Practice for the Kubernetes and Cloud Native Associate (KCNA) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: In Kubernetes architecture, which capability is exclusively provided by a Service object?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Kubernetes and Cloud Native Associate (KCNA) practice test →
What you will practice
- In Kubernetes architecture, which capability is exclusively provided by a Service object?
- What is the term for the process of automatically increasing or decreasing the number of instances based on d…
- How does the functionality of a NodePort Service in Kubernetes extend beyond that of a ClusterIP Service?
- In Kubernetes, which object is recommended for managing jobs that need to run multiple times according to a b…
- When managing authentication credentials in a Kubernetes cluster, which command initializes a dedicated objec…
- In Kubernetes, what is Ephemeral Storage with respect to a Pod?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. In Kubernetes architecture, which capability is exclusively provided by a Service object?
Answer: A. Maintaining persistent network endpoints for dynamic pod groups
A Service provides a persistent IP and DNS name so clients can reliably reach pods despite changing IP addresses. Remember that pod placement and infrastructure certificate rotation are scheduler or API server duties, not network routing.
Q2. What is the term for the process of automatically increasing or decreasing the number of instances based on demand?
Answer: C. Horizontal scaling
Horizontal scaling adjusts the number of running instances to match workload demands. A solid exam strategy is to associate horizontal with adding replicas and vertical scaling with adding compute resources to existing instances.
Q3. How does the functionality of a NodePort Service in Kubernetes extend beyond that of a ClusterIP Service?
Answer: A. While both provide a stable cluster-internal IP, NodePort also exposes the service on a fixed port on every cluster node, allowing external access
A NodePort service exposes the application on a static port across all cluster nodes while still providing the internal IP. Remembering this networking hierarchy helps eliminate options claiming NodePort skips assigning virtual IPs.
Q4. In Kubernetes, which object is recommended for managing jobs that need to run multiple times according to a batch process?
Answer: A. CronJob
A CronJob manages scheduled tasks using cron syntax to run batch processes repeatedly. Deployments are for stateless services, whereas CronJobs specifically handle time-triggered workloads like daily database backups.
Q5. When managing authentication credentials in a Kubernetes cluster, which command initializes a dedicated object for securing this data?
Answer: B. kubectl create secret
The kubectl create secret command explicitly generates a Secret resource designed to hold sensitive data like authentication credentials. For the exam, remember that configmaps store plain text configurations, whereas secrets hold base64 encoded data.
Q6. In Kubernetes, what is Ephemeral Storage with respect to a Pod?
Answer: B. Temporary storage assigned to a Pod, which is deleted when the Pod is removed
Ephemeral storage is temporary, meaning it is tightly coupled to the Pod's lifecycle and gets deleted when the Pod is removed. Persistent volumes are the exact opposite, as they retain data across Pod restarts and deletions.
Q7. What is the primary purpose of the Container Storage Interface (CSI) specification?
Answer: B. To provide a uniform API for container orchestrators to expose and manage storage from different vendors
The correct answer is providing a uniform API for container orchestrators to expose and manage storage from different vendors. CSI standardizes storage integration so Kubernetes can use third-party backends without modifying its core code.
Q8. In a Pod, which Linux namespace do containers usually share?
Answer: B. Network namespace
The correct answer is the network namespace. Containers within the same Pod share networking, allowing them to communicate via localhost. They maintain isolated mount and user namespaces for file system and privilege separation.
Q9. Which Kubernetes component interacts with the Container Runtime Interface (CRI)?
Answer: A. Kubelet
The correct answer is the Kubelet. The Kubelet is the node agent that communicates directly with the container runtime via the CRI to manage container lifecycles. The API server and scheduler handle higher-level cluster orchestration tasks.
Q10. In Kubernetes, which resource should you use to run a stateless web application that needs multiple replicas, rolling updates, and easy rollback support?
Answer: C. Deployment
A Deployment manages ReplicaSets to provide multiple replicas, rolling updates, and rollbacks. StatefulSets are used for stateful workloads, while DaemonSets run exactly one Pod per node.
Q11. A contributor is organizing local meetups about cloud native security, mentoring new Envoy contributors, and presenting CNCF project benefits at industry panels. Which CNCF role do these activities exemplify?
Answer: A. CNCF Ambassador
CNCF Ambassadors are recognized for promoting cloud native technologies through community engagement like organizing meetups and mentoring. Security TAG leads focus on technical security research rather than general advocacy.
Q12. Which tool is specifically designed for monitoring and managing costs in a Kubernetes environment, providing insights into spending and resource optimization?
Answer: A. Kubecost
Kubecost is built specifically for monitoring Kubernetes cluster spending and resource allocation efficiency. Prometheus collects metrics and Grafana visualizes them, but neither provides native cost tracking.
Q13. Which Cloud Native Computing Foundation (CNCF) project is specifically designed to provide GitOps-based continuous delivery for Kubernetes workloads?
Answer: C. Argo CD
Argo CD is a continuous delivery tool that synchronizes Kubernetes applications with Git repositories. Fluent Bit handles logging, while Prometheus handles metrics collection.
Q14. In a Kubernetes cluster, Secrets are stored in etcd. What is the default transformation applied to the data of a data Secret before it is stored?
Answer: C. Base64 encoding
Base64 encoding is the default transformation applied to Secret data before it is stored in etcd. Base64 is an encoding mechanism, not encryption, so always configure encryption at rest for actual security in production.
Q15. A Kubernetes pod is experiencing ImagePullBackOff errors after a deployment. What should be the initial step to diagnose the root cause?
Answer: B. Inspect the image name and tag in the pod specification for errors
Inspecting the image name and tag in the pod specification is the recommended first step because typos or invalid tags are the most frequent cause of ImagePullBackOff errors. Checking network connectivity is secondary since configuration mistakes are far more common.
Q16. Which kubectl command is used to generate a new Kubernetes resource for storing confidential information?
Answer: D. kubectl create secret
The kubectl create secret command is used to generate Secrets, which are Kubernetes resources designed for storing confidential information. ConfigMaps are used for non-sensitive data, while the other options are not valid subcommands.
More Kubernetes and Cloud Native Associate (KCNA) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.