Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: In a Kubernetes cluster running multiple Ingress Controllers, how should you configure an Ingress resource so that it is. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- In a Kubernetes cluster running multiple Ingress Controllers, how should you configure an Ingress resource so…
- In a Kubernetes cluster, which component runs on every node to manage the lifecycle of containers?
- How would you adjust a Kubernetes Deployment named 'cache' to run exactly 7 instances using kubectl?
- A Kubernetes cluster has 20 nodes, but you want to run exactly 5 instances of a stateless frontend service, i…
- In the Open Container Initiative (OCI) Specification, which areas are standardized?
- To enhance container security and efficiency in a production Kubernetes environment, which image build strate…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. In a Kubernetes cluster running multiple Ingress Controllers, how should you configure an Ingress resource so that it is handled by a specific controller?
Answer: C. Set spec.ingressClassName on the Ingress to the name of the desired IngressClass
Setting spec.ingressClassName explicitly binds the Ingress resource to the correct controller. Older Kubernetes versions relied on annotations, but the IngressClass API is now the standard mechanism.
Q2. In a Kubernetes cluster, which component runs on every node to manage the lifecycle of containers?
Answer: C. Kubelet
The kubelet runs on every node to ensure containers are healthy and running in their expected state. Do not confuse it with the container runtime, which the kubelet directs to execute the actual containers.
Q3. How would you adjust a Kubernetes Deployment named 'cache' to run exactly 7 instances using kubectl?
Answer: C. kubectl scale deployment/cache –replicas=7
The kubectl scale command with the replicas flag is the standard imperative method to adjust Deployment instances. Exam takers should memorize kubectl scale deployment and avoid distractors using fictional verbs like resize.
Q4. A Kubernetes cluster has 20 nodes, but you want to run exactly 5 instances of a stateless frontend service, independent of how many nodes are in the cluster. You also want Kubernetes to handle rolling updates to new image versions. Which K…
Answer: B. Deployment
A Deployment manages a set of stateless replicas and provides rolling updates, making it the correct choice for this scenario. A DaemonSet runs a pod on every node, which would not maintain an exact count of five instances.
Q5. In the Open Container Initiative (OCI) Specification, which areas are standardized?
Answer: A. Container image format, runtime environment, and distribution
The correct answer is image format, runtime environment, and distribution because the OCI defines these three core specifications. A strong distractor mentions orchestration tools, but the OCI deliberately avoids standardizing higher-level orchestration platforms like Kubernetes.
Q6. To enhance container security and efficiency in a production Kubernetes environment, which image build strategy aligns with industry best practices?
Answer: A. Use small base images in a multi-stage build with pinned dependency checksums
The correct answer uses small base images with multi-stage builds and pinned checksums to minimize attack surface and guarantee integrity. Distractors using distroless images fail because including debug packages directly contradicts the goal of minimizing image size.
Q7. A software company aims to implement an open storage standard to prevent vendor lock-in and ensure uniform storage compatibility across both open source and commercial platforms. Which Container Storage Interface (CSI) benefit most directl…
Answer: D. CSI allows vendors to create solutions using open specifications, allowing storage to operate consistently without core adjustments
The Container Storage Interface provides a standardized open specification, allowing storage vendors to write one plugin that works across multiple container orchestrators without touching core code. Option A fails because in-tree integrations are actively being phased out to prevent vendor lock-in.
Q8. A development team is migrating their microservices to the cloud and needs to monitor request flows across services. They want a solution that shows the entire journey of a user request from frontend through backend services. Which cloud-n…
Answer: A. Distributed Tracing
Distributed tracing tracks and visualizes the complete path of a single user request as it traverses across various microservices. While a service mesh can facilitate this tracking, distributed tracing is the specific observability discipline providing the actual visibility.
Q9. What is ephemeral storage in the context of Kubernetes?
Answer: B. A temporary storage type that is tied to the lifecycle of a Pod
Ephemeral storage is strictly tied to the lifecycle of a Pod, meaning the temporary data is deleted forever when the Pod is terminated or restarted. Option A describes persistent storage, which survives Pod restarts by using persistent volumes.
Q10. Which of the following options are metric types available in Prometheus?
Answer: A. Counter, Gauge, Histogram, Summary
Prometheus fundamentally supports four metric types: counter, gauge, histogram, and summary. Options including timer or rate are incorrect because rate is a PromQL function used on counters, while timers are typically implemented as histograms or summaries.
Q11. In Kubernetes, how do you add persistent storage to a Pod?
Answer: A. By defining a PersistentVolumeClaim in the Pod specification
You add persistent storage by defining a PersistentVolumeClaim inside the Pod specification. This claim acts as a request for storage resources that Kubernetes automatically fulfills by binding it to a matching PersistentVolume.
Q12. In Kubernetes, which security-focused tool is commonly used for runtime security monitoring and detection of anomalous activities within containers and pods?
Answer: A. Falco
Falco is a CNCF tool designed specifically for runtime security, tapping into system calls to detect anomalous container behavior in real-time. The other options are unrelated to runtime security; Istio manages networking, Prometheus handles metrics, and Helm deploys packages.
Q13. In Kubernetes, through which mechanism is a service account token made accessible to a Pod?
Answer: C. A file containing the token is mounted at /var/run/secrets/kubernetes.io/serviceaccount/token
Kubernetes automatically mounts a volume containing the service account token at a standard fixed file path for Pod consumption. Environment variables or direct API calls are not the default mechanisms used by the kubelet to inject credentials into Pods.
Q14. What are the three maturity stages a project passes through within the Cloud Native Computing Foundation (CNCF)?
Answer: A. Sandbox, Incubating, Graduated
The CNCF hosts projects through three maturity stages: Sandbox, Incubating, and finally Graduated. Option B describes Kubernetes resource stability phases, which is a distinct concept from the overall project lifecycle.
Q15. What does the acronym OIDC stand for in the context of authentication and authorization?
Answer: C. OpenID Connect
OIDC stands for OpenID Connect, an interoperable identity layer built on top of the OAuth 2.0 framework. It is the standard method Kubernetes uses to integrate external identity providers for authenticating cluster users.
Q16. In a Kubernetes cluster, the security team has applied the Restricted Pod Security level to a multi-tenant namespace. Which set of characteristics best describes this policy?
Answer: A. Requires pods to run as non-root, disallows privilege escalation, blocks hostPath and host networking, and enforces seccomp and capability restrictions
The Restricted profile enforces the most stringent security settings, including running as non-root and blocking privilege escalation. The Privileged profile places no limits, while Baseline allows root but blocks obvious privilege escalation.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.