Kubernetes and Cloud Native Associate (KCNA) Practice Test – 318 Free Exam Questions with Answers

Correct answer: C. runc

The correct answer is runc because it is the CLI reference implementation of the OCI runtime specification. For the KCNA exam, remember that Docker and containerd are higher-level runtimes, whereas runc actually does the container creation.

Correct answer: C. FinOps

The correct answer is FinOps because this persona focuses specifically on cloud financial management and cost optimization. DevOps is a strong distractor, but it focuses on delivery and operations workflows rather than financial accountability.

Correct answer: C. CRI-O

The correct answer is CRI-O because it was built specifically as a lightweight Kubernetes runtime implementing the Container Runtime Interface. While containerd also conforms to the CRI, it serves as a broader core container runtime rather than a Kubernetes-exclusive one.

Correct answer: B. Control Plane

The correct answer is the Control Plane since it makes global cluster decisions and manages the overall cluster state. The scheduler and controller manager are strong distractors, but they are individual components running within that control plane.

Correct answer: B. Kubelet

The correct answer is the Kubelet because it acts as the primary node agent ensuring containers run in their intended state. The API server is a distractor that manages the entire cluster centrally rather than managing individual nodes locally.

Correct answer: B. Pending

The correct answer is Pending because this state indicates the pod has been accepted but containers are not yet running, often due to image pulls. Initializing is a strong distractor, but Kubernetes does not use it as a primary pod phase.

Correct answer: C. Platform Engineers

The correct answer is Platform Engineers because they design and maintain the internal developer platform enabling application deployment. DevOps is a strong distractor, but it focuses broadly on culture and pipelines rather than building infrastructure products.

Correct answer: B. To generate and expose cluster state data

The correct answer is to generate and expose cluster state data because kube-state-metrics listens to the API server and outputs Prometheus metrics. A strong distractor is monitoring network traffic, which is handled by components like the CNI or network observability tools.

Correct answer: B. CNCF Ambassador

The CNCF Ambassador role matches these activities because ambassadors actively organize meetups, speak at conferences, and mentor new contributors. For the exam, remember that TOC members manage technical projects, while ambassadors focus on community advocacy.

Correct answer: B. Kubernetes can use OPA to validate requests and apply policies across the cluster

Kubernetes integrates OPA as an admission controller to validate API requests and enforce cluster-wide policies. OPA is not a service mesh or load balancer; it functions purely as a general-purpose policy engine used for compliance and governance.

Correct answer: B. Prometheus

Prometheus is the correct choice because it is the primary CNCF project designed for cloud-native monitoring and alerting via a time-series database. Do not confuse it with Envoy, which handles network proxying, or Helm, which packages applications.

Correct answer: B. kubectl label –overwrite ns example pod-security.kubernetes.io/warn=baseline

Pod Security Admission configurations are applied to namespaces using standard labels, specifically 'pod-security.kubernetes.io/warn=baseline'. Avoid using annotations for this, as the admission controller specifically reads security configurations from namespace labels.

Correct answer: C. The IP addresses and ports of the Pods backing a Service

Endpoints represent the actual IP addresses and ports of the Pods backing a Service. They are crucial for keeping network routing updated as Pods scale up or down, ensuring traffic reaches healthy targets.

Correct answer: C. Tracking the IP addresses and ports of Pods associated with a Service

Service Endpoints track the IP addresses and ports of associated Pods to enable accurate traffic routing. Endpoints update dynamically as Pods are created or terminated, ensuring clients always reach available application instances.

Correct answer: B. Kube-Proxy

Kube-Proxy runs on each node to handle packet routing and manage IP table rules for Services. The API server handles state management, while etcd provides the backing data store for the cluster.

Correct answer: C. Kubernetes API Server

The Kubernetes API Server acts as the central management hub, processing all RESTful requests to manage cluster resources. Every component, including kubelet and controller manager, must communicate through the API server.

Correct answer: C. Set spec.ingressClassName on the Ingress to the name of the desired IngressClass

Setting spec.ingressClassName explicitly binds the Ingress resource to the correct controller. Older Kubernetes versions relied on annotations, but the IngressClass API is now the standard mechanism.

Correct answer: C. Kubelet

The kubelet runs on every node to ensure containers are healthy and running in their expected state. Do not confuse it with the container runtime, which the kubelet directs to execute the actual containers.

Correct answer: C. kubectl scale deployment/cache –replicas=7

The kubectl scale command with the replicas flag is the standard imperative method to adjust Deployment instances. Exam takers should memorize kubectl scale deployment and avoid distractors using fictional verbs like resize.

Correct answer: B. Deployment

A Deployment manages a set of stateless replicas and provides rolling updates, making it the correct choice for this scenario. A DaemonSet runs a pod on every node, which would not maintain an exact count of five instances.

Correct answer: A. Container image format, runtime environment, and distribution

The correct answer is image format, runtime environment, and distribution because the OCI defines these three core specifications. A strong distractor mentions orchestration tools, but the OCI deliberately avoids standardizing higher-level orchestration platforms like Kubernetes.

Correct answer: A. Use small base images in a multi-stage build with pinned dependency checksums

The correct answer uses small base images with multi-stage builds and pinned checksums to minimize attack surface and guarantee integrity. Distractors using distroless images fail because including debug packages directly contradicts the goal of minimizing image size.

Correct answer: D. CSI allows vendors to create solutions using open specifications, allowing storage to operate consistently without core adjustments

The Container Storage Interface provides a standardized open specification, allowing storage vendors to write one plugin that works across multiple container orchestrators without touching core code. Option A fails because in-tree integrations are actively being phased out to prevent vendor lock-in.

Correct answer: A. Distributed Tracing

Distributed tracing tracks and visualizes the complete path of a single user request as it traverses across various microservices. While a service mesh can facilitate this tracking, distributed tracing is the specific observability discipline providing the actual visibility.

Correct answer: B. A temporary storage type that is tied to the lifecycle of a Pod

Ephemeral storage is strictly tied to the lifecycle of a Pod, meaning the temporary data is deleted forever when the Pod is terminated or restarted. Option A describes persistent storage, which survives Pod restarts by using persistent volumes.

Correct answer: A. Counter, Gauge, Histogram, Summary

Prometheus fundamentally supports four metric types: counter, gauge, histogram, and summary. Options including timer or rate are incorrect because rate is a PromQL function used on counters, while timers are typically implemented as histograms or summaries.

Correct answer: A. By defining a PersistentVolumeClaim in the Pod specification

You add persistent storage by defining a PersistentVolumeClaim inside the Pod specification. This claim acts as a request for storage resources that Kubernetes automatically fulfills by binding it to a matching PersistentVolume.

Correct answer: A. Falco

Falco is a CNCF tool designed specifically for runtime security, tapping into system calls to detect anomalous container behavior in real-time. The other options are unrelated to runtime security; Istio manages networking, Prometheus handles metrics, and Helm deploys packages.

Correct answer: C. A file containing the token is mounted at /var/run/secrets/kubernetes.io/serviceaccount/token

Kubernetes automatically mounts a volume containing the service account token at a standard fixed file path for Pod consumption. Environment variables or direct API calls are not the default mechanisms used by the kubelet to inject credentials into Pods.

Correct answer: A. Sandbox, Incubating, Graduated

The CNCF hosts projects through three maturity stages: Sandbox, Incubating, and finally Graduated. Option B describes Kubernetes resource stability phases, which is a distinct concept from the overall project lifecycle.

Correct answer: C. OpenID Connect

OIDC stands for OpenID Connect, an interoperable identity layer built on top of the OAuth 2.0 framework. It is the standard method Kubernetes uses to integrate external identity providers for authenticating cluster users.

Correct answer: A. Requires pods to run as non-root, disallows privilege escalation, blocks hostPath and host networking, and enforces seccomp and capability restrictions

The Restricted profile enforces the most stringent security settings, including running as non-root and blocking privilege escalation. The Privileged profile places no limits, while Baseline allows root but blocks obvious privilege escalation.

Correct answer: C. Control-plane nodes orchestrate the cluster, maintain the desired state, and manage scheduling, while worker nodes run the pods and containers.

Control-plane components make global decisions about scheduling and cluster state, while worker nodes host the container runtime and pods. Remember the exam cue: brain versus muscle.

Correct answer: C. By specifying the ApplicationSet in a YAML definition connected to a Git repo holding application configurations

ApplicationSets declaratively generate Argo CD Applications from a Git repository to automate cluster deployments. Avoid manual kubectl commands since GitOps relies entirely on Git as the single source of truth.

Correct answer: B. GitOps

GitOps uses a Git repository as the single source of truth for declarative infrastructure and applications. While Infrastructure as Code provisions resources, GitOps specifically relies on continuous reconciliation.

Correct answer: C. To define HTTP/HTTPS routing rules that expose multiple Services through a single external endpoint

The Ingress API consolidates external HTTP and HTTPS routing rules to expose multiple services behind a single endpoint. Standard services like LoadBalancer lack layer seven path and host-based routing capabilities.

Correct answer: A. Container Runtime

The container runtime, such as containerd, directly executes and manages container lifecycles. While the kubelet supervises pods, it delegates the actual container execution to the runtime.

Correct answer: B. Configure node affinity with requiredDuringSchedulingIgnoredDuringExecution to match 'environment: prod'

Using node affinity with requiredDuringSchedulingIgnoredDuringExecution strictly binds the Pod to nodes matching the specific label. Option D fails because anti-affinity rules only prevent scheduling relative to other Pods, not against node labels.

