Kubernetes and Cloud Native Associate (KCNA)

Correct answer: C. runc

The correct answer is runc because it is the CLI reference implementation of the OCI runtime specification. For the KCNA exam, remember that Docker and containerd are higher-level runtimes, whereas runc actually does the container creation.

Correct answer: C. FinOps

The correct answer is FinOps because this persona focuses specifically on cloud financial management and cost optimization. DevOps is a strong distractor, but it focuses on delivery and operations workflows rather than financial accountability.

Correct answer: C. CRI-O

The correct answer is CRI-O because it was built specifically as a lightweight Kubernetes runtime implementing the Container Runtime Interface. While containerd also conforms to the CRI, it serves as a broader core container runtime rather than a Kubernetes-exclusive one.

Correct answer: B. Control Plane

The correct answer is the Control Plane since it makes global cluster decisions and manages the overall cluster state. The scheduler and controller manager are strong distractors, but they are individual components running within that control plane.

Correct answer: B. Kubelet

The correct answer is the Kubelet because it acts as the primary node agent ensuring containers run in their intended state. The API server is a distractor that manages the entire cluster centrally rather than managing individual nodes locally.

Correct answer: B. Pending

The correct answer is Pending because this state indicates the pod has been accepted but containers are not yet running, often due to image pulls. Initializing is a strong distractor, but Kubernetes does not use it as a primary pod phase.

Correct answer: C. Platform Engineers

The correct answer is Platform Engineers because they design and maintain the internal developer platform enabling application deployment. DevOps is a strong distractor, but it focuses broadly on culture and pipelines rather than building infrastructure products.

Correct answer: B. To generate and expose cluster state data

The correct answer is to generate and expose cluster state data because kube-state-metrics listens to the API server and outputs Prometheus metrics. A strong distractor is monitoring network traffic, which is handled by components like the CNI or network observability tools.

Correct answer: B. CNCF Ambassador

The CNCF Ambassador role matches these activities because ambassadors actively organize meetups, speak at conferences, and mentor new contributors. For the exam, remember that TOC members manage technical projects, while ambassadors focus on community advocacy.

Correct answer: B. Kubernetes can use OPA to validate requests and apply policies across the cluster

Kubernetes integrates OPA as an admission controller to validate API requests and enforce cluster-wide policies. OPA is not a service mesh or load balancer; it functions purely as a general-purpose policy engine used for compliance and governance.

Correct answer: B. Prometheus

Prometheus is the correct choice because it is the primary CNCF project designed for cloud-native monitoring and alerting via a time-series database. Do not confuse it with Envoy, which handles network proxying, or Helm, which packages applications.

Correct answer: B. kubectl label --overwrite ns example pod-security.kubernetes.io/warn=baseline

Pod Security Admission configurations are applied to namespaces using standard labels, specifically 'pod-security.kubernetes.io/warn=baseline'. Avoid using annotations for this, as the admission controller specifically reads security configurations from namespace labels.

Correct answer: C. The IP addresses and ports of the Pods backing a Service

Endpoints represent the actual IP addresses and ports of the Pods backing a Service. They are crucial for keeping network routing updated as Pods scale up or down, ensuring traffic reaches healthy targets.

Correct answer: C. Tracking the IP addresses and ports of Pods associated with a Service

Service Endpoints track the IP addresses and ports of associated Pods to enable accurate traffic routing. Endpoints update dynamically as Pods are created or terminated, ensuring clients always reach available application instances.

Correct answer: B. Kube-Proxy

Kube-Proxy runs on each node to handle packet routing and manage IP table rules for Services. The API server handles state management, while etcd provides the backing data store for the cluster.

Correct answer: C. Kubernetes API Server

The Kubernetes API Server acts as the central management hub, processing all RESTful requests to manage cluster resources. Every component, including kubelet and controller manager, must communicate through the API server.

Correct answer: C. Set spec.ingressClassName on the Ingress to the name of the desired IngressClass

Setting spec.ingressClassName explicitly binds the Ingress resource to the correct controller. Older Kubernetes versions relied on annotations, but the IngressClass API is now the standard mechanism.

