Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What is the primary function of the Kubelet in a Kubernetes cluster?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- What is the primary function of the Kubelet in a Kubernetes cluster?
- In Kubernetes RBAC, how do Role and ClusterRole differ when you are granting permissions to namespaced resour…
- What is particularly beneficial for automating the building, testing, and deployment of software applications…
- In a managed public cloud Kubernetes service, which component is most closely associated with issues like a L…
- In Kubernetes, which PodDisruptionBudget field specifies the minimum number of Pods that must be available du…
- In Kubernetes, what is the fundamental method for categorizing and organizing resources such as Pods or Servi…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What is the primary function of the Kubelet in a Kubernetes cluster?
Answer: B. It manages the lifecycle of containers on a node
The Kubelet serves as the primary node agent, ensuring containers run and remain healthy in their designated Pods. On the exam, remember the Scheduler handles assigning Pods, while the Kubelet strictly executes them.
Q2. In Kubernetes RBAC, how do Role and ClusterRole differ when you are granting permissions to namespaced resources such as Pods or Secrets?
Answer: B. A Role is scoped to a single namespace, while a ClusterRole is cluster-scoped and can be reused across multiple namespaces via RoleBindings
A Role strictly limits permissions to a specific namespace, whereas a ClusterRole defines cluster-wide rules. A strong exam cue is remembering you can bind a ClusterRole locally using a RoleBinding to share configurations securely.
Q3. What is particularly beneficial for automating the building, testing, and deployment of software applications, ensuring consistent and efficient delivery processes?
Answer: C. CI/CD Pipelines
CI/CD pipelines are specifically designed to automate building, testing, and deploying software. While container orchestration manages the deployment environment, it does not inherently automate the continuous integration and delivery workflows.
Q4. In a managed public cloud Kubernetes service, which component is most closely associated with issues like a LoadBalancer being stuck in a pending state?
Answer: A. Cloud Controller Manager
The Cloud Controller Manager handles provisioning and managing cloud-specific resources like LoadBalancers. The scheduler only places pods on nodes and does not interact with cloud provider APIs to allocate external infrastructure resources.
Q5. In Kubernetes, which PodDisruptionBudget field specifies the minimum number of Pods that must be available during voluntary disruptions like node drains?
Answer: A. minAvailable
The minAvailable field dictates the required number of available pods during voluntary disruptions. The other fields listed do not exist in the PodDisruptionBudget specification, making this a straightforward factual recall.
Q6. In Kubernetes, what is the fundamental method for categorizing and organizing resources such as Pods or Services?
Answer: B. Labels
Labels are key-value pairs attached to objects for grouping and viewing resources. Annotations are used for non-identifying metadata, while label selectors simply filter resources based on existing labels.
Q7. What is the primary purpose of the Container Runtime Interface (CRI) in Kubernetes?
Answer: A. To provide a standard for implementing container runtimes compatible with Kubernetes
The Container Runtime Interface defines a standard API for container runtimes to communicate with the kubelet. Networking is handled by the Container Network Interface, and scheduling is performed by the kube-scheduler.
Q8. During a debugging session, you need to quickly run a temporary Pod named 'debug-pod' that you can access to test network connectivity, using the 'busybox' image. Which method is the QUICKEST to start this Pod?
Answer: A. Run the command: kubectl run debug-pod –image=busybox — sleep infinity
Using the kubectl run command creates a pod imperatively in a single step without writing YAML. Writing or modifying manifests takes longer, making it the slowest option for quick debugging tasks.
Q9. If the container runtime becomes non-functional on a Kubernetes node, what is the primary impact?
Answer: B. The kubelet loses its capability to initiate new pod execution
The kubelet depends on the container runtime to start and manage containers, so new pods cannot launch. Existing pods usually keep running, and the control plane will eventually mark the node as NotReady.
Q10. What layer of a software architecture is primarily targeted by OpenTracing and OpenTelemetry for monitoring and observability?
Answer: C. Application
OpenTelemetry and OpenTracing focus on the application layer by instrumenting code to generate traces, metrics, and logs. The infrastructure and network layers are typically monitored by system-level agents, so those options do not apply.
Q11. What is a reason to manually create Kubernetes Endpoints for a Service?
Answer: B. To define a Service that does not use selectors to map to backend Pods
Services without selectors require manual Endpoint creation to route traffic to external IPs or non-Pod resources. Standard Kubernetes Services use selectors to populate Endpoints automatically.
Q12. In Kubernetes, which two types of resources are used to expose applications to external traffic, including options like ClusterIP, NodePort, and LoadBalancer?
Answer: C. Services and Ingress
Services and Ingress resources are the primary ways to route external HTTP or network traffic into a cluster. Pods, Deployments, and Volumes handle compute and storage rather than external traffic routing.
Q13. Which statement best characterizes a JWT (JSON Web Token)?
Answer: B. A cryptographically signed token that carries user identity claims
A JSON Web Token is a cryptographically signed token used to securely transmit identity claims between parties. It is not a Kubernetes manifest, container image description, or system log file.
Q14. Which of the following is a defining characteristic of a StatefulSet in Kubernetes?
Answer: C. It provides each pod with a stable hostname and persistent storage.
A StatefulSet provides each pod with a stable hostname and persistent storage. This distinguishes it from standard Deployments, which use interchangeable stateless pods that lose their identity upon rescheduling.
Q15. Your team has a single Helm chart for a web API, with separate values files for 'dev', 'staging', and 'prod'. You want Argo CD to manage three Applications (one per environment), all generated from a single Git definition, and you want to…
Answer: B. It lets you define one ApplicationSet template and generate three Applications by referencing the different Helm values files for each environment
Using an ApplicationSet with a Helm generator is correct because it uses a single template to automatically generate multiple Argo CD Applications based on environment-specific values files. This avoids manually duplicating Application manifests while maintaining strict GitOps promotion.
Q16. A cloud engineering team is designing a Kubernetes-based platform for a healthcare application that requires granular traffic control, including blue-green deployments and real-time integration with a security service like a Web Applicatio…
Answer: B. Advanced traffic management features and traffic splitting
Advanced traffic splitting is correct because Gateway API natively supports HTTPRoute rules for managing blue-green deployments. Standard Ingress relies heavily on controller-specific annotations for basic routing, making complex traffic manipulation difficult and non-portable.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.