Correct answer: B. The CronJob controller spawns a Job, which is then processed by the Job controller to create a Pod

When triggered, the CronJob controller generates a Job object, which the Job controller uses to create Pods. Remember that controllers operate hierarchically; the CronJob does not directly create Pods, ensuring workload reliability.

Correct answer: A. kubectl logs [pod-name] -c [container-name] -p

The kubectl logs command requires the previous flag to retrieve outputs from a terminated container. Without this specific flag, kubectl attempts to fetch logs from the currently running instance, which fails for crashed containers.

Correct answer: A. Envoy

Envoy is a modern, high-performance proxy built specifically for microservices and service meshes. Prometheus and Grafana handle monitoring and visualization, while Fluentd focuses on logging, not routing network traffic.

Correct answer: B. Serverless

Serverless computing abstracts the underlying infrastructure away from the developer and bills based on actual execution time. Microservices and containerization represent application architectures, but still require you to manage the infrastructure scaling directly.

Correct answer: A. Supplying non-sensitive settings to containers through environment variables or mounted files

ConfigMaps inject non-sensitive configuration data into pods via environment variables or mounted volumes. For sensitive data like passwords or tokens, you must use Kubernetes Secrets instead to ensure secure handling.

Correct answer: B. Exec into one of the failing Pods or start a temporary debug Pod and run dig or nslookup for the target service name

Testing DNS resolution from inside the affected pod verifies the exact network path and configuration the application uses. Checking CoreDNS logs is useful later, but it does not validate end-to-end resolution from the pod perspective.

Correct answer: B. Kustomize allows defining environment-specific patches without altering the base, whereas Helm uses value files to parameterize templates.

Kustomize applies environment-specific overlays to base manifests without altering the base files themselves. Helm relies on templated manifests combined with values files to substitute variables dynamically during deployment.

Correct answer: A. Specify nodeSelector: 'compliance: pci-dss' in the Pod spec

Using nodeSelector in the pod spec directly constrains the scheduler to place pods only on nodes with the matching label. Tolerations allow pods to schedule onto tainted nodes but do not strictly enforce placement on specific labeled nodes.

Correct answer: A. Enable the Pod Security Admission controller and label all namespaces with pod-security.kubernetes.io/enforce=restricted

The Pod Security Admission controller enforces security profiles like restricted to prevent privilege escalation cluster-wide. PodSecurityPolicy was deprecated and removed in recent Kubernetes versions, making it an obsolete distractor.

Correct answer: C. Pods use direct, NAT-less networking for communication on the same node

Kubernetes requires pods to communicate directly without network address translation, whether on the same node or across nodes. Every pod receives a unique IP address, allowing seamless routing without relying on port mapping.

Correct answer: D. Inspect pod-specific events using kubectl describe

Using kubectl describe is the primary step because it surfaces pod-level events, exit codes, and configuration issues driving the crash. While container logs provide internal application output, events explain why Kubernetes is repeatedly restarting the container.

Correct answer: C. Ceph

Ceph is a highly scalable distributed storage system offering unified block, object, and file interfaces. The other options are either cloud-native storage orchestrators like Rook, or alternative systems like GlusterFS and OpenEBS that do not natively support all three modes simultaneously.

Correct answer: D. Apply a Label to the namespace that enables the Restricted profile.

The built-in Pod Security Admission controller is triggered by adding specific labels like 'pod-security.kubernetes.io/enforce=restricted' to the namespace. While a custom webhook could achieve this, namespace labels are the standard Kubernetes method.

Correct answer: B. Infrastructure as Code

Infrastructure as Code defines cloud resources declaratively or imperatively through machine-readable files. For the KCNA exam, associate IaC strictly with Terraform or Ansible rather than manual click-ops.

Correct answer: C. Site Reliability Engineer (SRE)

Site Reliability Engineers own system reliability and lead incident responses to minimize downtime. While DevOps focuses on delivery pipelines, SRE specifically applies service level objectives to production operations.

Correct answer: A. Require node with label 'gpu=true'

Using required rules enforces strict scheduling constraints for pods needing specialized hardware. Prefer rules only apply soft constraints, allowing the scheduler to place the pod anywhere if capacity is limited.

Correct answer: A. Use a nodeSelector with the label 'data-classification: confidential' in the Pod template

Using a nodeSelector with the appropriate label strictly constrains the Pod to nodes matching that specific tag. While node affinity could also work, nodeSelector is the simplest and most direct mechanism for strict label matching.

Correct answer: A. A container that runs alongside the main container to handle administrative tasks

A sidecar container runs alongside the main container within the same Pod to handle supporting tasks like logging or monitoring. Option B describes the primary application container, whereas the sidecar augments it without running the core workload.

Correct answer: A. Gateway API

The Gateway API provides a standardized, extensible interface for managing L4 and L7 traffic routing in Kubernetes. NetworkPolicy is limited to L3 and L4 access control, lacking the advanced routing capabilities defined by the Gateway API.

Correct answer: A. Managing network traffic between services

A service mesh primarily manages service-to-service communication, offering capabilities like load balancing and encryption. Option D fails because monitoring is merely an observability byproduct rather than the core traffic management function.

Correct answer: A. Orphaned ReplicaSets, Completed Jobs, Terminated Pods

The garbage collector automatically removes orphaned or finished resources like terminated Pods and completed Jobs. The other options contain active resources that the cluster still requires, so they are intentionally preserved.

Correct answer: C. 110

The default maximum pods per node in Kubernetes is one hundred and ten. This is enforced by the default IP address allocation range, and while it can be modified, the default limit remains a key exam detail.

Correct answer: A. Role-Based Access Control (RBAC)

Role-Based Access Control grants granular control by binding users or service accounts to specific permissions defined by roles. ABAC is largely deprecated in modern clusters because it is difficult to manage and lacks flexible policy updates.

Correct answer: C. metrics.k8s.io

The metrics.k8s.io API exposes resource consumption data gathered by the Metrics Server. This endpoint is required for core features like kubectl top to function and provides the essential telemetry needed for Horizontal Pod Autoscaling operations.

Correct answer: B. 1 year

According to official deprecation policy, Kubernetes guarantees API backward compatibility for one year. However, specific graduated stable APIs can be supported much longer, making this policy-specific question slightly ambiguous.

Correct answer: C. YAML Objects

Kubernetes manifests are typically written using YAML to declaratively represent objects like Pods and Services. Although the API server ultimately accepts and processes JSON payloads, YAML remains the industry standard for human-readable configuration files.

Correct answer: B. Exposing an application running on a set of Pods as a network service

A Kubernetes Service provides a stable network endpoint and load balancing for a dynamic set of Pods. Deployments handle scaling, while StatefulSets and volumes do not expose network routing.

Correct answer: B. Gauge

A Gauge is the correct metric type because it measures values that can increase or decrease, such as queue length. Counters only increase, while Histograms and Summaries measure distributions of events.

Correct answer: B. Store, index, and compress scraped samples as time series on local disk for efficient querying and retention

The built-in TSDB efficiently stores, indexes, and compresses scraped metric samples on local disk for querying and retention. Scraping, rule evaluation, and dashboard rendering are handled by other Prometheus components.

Correct answer: B. CSI defines a common storage interface so different vendors' drivers can be consumed through the same Kubernetes primitives

CSI establishes a standardized interface allowing Kubernetes to consume diverse storage backends uniformly using standard primitives like PersistentVolumes. It abstracts vendor differences rather than dictating storage performance.

Correct answer: B. Applications requiring persistent storage and stable network identities for every pod

StatefulSet is the correct answer because it guarantees stable network identities and persistent storage for each pod. Watch for keywords like stateful, unique, or persistent; standard Deployments handle stateless web apps, while DaemonSets manage logging agents.

Correct answer: B. OAuth 2.0

OpenID Connect builds directly on top of OAuth 2.0. Remember that OAuth 2.0 handles authorization, whereas OIDC simply adds an identity or authentication layer on top of it.

Correct answer: C. ResourceQuota

A ResourceQuota is applied to enforce aggregate namespace-level limits for resources like CPU and memory. LimitRange is a common distractor, but it sets per-object boundaries rather than total namespace limits.

Correct answer: B. For validating and enforcing policies and requests

Open Policy Agent is used in Kubernetes to validate and enforce policies dynamically. Acting as a general-purpose policy engine, it intercepts API requests to ensure compliance before they are persisted.

Correct answer: A. Define and document how project decisions are made and who has authority in the community

Governance defines and documents how project decisions are made and who has authority within the community. It ensures project health and transparency, rather than handling legal obligations or vendor authorization.

Correct answer: C. kube-scheduler

The kube-scheduler filters unsuitable nodes, scores the remaining candidates, and binds the pod. The kube-apiserver merely persists this decision, while the kube-controller-manager handles broader controller loops.

Correct answer: A. Special Interest Group

SIG stands for Special Interest Group in the Kubernetes community. These groups organize members around specific topics, providing a structured forum for collaboration and decision-making within the project.

Correct answer: C. Node Affinity with PreferredDuringSchedulingIgnoredDuringExecution

Node Affinity with PreferredDuringSchedulingIgnoredDuringExecution creates a soft rule, meaning the scheduler tries to match the label but allows alternatives. RequiredDuringScheduling is a hard rule that strictly limits scheduling.

Correct answer: C. They foster teamwork by facilitating idea sharing and professional relationship building

Collaborative gatherings foster teamwork by facilitating idea sharing and professional relationship building. They do not enforce technical standardization or directly provide structured tutorials, despite those being side benefits.

