Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Why would a platform team use an Argo CD ApplicationSet with a Helm generator instead of defining separate Argo CD Appli. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- Why would a platform team use an Argo CD ApplicationSet with a Helm generator instead of defining separate Ar…
- What is the role of the HTTPRoute Gateway API resource?
- In a Kubernetes namespace where no LimitRange objects exist, you apply a Pod manifest that explicitly sets re…
- What is the primary characteristic of the Baseline Pod Security Standard in Kubernetes?
- Which of the following is NOT something you can do with Kubernetes Pods?
- Which of the following groupings exclusively consists of valid Kubernetes container restart policies?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Why would a platform team use an Argo CD ApplicationSet with a Helm generator instead of defining separate Argo CD Applications for each cluster environment manually?
Answer: B. To dynamically create multiple Argo CD Applications from a single Helm chart using different values per environment
Using an ApplicationSet is correct because it dynamically generates multiple Argo CD Applications from one template using varying environment values. Defining separate Applications manually creates repetitive configuration and violates the Don't Repeat Yourself principle in infrastructure management.
Q2. What is the role of the HTTPRoute Gateway API resource?
Answer: A. Defining rules for routing HTTP requests to backend services based on host, path, or headers
The HTTPRoute resource defines rules for routing HTTP requests to backend services based on host, path, or headers. Providing network infrastructure and listener configuration refers to the Gateway resource itself, which is a distinct object in the Gateway API.
Q3. In a Kubernetes namespace where no LimitRange objects exist, you apply a Pod manifest that explicitly sets resources.limits for each container. What will be the outcome?
Answer: B. The Pod is created and uses the explicitly specified limits without any defaulting from LimitRange
The Pod is created and uses the explicitly specified limits because Kubernetes honors direct resource requests without requiring a default. LimitRange provides default limits and constraints only when values are omitted, so explicit values override any default behavior.
Q4. What is the primary characteristic of the Baseline Pod Security Standard in Kubernetes?
Answer: D. An intermediate approach that mitigates known privilege escalations while facilitating typical workloads
The Baseline standard is an intermediate policy that mitigates known privilege escalations while facilitating typical workloads. The most stringent policy is Privileged, which is the most relaxed and allows unrestricted privileges, contrasting sharply with the Baseline approach.
Q5. Which of the following is NOT something you can do with Kubernetes Pods?
Answer: D. Scale a Pod by setting a replicas count on the Pod specification
You cannot scale a Pod by setting a replicas count because the Pod spec lacks a replicas field entirely. Horizontal scaling is managed by higher-level controllers like Deployments or ReplicaSets, which own and manage the desired number of Pod replicas.
Q6. Which of the following groupings exclusively consists of valid Kubernetes container restart policies?
Answer: A. Always, OnFailure, Never
The valid Kubernetes restart policies are Always, OnFailure, and Never. Always is the default for Deployments, while OnFailure and Never are typically used for batch jobs and pods performing automated tasks.
Q7. For a Kubernetes cluster hosting independent HTTP services needing centralized access, path-specific routing, and shared TLS termination, which resource manages these requirements?
Answer: B. Ingress
An Ingress resource manages centralized access, path-based routing, and shared TLS termination for HTTP services. While a Service provides basic load balancing, it cannot route traffic based on HTTP paths or handle shared SSL termination.
Q8. What is a primary reason to use a DaemonSet in Kubernetes rather than a Deployment?
Answer: C. To ensure that a pod is running on every node for infrastructure-level tasks
A DaemonSet ensures a pod replica runs on every node, which is essential for infrastructure tasks like log collection. Deployments are for dynamically scaling applications and do not guarantee pod placement on specific cluster nodes.
Q9. To securely store a TLS certificate and private key as a Kubernetes secret of type 'tls', which kubectl command should be used?
Answer: A. kubectl create secret tls my-tls –cert=server.crt –key=server.key
The 'kubectl create secret tls' command explicitly creates TLS secrets with the required certificate and key data. Generic secrets lack the specialized schema and type validation needed for proper TLS integration with resources like Ingress.
Q10. During voluntary Kubernetes node maintenance, which PodDisruptionBudget field is the best design choice to ensure 60% of Pods remain available when the deployment has 10 replicas?
Answer: B. minAvailable: 60%
Using minAvailable with a percentage ensures the required number of pods stays running during voluntary disruptions. maxUnavailable could also work mathematically, but minAvailable is the most direct and unambiguous way to guarantee a specific availability threshold.
Q11. In Kubernetes, which API maturity level is usually regarded as "safe enough" for general use, but still not fully guaranteed against breaking changes?
Answer: B. Beta
Beta APIs are well-tested and enabled by default, making them generally safe for production use. However, they lack the strict backward compatibility guarantees of stable GA APIs and can still undergo breaking changes.
Q12. Which Kubernetes distribution, known for its minimal resource requirements and ease of installation, is particularly well-suited for IoT and edge computing environments?
Answer: C. k3s
K3s is a highly certified, lightweight Kubernetes distribution explicitly engineered for unattended and resource-constrained environments. It packages required components into a single binary, making it ideal for edge computing.
Q13. In the field of IT operations and software development, SRE stands for a discipline that emphasizes automation, continuous improvement, and a balanced approach to system reliability and features. What does SRE stand for?
Answer: C. Site Reliability Engineering
Site Reliability Engineering, or SRE, applies software engineering practices to infrastructure and operations problems. It focuses heavily on automation, measuring error budgets, and reducing manual toil.
Q14. Within a Helm chart structure, which file holds the default configuration settings that can be customized during a helm upgrade operation?
Answer: B. values.yaml
The values.yaml file stores default parameters for a Helm chart, which users can easily override during installations or upgrades. Chart.yaml merely contains metadata, and templates render the final manifests.
Q15. In a multi-cluster Kubernetes environment requiring centralized network policy enforcement, which API enables platform teams to manage infrastructure bindings while allowing developers to declare routing rules (e.g., 'route api.example.com…
Answer: B. Gateway API
Gateway API uses role-oriented resources to separate platform infrastructure management from application routing configuration. NetworkPolicy handles traffic restriction, whereas Gateway API explicitly handles advanced traffic routing.
Q16. When Kubernetes pods repeatedly fail with CrashLoopBackOff errors during a database migration, which diagnostic approach most efficiently isolates the root cause?
Answer: D. Analyze container exit codes and restart policies via kubectl describe pod
Using kubectl describe pod reveals termination events, exit codes, and specific application errors. Blindly increasing resources is a distractor because CrashLoopBackOff indicates a runtime failure, not an eviction caused by insufficient memory.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.