83 free Linux Foundation KCNA practice questions from the CertStash pack of 333, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 83 free here, all 333 in the pack, and each step includes the one before it.
Get all 333 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
What native runtime is Open Container Initiative (OCI) compliant?
Show answer and explanation
Correct answer: A. runC
runC is the reference implementation of the Open Container Initiative runtime specification. It was donated to the OCI as the low-level tool that creates and runs containers directly on the host using Linux kernel features such as namespaces and cgroups. Higher-level runtimes like containerd call runC by default to start containers, which is why it is regarded as the native OCI-compliant runtime. The other options are alternative runtimes that add virtualization or sandboxing layers rather than serving as the native reference implementation.
Why the other options are wrong
- B. runV is a hypervisor-based runtime that runs containers inside virtual machines; it is not the native OCI reference runtime.
- C. Kata Containers runs each workload inside a lightweight virtual machine for stronger isolation; it is an alternative sandboxed runtime, not the native reference implementation.
- D. gVisor provides a user-space application kernel that sandboxes containers; it is an alternative isolation runtime, not the native OCI reference implementation.
Question 2
Which API object is the recommended way to run a scalable, stateless application on your cluster?
Show answer and explanation
Correct answer: B. Deployment
A Deployment is the standard Kubernetes object for running a stateless application that needs to scale. You declare the desired number of replicas and the Pod template, and the Deployment controller manages ReplicaSets to keep that many identical Pods running. Deployments also provide rolling updates and rollbacks, so new versions can be released without downtime, and the replica count can be changed manually or by a Horizontal Pod Autoscaler. Because the Pods are interchangeable, this model fits stateless services perfectly.
Why the other options are wrong
- A. A ReplicaSet keeps a set number of Pods running but lacks rolling updates and rollbacks; Kubernetes recommends managing it through a Deployment instead.
- C. A DaemonSet runs one Pod per eligible node for node-level agents, so its size follows the node count rather than application demand.
- D. A bare Pod is a single instance with no controller to replace it on failure or to scale it out.
Question 3
A CronJob is scheduled to run by a user every one hour. What happens in the cluster when it's time for this CronJob to run?
Show answer and explanation
Correct answer: D. CronJob controller component creates a Job. Then the Job controller creates a Pod and waits until it finishes to run.
Kubernetes runs scheduled work through a chain of controllers in the kube-controller-manager. When the schedule of a CronJob comes due, the CronJob controller creates a new Job object from the CronJob's job template. The Job controller then sees that Job and creates one or more Pods to carry out the work, tracking them until the required number complete successfully. The scheduler assigns those Pods to nodes and the kubelet runs them, but the CronJob itself only ever creates Jobs, never Pods directly.
Why the other options are wrong
- A. The kubelet only runs Pods already assigned to its node; it does not watch CronJob objects or decide when scheduled work should start.
- B. kube-scheduler assigns pending Pods to nodes; its name refers to placement, not to time-based scheduling of CronJobs.
- C. The CronJob controller does not create Pods itself; it creates a Job, and the Job controller creates and tracks the Pods.
Question 4
What is the purpose of the kubelet component within a Kubernetes cluster?
Show answer and explanation
Correct answer: D. An agent that runs on each node in the cluster. It makes sure that containers are running in a Pod.
The kubelet is the node agent that runs on every node in a Kubernetes cluster. It receives Pod specifications assigned to its node from the API server and works with the container runtime through the Container Runtime Interface to make sure the described containers are running and healthy. The kubelet also runs liveness and readiness probes, mounts volumes, and reports node and Pod status back to the control plane. It manages only containers that were created through Kubernetes.
Why the other options are wrong
- A. This describes the Kubernetes Dashboard, a web user interface for managing and troubleshooting cluster applications, not the kubelet.
- B. This describes kube-proxy, the per-node network proxy that maintains rules so traffic to a Service reaches its backend Pods.
- C. This describes kube-scheduler, the control plane component that picks a node for each unscheduled Pod.
Question 5
What is the default value for authorization-mode in Kubernetes API server?
Show answer and explanation
Correct answer: B. --authorization-mode=AlwaysAllow
The kube-apiserver reference lists AlwaysAllow as the default value of the --authorization-mode flag. If no authorization mode is configured, every authenticated request is permitted without any authorization checks. That default is unsafe for real clusters, so cluster installers and administrators normally set the flag explicitly, commonly to Node,RBAC, so that the Node authorizer and role-based access control decide what each user and component may do. The question asks only about the built-in default of the flag.