Correct answer: B. kubectl api-resources

The kubectl api-resources command lists all available resource types in the cluster. Do not confuse this with kubectl get all, which only displays a limited subset of standard resources within a specific namespace.

Correct answer: A. Namespaces are used to logically isolate resources within a cluster, while labels are key/value metadata used to group and select resources

Namespaces provide logical groupings and scope for resources, which is vital for multi-tenant cluster management. Labels are key-value pairs attached to objects, enabling flexible grouping and filtering via selectors.

Correct answer: A. Distributing incoming network traffic across multiple healthy Pods backing a Service

A Kubernetes Service acts as a stable network abstraction that naturally load balances traffic across healthy backing pods. The kube-proxy handles the underlying network rules to route this traffic efficiently.

Correct answer: B. It manages the lifecycle of containers on a node

The Kubelet serves as the primary node agent, ensuring containers run and remain healthy in their designated Pods. On the exam, remember the Scheduler handles assigning Pods, while the Kubelet strictly executes them.

Correct answer: B. A Role is scoped to a single namespace, while a ClusterRole is cluster-scoped and can be reused across multiple namespaces via RoleBindings

A Role strictly limits permissions to a specific namespace, whereas a ClusterRole defines cluster-wide rules. A strong exam cue is remembering you can bind a ClusterRole locally using a RoleBinding to share configurations securely.

Correct answer: C. CI/CD Pipelines

CI/CD pipelines are specifically designed to automate building, testing, and deploying software. While container orchestration manages the deployment environment, it does not inherently automate the continuous integration and delivery workflows.

Correct answer: A. Cloud Controller Manager

The Cloud Controller Manager handles provisioning and managing cloud-specific resources like LoadBalancers. The scheduler only places pods on nodes and does not interact with cloud provider APIs to allocate external infrastructure resources.

Correct answer: A. minAvailable

The minAvailable field dictates the required number of available pods during voluntary disruptions. The other fields listed do not exist in the PodDisruptionBudget specification, making this a straightforward factual recall.

Correct answer: B. Labels

Labels are key-value pairs attached to objects for grouping and viewing resources. Annotations are used for non-identifying metadata, while label selectors simply filter resources based on existing labels.

Correct answer: A. To provide a standard for implementing container runtimes compatible with Kubernetes

The Container Runtime Interface defines a standard API for container runtimes to communicate with the kubelet. Networking is handled by the Container Network Interface, and scheduling is performed by the kube-scheduler.

Correct answer: A. Run the command: kubectl run debug-pod –image=busybox — sleep infinity

Using the kubectl run command creates a pod imperatively in a single step without writing YAML. Writing or modifying manifests takes longer, making it the slowest option for quick debugging tasks.

Correct answer: B. The kubelet loses its capability to initiate new pod execution

The kubelet depends on the container runtime to start and manage containers, so new pods cannot launch. Existing pods usually keep running, and the control plane will eventually mark the node as NotReady.

Correct answer: C. Application

OpenTelemetry and OpenTracing focus on the application layer by instrumenting code to generate traces, metrics, and logs. The infrastructure and network layers are typically monitored by system-level agents, so those options do not apply.

Correct answer: B. To define a Service that does not use selectors to map to backend Pods

Services without selectors require manual Endpoint creation to route traffic to external IPs or non-Pod resources. Standard Kubernetes Services use selectors to populate Endpoints automatically.

Correct answer: C. Services and Ingress

Services and Ingress resources are the primary ways to route external HTTP or network traffic into a cluster. Pods, Deployments, and Volumes handle compute and storage rather than external traffic routing.

Correct answer: B. A cryptographically signed token that carries user identity claims

A JSON Web Token is a cryptographically signed token used to securely transmit identity claims between parties. It is not a Kubernetes manifest, container image description, or system log file.

Correct answer: C. It provides each pod with a stable hostname and persistent storage.

A StatefulSet provides each pod with a stable hostname and persistent storage. This distinguishes it from standard Deployments, which use interchangeable stateless pods that lose their identity upon rescheduling.

Correct answer: B. It lets you define one ApplicationSet template and generate three Applications by referencing the different Helm values files for each environment

Using an ApplicationSet with a Helm generator is correct because it uses a single template to automatically generate multiple Argo CD Applications based on environment-specific values files. This avoids manually duplicating Application manifests while maintaining strict GitOps promotion.

Correct answer: B. Advanced traffic management features and traffic splitting

Advanced traffic splitting is correct because Gateway API natively supports HTTPRoute rules for managing blue-green deployments. Standard Ingress relies heavily on controller-specific annotations for basic routing, making complex traffic manipulation difficult and non-portable.

Correct answer: B. To dynamically create multiple Argo CD Applications from a single Helm chart using different values per environment

Using an ApplicationSet is correct because it dynamically generates multiple Argo CD Applications from one template using varying environment values. Defining separate Applications manually creates repetitive configuration and violates the Don't Repeat Yourself principle in infrastructure management.

Correct answer: A. Defining rules for routing HTTP requests to backend services based on host, path, or headers

The HTTPRoute resource defines rules for routing HTTP requests to backend services based on host, path, or headers. Providing network infrastructure and listener configuration refers to the Gateway resource itself, which is a distinct object in the Gateway API.

Correct answer: B. The Pod is created and uses the explicitly specified limits without any defaulting from LimitRange

The Pod is created and uses the explicitly specified limits because Kubernetes honors direct resource requests without requiring a default. LimitRange provides default limits and constraints only when values are omitted, so explicit values override any default behavior.

Correct answer: D. An intermediate approach that mitigates known privilege escalations while facilitating typical workloads

The Baseline standard is an intermediate policy that mitigates known privilege escalations while facilitating typical workloads. The most stringent policy is Privileged, which is the most relaxed and allows unrestricted privileges, contrasting sharply with the Baseline approach.

Correct answer: D. Scale a Pod by setting a replicas count on the Pod specification

You cannot scale a Pod by setting a replicas count because the Pod spec lacks a replicas field entirely. Horizontal scaling is managed by higher-level controllers like Deployments or ReplicaSets, which own and manage the desired number of Pod replicas.

Correct answer: A. Always, OnFailure, Never

The valid Kubernetes restart policies are Always, OnFailure, and Never. Always is the default for Deployments, while OnFailure and Never are typically used for batch jobs and pods performing automated tasks.

Correct answer: B. Ingress

An Ingress resource manages centralized access, path-based routing, and shared TLS termination for HTTP services. While a Service provides basic load balancing, it cannot route traffic based on HTTP paths or handle shared SSL termination.

Correct answer: C. To ensure that a pod is running on every node for infrastructure-level tasks

A DaemonSet ensures a pod replica runs on every node, which is essential for infrastructure tasks like log collection. Deployments are for dynamically scaling applications and do not guarantee pod placement on specific cluster nodes.

Correct answer: A. kubectl create secret tls my-tls –cert=server.crt –key=server.key

The 'kubectl create secret tls' command explicitly creates TLS secrets with the required certificate and key data. Generic secrets lack the specialized schema and type validation needed for proper TLS integration with resources like Ingress.

Correct answer: B. minAvailable: 60%

Using minAvailable with a percentage ensures the required number of pods stays running during voluntary disruptions. maxUnavailable could also work mathematically, but minAvailable is the most direct and unambiguous way to guarantee a specific availability threshold.

Correct answer: B. Beta

Beta APIs are well-tested and enabled by default, making them generally safe for production use. However, they lack the strict backward compatibility guarantees of stable GA APIs and can still undergo breaking changes.

Correct answer: C. k3s

K3s is a highly certified, lightweight Kubernetes distribution explicitly engineered for unattended and resource-constrained environments. It packages required components into a single binary, making it ideal for edge computing.

Correct answer: C. Site Reliability Engineering

Site Reliability Engineering, or SRE, applies software engineering practices to infrastructure and operations problems. It focuses heavily on automation, measuring error budgets, and reducing manual toil.

Correct answer: B. values.yaml

The values.yaml file stores default parameters for a Helm chart, which users can easily override during installations or upgrades. Chart.yaml merely contains metadata, and templates render the final manifests.

Correct answer: B. Gateway API

Gateway API uses role-oriented resources to separate platform infrastructure management from application routing configuration. NetworkPolicy handles traffic restriction, whereas Gateway API explicitly handles advanced traffic routing.

Correct answer: D. Analyze container exit codes and restart policies via kubectl describe pod

Using kubectl describe pod reveals termination events, exit codes, and specific application errors. Blindly increasing resources is a distractor because CrashLoopBackOff indicates a runtime failure, not an eviction caused by insufficient memory.

Correct answer: D. Envoy Proxy

Envoy is the default data plane proxy for popular service meshes like Istio. While NGINX is heavily used for standard Ingress routing, Envoy dominates microservice communication by managing east-west traffic between Pods.

Correct answer: D. VirtualBox

VirtualBox is a virtualization platform for running virtual machines, not a container runtime. For the exam, remember that valid CRI implementations include containerd and CRI-O, whereas VirtualBox simply manages VMs.

Correct answer: D. Utilise multiple build stages to discard unnecessary build artifacts and dependencies

Using multiple build stages lets you copy only the final artifacts to a tiny base image, discarding compiler dependencies. Squashing is an outdated approach, and environment variables do not meaningfully reduce image size.

Correct answer: A. Annotations

Annotations attach arbitrary non-identifying metadata to objects for external tools. Labels are used for identifying and selecting objects, whereas the other distractors describe entirely different operational features.

Correct answer: A. ClusterIP, NodePort, LoadBalancer, ExternalName

The four Kubernetes Service types are ClusterIP, NodePort, LoadBalancer, and ExternalName. Remembering these core network routing methods is crucial, as the distractors use fake concepts like NodeLink.

