver

The kube-apiserver acts as the front end for the Kubernetes control plane, exposing the Kubernetes API. It is the central hub for all communication within the cluster, handling requests from users, external components, and other control plane components, and validating and configuring data for API objects.

Question 32: Which principle states that users should only have access necessary for their role?

Separation of duties
Defense in depth
Need to share
Principle of least privilege (Correct answer)

Correct answer: Principle of least privilege

The principle of least privilege ensures users only have the minimum access rights needed to perform their job functions, limiting potential damage.

Question 33: What DNS name format does Kubernetes use for Services within the same namespace?

<service>.<namespace>.svc
<service>
<service>.cluster.local
<service>.<namespace>.svc.cluster.local (Correct answer)

Correct answer: <service>.<namespace>.svc.cluster.local

The fully qualified DNS name for a Service is <service-name>.<namespace>.svc.cluster.local, though within the same namespace a short name also resolves.

Question 34: What is the purpose of Helm hooks?

They register event listeners for Kubernetes resource changes
They define health check endpoints for deployed services
They allow external webhooks to trigger Helm deployments
They execute Kubernetes jobs or other resources at specific points in the release lifecycle (Correct answer)

Correct answer: They execute Kubernetes jobs or other resources at specific points in the release lifecycle

Helm hooks use annotations like `helm.sh/hook: pre-install` to run Jobs or other resources before/after install, upgrade, or delete.

Question 35: In the Operator Capability Level model, what does Level 2 (Seamless Upgrades) mean?

The operator uses level 2 TLS encryption for all communications
The operator can manage and orchestrate application version upgrades (Correct answer)
The operator can install the application on a fresh cluster
The operator provides full auto-pilot with no human intervention needed

Correct answer: The operator can manage and orchestrate application version upgrades

Level 2 in the Operator Capability Levels means the operator can handle application upgrades seamlessly without manual steps.

Question 36: What happens to a Pod that tries to use a PodSecurityPolicy that it is not authorized to use?

The pod is admitted but logged
The pod creation is rejected by the admission controller (Correct answer)
The pod runs in a restricted namespace
The pod runs with default security settings

Correct answer: The pod creation is rejected by the admission controller

The PodSecurityPolicy admission controller rejects pod creation if the pod does not satisfy any authorized PSP.

Question 37: What is the effect of setting 'automountServiceAccountToken: false' on a Pod?

The default ServiceAccount token is not mounted into the pod's filesystem (Correct answer)
The pod uses an anonymous identity for all API calls
The pod cannot access any Kubernetes resources
The pod's network policy is reset to default

Correct answer: The default ServiceAccount token is not mounted into the pod's filesystem

Setting automountServiceAccountToken: false prevents Kubernetes from automatically mounting the ServiceAccount token into the pod at /var/run/secrets/kubernetes.io/serviceaccount.

Question 38: A DaemonSet ensures that:

A copy of a Pod runs on every (or selected) node (Correct answer)
Exactly one Pod runs cluster-wide at all times
Pods restart on a defined schedule
Pods are evenly distributed across availability zones

Correct answer: A copy of a Pod runs on every (or selected) node

DaemonSets are ideal for node-level agents like log collectors or monitoring daemons that must run on every node.

Question 39: A KEDA ScaledObject targets a Kafka consumer group. What does KEDA use to determine the desired replica count?

Consumer group lag (number of unprocessed messages) (Correct answer)
The Kafka broker's memory usage
Network throughput on the consumer pods
CPU utilization of existing consumer pods

Correct answer: Consumer group lag (number of unprocessed messages)

KEDA scales based on event source metrics like consumer group lag, allowing it to scale to zero when there are no messages.

Question 40: When sessionAffinity is set to ClientIP on a Service, how does Kubernetes route repeated requests from the same client?

Routes to the most recently created pod
Routes to a random pod each time
Routes to the pod with lowest load
Routes to the same pod based on the client's IP (Correct answer)

Correct answer: Routes to the same pod based on the client's IP

ClientIP session affinity ensures that requests from the same source IP are consistently forwarded to the same backend pod.

Question 41: Which documentation is essential when working with networking services in Kubernetes Container Orchestration?

General descriptions without specifics
Marketing materials
Detailed technical specifications and as-built diagrams (Correct answer)
Only verbal notes

Correct answer: Detailed technical specifications and as-built diagrams

Detailed technical specifications and as-built diagrams provide the accurate reference information needed for maintenance and troubleshooting.

