Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: How do Roles and ClusterRoles differ in scope within Kubernetes RBAC?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- How do Roles and ClusterRoles differ in scope within Kubernetes RBAC?
- In Kubernetes, which feature is effective for managing costs by allowing for the categorization and organizat…
- Which open-source storage platform offers integrated block, file, and object storage, making it a versatile c…
- A platform team lead is evaluating events for her team's professional development. How do Kubernetes Communit…
- Which function is primarily associated with Kubernetes Security Contexts?
- Who is responsible for the governance and operation of hosted projects under the Cloud Native Computing Found…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. How do Roles and ClusterRoles differ in scope within Kubernetes RBAC?
Answer: A. Roles are limited to a specific namespace, while ClusterRoles have cluster-wide applicability
Roles are strictly namespaced objects that restrict permissions to a single specific namespace. ClusterRoles are cluster-scoped and can govern resources across the entire cluster, meaning they do not need separate bindings for each namespace.
Q2. In Kubernetes, which feature is effective for managing costs by allowing for the categorization and organization of resources?
Answer: C. Labels
Labels are key-value pairs used to attach identifying metadata to Kubernetes objects, allowing administrators to group, filter, and allocate resources effectively. While namespaces isolate environments, labels provide the flexible filtering required for granular cost tracking and resource organization.
Q3. Which open-source storage platform offers integrated block, file, and object storage, making it a versatile choice for distributed environments?
Answer: B. Ceph
Ceph provides a unified storage platform that simultaneously supports block, file, and object storage interfaces within distributed environments. MinIO is limited to object storage, whereas Ceph delivers the comprehensive multi-modal capability required by modern cloud-native workloads.
Q4. A platform team lead is evaluating events for her team's professional development. How do Kubernetes Community Days (KCDs) typically differ from large commercial Kubernetes conferences?
Answer: A. KCDs are community-driven events focused in a specific region or city
Kubernetes Community Days are locally organized events that emphasize regional networking and grassroots collaboration rather than global corporate sponsorships. While large commercial conferences often feature major vendor keynotes, KCDs focus on community-driven content tailored to specific geographic areas.
Q5. Which function is primarily associated with Kubernetes Security Contexts?
Answer: D. Defining container or pod level security settings
Security Contexts define privilege and access control settings for Pods or Containers. Resource constraints, like CPU limits, are managed separately through resource requests and limits, making that option a common distractor.
Q6. Who is responsible for the governance and operation of hosted projects under the Cloud Native Computing Foundation (CNCF)?
Answer: C. The CNCF Technical Oversight Committee
The CNCF Technical Oversight Committee handles technical governance and oversight for hosted projects. While the Linux Foundation manages overall administrative operations, the TOC directly oversees the technical direction and project lifecycle.
Q7. In Kubernetes, which tool is specifically designed as a comprehensive service mesh to control, secure, and observe the interactions between microservices, apart from facilitating advanced traffic management?
Answer: C. Istio
Istio is a dedicated service mesh providing advanced traffic management, security, and observability for microservices. Traefik is an ingress controller, and Weave Net focuses on container networking rather than service mesh capabilities.
Q8. Which product is built using the GitOps Toolkit, a set of composable APIs and specialised tools for building GitOps-based continuous delivery systems?
Answer: C. Flux
Flux is built using the GitOps Toolkit, providing composable APIs for continuous delivery. Argo CD is another popular GitOps tool but relies on its own monolithic controller architecture rather than the specialized GitOps Toolkit components.
Q9. A developer has configured a Kubernetes Service to route traffic to their application. The service makes use of Kubernetes EndpointSlices that contain IP addresses pointing to which type of Kubernetes Object?
Answer: A. Pod
EndpointSlices contain IP addresses that directly reference Pods, as Pods are the actual endpoints that receive traffic. Deployments manage Pods but are not the direct network endpoints.
Q10. You run the command kubectl get pods -l app=web in a Kubernetes cluster. What does this command illustrate about the relationship between labels and selectors?
Answer: B. The -l flag applies a label selector that filters pods based on their labels
The -l flag applies a label selector to filter resources matching specific key-value pairs. Candidates should remember labels are fundamental for grouping objects, whereas annotations are used for non-identifying metadata.
Q11. A company's security policy requires real-time vulnerability scanning on every physical and virtual machine in their hybrid cloud environment. Which Kubernetes resource ensures an identical security agent pod runs automatically on each clu…
Answer: A. DaemonSet
A DaemonSet ensures a copy of a specific pod runs on all matching nodes, making it ideal for node-level agents. Deployments manage stateless applications replicated across the cluster, but they do not guarantee one pod per node.
Q12. Which component in Kubernetes automatically adjusts the number of nodes in a cluster based on the demands of the workloads?
Answer: C. Cluster Autoscaler
The Cluster Autoscaler adjusts the number of nodes in a cluster based on pending pods due to insufficient resources. Remember the distinction: Horizontal and Vertical Pod Autoscalers adjust pod counts or resource requests, not node counts.
Q13. Which of the following is a primary security benefit of maintaining a Software Bill of Materials (SBOM)?
Answer: A. It provides visibility into third-party components and their vulnerabilities.
An SBOM provides visibility into third-party components, helping teams quickly identify and patch known vulnerabilities. Licensing or compliance options might be related side effects, but supply chain transparency is the core security focus for the exam.
Q14. In a standard Kubernetes cluster, which types of objects are directly targeted by a HorizontalPodAutoscaler (HPA) to adjust the number of running Pods?
Answer: B. Deployments, ReplicaSets and StatefulSets
The HorizontalPodAutoscaler targets scalable controllers like Deployments and StatefulSets to adjust replica counts. It does not target individual pods directly, as controllers are responsible for managing the desired number of pod replicas.
Q15. In Kubernetes, how are resources like Pods and Services represented when being accessed or modified through the API server?
Answer: D. REST Objects
Kubernetes resources are fundamentally represented as REST objects accessed via standard API calls to the API server. While JSON or YAML are the formats used to serialize these objects, REST defines their architectural representation and manipulation.
Q16. For a scalable web application in Kubernetes that requires zero-downtime updates and automatic rollback capabilities, which controller is most appropriate?
Answer: D. Deployment
A Deployment provides declarative updates, rolling updates, and automatic rollback capabilities for stateless applications. A ReplicaSet only maintains a stable set of pods at any given time but lacks the built-in rollout and rollback history features.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.