Correct answer: C. CronJob

CronJob is the correct resource because it schedules Kubernetes jobs to run at fixed times or intervals, much like a traditional Linux cron daemon. DaemonSets ensure one pod runs on every node, while StatefulSets and Deployments maintain ongoing workloads rather than scheduled tasks.

Correct answer: C. Vertical Pod Autoscaler

Vertical Pod Autoscaler is correct because it automatically adjusts the CPU and memory requests and limits for existing containers. Horizontal Pod Autoscaler instead changes the number of running pods, while Cluster Autoscaler modifies the underlying node count.

Correct answer: B. kube-proxy

kube-proxy is correct because it runs on every node and manages network routing rules for Services. The other three choices are core control plane components: etcd stores state, the API server exposes the API, and the scheduler assigns pods to nodes.

Correct answer: D. Kubernetes Event-Driven Autoscaling (KEDA)

KEDA is correct because it is an event-driven component that can scale deployments from zero to many pods based on external triggers. The default Horizontal Pod Autoscaler typically requires baseline metrics, meaning it generally cannot scale workloads to zero.

Correct answer: C. NetworkPolicy

NetworkPolicy is correct because it acts as a firewall for pods by explicitly defining allowed ingress and egress network traffic. Ingress manages external HTTP routing into the cluster, while Services handle internal forwarding without providing traffic restriction capabilities.

Correct answer: A. ResourceQuota

ResourceQuota is the correct answer because it operates at the namespace level to limit the total aggregate compute resources consumed. LimitRange is a common distractor, but it is used to set default limits or enforce constraints on individual containers rather than the overall namespace total.

Correct answer: A. To display the resource usage of nodes and pods in the cluster

The kubectl top command shows real-time CPU and memory usage for nodes and pods. Remember that it requires the Metrics Server to be running in your cluster, otherwise the command will fail.

Correct answer: A. kubectl rollout status deployment/<deployment-name>

The kubectl rollout status command is the standard way to watch a deployment's progress until it completes or fails. The kubectl monitor and track subcommands do not exist in the CLI.

Correct answer: C. It is the recommended maximum size for an individual value stored in etcd

The 1.5 MB limit is correct because etcd recommends keeping individual values small to maintain cluster performance and stability. Storing large objects in etcd can degrade database performance, so large files should use external object storage instead.

Correct answer: C. Jenkins

Jenkins is the correct answer because it is a widely used automation server for building, testing, and deploying code in continuous integration pipelines. While Git manages source code, Jenkins actively orchestrates the pipeline stages defined by the development team.

Correct answer: A. Maintaining persistent network endpoints for dynamic pod groups

A Service provides a persistent IP and DNS name so clients can reliably reach pods despite changing IP addresses. Remember that pod placement and infrastructure certificate rotation are scheduler or API server duties, not network routing.

Correct answer: C. Horizontal scaling

Horizontal scaling adjusts the number of running instances to match workload demands. A solid exam strategy is to associate horizontal with adding replicas and vertical scaling with adding compute resources to existing instances.

Correct answer: A. While both provide a stable cluster-internal IP, NodePort also exposes the service on a fixed port on every cluster node, allowing external access

A NodePort service exposes the application on a static port across all cluster nodes while still providing the internal IP. Remembering this networking hierarchy helps eliminate options claiming NodePort skips assigning virtual IPs.

Correct answer: A. CronJob

A CronJob manages scheduled tasks using cron syntax to run batch processes repeatedly. Deployments are for stateless services, whereas CronJobs specifically handle time-triggered workloads like daily database backups.

Correct answer: B. kubectl create secret

The kubectl create secret command explicitly generates a Secret resource designed to hold sensitive data like authentication credentials. For the exam, remember that configmaps store plain text configurations, whereas secrets hold base64 encoded data.

Correct answer: B. Temporary storage assigned to a Pod, which is deleted when the Pod is removed

Ephemeral storage is temporary, meaning it is tightly coupled to the Pod's lifecycle and gets deleted when the Pod is removed. Persistent volumes are the exact opposite, as they retain data across Pod restarts and deletions.

Correct answer: B. To provide a uniform API for container orchestrators to expose and manage storage from different vendors

The correct answer is providing a uniform API for container orchestrators to expose and manage storage from different vendors. CSI standardizes storage integration so Kubernetes can use third-party backends without modifying its core code.

Correct answer: B. Network namespace

The correct answer is the network namespace. Containers within the same Pod share networking, allowing them to communicate via localhost. They maintain isolated mount and user namespaces for file system and privilege separation.

Correct answer: A. Kubelet

The correct answer is the Kubelet. The Kubelet is the node agent that communicates directly with the container runtime via the CRI to manage container lifecycles. The API server and scheduler handle higher-level cluster orchestration tasks.

Correct answer: C. Deployment

A Deployment manages ReplicaSets to provide multiple replicas, rolling updates, and rollbacks. StatefulSets are used for stateful workloads, while DaemonSets run exactly one Pod per node.

Correct answer: A. CNCF Ambassador

CNCF Ambassadors are recognized for promoting cloud native technologies through community engagement like organizing meetups and mentoring. Security TAG leads focus on technical security research rather than general advocacy.

Correct answer: A. Kubecost

Kubecost is built specifically for monitoring Kubernetes cluster spending and resource allocation efficiency. Prometheus collects metrics and Grafana visualizes them, but neither provides native cost tracking.

Correct answer: C. Argo CD

Argo CD is a continuous delivery tool that synchronizes Kubernetes applications with Git repositories. Fluent Bit handles logging, while Prometheus handles metrics collection.

Correct answer: C. Base64 encoding

Base64 encoding is the default transformation applied to Secret data before it is stored in etcd. Base64 is an encoding mechanism, not encryption, so always configure encryption at rest for actual security in production.

Correct answer: B. Inspect the image name and tag in the pod specification for errors

Inspecting the image name and tag in the pod specification is the recommended first step because typos or invalid tags are the most frequent cause of ImagePullBackOff errors. Checking network connectivity is secondary since configuration mistakes are far more common.

Correct answer: D. kubectl create secret

The kubectl create secret command is used to generate Secrets, which are Kubernetes resources designed for storing confidential information. ConfigMaps are used for non-sensitive data, while the other options are not valid subcommands.

Correct answer: B. kubectl apply -f manifest.yaml

The kubectl apply command applies configurations from a YAML file to create or update resources declaratively. The create command fails if the resource already exists, making apply the standard for managing live state.

Correct answer: C. By scaling applications based on external metrics, using ScaledObjects

KEDA enables event-driven autoscaling by scaling applications based on external metrics, such as message queue lengths. It utilizes custom resources called ScaledObjects for deployments and ScaledJobs for jobs.

Correct answer: B. kubectl logs web-app –container app-logger

The –container or -c flag explicitly specifies the container name when retrieving logs from a multi-container pod. Without this flag, kubectl typically prompts you to select a container if multiple exist.

Correct answer: C. Cloud-controller-manager

The cloud-controller-manager is a control plane component that manages cloud-specific logic, separating core Kubernetes from cloud provider integrations. Helm and the container runtime are tools or node components, not control plane parts.

Correct answer: C. A package manager that simplifies deployment of applications in Kubernetes

Helm is a package manager for Kubernetes that simplifies application deployment using templated files called charts. It is widely used to define, install, and upgrade even the most complex Kubernetes applications seamlessly.

Correct answer: C. Argo CD & Flux

Argo CD and Flux are dedicated continuous delivery tools for Kubernetes GitOps workflows. Helm is a package manager, while Istio and Cilium handle networking and service mesh capabilities.

Correct answer: A. Direct TCP tunnel via the Kubernetes API server

The port-forward command establishes a direct TCP tunnel through the Kubernetes API server to the target pod. It avoids needing Ingress or exposing services to route local testing traffic.

Correct answer: A. livenessProbe

The livenessProbe detects container deadlocks or unresponsive states, triggering a restart based on the policy. The readinessProbe temporarily removes traffic instead of restarting.

Correct answer: B. Headless Service

A service created with no cluster IP is called a headless service, which returns individual pod IP addresses instead of acting as a single virtual proxy. StatefulSets leverage this behavior for direct peer discovery.

Correct answer: B. Rook

Rook operates as a cloud-native storage orchestrator, turning distributed storage systems into self-managing services. As a memory cue, Istio routes network traffic, Prometheus monitors metrics, and Rook manages persistent volumes.

Correct answer: B. KubeScape

The correct answer is Kubescape. It is an open-source security tool that checks Kubernetes clusters against NSA and CISA hardening guidelines. Falco is used for runtime security, not initial posture assessment.

Correct answer: A. kubectl set image deployment/webserver nginx=nginx:mainline

The correct answer is using the set image command. This command directly updates the deployment's pod template, triggering a rolling update to replace pods incrementally. Other options require manual editing or recreate the deployment object itself.

Correct answer: B. The application encountered an unhandled exception during runtime initialization

The correct answer is that the application encountered an unhandled exception during runtime initialization. Since the container initially started, image pulls succeeded. Network policies or low CPU limits cause different failure states, but a crash points to a code error.

Correct answer: A. It maintains two parallel production environments and shifts all traffic instantly after validation, minimizing user impact.

The correct answer is maintaining two parallel production environments and shifting traffic instantly after validation. This provides a rapid rollback path and zero downtime. Feature flags are used for progressive delivery or A/B testing, not traditional Blue-Green.

Correct answer: B. By discussion and voting

CNCF groups resolve conflicts through discussion and voting among community members. This open governance model avoids central authority dictates and ensures collective consensus.

Correct answer: C. Traces

Traces record a request's journey across microservices using spans to map its path. Logs capture discrete events, while metrics aggregate numerical data over time.

Correct answer: A. A replacement pod is started on another healthy node

After evicting pods from an unreachable node, Kubernetes relies on controllers like ReplicaSets to reschedule replacement pods onto healthy nodes. This self-healing behavior maintains application availability.

Correct answer: B. Secret

Kubernetes Secrets store sensitive data like encrypted patient IDs separately from Pod definitions. ConfigMaps are used for non-sensitive configuration data, making them inappropriate for this use case.

Correct answer: C. 5 minutes

The Node Controller has a default grace period of five minutes before marking pods for eviction on an unreachable node. This timeout prevents premature evictions during brief network partitions.

Correct answer: C. Prometheus server with prometheus-adapter

The Prometheus adapter implements the Kubernetes custom metrics API, allowing the HorizontalPodAutoscaler to access custom application metrics. The kube-controller-manager only consumes this API rather than serving the metrics directly.

Correct answer: C. Clusters, Nodes, Pods, Containers

The correct sequence flows from the overarching cluster down to individual containers. A cluster contains nodes, nodes run pods, and pods encapsulate containers. Remembering this top-down hierarchy is a fundamental building block for all Kubernetes architecture questions.

Correct answer: C. Labels are key-value tags on objects, and selectors are queries that match objects based on those labels

Labels are key-value pairs attached to Kubernetes objects, while selectors act as queries to filter those objects. Services and Deployments heavily rely on selectors to route traffic or manage groups of pods dynamically.

Correct answer: C. ingress and egress

Kubernetes NetworkPolicies explicitly support ingress for incoming traffic and egress for outgoing traffic. The policyTypes field tells the controller which rule sets to enforce for pod communication.

Correct answer: A. Use nodeSelector in the Pod template with the label 'tier: high-performance'

Using nodeSelector with the matching label directly constrains the scheduler to place pods only on those specific nodes. NetworkPolicy and StatefulSet do not dictate physical node placement based on labels.

Correct answer: A. Privileged, Baseline, Restricted

The progression moves from Privileged, which is completely open, to Baseline, which blocks known escalations, ending at Restricted for strict hardening. Exam candidates should memorize this exact security escalation ladder.

Correct answer: B. CustomResourceDefinition (CRD)

CustomResourceDefinitions allow users to create completely new API endpoints and resource types natively. They let operators manage custom applications using standard Kubernetes commands like kubectl.

Correct answer: B. A set of standards for describing event data in a common way

CloudEvents provides a standardized specification for describing event data consistently across different platforms. This common format ensures interoperability when passing messages between various cloud-native applications.

Correct answer: A. ConfigMap

ConfigMap stores non-sensitive data in key-value pairs, keeping configuration separate from container images. Secret is the distractor intended for confidential information like passwords or tokens.

Correct answer: C. Headless Service

A Headless Service provides stable network identities for StatefulSet pods. Configuring clusterIP to none allows direct DNS resolution to individual pods rather than round-robin load balancing.

Correct answer: B. Implementing and fine-tuning thresholds and alerts for monitoring system health

SREs focus on system reliability by implementing monitoring, fine-tuning alert thresholds, and managing incidents. Developing frontend interfaces or conducting market research falls outside the operations scope.

Correct answer: C. Ingress routes external HTTP and HTTPS traffic to services within the cluster

Ingress manages external HTTP and HTTPS traffic routing to services within the cluster. It supports both path-based and host-based routing rules, along with TLS termination capabilities.

Correct answer: A. default, kube-system, kube-public, kube-node-lease

Kubernetes creates four default namespaces: default, kube-system, kube-public, and kube-node-lease. Watch for distractors inventing namespaces like kube-services or kube-config on the exam.

Correct answer: D. A pod hosting one or more containers with common storage and networking

A pod represents the smallest deployable unit, encapsulating one or more containers that share network and storage. Services provide routing, while clusters group multiple nodes together.

Correct answer: A. RoleBinding

A RoleBinding grants the permissions defined in a Role to a specific subject within a single namespace. For the exam, remember that ClusterRoleBinding is used for cluster-scoped access, whereas RoleBinding restricts access to a single namespace.

Correct answer: A. Add a nodeSelector field under spec with environment: production

Adding a nodeSelector field under the spec section forces the pod to be scheduled on nodes with matching labels. Remember that metadata only holds identifying information, while spec defines the desired state, including scheduling constraints.

Correct answer: A. Linkerd

Linkerd is a lightweight service mesh designed specifically for Kubernetes to provide traffic management and observability. Helm is a package manager, Knable handles serverless workloads, and the Dashboard is simply a web UI.

Correct answer: C. Persistent Volume Claim (PVC)

A Persistent Volume Claim provides durable storage that survives pod termination, allowing sequential access across different jobs. ConfigMaps and Secrets are intended for configuration data, while Job Controllers only manage batch execution without providing storage.

Correct answer: A. kubectl exec

The kubectl exec command opens a shell or runs a specific process inside an already running container. A practical exam cue is to associate exec with interactive troubleshooting, whereas attach only connects to an existing process.

Correct answer: B. minAvailable

The minAvailable field sets the minimum replicas that must stay running during voluntary disruptions like node drains. As a quick exam tip, Deployment replicas scale workloads, while PodDisruptionBudgets specifically protect application availability.

Correct answer: A. Cloud, Clusters, Containers, Code

The correct answer is Cloud, Clusters, Containers, Code. Think of the 4C's as layers moving from the outside in, starting with the broad infrastructure and ending with the application logic itself.

Correct answer: A. Retain

The correct answer is Retain. When a PVC is deleted, the Retain policy keeps the underlying volume and its data intact until an administrator manually reclaims it. The Recycle policy is deprecated, making Retain the clear choice.

Correct answer: B. kubelet

The kubelet enforces CPU and memory limits by configuring Linux cgroups. The Container Runtime Interface executes containers but relies on the kubelet to translate Pod specifications into cgroup constraints.

Correct answer: A. helm uninstall <release>

The command 'helm uninstall' is the standard Helm v3 method for completely removing a release from a cluster. While older Helm v2 used 'helm delete', the modern exam expects the uninstall syntax for current versions.

Correct answer: A. The CNI is responsible for implementing the rules defined in Network Policies

The CNI plugin is directly responsible for actually implementing and enforcing the rules defined by Network Policies. Policies are simply API objects until the underlying network plugin reads them to manage traffic.

Correct answer: B. Kubelet

The kubelet ensures containers run as defined in the Pod manifests. The scheduler assigns pods to nodes, while the container runtime executes the underlying container processes.

Correct answer: C. Four

Kubernetes has four primary Service types: ClusterIP, NodePort, LoadBalancer, and ExternalName. Remember that LoadBalancer actually builds upon NodePort, which in turn builds upon ClusterIP, making them layered exposures.

Correct answer: A. Security Contexts operate at the container runtime level, while Security Policies work at the cluster control plane level.

Security Contexts dictate specific runtime privileges for individual pods or containers, whereas Security Policies act as cluster-wide admission controls. Policies validate pod configurations before they ever reach the runtime stage.

Correct answer: B. If you remove resources from the applied manifest, kubectl apply may not track them and can inadvertently delete those resources

If you remove resources from a manifest and reapply it, kubectl apply with default settings may inadvertently delete those resources. Use server-side apply or careful pruning flags to avoid unexpected deletions in live environments.

Correct answer: B. Service

A Service provides a stable network endpoint and load balances traffic across a dynamic set of Pods. While an Ingress manages external HTTP routing, the Service is the core abstraction that exposes the pod network.

Correct answer: C. Associate a custom ServiceAccount with the pod and bind it to a least-privilege Role.

Assigning a dedicated custom ServiceAccount bound to a least-privilege Role adheres to the principle of least privilege for applications needing API access. Avoid modifying the default ServiceAccount because it is heavily shared across all pods in a namespace.

Correct answer: C. To authenticate cluster users using an external identity provider

OpenID Connect allows Kubernetes to delegate user authentication to an external identity provider, enabling single sign-on for cluster access. It verifies identities, while internal RBAC components handle what those authenticated users are authorized to do.

Correct answer: B. Service

Running kubectl expose creates a Service object that provides a stable IP and routes network traffic to the underlying Pods. This command takes an existing workload resource like a Deployment and abstracts it for network access.

Correct answer: B. etcd

etcd serves as the definitive distributed key-value store, persisting the entire desired state and cluster configuration. Although the API Server acts as the gateway for all interactions, it reads and writes every change directly to etcd.

Correct answer: A. The combination and testing of code changes from multiple developers to a shared repository

Continuous Integration emphasizes frequently merging code changes from multiple developers into a shared main repository. Automated testing validates these merges immediately, catching integration bugs early before they reach production.

Correct answer: A. Gradual shifting of user traffic to the new version while monitoring key metrics

A canary deployment incrementally shifts a small fraction of user traffic to the new version while monitoring key health metrics. This controlled rollout limits blast radius, unlike parallel updates which expose all users simultaneously.

Correct answer: B. RollingUpdate

The default deployment strategy is RollingUpdate, ensuring new pods become ready before terminating old ones. Recreate causes downtime, while blue/green and canary require custom tooling outside default strategy configuration.

Correct answer: B. Horizontal Pod Autoscaler

The Horizontal Pod Autoscaler automatically adjusts the number of replicas based on CPU or custom metrics. The Deployment Controller manages pod lifecycle, not dynamic autoscaling based on load.

Correct answer: C. Persistent Volume

A Persistent Volume provides durable storage independent of pod lifecycles. ConfigMaps and Secrets handle configuration data, not persistent block or file storage required by stateful workloads.

Correct answer: B. They are additive, where each additional policy further restricts allowed traffic

Network Policies are strictly additive, meaning each new policy can only further restrict traffic or grant additional exceptions. For the exam, remember that rules never override each other, and isolation only occurs when a policy explicitly selects a pod.

Correct answer: B. Label the namespace to enable the Pod Security Admission controller with the Baseline profile.

The built-in Pod Security Admission controller enforces the Baseline profile when specific labels are applied to the namespace. This modern approach replaced complex custom webhooks, providing native, standardized policy enforcement for cluster security.

Correct answer: C. kubelet

The kubelet runs on every node and receives instructions from the API server to instantiate and manage containers. If pods remain pending without container creation, always check the node's kubelet status and logs before troubleshooting the scheduler.

Correct answer: B. ReplicaSets are created and managed by Deployments to ensure the desired number of pod replicas

Deployments manage ReplicaSets to handle pod rollout and scaling. A strong exam tip is remembering that ReplicaSets maintain exact pod counts, while Deployments provide the layered declarative updates.

Correct answer: B. When the sidecar container provides auxiliary support, like logging or monitoring, to the main application container

The sidecar pattern pairs a helper container with a main application within the same pod. Remember that pods are the smallest scalable unit, meaning all containers inside scale together, so independent scaling fails.

Correct answer: B. DaemonSet

A DaemonSet ensures that a replica of a specific pod runs on every selected node. For the exam, associate DaemonSets with node-level background tasks like logging agents or network probes.

Correct answer: C. Site Reliability Engineer (SRE)

Site Reliability Engineers specifically own SLIs, SLOs, and SLAs to measure and enforce reliability. While DevOps engineers work broadly across pipelines, SREs focus mathematically on service stability.

Correct answer: D. helm uninstall

The helm uninstall command cleanly removes all associated resources from a cluster. Remember that rollback reverts to a previous chart version, while upgrade installs a newer one.

Correct answer: C. Introducing role-oriented resources like GatewayClass, Gateway and Route to separate infra ownership from application routing configuration

Gateway API separates roles via GatewayClass, Gateway, and Route resources. On the exam, recognize that this structure replaces messy Ingress annotations, cleanly dividing infrastructure ownership from application routing.

Correct answer: C. ResourceQuota

ResourceQuota objects limit total CPU and memory consumption within a specific namespace. LimitRanges restrict individual pod resources, but ResourceQuotas cap the aggregate totals across all workloads.

Correct answer: B. Facilitating Pod-to-Pod networking across different nodes

CNI plugins handle pod-to-pod networking across multiple cluster nodes. Do not confuse this with intra-pod networking, which leverages a shared localhost network namespace for containers.

Correct answer: C. Ensure that containers for Pods assigned to the node are running and healthy according to their PodSpecs

The kubelet ensures that containers assigned to its node match the desired PodSpec state. Remember that scheduling is handled by the kube-scheduler, not the kubelet. The kubelet simply receives instructions from the API server to maintain container health.

Correct answer: C. Containers share the host OS kernel, eliminating redundant operating system processes across workloads

Containers achieve higher density by sharing the host operating system kernel, which avoids running redundant operating system instances. Virtual machines require a full guest operating system for every instance, which consumes significant memory and CPU cycles.

Correct answer: C. default

When a Pod is created without a specified Service Account, Kubernetes automatically assigns the Service Account named default in the Pod's namespace. Remember that this built-in account provides API discovery access but lacks broad permissions by default.

Correct answer: B. Configuring an odd number of etcd nodes, minimally three, for quorum resilience

An odd number of etcd nodes is required to maintain a Raft majority and prevent split-brain. While spreading nodes across availability zones is good practice, a single zone fails to protect against zone-level outages.

Correct answer: B. To initialise a database schema before the application starts

Init containers run sequentially before main containers, making them ideal for preparing data or initializing schemas on mounted PVCs. Real-time processing happens in main application containers, not init containers.

Correct answer: B. Guarantees that every node runs a single pod instance and adapts to cluster scaling

DaemonSets automatically schedule a pod copy onto matching nodes, perfect for node-level agents. Deployments balance replicas randomly across nodes, but do not guarantee node-wide coverage.

Correct answer: C. A workload needing durable storage and consistent network identifiers for each instance

StatefulSets provide stable network identities and persistent storage essential for distributed databases. Deployments suit stateless apps, while DaemonSets handle node-wide background tasks.

Correct answer: C. To show documentation and field definitions for Kubernetes resources

The kubectl explain command pulls schema documentation directly from the API server. Use describe or logs to inspect active runtime state rather than API field definitions.

Correct answer: A. A CNCF graduated project that acts as a dedicated high-speed proxy, widely used as the data plane in service mesh architectures like Istio

Envoy operates as a high-speed proxy and serves as the standard data plane in service mesh architectures. It does not function as a tracing backend, nor does it handle pod scheduling or internal Kubernetes service discovery.

Correct answer: C. It streams the log output continuously until the user interrupts the command

The dash f flag is shorthand for dash dash follow, enabling real-time streaming of log output. To view aggregated logs across multiple matching pods, you would use the dash dash selector flag with labels.

Correct answer: C. Git repository references in the ApplicationSet spec triggering automatic syncs

Argo CD ApplicationSets use Git repository references to automate synchronization across multiple applications or clusters. This declarative GitOps approach relies on Git as the single source of truth rather than imperative scripts.

Correct answer: A. Cloud Native Computing Foundation

The Cloud Native Computing Foundation, under the Linux Foundation, is the governing body responsible for Kubernetes and other cloud native projects. The other options are distractors with similar acronyms that do not exist.

Correct answer: D. Configure an ApplicationSet resource linked to a Git repository storing the microservice's Kubernetes definitions

An ApplicationSet uses generators to automatically create Argo CD Applications across multiple clusters based on Git definitions. Standard Application resources lack the native templating needed for automated multi-cluster deployment.

Correct answer: C. Label Selectors

Label selectors provide the core querying mechanism used by Services and Deployments to group objects. While labels attach identifying metadata to resources, selectors actually perform the filtering based on those key-value pairs.

Correct answer: C. Controlled and restricted network traffic flows between pods as required

NetworkPolicy resources enforce security rules by restricting ingress and egress network traffic between pods. They do not manage storage, load balancing, or pod autoscaling, which are handled by separate Kubernetes components.

Correct answer: B. Use labels for identifying and selecting objects, and annotations for non-identifying metadata consumed by tools

Labels are designed for identifying and grouping resources using selectors, while annotations store non-identifying metadata. This makes annotations ideal for holding tooling configuration data that the core control plane ignores.

Correct answer: A. The application encountered an unhandled exception during startup

An unhandled application exception during startup immediately terminates the process with a non-zero exit code, causing the container to crash and loop. Watch for trick distractors like CPU throttling, which typically causes evictions rather than immediate application exits.

Correct answer: C. A balanced approach that blocks known privilege escalations while accommodating common workloads

The Baseline policy is designed to prevent known privilege escalations while still permitting broadly compatible, everyday workloads. For context, the Privileged policy is the most open, while the Restricted policy is the strictest.

Correct answer: A. Base64

Kubernetes encodes Secret data in base64 by default to safely represent binary information as text in JSON payloads. Remember that base64 is strictly encoding, not encryption, and offers zero confidentiality without enabling Encryption at Rest.

Correct answer: C. Stored unencrypted in base64 encoding

Secrets are stored unencrypted, encoded only in base64 within the etcd database by default. Avoid confusing base64 with a hashing algorithm, and remember that true encryption requires actively configuring Encryption at Rest.

Correct answer: A. Data plane and Control plane

Service mesh architectures rely on a data plane to handle traffic via proxies and a control plane to configure routing policies. Knowing this clear separation of concerns is foundational for answering cloud-native networking questions.

Correct answer: A. ConfigMap

ConfigMaps store non-sensitive configuration data as plaintext key-value pairs. For the exam, contrast this with Secrets, which are specifically intended for confidential information like passwords or tokens.

Correct answer: B. ConfigMaps and Secrets

Setting the immutable field to true on ConfigMaps and Secrets prevents any further modifications to their data. Marking these resources as immutable also improves cluster performance by reducing unnecessary watches on the API server, which is a great practical tip to remember.

Correct answer: B. Kubernetes RBAC is a mechanism that can be configured to enforce least privilege by granting narrowly scoped permissions to users and ServiceAccounts

Kubernetes RBAC is the core mechanism used to enforce least privilege by binding specific permissions to identities like ServiceAccounts. Remember that security is not automatic by default; administrators must actively configure Roles and RoleBindings to restrict access appropriately.

Correct answer: B. Controller Manager

The Controller Manager runs control loops that continuously watch cluster state and drive it toward the desired specification. Be careful not to confuse this reconciliation work with the kubelet, which only manages pods on a single node, or the scheduler, which simply assigns pods to nodes.

Correct answer: C. cgroups

Control groups, or cgroups, are the Linux feature used to limit, account for, and isolate resource usage like CPU and memory for processes. Remember that namespaces handle the visual and network isolation, whereas cgroups specifically enforce the resource quotas.

Correct answer: B. To incrementally update pods with a new version while maintaining availability

The RollingUpdate strategy incrementally updates pod instances with a new version while maintaining application availability. It prevents downtime by ensuring a certain number of replicas stay available, distinguishing it from the Recreate strategy which takes the application offline.

