KCNA practice questions and answers

Correct answer: A — The platform manages capacity and scales to zero, and you pay per execution rather than for idle capacity

Serverless means the operator no longer provisions or manages capacity and billing follows actual execution, including scaling to zero. Servers still exist beneath the abstraction, language choice is open, and many serverless platforms run containers.

Correct answer: A — OpenTelemetry

OpenTelemetry standardises instrumentation across the three telemetry signals so backends become interchangeable. Kubernetes orchestrates workloads, etcd stores cluster state, and Rook manages storage.

Correct answer: A — NetworkPolicy

NetworkPolicies define allowed ingress and egress for selected Pods, and require a CNI plugin that implements them. Services provide load balancing, Ingress routes external HTTP traffic, and Endpoints list backing Pod addresses.

Correct answer: A, B — Consistent runtime environment from a developer laptop through to production · Faster start-up because there is no guest operating system to boot

Containers package dependencies so the environment travels with the application, and they start in seconds because they share the host kernel. They provide weaker isolation than virtual machines, they fix no bugs, and resource limits remain important to prevent noisy neighbours.

Correct answer: A — Cluster Autoscaler

The Cluster Autoscaler grows the node pool when Pods cannot be scheduled and shrinks it when nodes are underused. The horizontal and vertical Pod autoscalers change replica counts and resource requests, and the kubelet manages Pods on a node it already belongs to.

Correct answer: A — Sandbox, incubating, and graduated

CNCF projects progress from sandbox through incubating to graduated as adoption, governance, and maturity criteria are met. Alpha and beta describe API versions rather than project maturity, and the other schemes are not used by the CNCF.

Correct answer: A — StatefulSet

StatefulSets give each Pod a stable ordinal name, stable storage, and ordered rollout and termination, which stateful systems depend on. Deployments treat Pods as interchangeable, Jobs run to completion, and DaemonSets pin one Pod per node.

Correct answer: A — Traffic splitting between service subsets at the proxy layer

A mesh's sidecar proxies can route a percentage of requests to a new subset, which enables canaries without application changes. Secret storage, image building, and volume provisioning are handled by other components entirely.

Correct answer: A, B — Build the image once and promote the same digest through environments · Run automated tests before an artefact is promoted

Promoting an immutable artefact that has passed automated tests is what makes a release predictable. Laptop deploys bypass review, mutable latest tags make it impossible to know what is running, and skipping staging removes the safety net exactly when confidence is unverified.

Correct answer: A, B — maxUnavailable and maxSurge control how aggressively Pods are replaced · The previous ReplicaSet is retained so a rollback is possible

The rolling update strategy is tuned with maxUnavailable and maxSurge, and old ReplicaSets are kept within the revision history limit so rollback works. Terminating everything first is the Recreate strategy, no drain is needed, and Deployments are the canonical rolling update controller.

Correct answer: A — HorizontalPodAutoscaler

The HorizontalPodAutoscaler changes the replica count of a workload based on metrics such as CPU utilisation. The Cluster Autoscaler adds and removes nodes, a PodDisruptionBudget limits voluntary evictions, and a quota caps namespace usage.

Correct answer: A — PodDisruptionBudget

A PodDisruptionBudget specifies the minimum available or maximum unavailable Pods so a drain cannot evict too many at once. Quotas and LimitRanges govern resource consumption, and PriorityClasses affect preemption during scheduling pressure.

Correct answer: A — It runs to completion before the application containers start, for setup tasks

Init containers run sequentially to completion before app containers begin, which suits waiting for a dependency or preparing a volume. A container that runs alongside is a sidecar, containers do not restart nodes, and readiness probes serve a different purpose.

Correct answer: A, B — Role and RoleBinding · ClusterRole bound within a namespace by a RoleBinding

RBAC grants permissions through Roles and RoleBindings, and a ClusterRole can be reused inside a namespace by binding it with a RoleBinding. Labels and annotations are metadata without authorisation effect, and node taints influence scheduling.