Why the other options are wrong
- A. RBAC is the widely recommended mode and is commonly enabled by installers, but it must be set explicitly and is not the flag's default.
- C. AlwaysDeny blocks every request and is meant mainly for testing; it is not the default value.
- D. ABAC is an attribute-based mode that requires a policy file and explicit configuration; it is not the default.
Question 6
Let's assume that an organization needs to process large amounts of data in bursts, on a cloud-based Kubernetes cluster. For instance: each Monday morning, they need to run a batch of 1000 compute jobs of 1 hour each, and these jobs must be completed by Monday night. What's going to be the most cost-effective method?
Show answer and explanation
Correct answer: B. Leverage the Kubernetes Cluster Autoscaler to automatically start and stop nodes as they're needed.
The workload is bursty: heavy demand for one day each week and little demand the rest of the time. The Cluster Autoscaler fits this pattern because it adds nodes when Pods cannot be scheduled for lack of capacity and removes nodes that stay underutilized. On Monday the 1000 pending jobs trigger new nodes so the batch finishes on time, and afterward the extra nodes are scaled back down. The organization pays for the additional compute only while the jobs run, which is the most cost-effective approach.
Why the other options are wrong
- A. A fixed, reserved node group guarantees capacity, but those nodes keep running and costing money all week while the batch runs only on Mondays.
- C. Committed-spend discounts suit steady, predictable usage; committing to capacity needed only one day a week leaves most of it paid for but unused.
- D. PriorityClasses only decide which Pods win existing capacity; they add no nodes, so the batch may still lack resources or starve other workloads.
Question 7
What is a Kubernetes service with no cluster IP address called?
Show answer and explanation
Correct answer: A. Headless Service
A Service that is created with spec.clusterIP set to None is called a headless Service. Kubernetes allocates no cluster IP for it, and kube-proxy does not load-balance or proxy its traffic. Instead, cluster DNS returns records that point directly at the IP addresses of the backing Pods, so clients can discover and reach individual Pods. Headless Services are commonly used with StatefulSets and with applications that perform their own peer discovery or load balancing.
Why the other options are wrong
- B. Nodeless Service is not a Kubernetes term; a Service without a cluster IP is called a headless Service.
- C. IPLess Service is not a Kubernetes term; the documented name for a Service with clusterIP set to None is headless Service.
- D. Specless Service is not a Kubernetes concept; every Service has a spec, and one without a cluster IP is called headless.
Question 8
CI/CD stands for:
Show answer and explanation
Correct answer: D. Continuous Integration / Continuous Deployment
CI/CD stands for Continuous Integration and Continuous Deployment. Continuous Integration means developers merge code changes into a shared repository frequently, and each change is automatically built and tested so problems surface early. Continuous Deployment extends the pipeline so that every change that passes the automated checks is released to production automatically. Together these practices shorten feedback loops and make releases small, frequent, and repeatable, which is central to cloud native delivery.
Why the other options are wrong
- A. Neither term is right: CI means Continuous Integration, not Continuous Information, and CD does not mean Continuous Development.
- B. Continuous Integration is correct, but CD refers to deploying or delivering software, not to Continuous Development.
- C. CI/CD is not about cloud; the C stands for Continuous in both halves of the abbreviation.
Question 9
What default level of protection is applied to the data in Secrets in the Kubernetes API?
Show answer and explanation
Correct answer: D. The values are base64 encoded
In the Kubernetes API, the values in a Secret's data field are base64 encoded. Base64 is only an encoding that lets arbitrary binary data be represented as text; anyone who can read the Secret can decode it instantly, so it provides no confidentiality. By default Secrets are also stored unencrypted in etcd. Kubernetes documentation therefore recommends enabling encryption at rest, restricting access with RBAC, and limiting who can read Secrets or create Pods that mount them.
Why the other options are wrong
- A. AES encryption of Secrets is available through encryption at rest, but an administrator must configure it; it is not applied by default.
- B. Secret values in the data field are represented base64 encoded rather than as raw text, even though that encoding offers no real protection.
- C. SHA256 is a one-way hash, so values could never be recovered; Kubernetes does not hash Secret data.
Question 10
What function does kube-proxy provide to a cluster?