Correct answer: C. The container will run as root which poses a security risk

Omitting the USER directive causes the container to default to running as the root user. Running processes as root poses a massive security risk because if the container is compromised, the attacker gains elevated administrative privileges within that environment.

Correct answer: C. Increasing the computational resources (like CPU or memory) of an existing instance

Vertical scaling means increasing the computational resources, such as CPU or memory, allocated to an existing instance. This directly contrasts with horizontal scaling, which handles increased load by adding more parallel instances of the application.

Correct answer: C. Kubelet

The kubelet is the primary node agent that ensures containers are running and healthy as defined in Pod specifications. Do not confuse this with the API server, which acts as the central management hub, or the scheduler, which only assigns pods to nodes.

Correct answer: B. A system that allows services to locate and communicate with each other on the network

Service Discovery is the mechanism that allows services to locate and communicate with each other on the network. Kubernetes uses Service objects to provide stable IP addresses and DNS names, effectively decoupling workloads from the changing pod IP addresses.

Correct answer: A. Setting the ClusterIP to 'None'

Setting the clusterIP field to None creates a headless service, which bypasses kube-proxy and allows direct DNS resolution to individual Pod IP addresses. This is ideal for stateful workloads like databases requiring peer discovery.

Correct answer: A. AlwaysAllow

AlwaysAllow is the default setting, meaning no authorization checks are performed if specific modes are omitted from the startup flags. For any production cluster, you should explicitly configure secure modes like Node and RBAC.

Correct answer: A. Logs, Metrics, Traces

Logs, metrics, and traces form the foundational triad of observability. Performance and reliability are derived outcomes, whereas these three pillars provide the raw telemetry needed to inspect state.

Correct answer: B. kubectl exec <pod> — env

Using the double dash ensures kubectl passes the subsequent arguments directly to the container as a command. While 'kubectl exec -it <pod> env' works interactively, the correct syntax to execute a command cleanly without TTY allocation is using the double dash separator.

Correct answer: D. CNCF Ambassador

CNCF Ambassadors actively promote cloud native technologies through community advocacy, workshops, and public speaking. Project maintainers focus on technical code contributions, while the TOC handles project governance and technical direction.

Correct answer: B. They ensure a minimum number of pods are always running during voluntary disruptions

PDBs ensure a minimum number or percentage of pods remain available during voluntary disruptions, protecting application availability. Note that PDBs do not manage involuntary disruptions like node hardware failures, which are handled by controllers.

Correct answer: B. When a new Pod is created and needs to be scheduled

When a new Pod is created, it enters a Pending state, triggering the kube-scheduler to evaluate resources and assign it to a healthy node. While adding nodes changes available capacity, it does not directly trigger pod scheduling.

Correct answer: A. Startup first, then Readiness and Liveness concurrently

The Startup probe runs first and must complete successfully before any other probes begin. Once the startup phase finishes successfully, both Readiness and Liveness probes will run concurrently. Readiness handles traffic routing, while Liveness handles restarts.

Correct answer: A. kubectl rollout history deployment/api-service

The rollout history command displays all revision numbers and change-cause annotations for a Deployment. While checking cluster events is useful for live debugging, it does not reliably provide the structured version history that the rollout subcommand outputs.

Correct answer: C. Kata Containers and gVisor

Kata Containers and gVisor provide enhanced security by implementing stronger isolation boundaries using lightweight virtual machines or user-space kernels. Standard runtimes like Docker and containerd share the host kernel, which offers less protection against escape attacks.

Correct answer: B. Resiliency

Microservices isolate failures, directly enhancing system resiliency. While cloud-native systems can improve performance or rapid development, strict isolation makes fault tolerance the defining quality.

Correct answer: B. Cloud Anomaly Detection

Cloud anomaly detection fits because it flags unusual patterns that often signal security threats or waste. However, the wording is slightly ambiguous because resource allocation also handles optimization, though not security.

Correct answer: C. Pod

A Pod is the fundamental unit that the Kubernetes scheduler works with. Deployments and ReplicaSets manage Pods but are not the actual units assigned to nodes.

Correct answer: D. Provides an internal virtual IP address only reachable by workloads within the Kubernetes environment

A ClusterIP service provides an internal virtual IP address only reachable by workloads within the Kubernetes cluster. NodePort and LoadBalancer types expose applications to external traffic.

Correct answer: D. Perform a controlled drain with kubectl drain and PDB checks

Performing a controlled drain with kubectl drain enforces Pod Disruption Budgets to minimize disruptions. Force-deleting or applying a NoExecute taint bypasses these safety constraints.

Correct answer: B. Environment Variables and DNS

Environment variables and DNS are the primary modes of service discovery within a Kubernetes cluster. The built-in DNS service is heavily relied upon for name resolution across namespaces.

Correct answer: C. –container or -c

The –container or -c flag specifies a particular container inside a pod when using kubectl logs. The –namespace or -n flag targets the broader resource location.

Correct answer: D. Service Mesh

Istio is primarily identified as a service mesh technology that manages traffic and security for microservices. Container orchestration is handled by platforms like Kubernetes.

Correct answer: C. Deployment

A Deployment manages a set of identical stateless pods, providing robust features like rolling updates and horizontal scaling. StatefulSet is the strongest distractor, but it is explicitly designed for stateful workloads requiring persistent identities and stable storage.

Correct answer: D. Rook

Rook is a cloud-native storage orchestrator that translates Kubernetes storage requirements into automated management of distributed storage systems. Kubernetes provides the general container orchestration layer, but Rook acts as the specialized operator handling the Ceph cluster lifecycle.

Correct answer: D. Argo Workflows

Argo Workflows is a custom resource definition engine built specifically to orchestrate parallel, multi-step pipelines natively inside Kubernetes. Kubernetes Jobs handle basic batch execution, but they lack the advanced dependency graphing needed for complex, parallel workflow orchestration.

Correct answer: D. A Pod managing one or more containers with common resources

A Pod is the smallest deployable computing unit in Kubernetes, encapsulating one or more tightly coupled containers that share the same network and storage namespaces. ReplicaSets manage Pod scaling, but the Pod itself serves as the foundational shared resource bundle.

Correct answer: C. Both Deployments and StatefulSets use the same container spec within their pod templates

Both Deployments and StatefulSets embed identical container specifications inside their respective Pod templates, standardizing runtime configuration. The primary difference lies in their rollout strategies and network identity handling, rather than any variation in how container images and commands are defined.

Correct answer: C. A text document containing all the commands to build a Docker image

A Dockerfile is a text document containing all the sequential commands needed to assemble a custom container image, such as setting base layers and copying files. Helm charts handle deployment orchestration, whereas the Dockerfile strictly dictates image creation.

Correct answer: C. Open Container Initiative (OCI)

The Open Container Initiative establishes the formal specifications for container images and runtimes. Docker and Kubernetes utilize these OCI standards, but neither defines the foundational open specification itself.

Correct answer: B. Defining an ApplicationSet that uses a generator to target multiple applications from a single configuration.

ApplicationSet uses generators to template and deploy multiple Argo CD Applications declaratively. Creating individual Application resources works but introduces duplication, defeating the purpose of scalable GitOps automation.

Correct answer: C. Gauge

A gauge represents metrics that can arbitrarily increase or decrease, such as memory usage. Counters only increment, making them suitable for tracking total events, not fluctuating current states.

Correct answer: B. Grafana

Grafana is the industry standard visualization tool for creating dashboards from Prometheus time-series data. While Jenkins handles automation, it lacks the specialized querying and dashboarding features required for metrics analysis.

Correct answer: B. kubectl cordon node-1

The kubectl cordon command marks a node as unschedulable, preventing new pods from being placed on it. The kubectl drain command also evicts existing pods, which differs from just cordoning.

Correct answer: A. kubectl exec <pod> -c <container> — env

The kubectl exec command with the -c flag specifies the container and runs the env utility. The –env flag does not exist for kubectl exec.

Correct answer: A. Microservices, Containers, DevOps, CI/CD

Microservices, containers, DevOps, and CI/CD form the foundational pillars of cloud native architecture. Virtual machines and big data are not considered core pillars of this paradigm.

Correct answer: A. DaemonSet

A DaemonSet ensures that a copy of a pod runs on all eligible nodes, automatically adding pods to any new nodes. Deployments and StatefulSets do not guarantee a pod on every single node, making them incorrect for node-level security agents.

Correct answer: A. kubelet

The kubelet is the primary node agent that ensures containers described in pod specs are running and healthy. The kube-controller-manager is a control plane component, while the container runtime only executes the containers locally.

Correct answer: C. Maintaining a minimum number of available replicas during voluntary disruptions

PDBs guarantee that a minimum number or percentage of pod replicas remain available during voluntary disruptions. They do not manage storage, load balancing, or autoscaling, but specifically protect application availability during maintenance.

Correct answer: D. kubectl label –overwrite ns example pod-security.kubernetes.io/warn=baseline

Using the warn mode in Pod Security Admission triggers alerts when creating pods that violate the baseline policy. Enforce mode would reject the pod creation outright, while audit only logs the violation silently.

Correct answer: A. Readiness Probe

A readiness probe determines if a container is ready to accept traffic, removing the pod from service endpoints if it fails. Liveness probes only restart crashed containers, while other options do not directly manage service routing.

Correct answer: B. Always, Never, OnFailure

The valid restart policies for Kubernetes pods are Always, Never, and OnFailure. Always is the default for Deployments, while OnFailure and Never are typically used for batch Jobs and direct pod creation.