Question 42: What does 'kubectl cordon <node>' do?

Removes the node from the cluster permanently
Drains all Pods from the node and deletes it
Reboots the node gracefully
Marks the node as unschedulable so no new Pods are placed on it (Correct answer)

Correct answer: Marks the node as unschedulable so no new Pods are placed on it

Cordoning a node sets it to 'SchedulingDisabled', preventing the scheduler from placing new Pods while existing Pods continue running.

Question 43: What Kubernetes feature allows storage capacity information to be published so the scheduler can make volume-aware placement decisions?

StorageClass topology keys
PVCapacityMap
CSIStorageCapacity objects (Correct answer)
VolumeNodeAffinity hints

Correct answer: CSIStorageCapacity objects

CSIStorageCapacity objects, created by CSI drivers, expose available capacity per topology segment so the scheduler avoids placing pods where storage would be insufficient.

Question 44: What does the 'principle of least privilege' mean in Kubernetes RBAC?

Allow all service accounts to access the API server
Grant only the minimum permissions required to perform a task (Correct answer)
Grant all permissions by default and revoke as needed
Use ClusterRoles instead of Roles for simplicity

Correct answer: Grant only the minimum permissions required to perform a task

Least privilege means granting only the permissions necessary for a user or service account to perform its intended function.

Question 45: What happens to traffic in a mesh when a circuit breaker is 'open'?

Requests to the unhealthy service are immediately rejected without forwarding (Correct answer)
All traffic is retried with exponential backoff
Traffic is rerouted to an identical backup service
The pod is restarted by the kubelet

Correct answer: Requests to the unhealthy service are immediately rejected without forwarding

When a circuit breaker is open, the proxy immediately returns an error to the caller without attempting to reach the failing service, preventing cascade failures.

Question 46: Which kubectl command streams live logs from all containers in a pod?

kubectl logs <pod> --stream all
kubectl watch logs <pod>
kubectl tail <pod> -a
kubectl logs <pod> --all-containers -f (Correct answer)

Correct answer: kubectl logs <pod> --all-containers -f

The `--all-containers` flag combined with `-f` streams live logs from every container in the specified Pod simultaneously.

Question 47: What is the purpose of the service.kubernetes.io/topology-aware-hints annotation on a Service?

Hints to kube-proxy to prefer endpoints in the same zone as the client (Correct answer)
Enables cross-cluster Service discovery
Restricts the Service to a specific availability zone
Forces all traffic through a single node

Correct answer: Hints to kube-proxy to prefer endpoints in the same zone as the client

Topology-aware hints instruct kube-proxy and EndpointSlice controllers to prefer routing traffic to endpoints in the same zone, reducing inter-zone data transfer costs.

Question 48: Limits and requests for memory in Kubernetes are expressed in

MB
GB
bytes (Correct answer)
KB

Correct answer: bytes

In Kubernetes, memory limits and requests for containers are fundamentally expressed in bytes. While common suffixes like `Mi` (mebibytes) or `Gi` (gibibytes) are often used for convenience in YAML configurations, these are internally converted to their byte equivalents for resource allocation and management.

Question 49: What is the purpose of the namespaceSelector field in a NetworkPolicy ingress rule?

Defines DNS search domains
Selects which namespaces the policy is created in
Allows traffic from pods in namespaces matching the label selector (Correct answer)
Restricts the policy to a single namespace

Correct answer: Allows traffic from pods in namespaces matching the label selector

namespaceSelector in an ingress from block permits traffic from pods residing in namespaces whose labels match the selector.

Question 50: What does setting hostNetwork: true on a pod do?

Assigns the pod a LoadBalancer IP
Enables IPv6 for the pod
Makes the pod share the node's network namespace and IP (Correct answer)
Bypasses NetworkPolicy rules

Correct answer: Makes the pod share the node's network namespace and IP

With hostNetwork: true the pod uses the node's network stack directly, meaning it shares the node's IP address and can listen on node ports without a Service.

Question 51: Which field in a Pod spec allows you to run a container as a non-root user?

securityPolicy.noRoot
podSpec.nonRoot
securityContext.runAsNonRoot (Correct answer)
containerSpec.rootless

Correct answer: securityContext.runAsNonRoot

Setting securityContext.runAsNonRoot: true prevents the container from running as the root user (UID 0).