Correct answer: A, B — kubectl logs <pod> · kubectl exec -it <pod> -- sh

Reading container logs and opening a shell inside the container are the two standard first diagnostic steps. Deleting the Pod destroys the evidence, draining evicts workloads from a node, and tainting affects future scheduling.

Correct answer: A, B — A Service of type LoadBalancer · An Ingress resource with an ingress controller

LoadBalancer Services provision an external address and Ingress routes external HTTP traffic through a controller. ConfigMaps supply configuration, PersistentVolumeClaims request storage, and ResourceQuotas cap namespace consumption.

Correct answer: A — Circuit breaker with timeouts and bounded concurrency

A circuit breaker combined with timeouts and concurrency limits makes the caller fail fast instead of piling up blocked work. Unbounded retries amplify the outage, synchronous chaining propagates it, and removing health checks hides it.

Correct answer: A — Readiness probe

A failing readiness probe removes the Pod from Service endpoints without restarting it. The liveness probe restarts an unhealthy container, the startup probe protects slow-starting containers from premature liveness failures, and there is no termination probe.

Correct answer: A — Technologies that build and run scalable applications in modern, dynamic environments using containers, meshes, microservices, and declarative APIs

The CNCF definition centres on loosely coupled, resilient, observable systems built with containers, service meshes, microservices, immutable infrastructure, and declarative APIs. Running on a cloud provider, choosing a language, or lifting a monolith does not make a system cloud native.

Correct answer: A — kubelet

The kubelet is the node agent that receives PodSpecs and instructs the container runtime to run them, reporting status back. The API server serves the API, the controller manager runs control loops, and the cloud controller manager integrates with cloud provider APIs.

Correct answer: A — Service of type ClusterIP

A ClusterIP Service gives a stable in-cluster address and DNS name that fronts the Pods matching its selector. ConfigMaps hold configuration, PersistentVolumeClaims request storage, and Namespaces partition objects logically.

Correct answer: A — Blue/green deployment

Blue/green keeps a complete standby environment and cuts traffic over atomically, making rollback a second cutover. Rolling updates replace Pods incrementally, canary shifts a small traffic percentage first, and Recreate takes the old version down before starting the new one.

Correct answer: A, B — Argo CD · Flux

Argo CD and Flux are the two widely used GitOps controllers that reconcile clusters to a repository. Prometheus is a monitoring system, Envoy is a proxy, and etcd is Kubernetes' datastore.

Correct answer: A — GitOps

GitOps keeps declarative configuration in version control and uses an agent to converge the cluster to it, giving review, audit, and drift correction. Manual edits, snowflakes, and ad hoc scripts all break the link between repository and reality.

Correct answer: A — kube-proxy

kube-proxy watches Services and Endpoints and maintains iptables or IPVS rules that direct ClusterIP traffic to Pod addresses. The scheduler places Pods, etcd stores state, and the controller manager runs reconciliation loops.

Correct answer: A — Changes are made by replacing instances or containers with new versions rather than modifying running ones

Immutable infrastructure means you replace rather than mutate, so what runs always matches a known artefact. In-place patching, tolerated drift, and manual logins are exactly the practices this model removes.

Correct answer: A — You submit the desired state and controllers continuously work to make actual state match

Kubernetes runs control loops that continuously compare desired state in the API to observed state and act to close the gap. Imperative one-shot execution is the opposite model, scheduling is automatic, and reconciliation does not delete healthy objects.

Correct answer: A — kube-scheduler

The scheduler is responsible for placement decisions based on resource requests, affinity, taints, and other constraints. The kubelet runs on each node and starts containers once placement is decided, kube-proxy programs service networking, and etcd stores cluster state.

Correct answer: A — A taint on the node

Taints repel Pods that do not carry a matching toleration, which is how nodes are reserved for particular workloads. Labels attract Pods through node selectors rather than repelling, quotas limit resource consumption, and NetworkPolicies control traffic.

