Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: During a deployment of a real-time analytics platform on Kubernetes, the data-ingester pods are stuck in CrashLoopBackOf. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- During a deployment of a real-time analytics platform on Kubernetes, the data-ingester pods are stuck in Cras…
- Which of the following provides highly scalable distributed storage with support for block, object, and file…
- To enforce the Restricted profile of the Pod Security Standards across all pods in a namespace, which Kuberne…
- What does IaC stand for in the context of cloud computing and DevOps?
- In a cloud-native environment, which persona is typically responsible for the creation and execution of an in…
- A Kubernetes cluster has nodes labeled with 'gpu=true' for GPU-equipped nodes. A team needs to run a Pod that…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. During a deployment of a real-time analytics platform on Kubernetes, the data-ingester pods are stuck in CrashLoopBackOff. As the site reliability engineer, which action should you prioritize to identify the cause?
Answer: D. Inspect pod-specific events using kubectl describe
Using kubectl describe is the primary step because it surfaces pod-level events, exit codes, and configuration issues driving the crash. While container logs provide internal application output, events explain why Kubernetes is repeatedly restarting the container.
Q2. Which of the following provides highly scalable distributed storage with support for block, object, and file interfaces?
Answer: C. Ceph
Ceph is a highly scalable distributed storage system offering unified block, object, and file interfaces. The other options are either cloud-native storage orchestrators like Rook, or alternative systems like GlusterFS and OpenEBS that do not natively support all three modes simultaneously.
Q3. To enforce the Restricted profile of the Pod Security Standards across all pods in a namespace, which Kubernetes resource should be configured?
Answer: D. Apply a Label to the namespace that enables the Restricted profile.
The built-in Pod Security Admission controller is triggered by adding specific labels like 'pod-security.kubernetes.io/enforce=restricted' to the namespace. While a custom webhook could achieve this, namespace labels are the standard Kubernetes method.
Q4. What does IaC stand for in the context of cloud computing and DevOps?
Answer: B. Infrastructure as Code
Infrastructure as Code defines cloud resources declaratively or imperatively through machine-readable files. For the KCNA exam, associate IaC strictly with Terraform or Ansible rather than manual click-ops.
Q5. In a cloud-native environment, which persona is typically responsible for the creation and execution of an incident management procedure?
Answer: C. Site Reliability Engineer (SRE)
Site Reliability Engineers own system reliability and lead incident responses to minimize downtime. While DevOps focuses on delivery pipelines, SRE specifically applies service level objectives to production operations.
Q6. A Kubernetes cluster has nodes labeled with 'gpu=true' for GPU-equipped nodes. A team needs to run a Pod that requires a GPU and must run on one of these nodes. Which node affinity configuration ensures the Pod is scheduled only on a node…
Answer: A. Require node with label 'gpu=true'
Using required rules enforces strict scheduling constraints for pods needing specialized hardware. Prefer rules only apply soft constraints, allowing the scheduler to place the pod anywhere if capacity is limited.
Q7. A healthcare application requires Kubernetes Pods to run only on nodes tagged with 'data-classification: confidential' to meet regulatory requirements. Which configuration ensures strict adherence to this policy?
Answer: A. Use a nodeSelector with the label 'data-classification: confidential' in the Pod template
Using a nodeSelector with the appropriate label strictly constrains the Pod to nodes matching that specific tag. While node affinity could also work, nodeSelector is the simplest and most direct mechanism for strict label matching.
Q8. In Kubernetes, what is a sidecar container?
Answer: A. A container that runs alongside the main container to handle administrative tasks
A sidecar container runs alongside the main container within the same Pod to handle supporting tasks like logging or monitoring. Option B describes the primary application container, whereas the sidecar augments it without running the core workload.
Q9. As Kubernetes has evolved, which API standardizes the configuration of L4 and L7 traffic management, including load balancing and TLS, while allowing for vendor-specific implementations?
Answer: A. Gateway API
The Gateway API provides a standardized, extensible interface for managing L4 and L7 traffic routing in Kubernetes. NetworkPolicy is limited to L3 and L4 access control, lacking the advanced routing capabilities defined by the Gateway API.
Q10. What are the core features typically provided by a service mesh in a cloud-native environment?
Answer: A. Managing network traffic between services
A service mesh primarily manages service-to-service communication, offering capabilities like load balancing and encryption. Option D fails because monitoring is merely an observability byproduct rather than the core traffic management function.
Q11. Which resources are commonly cleaned up automatically by the Kubernetes garbage collector?
Answer: A. Orphaned ReplicaSets, Completed Jobs, Terminated Pods
The garbage collector automatically removes orphaned or finished resources like terminated Pods and completed Jobs. The other options contain active resources that the cluster still requires, so they are intentionally preserved.
Q12. What is the maximum number of pods allowed per node in Kubernetes?
Answer: C. 110
The default maximum pods per node in Kubernetes is one hundred and ten. This is enforced by the default IP address allocation range, and while it can be modified, the default limit remains a key exam detail.
Q13. In Kubernetes, which authorization mode is known for offering detailed control over what specific actions can be performed on different resources within the cluster?
Answer: A. Role-Based Access Control (RBAC)
Role-Based Access Control grants granular control by binding users or service accounts to specific permissions defined by roles. ABAC is largely deprecated in modern clusters because it is difficult to manage and lacks flexible policy updates.
Q14. Which API group must be available in the cluster for resource metrics (CPU and memory) to be queried?
Answer: C. metrics.k8s.io
The metrics.k8s.io API exposes resource consumption data gathered by the Metrics Server. This endpoint is required for core features like kubectl top to function and provides the essential telemetry needed for Horizontal Pod Autoscaling operations.
Q15. For how long is the Kubernetes API guaranteed to be backward compatible following a release?
Answer: B. 1 year
According to official deprecation policy, Kubernetes guarantees API backward compatibility for one year. However, specific graduated stable APIs can be supported much longer, making this policy-specific question slightly ambiguous.
Q16. In the context of Kubernetes configuration files and manifests, what types of objects are Services and Pods typically represented as?
Answer: C. YAML Objects
Kubernetes manifests are typically written using YAML to declaratively represent objects like Pods and Services. Although the API server ultimately accepts and processes JSON payloads, YAML remains the industry standard for human-readable configuration files.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.