Correct answer: D. By generating and maintaining Kubernetes Secrets with certificates that other resources reference

Cert-manager automates TLS provisioning by generating and securely storing certificates inside Kubernetes Secrets. Applications and Ingress controllers then reference these Secrets directly rather than relying on manual creation or sidecars.

Correct answer: C. Pod

A pod represents the smallest deployable compute unit in Kubernetes, wrapping one or more tightly coupled containers. Nodes and clusters are infrastructure layers, while Services provide network abstraction over running pods.

Correct answer: B. A ConfigMap is intended for non-sensitive configuration data, while a Secret is intended for sensitive values that should be handled more securely by the cluster

ConfigMaps store non-sensitive plain-text configuration, while Secrets handle sensitive values with additional cluster protections like restricted visibility. Avoid options claiming Secrets are plaintext or that mounting rules differ; both objects support volumes and environment variables.

Correct answer: C. spec.template

The spec.template field in a Deployment contains the PodTemplateSpec, defining exactly how the Pods should be created. Remember that spec.replicas only dictates the count, while spec.selector tells the Deployment which Pods to manage.

Correct answer: C. Kubernetes automatically creates DNS records that map names like service-name.namespace.svc.cluster.local to the Service's virtual IP, and pods can use shorter names like service-name for Services in the same namespace

Kubernetes DNS maps the fully qualified domain name of a Service to its cluster IP, allowing Pods to resolve it. Pods in the same namespace can use short names thanks to DNS search path configurations, simplifying internal service discovery.

Correct answer: D. To provide a framework for controlling request routing to Kubernetes services

Gateway API provides a standardized, expressive framework for managing external traffic routing into Kubernetes Services. It focuses on advanced request routing, unlike mutual TLS or DNS resolution which are handled by other native components.

Correct answer: B. Enable Pods on separate nodes to communicate with each other

Container Network Interface plugins configure pod networking so that workloads on different cluster nodes can seamlessly communicate. Containers in the same pod naturally share a localhost network namespace, which is handled by the container runtime rather than the CNI.

Correct answer: A. Roles are limited to a specific namespace, while ClusterRoles have cluster-wide applicability

Roles are strictly namespaced objects that restrict permissions to a single specific namespace. ClusterRoles are cluster-scoped and can govern resources across the entire cluster, meaning they do not need separate bindings for each namespace.

Correct answer: C. Labels

Labels are key-value pairs used to attach identifying metadata to Kubernetes objects, allowing administrators to group, filter, and allocate resources effectively. While namespaces isolate environments, labels provide the flexible filtering required for granular cost tracking and resource organization.

Correct answer: B. Ceph

Ceph provides a unified storage platform that simultaneously supports block, file, and object storage interfaces within distributed environments. MinIO is limited to object storage, whereas Ceph delivers the comprehensive multi-modal capability required by modern cloud-native workloads.

Correct answer: A. KCDs are community-driven events focused in a specific region or city

Kubernetes Community Days are locally organized events that emphasize regional networking and grassroots collaboration rather than global corporate sponsorships. While large commercial conferences often feature major vendor keynotes, KCDs focus on community-driven content tailored to specific geographic areas.

Correct answer: D. Defining container or pod level security settings

Security Contexts define privilege and access control settings for Pods or Containers. Resource constraints, like CPU limits, are managed separately through resource requests and limits, making that option a common distractor.

Correct answer: C. The CNCF Technical Oversight Committee

The CNCF Technical Oversight Committee handles technical governance and oversight for hosted projects. While the Linux Foundation manages overall administrative operations, the TOC directly oversees the technical direction and project lifecycle.

Correct answer: C. Istio

Istio is a dedicated service mesh providing advanced traffic management, security, and observability for microservices. Traefik is an ingress controller, and Weave Net focuses on container networking rather than service mesh capabilities.

Correct answer: C. Flux

Flux is built using the GitOps Toolkit, providing composable APIs for continuous delivery. Argo CD is another popular GitOps tool but relies on its own monolithic controller architecture rather than the specialized GitOps Toolkit components.

Correct answer: A. Pod

EndpointSlices contain IP addresses that directly reference Pods, as Pods are the actual endpoints that receive traffic. Deployments manage Pods but are not the direct network endpoints.

Correct answer: B. The -l flag applies a label selector that filters pods based on their labels

The -l flag applies a label selector to filter resources matching specific key-value pairs. Candidates should remember labels are fundamental for grouping objects, whereas annotations are used for non-identifying metadata.

Correct answer: A. DaemonSet

A DaemonSet ensures a copy of a specific pod runs on all matching nodes, making it ideal for node-level agents. Deployments manage stateless applications replicated across the cluster, but they do not guarantee one pod per node.

Correct answer: C. Cluster Autoscaler

The Cluster Autoscaler adjusts the number of nodes in a cluster based on pending pods due to insufficient resources. Remember the distinction: Horizontal and Vertical Pod Autoscalers adjust pod counts or resource requests, not node counts.

Correct answer: A. It provides visibility into third-party components and their vulnerabilities.

An SBOM provides visibility into third-party components, helping teams quickly identify and patch known vulnerabilities. Licensing or compliance options might be related side effects, but supply chain transparency is the core security focus for the exam.

Correct answer: B. Deployments, ReplicaSets and StatefulSets

The HorizontalPodAutoscaler targets scalable controllers like Deployments and StatefulSets to adjust replica counts. It does not target individual pods directly, as controllers are responsible for managing the desired number of pod replicas.

Correct answer: D. REST Objects

Kubernetes resources are fundamentally represented as REST objects accessed via standard API calls to the API server. While JSON or YAML are the formats used to serialize these objects, REST defines their architectural representation and manipulation.

Correct answer: D. Deployment

A Deployment provides declarative updates, rolling updates, and automatic rollback capabilities for stateless applications. A ReplicaSet only maintains a stable set of pods at any given time but lacks the built-in rollout and rollback history features.

Correct answer: B. To store configuration and state data for the cluster

Etcd acts as the distributed key-value store that persists all cluster configuration and state data. As the single source of truth for the cluster, its primary role is data persistence rather than load balancing, networking, or scheduling tasks.

Correct answer: B. 5,000

The official Kubernetes scalability target supports clusters with up to 5,000 nodes. This benchmark also accounts for a maximum of 300,000 total containers, establishing the ceiling for standard vanilla installations.

Correct answer: C. To execute pre-start tasks or setup actions before the main application container starts

Init containers run to completion before the main application containers start, handling prerequisites like file downloads or environment setup. They do not manage the primary app logs or provide runtime security, focusing purely on pre-start setup tasks.

Correct answer: B. Helm

Helm is the standard package manager for Kubernetes, streamlining the installation and management of complex cloud-native applications using charts. While kubectl manages raw resources, Helm handles templated application releases efficiently.

Correct answer: B. Labels assigned to nodes

The nodeSelector field uses labels assigned to nodes to constrain where the scheduler places a Pod. While advanced scheduling can consider CPU capacity via limits, nodeSelector strictly provides simple key-value label matching for placement.

Correct answer: A. ResourceQuota

ResourceQuota objects enforce aggregate limits on total resource consumption within a namespace. PriorityClasses dictate pod scheduling priority during node pressure, while LimitRanges restrict individual pod resource boundaries rather than cumulative namespace totals.

Correct answer: C. Leader Election

Leader election is the standard Kubernetes mechanism ensuring only one active replica processes writes, fundamentally preventing split-brain conflicts during network partitions. StatefulSets provide stable identities, but avoiding split-brain strictly relies on application-level leader election coordination.

Correct answer: A. Cloud Native Computing Foundation

CNCF stands for Cloud Native Computing Foundation. This organization hosts critical open-source projects like Kubernetes. The alternative options are plausible technical acronyms designed to distract test-takers.

Correct answer: A. Manually applying cluster changes using kubectl commands

GitOps mandates that all desired state changes originate from a version-controlled Git repository. Manually running kubectl bypasses this declarative automation, immediately causing configuration drift and breaking the reconciliation loop.

Correct answer: D. Build, Testing, Release, Deployment

The traditional pipeline workflow typically progresses through Build, Testing, Release, and Deployment. Remember Continuous Delivery stops at Release for manual approval, while Continuous Deployment automatically pushes releases straight to production environments.

Correct answer: C. 150,000

Kubernetes is designed to support clusters with up to 150,000 pods while maintaining stability and performance. For the exam, memorize the standard scaling limits, such as 5,000 nodes and 300,000 total containers, to identify correct thresholds.

Correct answer: A. 1.2.3

Semantic versioning strictly follows the MAJOR.MINOR.PATCH format using non-negative integers, making 1.2.3 the correct choice. Options like 1.2-beta or 1.2 fail because they omit required numeric segments or use invalid formatting.

Correct answer: A. Delivering non-confidential configuration data to containers via environment variables or volume mounts

ConfigMaps inject non-sensitive configuration data into containers via environment variables or mounted files. Sensitive credentials belong in Secrets, not ConfigMaps, ensuring secure cluster operations during application deployment.

Correct answer: A. CoreDNS

CoreDNS serves as the default Kubernetes DNS server, resolving internal Service names to their respective virtual IP addresses. Remember that kube-proxy handles routing network traffic to the Pods, rather than providing name resolution.

Correct answer: A. ServiceMeshInterface (SMI)

The Service Mesh Interface provides a standard specification for service mesh capabilities on Kubernetes platforms. The other listed acronyms serve as distractors and are not actual specifications within the cloud native ecosystem.