Correct answer: C. Kubelet

The kubelet runs on every node to ensure containers are healthy and running in their expected state. Do not confuse it with the container runtime, which the kubelet directs to execute the actual containers.

Correct answer: C. kubectl scale deployment/cache --replicas=7

The kubectl scale command with the replicas flag is the standard imperative method to adjust Deployment instances. Exam takers should memorize kubectl scale deployment and avoid distractors using fictional verbs like resize.

Correct answer: B. Deployment

A Deployment manages a set of stateless replicas and provides rolling updates, making it the correct choice for this scenario. A DaemonSet runs a pod on every node, which would not maintain an exact count of five instances.

Correct answer: A. Container image format, runtime environment, and distribution

The correct answer is image format, runtime environment, and distribution because the OCI defines these three core specifications. A strong distractor mentions orchestration tools, but the OCI deliberately avoids standardizing higher-level orchestration platforms like Kubernetes.

Correct answer: A. Use small base images in a multi-stage build with pinned dependency checksums

The correct answer uses small base images with multi-stage builds and pinned checksums to minimize attack surface and guarantee integrity. Distractors using distroless images fail because including debug packages directly contradicts the goal of minimizing image size.

Correct answer: D. CSI allows vendors to create solutions using open specifications, allowing storage to operate consistently without core adjustments

The Container Storage Interface provides a standardized open specification, allowing storage vendors to write one plugin that works across multiple container orchestrators without touching core code. Option A fails because in-tree integrations are actively being phased out to prevent vendor lock-in.

Correct answer: A. Distributed Tracing

Distributed tracing tracks and visualizes the complete path of a single user request as it traverses across various microservices. While a service mesh can facilitate this tracking, distributed tracing is the specific observability discipline providing the actual visibility.

Correct answer: B. A temporary storage type that is tied to the lifecycle of a Pod

Ephemeral storage is strictly tied to the lifecycle of a Pod, meaning the temporary data is deleted forever when the Pod is terminated or restarted. Option A describes persistent storage, which survives Pod restarts by using persistent volumes.

Correct answer: A. Counter, Gauge, Histogram, Summary

Prometheus fundamentally supports four metric types: counter, gauge, histogram, and summary. Options including timer or rate are incorrect because rate is a PromQL function used on counters, while timers are typically implemented as histograms or summaries.

Correct answer: A. By defining a PersistentVolumeClaim in the Pod specification

You add persistent storage by defining a PersistentVolumeClaim inside the Pod specification. This claim acts as a request for storage resources that Kubernetes automatically fulfills by binding it to a matching PersistentVolume.

Correct answer: A. Falco

Falco is a CNCF tool designed specifically for runtime security, tapping into system calls to detect anomalous container behavior in real-time. The other options are unrelated to runtime security; Istio manages networking, Prometheus handles metrics, and Helm deploys packages.

Correct answer: C. A file containing the token is mounted at /var/run/secrets/kubernetes.io/serviceaccount/token

Kubernetes automatically mounts a volume containing the service account token at a standard fixed file path for Pod consumption. Environment variables or direct API calls are not the default mechanisms used by the kubelet to inject credentials into Pods.

Correct answer: A. Sandbox, Incubating, Graduated

The CNCF hosts projects through three maturity stages: Sandbox, Incubating, and finally Graduated. Option B describes Kubernetes resource stability phases, which is a distinct concept from the overall project lifecycle.

Correct answer: C. OpenID Connect

OIDC stands for OpenID Connect, an interoperable identity layer built on top of the OAuth 2.0 framework. It is the standard method Kubernetes uses to integrate external identity providers for authenticating cluster users.

Correct answer: A. Requires pods to run as non-root, disallows privilege escalation, blocks hostPath and host networking, and enforces seccomp and capability restrictions

The Restricted profile enforces the most stringent security settings, including running as non-root and blocking privilege escalation. The Privileged profile places no limits, while Baseline allows root but blocks obvious privilege escalation.

Correct answer: C. Control-plane nodes orchestrate the cluster, maintain the desired state, and manage scheduling, while worker nodes run the pods and containers.

Control-plane components make global decisions about scheduling and cluster state, while worker nodes host the container runtime and pods. Remember the exam cue: brain versus muscle.

Correct answer: C. By specifying the ApplicationSet in a YAML definition connected to a Git repo holding application configurations

ApplicationSets declaratively generate Argo CD Applications from a Git repository to automate cluster deployments. Avoid manual kubectl commands since GitOps relies entirely on Git as the single source of truth.

Correct answer: B. GitOps

GitOps uses a Git repository as the single source of truth for declarative infrastructure and applications. While Infrastructure as Code provisions resources, GitOps specifically relies on continuous reconciliation.

Correct answer: C. To define HTTP/HTTPS routing rules that expose multiple Services through a single external endpoint

The Ingress API consolidates external HTTP and HTTPS routing rules to expose multiple services behind a single endpoint. Standard services like LoadBalancer lack layer seven path and host-based routing capabilities.

Correct answer: A. Container Runtime

The container runtime, such as containerd, directly executes and manages container lifecycles. While the kubelet supervises pods, it delegates the actual container execution to the runtime.

Correct answer: B. Configure node affinity with requiredDuringSchedulingIgnoredDuringExecution to match 'environment: prod'

Using node affinity with requiredDuringSchedulingIgnoredDuringExecution strictly binds the Pod to nodes matching the specific label. Option D fails because anti-affinity rules only prevent scheduling relative to other Pods, not against node labels.

Correct answer: B. The CronJob controller spawns a Job, which is then processed by the Job controller to create a Pod

When triggered, the CronJob controller generates a Job object, which the Job controller uses to create Pods. Remember that controllers operate hierarchically; the CronJob does not directly create Pods, ensuring workload reliability.

Correct answer: A. kubectl logs [pod-name] -c [container-name] -p

The kubectl logs command requires the previous flag to retrieve outputs from a terminated container. Without this specific flag, kubectl attempts to fetch logs from the currently running instance, which fails for crashed containers.

Correct answer: A. Envoy

Envoy is a modern, high-performance proxy built specifically for microservices and service meshes. Prometheus and Grafana handle monitoring and visualization, while Fluentd focuses on logging, not routing network traffic.

Correct answer: B. Serverless

Serverless computing abstracts the underlying infrastructure away from the developer and bills based on actual execution time. Microservices and containerization represent application architectures, but still require you to manage the infrastructure scaling directly.

Correct answer: A. Supplying non-sensitive settings to containers through environment variables or mounted files

ConfigMaps inject non-sensitive configuration data into pods via environment variables or mounted volumes. For sensitive data like passwords or tokens, you must use Kubernetes Secrets instead to ensure secure handling.

Correct answer: B. Exec into one of the failing Pods or start a temporary debug Pod and run dig or nslookup for the target service name

Testing DNS resolution from inside the affected pod verifies the exact network path and configuration the application uses. Checking CoreDNS logs is useful later, but it does not validate end-to-end resolution from the pod perspective.

Correct answer: B. Kustomize allows defining environment-specific patches without altering the base, whereas Helm uses value files to parameterize templates.

Kustomize applies environment-specific overlays to base manifests without altering the base files themselves. Helm relies on templated manifests combined with values files to substitute variables dynamically during deployment.

Correct answer: A. Specify nodeSelector: 'compliance: pci-dss' in the Pod spec

Using nodeSelector in the pod spec directly constrains the scheduler to place pods only on nodes with the matching label. Tolerations allow pods to schedule onto tainted nodes but do not strictly enforce placement on specific labeled nodes.

Correct answer: A. Enable the Pod Security Admission controller and label all namespaces with pod-security.kubernetes.io/enforce=restricted

The Pod Security Admission controller enforces security profiles like restricted to prevent privilege escalation cluster-wide. PodSecurityPolicy was deprecated and removed in recent Kubernetes versions, making it an obsolete distractor.

Correct answer: C. Pods use direct, NAT-less networking for communication on the same node

Kubernetes requires pods to communicate directly without network address translation, whether on the same node or across nodes. Every pod receives a unique IP address, allowing seamless routing without relying on port mapping.

Correct answer: D. Inspect pod-specific events using kubectl describe

Using kubectl describe is the primary step because it surfaces pod-level events, exit codes, and configuration issues driving the crash. While container logs provide internal application output, events explain why Kubernetes is repeatedly restarting the container.

Correct answer: C. Ceph

Ceph is a highly scalable distributed storage system offering unified block, object, and file interfaces. The other options are either cloud-native storage orchestrators like Rook, or alternative systems like GlusterFS and OpenEBS that do not natively support all three modes simultaneously.

Correct answer: D. Apply a Label to the namespace that enables the Restricted profile.

The built-in Pod Security Admission controller is triggered by adding specific labels like 'pod-security.kubernetes.io/enforce=restricted' to the namespace. While a custom webhook could achieve this, namespace labels are the standard Kubernetes method.

Correct answer: B. Infrastructure as Code

Infrastructure as Code defines cloud resources declaratively or imperatively through machine-readable files. For the KCNA exam, associate IaC strictly with Terraform or Ansible rather than manual click-ops.

Correct answer: C. Site Reliability Engineer (SRE)

Site Reliability Engineers own system reliability and lead incident responses to minimize downtime. While DevOps focuses on delivery pipelines, SRE specifically applies service level objectives to production operations.

Correct answer: A. Require node with label 'gpu=true'

Using required rules enforces strict scheduling constraints for pods needing specialized hardware. Prefer rules only apply soft constraints, allowing the scheduler to place the pod anywhere if capacity is limited.

Correct answer: A. Use a nodeSelector with the label 'data-classification: confidential' in the Pod template

Using a nodeSelector with the appropriate label strictly constrains the Pod to nodes matching that specific tag. While node affinity could also work, nodeSelector is the simplest and most direct mechanism for strict label matching.

Correct answer: A. A container that runs alongside the main container to handle administrative tasks

A sidecar container runs alongside the main container within the same Pod to handle supporting tasks like logging or monitoring. Option B describes the primary application container, whereas the sidecar augments it without running the core workload.

Correct answer: A. Gateway API

The Gateway API provides a standardized, extensible interface for managing L4 and L7 traffic routing in Kubernetes. NetworkPolicy is limited to L3 and L4 access control, lacking the advanced routing capabilities defined by the Gateway API.

Correct answer: A. Managing network traffic between services

A service mesh primarily manages service-to-service communication, offering capabilities like load balancing and encryption. Option D fails because monitoring is merely an observability byproduct rather than the core traffic management function.

Correct answer: A. Orphaned ReplicaSets, Completed Jobs, Terminated Pods

The garbage collector automatically removes orphaned or finished resources like terminated Pods and completed Jobs. The other options contain active resources that the cluster still requires, so they are intentionally preserved.

Correct answer: C. 110

The default maximum pods per node in Kubernetes is one hundred and ten. This is enforced by the default IP address allocation range, and while it can be modified, the default limit remains a key exam detail.

Correct answer: A. Role-Based Access Control (RBAC)

Role-Based Access Control grants granular control by binding users or service accounts to specific permissions defined by roles. ABAC is largely deprecated in modern clusters because it is difficult to manage and lacks flexible policy updates.

Correct answer: C. metrics.k8s.io

The metrics.k8s.io API exposes resource consumption data gathered by the Metrics Server. This endpoint is required for core features like kubectl top to function and provides the essential telemetry needed for Horizontal Pod Autoscaling operations.

Correct answer: B. 1 year

According to official deprecation policy, Kubernetes guarantees API backward compatibility for one year. However, specific graduated stable APIs can be supported much longer, making this policy-specific question slightly ambiguous.

Correct answer: C. YAML Objects

Kubernetes manifests are typically written using YAML to declaratively represent objects like Pods and Services. Although the API server ultimately accepts and processes JSON payloads, YAML remains the industry standard for human-readable configuration files.