Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: In Kubernetes, which of the following accurately describes the functional separation between control-plane and worker no. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- In Kubernetes, which of the following accurately describes the functional separation between control-plane an…
- What configuration approach enables continuous deployment of applications using an Argo CD ApplicationSet?
- What is the name of the infrastructure and application delivery approach that uses version-controlled source…
- What is the primary role of the Ingress API in a Kubernetes cluster?
- In a Kubernetes node, which component is directly responsible for running containers?
- A healthcare company uses Kubernetes to manage a cluster with nodes labeled 'environment: prod' for patient d…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. In Kubernetes, which of the following accurately describes the functional separation between control-plane and worker nodes?
Answer: C. Control-plane nodes orchestrate the cluster, maintain the desired state, and manage scheduling, while worker nodes run the pods and containers.
Control-plane components make global decisions about scheduling and cluster state, while worker nodes host the container runtime and pods. Remember the exam cue: brain versus muscle.
Q2. What configuration approach enables continuous deployment of applications using an Argo CD ApplicationSet?
Answer: C. By specifying the ApplicationSet in a YAML definition connected to a Git repo holding application configurations
ApplicationSets declaratively generate Argo CD Applications from a Git repository to automate cluster deployments. Avoid manual kubectl commands since GitOps relies entirely on Git as the single source of truth.
Q3. What is the name of the infrastructure and application delivery approach that uses version-controlled source repositories as the authoritative source for declarative management?
Answer: B. GitOps
GitOps uses a Git repository as the single source of truth for declarative infrastructure and applications. While Infrastructure as Code provisions resources, GitOps specifically relies on continuous reconciliation.
Q4. What is the primary role of the Ingress API in a Kubernetes cluster?
Answer: C. To define HTTP/HTTPS routing rules that expose multiple Services through a single external endpoint
The Ingress API consolidates external HTTP and HTTPS routing rules to expose multiple services behind a single endpoint. Standard services like LoadBalancer lack layer seven path and host-based routing capabilities.
Q5. In a Kubernetes node, which component is directly responsible for running containers?
Answer: A. Container Runtime
The container runtime, such as containerd, directly executes and manages container lifecycles. While the kubelet supervises pods, it delegates the actual container execution to the runtime.
Q6. A healthcare company uses Kubernetes to manage a cluster with nodes labeled 'environment: prod' for patient data processing and 'environment: dev' for testing. They need to deploy a sensitive Pod that must run exclusively on production nod…
Answer: B. Configure node affinity with requiredDuringSchedulingIgnoredDuringExecution to match 'environment: prod'
Using node affinity with requiredDuringSchedulingIgnoredDuringExecution strictly binds the Pod to nodes matching the specific label. Option D fails because anti-affinity rules only prevent scheduling relative to other Pods, not against node labels.
Q7. What takes place in a Kubernetes cluster when a CronJob reaches its scheduled execution time?
Answer: B. The CronJob controller spawns a Job, which is then processed by the Job controller to create a Pod
When triggered, the CronJob controller generates a Job object, which the Job controller uses to create Pods. Remember that controllers operate hierarchically; the CronJob does not directly create Pods, ensuring workload reliability.
Q8. Which kubectl command is used to view the logs of a terminated container in a multi-container pod in Kubernetes?
Answer: A. kubectl logs [pod-name] -c [container-name] -p
The kubectl logs command requires the previous flag to retrieve outputs from a terminated container. Without this specific flag, kubectl attempts to fetch logs from the currently running instance, which fails for crashed containers.
Q9. In a Kubernetes environment, which software is widely used as a lightweight proxy to handle traffic management between microservices?
Answer: A. Envoy
Envoy is a modern, high-performance proxy built specifically for microservices and service meshes. Prometheus and Grafana handle monitoring and visualization, while Fluentd focuses on logging, not routing network traffic.
Q10. Which architectural pattern in cloud computing allows you to build and run applications and services without managing infrastructure, typically billed based on usage rather than pre-allocated capacity?
Answer: B. Serverless
Serverless computing abstracts the underlying infrastructure away from the developer and bills based on actual execution time. Microservices and containerization represent application architectures, but still require you to manage the infrastructure scaling directly.
Q11. What is the primary function of a ConfigMap in Kubernetes pod configuration?
Answer: A. Supplying non-sensitive settings to containers through environment variables or mounted files
ConfigMaps inject non-sensitive configuration data into pods via environment variables or mounted volumes. For sensitive data like passwords or tokens, you must use Kubernetes Secrets instead to ensure secure handling.
Q12. In a Kubernetes cluster, several Pods report 'temporary failure in name resolution' when calling an internal service. What is the most effective first step to verify whether cluster DNS is working correctly from the Pod perspective?
Answer: B. Exec into one of the failing Pods or start a temporary debug Pod and run dig or nslookup for the target service name
Testing DNS resolution from inside the affected pod verifies the exact network path and configuration the application uses. Checking CoreDNS logs is useful later, but it does not validate end-to-end resolution from the pod perspective.
Q13. What is a fundamental difference in how Helm and Kustomize handle environment-specific configurations?
Answer: B. Kustomize allows defining environment-specific patches without altering the base, whereas Helm uses value files to parameterize templates.
Kustomize applies environment-specific overlays to base manifests without altering the base files themselves. Helm relies on templated manifests combined with values files to substitute variables dynamically during deployment.
Q14. A financial services firm must deploy Kubernetes Pods exclusively on nodes labeled 'compliance: pci-dss' for audit purposes. Which configuration enforces this requirement?
Answer: A. Specify nodeSelector: 'compliance: pci-dss' in the Pod spec
Using nodeSelector in the pod spec directly constrains the scheduler to place pods only on nodes with the matching label. Tolerations allow pods to schedule onto tainted nodes but do not strictly enforce placement on specific labeled nodes.
Q15. In a Kubernetes cluster, which API feature and configuration most directly prevent pods from running with elevated privileges across all namespaces and is the best practice?
Answer: A. Enable the Pod Security Admission controller and label all namespaces with pod-security.kubernetes.io/enforce=restricted
The Pod Security Admission controller enforces security profiles like restricted to prevent privilege escalation cluster-wide. PodSecurityPolicy was deprecated and removed in recent Kubernetes versions, making it an obsolete distractor.
Q16. What is true about Pod-to-Pod communication within the same node in Kubernetes?
Answer: C. Pods use direct, NAT-less networking for communication on the same node
Kubernetes requires pods to communicate directly without network address translation, whether on the same node or across nodes. Every pod receives a unique IP address, allowing seamless routing without relying on port mapping.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.