Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: In terms of security best practices for containerization, why is it considered a bad practice to omit the USER directive. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- In terms of security best practices for containerization, why is it considered a bad practice to omit the USE…
- Which of the following best describes the concept of vertical scaling of an application?
- In a Kubernetes node, which component is primarily responsible for ensuring that the containers are running a…
- In Kubernetes, what does Service Discovery refer to?
- In Kubernetes, what modification is made to a ClusterIP service to create a headless service?
- What is the default setting for the –authorization-mode flag in the Kubernetes API server if the –authoriza…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. In terms of security best practices for containerization, why is it considered a bad practice to omit the USER directive in a Dockerfile?
Answer: C. The container will run as root which poses a security risk
Omitting the USER directive causes the container to default to running as the root user. Running processes as root poses a massive security risk because if the container is compromised, the attacker gains elevated administrative privileges within that environment.
Q2. Which of the following best describes the concept of vertical scaling of an application?
Answer: C. Increasing the computational resources (like CPU or memory) of an existing instance
Vertical scaling means increasing the computational resources, such as CPU or memory, allocated to an existing instance. This directly contrasts with horizontal scaling, which handles increased load by adding more parallel instances of the application.
Q3. In a Kubernetes node, which component is primarily responsible for ensuring that the containers are running as defined in the Pod specifications?
Answer: C. Kubelet
The kubelet is the primary node agent that ensures containers are running and healthy as defined in Pod specifications. Do not confuse this with the API server, which acts as the central management hub, or the scheduler, which only assigns pods to nodes.
Q4. In Kubernetes, what does Service Discovery refer to?
Answer: B. A system that allows services to locate and communicate with each other on the network
Service Discovery is the mechanism that allows services to locate and communicate with each other on the network. Kubernetes uses Service objects to provide stable IP addresses and DNS names, effectively decoupling workloads from the changing pod IP addresses.
Q5. In Kubernetes, what modification is made to a ClusterIP service to create a headless service?
Answer: A. Setting the ClusterIP to 'None'
Setting the clusterIP field to None creates a headless service, which bypasses kube-proxy and allows direct DNS resolution to individual Pod IP addresses. This is ideal for stateful workloads like databases requiring peer discovery.
Q6. What is the default setting for the –authorization-mode flag in the Kubernetes API server if the –authorization-config is not used?
Answer: A. AlwaysAllow
AlwaysAllow is the default setting, meaning no authorization checks are performed if specific modes are omitted from the startup flags. For any production cluster, you should explicitly configure secure modes like Node and RBAC.
Q7. What are the three pillars of observability in a software system?
Answer: A. Logs, Metrics, Traces
Logs, metrics, and traces form the foundational triad of observability. Performance and reliability are derived outcomes, whereas these three pillars provide the raw telemetry needed to inspect state.
Q8. When you need to examine the environment variables within an active container in a Kubernetes pod, which kubectl exec command should be employed?
Answer: B. kubectl exec <pod> — env
Using the double dash ensures kubectl passes the subsequent arguments directly to the container as a command. While 'kubectl exec -it <pod> env' works interactively, the correct syntax to execute a command cleanly without TTY allocation is using the double dash separator.
Q9. A cloud native advocate is observed hosting workshops to demonstrate CNCF project usage, presenting at industry events to advocate for cloud native technologies, and guiding newcomers through their first contributions to the community. Bas…
Answer: D. CNCF Ambassador
CNCF Ambassadors actively promote cloud native technologies through community advocacy, workshops, and public speaking. Project maintainers focus on technical code contributions, while the TOC handles project governance and technical direction.
Q10. How do Pod Disruption Budgets (PDBs) in Kubernetes help manage voluntary disruptions?
Answer: B. They ensure a minimum number of pods are always running during voluntary disruptions
PDBs ensure a minimum number or percentage of pods remain available during voluntary disruptions, protecting application availability. Note that PDBs do not manage involuntary disruptions like node hardware failures, which are handled by controllers.
Q11. In Kubernetes, what event triggers the kube-scheduler to assign a Pod to a specific node?
Answer: B. When a new Pod is created and needs to be scheduled
When a new Pod is created, it enters a Pending state, triggering the kube-scheduler to evaluate resources and assign it to a healthy node. While adding nodes changes available capacity, it does not directly trigger pod scheduling.
Q12. During Kubernetes pod initialization, what is the standard execution order for container probes?
Answer: A. Startup first, then Readiness and Liveness concurrently
The Startup probe runs first and must complete successfully before any other probes begin. Once the startup phase finishes successfully, both Readiness and Liveness probes will run concurrently. Readiness handles traffic routing, while Liveness handles restarts.
Q13. When troubleshooting update failures for a Deployment called 'api-service', which command reveals all historical versions and their change triggers?
Answer: A. kubectl rollout history deployment/api-service
The rollout history command displays all revision numbers and change-cause annotations for a Deployment. While checking cluster events is useful for live debugging, it does not reliably provide the structured version history that the rollout subcommand outputs.
Q14. Which of the following container runtimes are recognized for providing enhanced security features, such as stronger isolation through virtualization?
Answer: C. Kata Containers and gVisor
Kata Containers and gVisor provide enhanced security by implementing stronger isolation boundaries using lightweight virtual machines or user-space kernels. Standard runtimes like Docker and containerd share the host kernel, which offers less protection against escape attacks.
Q15. The cloud-native architecture centered around microservices proves to be a strong system that ensures what key quality in software systems?
Answer: B. Resiliency
Microservices isolate failures, directly enhancing system resiliency. While cloud-native systems can improve performance or rapid development, strict isolation makes fault tolerance the defining quality.
Q16. In cloud computing, which approach is best suited for simultaneously managing security threats and optimising costs by identifying unusual activities?
Answer: B. Cloud Anomaly Detection
Cloud anomaly detection fits because it flags unusual patterns that often signal security threats or waste. However, the wording is slightly ambiguous because resource allocation also handles optimization, though not security.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.