Show answer and explanation
Correct answer: B. Forwarding data to the correct endpoints for Services.
kube-proxy is a network proxy that runs on each node and implements part of the Kubernetes Service concept. It watches the API server for Services and their EndpointSlices and programs rules on the node, for example with iptables, IPVS or nftables, so that traffic sent to a Service's virtual IP and port is forwarded to one of the healthy backend Pods. This gives clients a stable address while the set of Pods behind it changes.
Why the other options are wrong
- A. Ingress resources are implemented by an Ingress controller that routes external HTTP and HTTPS traffic, not by kube-proxy.
- C. kube-proxy handles traffic to Services, not general egress from nodes; outbound traffic is governed by node networking, the CNI plugin and network policies.
- D. Access to the Kubernetes API is controlled by the API server through authentication, authorization and admission control, not by kube-proxy.
What people say about the full KCNA pack 4.6 from 11
Passed today. This KCNA dump is 100% valid. And yes, you can pass too with the help of valid braindumps.
Cert Stash exam dumps for KCNA certification are the latest. Highly recommended to all taking this exam. I scored 96% marks in the exam. Thank you Cert Stash.
Passed the KCNA! Good dump for this cert. Real questions throughout and a lot came out in my actual exam. Cheap for what it is. Cleared it comfortably.
Question 11
Which kubectl command is useful for collecting information about any type of resource that is active in a Kubernetes cluster?
Show answer and explanation
Correct answer: A. describe
kubectl describe shows detailed information about one resource or a group of resources of any kind that exist in the cluster, such as Pods, Nodes, Services or Deployments. It collects the object's configuration, current status, conditions and related information, and it lists recent events, which makes it one of the first commands to run when troubleshooting a Pod that will not start or a Node under pressure. It works with names, label selectors or files.
Why the other options are wrong
- B. kubectl has no list subcommand; resources are listed with kubectl get.
- C. kubectl expose creates a Service for an existing resource; it does not collect information.
- D. kubectl explain shows schema documentation for resource fields, not information about live objects in the cluster.
Question 12
Which group of container runtimes provides additional sandboxed isolation and elevated security?
Show answer and explanation
Correct answer: C. runsc, kata
runsc and Kata Containers both add an extra isolation boundary between a container and the host kernel. runsc is the runtime of gVisor, which intercepts system calls with a user-space application kernel, so the container does not talk to the host kernel directly. Kata Containers runs each Pod or container inside a lightweight virtual machine with its own guest kernel. These sandboxed runtimes are used for untrusted or multi-tenant workloads where standard namespace and cgroup isolation is not considered strong enough.
Why the other options are wrong
- A. cgroups is a Linux kernel feature for limiting resources, not a container runtime, so this pair does not describe sandboxed runtimes.
- B. Docker and containerd normally start containers with runc, which shares the host kernel and adds no extra sandbox boundary.
- D. crun is a lightweight OCI runtime and CRI-O is a Kubernetes CRI implementation; by default they use standard kernel isolation, not a sandbox.
Question 13
What is the correct hierarchy of Kubernetes components?
Show answer and explanation
Correct answer: C. Cluster → Nodes → Pods → Containers
From largest to smallest scope, the hierarchy is cluster, nodes, Pods and containers. A cluster is made up of a control plane and a set of nodes, the worker machines, physical or virtual, that run workloads. Each node runs one or more Pods, the smallest deployable unit in Kubernetes. Each Pod in turn holds one or more containers that share its network namespace and storage volumes. Every level contains the one below it.
Why the other options are wrong
- A. Containers are the smallest unit, so placing them first and nodes last scrambles the nesting order.
- B. Nodes belong to a cluster, not the reverse, and Pods contain containers, so this order is wrong at both ends.
- D. Pods run on nodes inside a cluster, so they cannot sit above the cluster, and containers do not contain nodes.
Question 14
What framework does Kubernetes use to authenticate users with JSON Web Tokens?
Show answer and explanation
Correct answer: A. OpenID Connect
Kubernetes supports OpenID Connect (OIDC) as an authentication strategy for human users. OIDC is an identity layer built on OAuth 2.0, and the identity provider issues an ID token that is a signed JSON Web Token carrying claims such as the user name and groups. The user presents this token to the kube-apiserver as a bearer token, and the API server verifies its signature and claims against the configured issuer before treating the request as coming from that user. This lets clusters delegate login to external providers instead of managing user accounts themselves.
Why the other options are wrong
- B. OpenID Container is not an authentication framework; no such standard exists in Kubernetes or the OpenID family of specifications.
- C. OpenID Cluster is not a real framework; Kubernetes token-based user authentication relies on OpenID Connect.
- D. OpenID CNCF is not a real framework; the CNCF hosts projects but does not define an OpenID standard.
Question 15
Which is an industry-standard container runtime with an emphasis on simplicity, robustness, and portability?
Show answer and explanation
Correct answer: C. containerd
containerd describes itself as an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is a CNCF graduated project that runs as a daemon on Linux and Windows and manages the full container lifecycle on a host: pulling and storing images, running containers, and handling storage and network attachments. It includes a CRI plugin, so Kubernetes can use it directly through the kubelet, and Docker uses it underneath as well.
Why the other options are wrong
- A. CRI-O is a lightweight runtime built specifically to implement the Kubernetes CRI; the simplicity, robustness and portability tagline belongs to containerd.
- B. LXD is a manager for system containers and virtual machines, not the industry-standard application container runtime described.
- D. Kata Containers runs containers inside lightweight virtual machines for stronger isolation; its focus is security, not the description given.
Question 16
What is the purpose of the kube-proxy?
Show answer and explanation
Correct answer: B. The kube-proxy maintains network rules on nodes.
kube-proxy is a network proxy that runs on each node and maintains network rules on that node. It watches the API server for Services and their endpoints and programs rules, for example with iptables, IPVS or nftables depending on its mode, so that traffic sent to a Service's virtual IP and port is forwarded to one of the backing Pods. These rules allow network communication to Pods from inside or outside the cluster, which is how Kubernetes Services are implemented on each node.
Why the other options are wrong
- A. Traffic distribution to Pods is a result of the rules kube-proxy writes; its documented purpose is maintaining those network rules on nodes.
- C. kube-proxy does not provide the cluster's internet connectivity; that depends on the node network and infrastructure.
- D. Cluster DNS is provided by a DNS add-on such as CoreDNS, not by kube-proxy.
Question 17
What is the purpose of the CRI?
Show answer and explanation
Correct answer: C. Provide an interface allowing Kubernetes to support pluggable container runtimes.
The Container Runtime Interface is the gRPC-based plugin API between the kubelet and the container runtime. It lets Kubernetes work with any runtime that implements it, such as containerd or CRI-O, without recompiling or changing Kubernetes components. Through CRI, the kubelet asks the runtime to pull images, create Pod sandboxes, and start, stop and inspect containers. This separation keeps Kubernetes runtime-agnostic and lets runtimes develop on their own schedule.
Why the other options are wrong
- A. Choosing among several runtimes is done with RuntimeClass; the CRI itself is the standard interface any runtime implements, not a multi-runtime control layer.
- B. Replicating and scaling Pods is the job of controllers such as ReplicaSets and autoscalers, not the runtime interface.
- D. Resource needs are set through requests, limits and related APIs; CRI does not define resource criteria across containers.
Question 18
How long should a stable API element in Kubernetes be supported (at minimum) after deprecation?
Show answer and explanation
Correct answer: C. 12 months
The Kubernetes deprecation policy sets minimum support periods by API stability level. For stable, generally available elements the minimum is 12 months: user-facing CLI elements such as kubectl flags must keep working for at least 12 months or 2 releases after deprecation, whichever is longer, and GA API versions may not be removed at all within a major version. Beta APIs get a shorter window of 9 months or 3 releases, and alpha APIs can be removed in any release without notice. These guarantees give users predictable time to migrate their manifests and tooling before a stable API goes away.
Why the other options are wrong
- A. Nine months (or 3 releases) is the minimum for deprecated beta APIs, not for stable ones.
- B. Twenty-four months is not the figure in the Kubernetes deprecation policy; the minimum for deprecated stable elements is 12 months.
- D. Six months is shorter than any minimum the policy sets for deprecated stable APIs.
Question 19
In CNCF, who develops specifications for industry standards around container formats and runtimes?
Show answer and explanation
Correct answer: A. Open Container Initiative (OCI)
The Open Container Initiative is an open governance project under the Linux Foundation that creates open industry standards for container formats and runtimes. Its main specifications are the Runtime Specification, the Image Specification and the Distribution Specification, and it maintains runc as the reference runtime. Because CNCF projects such as containerd, CRI-O and container registries follow these specs, images and runtimes from different tools work together across the cloud native ecosystem.
Why the other options are wrong
- B. There is no Linux Foundation Certification Group that writes container standards; container format and runtime specifications come from the OCI.
- C. CNI is a CNCF specification and set of libraries for configuring container networking, not for container formats or runtimes.
- D. CRI is the Kubernetes API between the kubelet and container runtimes, not a body that writes industry container standards.
Question 20
What is Serverless computing?
Show answer and explanation
Correct answer: A. A computing method of providing backend services on an as-used basis.
Serverless computing is a model in which a provider runs backend services on demand and charges only for what is used. Developers deploy code, often as event-driven functions, and the platform handles provisioning, scaling (including down to zero) and server maintenance. The CNCF glossary describes it as abstracting servers away from the user so they can focus on code. In Kubernetes, projects such as Knative bring this model to the cluster.
Why the other options are wrong
- B. Serverless is a general way of running applications and is not tied to AI or machine learning operating systems.
- C. Serverless has nothing to do with quantum computing operating systems; it is about running code without managing servers.
- D. Serverless is offered by cloud platforms, but it is a way of running application code, not a service for cloud operating systems.
Question 21
At which layer would distributed tracing be implemented in a cloud native deployment?
Show answer and explanation
Correct answer: B. Application
Distributed tracing follows a single request as it passes through many services, recording each unit of work as a span within a shared trace. This is implemented at the application layer: services are instrumented, with libraries such as OpenTelemetry SDKs or automatic instrumentation, to create spans and propagate trace context in request headers to the next service. Backends such as Jaeger then assemble the spans to show latency and dependencies across the whole request path.
Why the other options are wrong
- A. The network layer sees packets and connections but cannot link them into end-to-end request traces without application context.
- C. A database is only one component a request may touch; tracing must span all services, so it is not implemented there.
- D. Infrastructure monitoring covers hosts and clusters but does not follow individual requests through application code.
Question 22
Which of the following capabilities are you allowed to add to a container using the Restricted policy?
Show answer and explanation
Correct answer: D. NET_BIND_SERVICE
The Restricted profile of the Kubernetes Pod Security Standards applies current Pod hardening practices. Containers must drop ALL capabilities, and the only capability they may add back is NET_BIND_SERVICE. That capability lets a process bind to ports below 1024 without other root privileges, a common and low-risk need for things like web servers. Adding any other capability causes the Pod to fail validation under the Restricted level.
Why the other options are wrong
- A. CHOWN lets a process change file ownership freely; the Restricted profile does not permit adding it back after ALL is dropped.
- B. SYS_CHROOT allows changing the root directory, and the Restricted profile does not allow adding it.
- C. SETUID lets a process change user IDs, which could be used to gain privileges, so the Restricted profile forbids adding it.
Question 23
What sentence is true about CronJobs in Kubernetes?
Show answer and explanation
Correct answer: A. A CronJob creates one or multiple Jobs on a repeating schedule.
A CronJob creates Jobs on a repeating schedule written in cron format. At each scheduled time the CronJob controller creates a new Job object from the CronJob's job template, and that Job then creates the Pods that do the work. Over time a single CronJob therefore produces many Jobs, and fields such as concurrencyPolicy and the history limits control whether runs may overlap and how many finished Jobs are kept. CronJobs are commonly used for periodic tasks like backups, report generation and cleanup.
Why the other options are wrong
- B. A CronJob does not create containers directly; it creates Jobs, which create Pods that run the containers.
- C. CronJob is a stable, built-in Kubernetes workload resource, not an obsolete concept.
- D. The CronJob schedule uses the standard cron syntax familiar from Linux, with five fields for minute, hour, day of month, month and day of week.
Question 24
Which persona is normally responsible for defining, testing, and running an incident management process?
Show answer and explanation
Correct answer: A. Site Reliability Engineers
Site Reliability Engineers own the reliability of production systems, so defining, rehearsing and running the incident management process falls to them. Their work includes setting severity levels and escalation paths, writing runbooks, organizing on-call rotations, running drills or game days to test the process, coordinating the response when an outage happens, and leading blameless postmortems that feed improvements back into the system. Other roles take part in incidents, but SRE is the persona whose core job is keeping services available and making the response repeatable and measurable.
Why the other options are wrong
- B. Project Managers plan scope, schedules and resources for delivery work; they do not normally design or operate the incident response process.
- C. Application Developers build features and often help fix the code during an incident, but they do not usually own the process itself.
- D. Quality Engineers focus on testing software before release; running production incident response is outside their usual responsibilities.
Question 25
Which of these components is part of the Kubernetes Control Plane?
Show answer and explanation
Correct answer: B. cloud-controller-manager
Kubernetes documentation lists the cloud-controller-manager among the control plane components, together with kube-apiserver, etcd, kube-scheduler and kube-controller-manager. It runs controllers that depend on the cloud provider, such as the node controller that checks whether cloud instances still exist, the route controller and the service controller that provisions cloud load balancers. Separating this logic from the kube-controller-manager lets cloud providers release their integrations independently of Kubernetes itself. Clusters running on premises or on a local machine do not need it.
Why the other options are wrong
- A. CoreDNS provides cluster DNS and is deployed as an add-on that runs as ordinary Pods, not as a core control plane component.
- C. kube-proxy is a node component that runs on each node and maintains the network rules that implement Services.
- D. The kubelet is the node agent that runs on every node and makes sure the containers described in Pods are running.
Question 26
Which Kubernetes component is the smallest deployable unit of computing?
Show answer and explanation
Correct answer: C. Pod
The Kubernetes documentation defines Pods as the smallest deployable units of computing that can be created and managed in Kubernetes. A Pod wraps one or more containers that are always scheduled together on the same node and share a network namespace, an IP address and any volumes. Kubernetes schedules, starts and replaces whole Pods, never single containers outside a Pod. Higher-level workload resources such as Deployments and StatefulSets create and manage Pods.
Why the other options are wrong
- A. A StatefulSet is a workload controller that manages a set of Pods with stable identities and storage, so it sits above the Pod.
- B. A Deployment is a controller that manages ReplicaSets and their Pods; it is a higher-level abstraction, not the smallest unit.
- D. Containers run inside Pods, but Kubernetes does not deploy a container on its own; the Pod is the unit it schedules and manages.
Question 27
The IPv4/IPv6 dual stack in Kubernetes:
Show answer and explanation
Correct answer: D. Allows you to create IPv4 and IPv6 dual stack services.
IPv4/IPv6 dual-stack networking lets a cluster assign both IPv4 and IPv6 addresses to Pods and Services. For Services, the ipFamilyPolicy field can be set to SingleStack, PreferDualStack or RequireDualStack, and ipFamilies chooses the address families and their order, so a Service can get a cluster IP from each family. Clients can then reach the workload natively over either protocol, with no translation between the two.
Why the other options are wrong
- A. Dual stack runs both address families side by side; it does not translate IPv4 requests into IPv6.
- B. Each address family is reached with its own address; an IPv4 address is not accessed by using an IPv6 one.
- C. Dual stack does not require NetworkPolicies; NetworkPolicies control which traffic is allowed, not address families.
Question 28
How do you perform a command in a running container of a Pod?
Show answer and explanation
Correct answer: A. kubectl exec <pod-name> -- <command>
kubectl exec runs a command inside a container that is already running in a Pod. Everything after the double dash is passed to the container as the command and its arguments, so kubectl does not try to read them as its own flags. Adding -c selects a specific container in a multi-container Pod, and -it opens an interactive terminal, for example to start a shell. The request goes through the API server to the kubelet on the node, so the user never has to log in to that node.
Why the other options are wrong
- B. docker exec works with containers managed by a local Docker engine and does not go through the Kubernetes API; many clusters do not use Docker as their runtime.
- C. kubectl run creates a new Pod from an image; it does not run a command in an existing container.
- D. kubectl attach connects to the input and output of the process already running in the container; it does not start a new command.
Question 29
Which Kubernetes resource uses the immutable: true boolean field?
Show answer and explanation
Correct answer: C. ConfigMap
ConfigMaps, like Secrets, have a top-level boolean field called immutable. Setting immutable: true prevents any later change to the object's data. Kubernetes documentation notes two benefits: it protects applications from accidental updates that could cause outages, and it reduces load on the kube-apiserver because the kubelet no longer needs to watch immutable ConfigMaps for changes. The setting is one-way: once a ConfigMap is marked immutable you cannot revert it or edit its data, and must delete and recreate it instead.
Why the other options are wrong
- A. Deployment objects have no immutable field; they are meant to be updated to roll out changes.
- B. Pods have no immutable field, even though many fields of a running Pod cannot be changed.
- D. ReplicaSets have no immutable field; their replica count and template can be updated.
Question 30
Which tools enable Kubernetes HorizontalPodAutoscalers to use custom, application-generated metrics to trigger scaling events?
Show answer and explanation
Correct answer: A. Prometheus and the prometheus-adapter.
A HorizontalPodAutoscaler reads custom metrics through the Kubernetes custom metrics API (custom.metrics.k8s.io) and external metrics API, which an adapter must implement. Prometheus scrapes the application-generated metrics, and the prometheus-adapter registers itself as an API server extension that turns Prometheus queries into those metrics APIs. The HPA controller can then scale a workload on values such as requests per second or queue length instead of only CPU and memory.
Why the other options are wrong
- B. Graylog is a log management platform, and graylog-autoscaler metrics is not a component that serves the Kubernetes custom metrics API.
- C. Graylog handles logs rather than metrics, and kubernetes-adapter is not the component that exposes metrics to the HPA.
- D. Grafana visualizes metrics but does not implement the custom metrics API, so without an adapter the HPA cannot consume Prometheus data.
Question 31
Which of the following statements is correct concerning Open Policy Agent (OPA)?
Show answer and explanation
Correct answer: B. Kubernetes can use it to validate requests and apply policies.
Open Policy Agent is a general-purpose policy engine, graduated in the CNCF, that decouples policy decisions from application code. In Kubernetes it is commonly deployed as an admission controller, for example through OPA Gatekeeper, so the API server sends incoming requests to OPA and OPA validates them against organizational policies before objects are created or changed. Policies are written in the declarative Rego language, can be unit tested with the opa test command, and OPA can also enforce policy in microservices, CI/CD pipelines and API gateways.
Why the other options are wrong
- A. OPA policies are written in Rego, a declarative policy language, not in Python.
- C. Rego policies can be tested before deployment, for example with OPA's built-in opa test command.
- D. OPA is general purpose and is used outside Kubernetes, for example in microservices, API gateways, CI/CD pipelines and Terraform checks.
Question 32
What is the reference implementation of the OCI runtime specification?
Show answer and explanation
Correct answer: C. runc
runc is a command-line tool for spawning and running containers according to the OCI runtime specification, and the Open Container Initiative maintains it as the spec's reference implementation. It takes an OCI bundle, a root filesystem plus a config.json, and creates the container process with the requested namespaces, cgroups and security settings. Higher-level runtimes such as containerd and CRI-O commonly use runc as their low-level runtime.
Why the other options are wrong
- A. LXC is an older Linux container toolset with its own format, not the OCI reference runtime.
- B. CRI-O is a CRI implementation for Kubernetes that calls an OCI runtime such as runc; it is not the reference runtime itself.
- D. Docker is a full container platform that relies on containerd and runc underneath, not the OCI reference runtime.
Question 33
Which are the two primary modes for Service discovery within a Kubernetes cluster?
Show answer and explanation
Correct answer: A. Environment variables and DNS
Kubernetes has two main ways to find a Service: environment variables and DNS. When a Pod starts, the kubelet adds environment variables such as SERVICENAME_SERVICE_HOST and SERVICENAME_SERVICE_PORT for each active Service, which only works if the Service existed before the Pod was created. DNS, served by a cluster add-on such as CoreDNS, gives each Service a name like my-service.my-namespace.svc.cluster.local and keeps it current as Services change, so it is the recommended approach.
Why the other options are wrong
- B. Clients can query the Kubernetes API, but it is not one of the two built-in discovery modes, and LDAP is a directory protocol not used for Service discovery.
- C. Labels group and select objects, and RADIUS is a network authentication protocol; neither is a Service discovery mode.
- D. Selectors decide which Pods back a Service, and DHCP hands out IP addresses on traditional networks; neither is how clients discover Services.
Question 34
What are the characteristics for building every cloud-native application?
Show answer and explanation
Correct answer: D. Resiliency, Agility, Operability, Observability
Cloud native applications are commonly described by four characteristics. Resiliency means the application keeps working, or recovers quickly, when components fail. Agility means teams can change and deploy the application quickly and often, which loosely coupled services and automation make possible. Operability means the application is built to be managed through automation and configuration rather than manual work. Observability means the application exposes metrics, logs and traces so operators can understand its internal state from the outside. Together these qualities explain why cloud native systems favor microservices, containers, declarative APIs and continuous delivery.
Why the other options are wrong
- A. This list swaps agility for availability; high availability results from resiliency rather than being one of the four characteristics.
- B. containerd is a container runtime, a specific piece of software, not a design characteristic of cloud native applications.
- C. Kubernetes is a platform that can run cloud native applications, not a characteristic of how those applications are built.