Correct answer: A — Pod

A Pod is the atomic scheduling unit and its containers share the same network namespace and can share volumes. A Deployment manages Pods through ReplicaSets, a Service provides stable networking to Pods, and a Node is a worker machine.

Correct answer: A — Job

A Job creates Pods and tracks successful completions, retrying according to its backoff policy. Deployments and ReplicaSets keep long-running Pods alive indefinitely, and a DaemonSet places Pods on every node.

Correct answer: A, B — It manages ReplicaSets to maintain a declared number of Pod replicas · It supports rolling updates and rollbacks to previous revisions

Deployments own ReplicaSets to keep the desired replica count and provide rolling update and rollback semantics. Stable per-Pod identity and ordered startup are StatefulSet properties, and one Pod per node is what a DaemonSet does.

Correct answer: A — They provide a scope for object names and a boundary for quotas and RBAC

Namespaces scope object names and give a natural boundary for ResourceQuota and RBAC. They do not isolate network traffic unless NetworkPolicies are applied, they are logical rather than physical, and cluster-scoped objects such as Nodes and PersistentVolumes are not namespaced.

Correct answer: A — No node can satisfy the Pod's memory request, so the scheduler cannot place it

Pending with an insufficient resources event means scheduling failed because no node has enough allocatable capacity for the request. Image pull problems show as ImagePullBackOff, probe failures require the Pod to be running first, and missing Service endpoints is a networking symptom.

Correct answer: A — Distributed traces

Traces record a request's path across services as spans with timings, which is exactly a per-hop breakdown. Metrics aggregate across requests, unstructured logs are hard to correlate, and configuration snapshots describe state rather than request flow.

Correct answer: A, B — Namespaces · Control groups

Namespaces isolate what a process can see and cgroups limit what it can consume, which together provide container isolation. Hypervisors virtualise hardware for virtual machines, and BIOS settings and swap are unrelated to container boundaries.

Correct answer: A — ResourceQuota

A ResourceQuota caps total resource consumption and object counts within a namespace. A PodDisruptionBudget limits voluntary disruption, the HorizontalPodAutoscaler scales replicas, and a PriorityClass influences preemption order.

Correct answer: A — Secret

Secrets are the object intended for sensitive values and can be mounted or exposed as environment variables with access controlled by RBAC. ConfigMaps hold non-sensitive configuration, and annotations and labels are metadata attached to objects.

Correct answer: A — PersistentVolumeClaim

A PersistentVolumeClaim expresses a storage request that is satisfied by a PersistentVolume, often provisioned dynamically by a StorageClass. emptyDir is ephemeral and dies with the Pod, ConfigMap volumes project configuration, and hostPath ties the Pod to a specific node's filesystem.

Correct answer: A — Which API group the resource belongs to and the stability level of that API version

apiVersion names the API group and version, where v1 indicates a stable API and beta or alpha indicate less stable ones. It has nothing to do with image tags, cluster patch versions, or namespace placement.

Correct answer: A — Helm

Helm charts bundle templated manifests with values, and releases are versioned and upgradeable. etcdctl administers etcd, crictl talks to the container runtime, and kubeadm bootstraps clusters.

Correct answer: A — The scheduler reserves 200m for placement and the container is throttled above 500m

The request drives scheduling and guaranteed share, while the CPU limit causes throttling rather than termination when exceeded. CPU is compressible, so exceeding it slows the container instead of killing it, which is what happens with memory limits.

Correct answer: A — etcd

etcd is the consistent key-value store that holds all API objects, which is why backing it up is essential. The container runtime runs containers, the kubelet caches for its own node, and kube-proxy programs networking rules derived from state rather than storing it.

Correct answer: A — They store non-confidential configuration as key-value pairs that can be mounted or exposed as environment variables

ConfigMaps carry non-sensitive configuration and can be projected as files or environment variables. They are not designed for confidentiality, they support multiple consumption methods, and they are namespaced objects.