Question 52: A canary deployment in Kubernetes sends 10% of traffic to the new version. Which Ingress-level feature enables weighted traffic splitting?

Ingress TLS termination
Ingress path-based routing rules
Ingress canary annotations (e.g., nginx.ingress.kubernetes.io/canary-weight) (Correct answer)
Ingress defaultBackend configuration

Correct answer: Ingress canary annotations (e.g., nginx.ingress.kubernetes.io/canary-weight)

NGINX Ingress supports canary annotations that direct a configurable percentage of traffic to a canary Ingress/Service for staged rollouts.

Question 53: Which logging agents are included in the Kubernetes distribution?

None of the above
Elasticsearch
Both Stackdriver Logging for use with Google Cloud Platform and Elasticsearch (Correct answer)
Stackdriver Logging for use with Google Cloud Platform

Correct answer: Both Stackdriver Logging for use with Google Cloud Platform and Elasticsearch

Kubernetes distributions often integrate with or support popular logging agents for collecting and managing container logs. This includes both Stackdriver Logging, commonly used with Google Cloud Platform, and Elasticsearch, a widely adopted open-source solution for log aggregation and analysis.

Question 54: What is defense in depth in the context of Kubernetes Container Orchestration security?

Relying solely on encryption
Focusing only on perimeter security
Using one strong security control
Implementing multiple layers of security controls (Correct answer)

Correct answer: Implementing multiple layers of security controls

Defense in depth uses multiple layers of security controls so that if one layer fails, additional layers continue to provide protection.

Question 55: What happens during a rolling update in a Kubernetes Deployment by default?

All old Pods are terminated before new ones start
The Deployment is paused and requires manual approval at each step
New Pods are gradually started while old ones are incrementally terminated (Correct answer)
Old and new Pods run simultaneously forever

Correct answer: New Pods are gradually started while old ones are incrementally terminated

Rolling updates incrementally replace old Pods with new ones to maintain availability throughout the update.

Question 56: Which approach best demonstrates mastery of service mesh in Kubernetes Container Orchestration practice?

Relying entirely on technology
Following procedures without understanding
Applying principles to novel situations with sound judgment (Correct answer)
Avoiding complex scenarios

Correct answer: Applying principles to novel situations with sound judgment

True mastery involves understanding underlying principles well enough to apply them to new and unfamiliar situations with professional judgment.

Question 57: What happens to a PersistentVolume with ReclaimPolicy 'Retain' after its PVC is deleted?

The PV is deleted automatically
The PV is immediately rebound to the next available PVC
The PV enters a Pending state waiting for rebinding
The PV is released but data is preserved and must be manually reclaimed (Correct answer)

Correct answer: The PV is released but data is preserved and must be manually reclaimed

With the Retain policy, the PV moves to Released state and retains its data, requiring manual administrator intervention to reclaim.

Question 58: When a Kubernetes Container is created, it has access to a list of all services that were operating as

configuration file
global accessible file
environment variable (Correct answer)
None of the above

Correct answer: environment variable

When a Kubernetes Container is created, it gains access to information about other services in the cluster through environment variables. Kubernetes automatically injects these variables, providing details like the service's IP address and port. This mechanism allows containers to discover and connect to other services without needing hardcoded network locations.

Question 59: What is the effect of setting 'readOnlyRootFilesystem: true' in a container's securityContext?

Prevents the container from reading any files
Removes write permissions from all mounted volumes
Makes the container's root filesystem immutable (Correct answer)
Enables AppArmor profile enforcement

Correct answer: Makes the container's root filesystem immutable

readOnlyRootFilesystem: true mounts the container's root filesystem as read-only, preventing file modifications to the container layer.

Question 60: In Kubernetes Container Orchestration certification, what is the purpose of automated testing?

To catch regressions and verify functionality continuously (Correct answer)
To slow down development
To increase server costs
To replace manual code review entirely

Correct answer: To catch regressions and verify functionality continuously

Automated testing catches regressions early and verifies that functionality works as expected, providing confidence in code changes.

Kubernetes and Cloud Native Associate (KCNA)

The KCNA is a pre-professional certification that validates foundational knowledge of Kubernetes and cloud native technologies, including container orchestration, cloud native architecture, and application delivery pipelines.

Questions

90 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds