Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which Kubernetes component is responsible for exposing applications running on a set of Pods as a network service?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- Which Kubernetes component is responsible for exposing applications running on a set of Pods as a network ser…
- When a pod-based application requires secure Kubernetes API access independent of user credentials, which met…
- What is the main function of OpenID Connect (OIDC) when integrated with Kubernetes?
- When the kubectl expose command is used in Kubernetes, which component is created?
- In Kubernetes architecture, which component is considered the "source of truth" for all cluster state and con…
- In the CI/CD pipeline, what does "Integration" in Continuous Integration (CI) particularly emphasise?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which Kubernetes component is responsible for exposing applications running on a set of Pods as a network service?
Answer: B. Service
A Service provides a stable network endpoint and load balances traffic across a dynamic set of Pods. While an Ingress manages external HTTP routing, the Service is the core abstraction that exposes the pod network.
Q2. When a pod-based application requires secure Kubernetes API access independent of user credentials, which method aligns with cluster security best practices?
Answer: C. Associate a custom ServiceAccount with the pod and bind it to a least-privilege Role.
Assigning a dedicated custom ServiceAccount bound to a least-privilege Role adheres to the principle of least privilege for applications needing API access. Avoid modifying the default ServiceAccount because it is heavily shared across all pods in a namespace.
Q3. What is the main function of OpenID Connect (OIDC) when integrated with Kubernetes?
Answer: C. To authenticate cluster users using an external identity provider
OpenID Connect allows Kubernetes to delegate user authentication to an external identity provider, enabling single sign-on for cluster access. It verifies identities, while internal RBAC components handle what those authenticated users are authorized to do.
Q4. When the kubectl expose command is used in Kubernetes, which component is created?
Answer: B. Service
Running kubectl expose creates a Service object that provides a stable IP and routes network traffic to the underlying Pods. This command takes an existing workload resource like a Deployment and abstracts it for network access.
Q5. In Kubernetes architecture, which component is considered the "source of truth" for all cluster state and configuration?
Answer: B. etcd
etcd serves as the definitive distributed key-value store, persisting the entire desired state and cluster configuration. Although the API Server acts as the gateway for all interactions, it reads and writes every change directly to etcd.
Q6. In the CI/CD pipeline, what does "Integration" in Continuous Integration (CI) particularly emphasise?
Answer: A. The combination and testing of code changes from multiple developers to a shared repository
Continuous Integration emphasizes frequently merging code changes from multiple developers into a shared main repository. Automated testing validates these merges immediately, catching integration bugs early before they reach production.
Q7. What is the essential requirement for a successful canary deployment in Kubernetes?
Answer: A. Gradual shifting of user traffic to the new version while monitoring key metrics
A canary deployment incrementally shifts a small fraction of user traffic to the new version while monitoring key health metrics. This controlled rollout limits blast radius, unlike parallel updates which expose all users simultaneously.
Q8. What is the default update strategy used by Kubernetes Deployments for rolling out updates?
Answer: B. RollingUpdate
The default deployment strategy is RollingUpdate, ensuring new pods become ready before terminating old ones. Recreate causes downtime, while blue/green and canary require custom tooling outside default strategy configuration.
Q9. Which Kubernetes feature automatically scales the number of pods in a deployment or replica set based on observed CPU utilisation or other select metrics?
Answer: B. Horizontal Pod Autoscaler
The Horizontal Pod Autoscaler automatically adjusts the number of replicas based on CPU or custom metrics. The Deployment Controller manages pod lifecycle, not dynamic autoscaling based on load.
Q10. When you need to manage and provide persistent data for an application running in Kubernetes, which resource should you use?
Answer: C. Persistent Volume
A Persistent Volume provides durable storage independent of pod lifecycles. ConfigMaps and Secrets handle configuration data, not persistent block or file storage required by stateful workloads.
Q11. In Kubernetes, how do Network Policies behave when multiple policies are applied to the same set of pods?
Answer: B. They are additive, where each additional policy further restricts allowed traffic
Network Policies are strictly additive, meaning each new policy can only further restrict traffic or grant additional exceptions. For the exam, remember that rules never override each other, and isolation only occurs when a policy explicitly selects a pod.
Q12. To enforce the Baseline security profile for pods in the 'production' namespace using Kubernetes built-in controls, what should a cluster administrator do?
Answer: B. Label the namespace to enable the Pod Security Admission controller with the Baseline profile.
The built-in Pod Security Admission controller enforces the Baseline profile when specific labels are applied to the namespace. This modern approach replaced complex custom webhooks, providing native, standardized policy enforcement for cluster security.
Q13. You notice that Pods are successfully scheduled onto a specific Kubernetes worker node, but on that node no containers are actually being created or started. Which component on that node is primarily responsible for creating and managing t…
Answer: C. kubelet
The kubelet runs on every node and receives instructions from the API server to instantiate and manage containers. If pods remain pending without container creation, always check the node's kubelet status and logs before troubleshooting the scheduler.
Q14. In Kubernetes, what is the relationship between Deployments and ReplicaSets?
Answer: B. ReplicaSets are created and managed by Deployments to ensure the desired number of pod replicas
Deployments manage ReplicaSets to handle pod rollout and scaling. A strong exam tip is remembering that ReplicaSets maintain exact pod counts, while Deployments provide the layered declarative updates.
Q15. In Kubernetes, when would you use co-located containers within a single Pod, specifically in a sidecar pattern?
Answer: B. When the sidecar container provides auxiliary support, like logging or monitoring, to the main application container
The sidecar pattern pairs a helper container with a main application within the same pod. Remember that pods are the smallest scalable unit, meaning all containers inside scale together, so independent scaling fails.
Q16. Which Kubernetes resource should you use if you need to ensure that an instance of a pod runs on every node in the cluster?
Answer: B. DaemonSet
A DaemonSet ensures that a replica of a specific pod runs on every selected node. For the exam, associate DaemonSets with node-level background tasks like logging agents or network probes.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.