Correct answer: A — CustomResourceDefinition

A CustomResourceDefinition registers a new resource type so instances can be created and watched like built-in objects. ConfigMaps hold data rather than defining types, ingress classes select controllers, and PodPreset was an older removed feature.

Correct answer: A — Container Storage Interface

CSI is the standard that lets storage systems provide drivers out of tree. CRI covers runtimes, SMI is a service mesh specification, and CNI covers pod networking.

Correct answer: A — kubectl describe pod <name>

kubectl describe prints the object's spec, status, conditions, and recent events, which is where scheduling and image pull failures appear. Listing nodes, applying a manifest, and viewing kubeconfig do not report a Pod's failure reason.

Correct answer: A — Every Pod gets its own IP address and can reach every other Pod without NAT

The Kubernetes network model requires a flat address space where each Pod has its own IP and can reach any other Pod directly. Pods do not share a node IP, direct Pod-to-Pod traffic is allowed, and Pod IPs are ephemeral by design.

Correct answer: A — The image name is wrong or the registry credentials are missing

ImagePullBackOff means the kubelet could not pull the image, typically because of a bad reference, a missing tag, or an unauthenticated private registry. Probe failures show as unready containers, insufficient CPU shows as Pending, and a selector mismatch affects Service endpoints rather than image pulls.

Correct answer: A — kubectl apply -f manifest.yaml

kubectl apply performs a declarative update, creating or patching only the objects in the file. Replace with force deletes and recreates the object, delete removes it, and drain evicts workloads from a node.

Correct answer: A — It encodes operational knowledge for an application as a controller acting on custom resources

An operator is software that watches custom resources and automates day-two tasks such as backup, upgrade, and failover for a specific application. It is not a person, it does not replace the scheduler, and it is not a manifest editor.

Correct answer: A — Use minimal base images and multi-stage builds so build tools are not shipped

Minimal bases and multi-stage builds keep compilers and package managers out of the runtime image, which shrinks both size and vulnerability surface. Full distributions, root execution, and speculative package installation all increase risk.

Correct answer: A, B — Services can be deployed and scaled independently · Teams can own and release their services autonomously

Independent deployment, scaling, and team ownership are the real benefits microservices buy. They make distributed transactions harder, introduce network latency and failure between components, and spread debugging across many processes.

Correct answer: A — kube-apiserver

The API server is the front door to the cluster and mediates all reads and writes to etcd, which keeps the datastore's access surface small. The scheduler, kubelet, and kube-proxy all interact with the cluster through the API server.

Correct answer: A, B — An image is composed of read-only layers plus metadata · A digest identifies exact image content, while a tag is a mutable pointer

Images are layered and content-addressable by digest, whereas tags can be repointed to different content. Containers share the host kernel rather than shipping or booting their own, and one image can back any number of concurrent containers.

Correct answer: A — The Cloud Native Computing Foundation

The CNCF hosts the cloud native project landscape and marks maturity as sandbox, incubating, or graduated. Apache hosts a different portfolio, the IETF publishes internet standards, and the OCI defines container image and runtime specifications.

Correct answer: A — allowPrivilegeEscalation set to false

Setting allowPrivilegeEscalation to false stops a process gaining more privileges than its parent. Running privileged or sharing the host network and PID namespaces all increase rather than reduce the container's reach into the host.

Correct answer: A — Kustomize

Kustomize composes manifests through bases and overlays using patches rather than templates, and it is built into kubectl. Helm uses templating with values, kubeadm bootstraps clusters, and kubectl proxy forwards API traffic.

Correct answer: A — DaemonSet

A DaemonSet schedules one Pod per matching node and adds Pods automatically as nodes join. Deployments manage a replica count without node affinity guarantees, Jobs run to completion, and StatefulSets manage ordered, identity-bearing Pods.

Correct answer: A — Container Runtime Interface

CRI is the gRPC interface between the kubelet and the container runtime, which is what makes runtimes pluggable. CNI covers networking plugins, CSI covers storage drivers, and the OCI image spec defines image format rather than the runtime interface.