Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which organization oversees the development and standardization of cloud-native technologies including Kubernetes?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- Which organization oversees the development and standardization of cloud-native technologies including Kubern…
- In an Argo CD environment, which setup allows a new application to be consistently deployed across all manage…
- Which Kubernetes feature allows you to filter and retrieve a specific set of resources that share defined lab…
- In Kubernetes, what primary benefit is achieved by implementing NetworkPolicy resources?
- You are defining a convention for metadata in your Kubernetes cluster. How should you use annotations compare…
- A pod in a Kubernetes cluster is stuck in CrashLoopBackOff. The container logs indicate that the application…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which organization oversees the development and standardization of cloud-native technologies including Kubernetes?
Answer: A. Cloud Native Computing Foundation
The Cloud Native Computing Foundation, under the Linux Foundation, is the governing body responsible for Kubernetes and other cloud native projects. The other options are distractors with similar acronyms that do not exist.
Q2. In an Argo CD environment, which setup allows a new application to be consistently deployed across all managed clusters without manual intervention?
Answer: D. Configure an ApplicationSet resource linked to a Git repository storing the microservice's Kubernetes definitions
An ApplicationSet uses generators to automatically create Argo CD Applications across multiple clusters based on Git definitions. Standard Application resources lack the native templating needed for automated multi-cluster deployment.
Q3. Which Kubernetes feature allows you to filter and retrieve a specific set of resources that share defined labels?
Answer: C. Label Selectors
Label selectors provide the core querying mechanism used by Services and Deployments to group objects. While labels attach identifying metadata to resources, selectors actually perform the filtering based on those key-value pairs.
Q4. In Kubernetes, what primary benefit is achieved by implementing NetworkPolicy resources?
Answer: C. Controlled and restricted network traffic flows between pods as required
NetworkPolicy resources enforce security rules by restricting ingress and egress network traffic between pods. They do not manage storage, load balancing, or pod autoscaling, which are handled by separate Kubernetes components.
Q5. You are defining a convention for metadata in your Kubernetes cluster. How should you use annotations compared to labels on Kubernetes objects?
Answer: B. Use labels for identifying and selecting objects, and annotations for non-identifying metadata consumed by tools
Labels are designed for identifying and grouping resources using selectors, while annotations store non-identifying metadata. This makes annotations ideal for holding tooling configuration data that the core control plane ignores.
Q6. A pod in a Kubernetes cluster is stuck in CrashLoopBackOff. The container logs indicate that the application started but then immediately exited with a non-zero exit code. What is the most probable cause?
Answer: A. The application encountered an unhandled exception during startup
An unhandled application exception during startup immediately terminates the process with a non-zero exit code, causing the container to crash and loop. Watch for trick distractors like CPU throttling, which typically causes evictions rather than immediate application exits.
Q7. Which description best captures the defining features of the Baseline Pod Security Standard in Kubernetes?
Answer: C. A balanced approach that blocks known privilege escalations while accommodating common workloads
The Baseline policy is designed to prevent known privilege escalations while still permitting broadly compatible, everyday workloads. For context, the Privileged policy is the most open, while the Restricted policy is the strictest.
Q8. As part of enhancing security for a Kubernetes-based application, a developer is reviewing how sensitive data from Secrets is prepared for storage in etcd. Which encoding method does Kubernetes apply to this data by default?
Answer: A. Base64
Kubernetes encodes Secret data in base64 by default to safely represent binary information as text in JSON payloads. Remember that base64 is strictly encoding, not encryption, and offers zero confidentiality without enabling Encryption at Rest.
Q9. In Kubernetes, when using Secrets to store sensitive data, how is the data stored within the Secret by default?
Answer: C. Stored unencrypted in base64 encoding
Secrets are stored unencrypted, encoded only in base64 within the etcd database by default. Avoid confusing base64 with a hashing algorithm, and remember that true encryption requires actively configuring Encryption at Rest.
Q10. What are common components found in a service mesh implementation?
Answer: A. Data plane and Control plane
Service mesh architectures rely on a data plane to handle traffic via proxies and a control plane to configure routing policies. Knowing this clear separation of concerns is foundational for answering cloud-native networking questions.
Q11. For managing non-sensitive environment variables in Kubernetes, which resource provides key-value pairs without encryption?
Answer: A. ConfigMap
ConfigMaps store non-sensitive configuration data as plaintext key-value pairs. For the exam, contrast this with Secrets, which are specifically intended for confidential information like passwords or tokens.
Q12. In Kubernetes, which entities can utilise the immutable:true attribute to ensure that their data cannot be modified after creation?
Answer: B. ConfigMaps and Secrets
Setting the immutable field to true on ConfigMaps and Secrets prevents any further modifications to their data. Marking these resources as immutable also improves cluster performance by reducing unnecessary watches on the API server, which is a great practical tip to remember.
Q13. Which statement best describes the relationship between Kubernetes RBAC and the principle of least privilege?
Answer: B. Kubernetes RBAC is a mechanism that can be configured to enforce least privilege by granting narrowly scoped permissions to users and ServiceAccounts
Kubernetes RBAC is the core mechanism used to enforce least privilege by binding specific permissions to identities like ServiceAccounts. Remember that security is not automatic by default; administrators must actively configure Roles and RoleBindings to restrict access appropriately.
Q14. Within Kubernetes architecture, which component continuously ensures that deployed applications adhere to their specified configurations?
Answer: B. Controller Manager
The Controller Manager runs control loops that continuously watch cluster state and drive it toward the desired specification. Be careful not to confuse this reconciliation work with the kubelet, which only manages pods on a single node, or the scheduler, which simply assigns pods to nodes.
Q15. Which Linux feature is utilized by Kubernetes for container isolation and limits the resource usage of a process or a set of processes?
Answer: C. cgroups
Control groups, or cgroups, are the Linux feature used to limit, account for, and isolate resource usage like CPU and memory for processes. Remember that namespaces handle the visual and network isolation, whereas cgroups specifically enforce the resource quotas.
Q16. What is the purpose of the RollingUpdate strategy in a Kubernetes Deployment?
Answer: B. To incrementally update pods with a new version while maintaining availability
The RollingUpdate strategy incrementally updates pod instances with a new version while maintaining application availability. It prevents downtime by ensuring a certain number of replicas stay available, distinguishing it from the Recreate strategy which takes the application offline.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.