Question 35
Which Kubernetes feature would you use to guard against split brain scenarios with your distributed application?
Show answer and explanation
Correct answer: D. StatefulSet
A StatefulSet gives each Pod a stable, unique identity made up of an ordinal index, a stable network name and its own persistent storage. Kubernetes aims to run at most one Pod with a given identity at any time, and the StatefulSet controller will not create a replacement until it is sure the old Pod is gone. This at-most-one guarantee is what protects clustered applications such as databases from split brain, where two members believe they hold the same role and write to the same data. Clustered applications rely on these stable identities to build their membership and quorum.
Why the other options are wrong
- A. A ReplicationController only keeps a set number of interchangeable Pod replicas running and gives them no stable identity or at-most-one guarantee.
- B. Consensus protocols such as Raft are algorithms that applications implement themselves, not a Kubernetes feature you configure.
- C. Rolling updates control how a new Pod template replaces the old one and offer no protection against two members claiming the same identity.
Question 36
How does dynamic storage provisioning work?
Show answer and explanation
Correct answer: A. A user requests dynamically provisioned storage by including an existing storage class in their PersistentVolumeClaim.
Dynamic provisioning lets storage be created on demand rather than set up ahead of time by an administrator. A cluster administrator defines one or more StorageClass objects, each naming a provisioner and its parameters. A user then creates a PersistentVolumeClaim that names an existing StorageClass in its storageClassName field. The provisioner creates a matching PersistentVolume automatically and binds it to the claim, and a Pod uses the storage by referring to the claim in its volumes section.
Why the other options are wrong
- B. Pods do not reference a StorageClass directly; dynamic provisioning is triggered by a PersistentVolumeClaim that names the class.
- C. A PersistentVolumeClaim does not include a Pod name; the Pod refers to the claim, not the other way around.
- D. An administrator creating a PersistentVolume ahead of time is static provisioning, and Pods normally consume it through a claim rather than by PV name.
Question 37
What is a sidecar container?
Show answer and explanation
Correct answer: C. A container that runs next to another container within the same Pod.
A sidecar is a helper container that runs alongside the main application container in the same Pod. Because the containers in a Pod share a network namespace and can mount the same volumes, the sidecar can talk to the main container over localhost or through shared files. Typical uses are log shipping, metrics collection, configuration reloading and service mesh proxies such as Envoy, which add features without changing the application. Kubernetes also supports native sidecars, defined as init containers with restartPolicy set to Always.
Why the other options are wrong
- A. A sidecar is a container, not a Pod; a Pod cannot run inside another Pod.
- B. A sidecar shares a Pod with the main container, not just a namespace, and it runs next to a container rather than a Pod.
- D. Two Pods in the same namespace are separate units with separate networks; the sidecar pattern needs containers in a single Pod.
Question 38
Which one of the following is an open source runtime security tool?
Show answer and explanation
Correct answer: C. falco
Falco is a CNCF graduated project built for cloud native runtime security. It observes kernel events, such as system calls, on hosts and in containers, enriches them with container and Kubernetes metadata, and evaluates them against rules that describe suspicious behavior. Examples include a shell spawned inside a container or an unexpected write to a sensitive file. When a rule matches, Falco raises an alert in real time, giving teams detection of threats while workloads are running.
Why the other options are wrong
- A. lxd is a manager for system containers and virtual machines, not a runtime threat detection tool.
- B. containerd is a container runtime that runs containers; it does not monitor them for suspicious behavior.
- D. gVisor is an application kernel that sandboxes containers for isolation; it does not detect and alert on suspicious runtime activity.
Question 39
What is the primary mechanism to identify grouped objects in a Kubernetes cluster?
Show answer and explanation
Correct answer: B. Labels
Labels are key-value pairs attached to objects such as Pods, Services and Nodes to specify identifying attributes that are meaningful to users, for example app=frontend or environment=production. Kubernetes documentation describes them as the mechanism for organizing and selecting subsets of objects, since many objects can share the same label and a single object can carry many labels. Controllers and Services then use label selectors to find the group of objects they act on, which is why consistent labeling is central to how Kubernetes groups resources.
Why the other options are wrong
- A. Custom Resources extend the Kubernetes API with new object types; they do not identify groups of existing objects.
- C. A label selector is the query that picks out objects by their labels; the labels themselves are what identify the group.
- D. A Pod is a workload object that runs containers, not a mechanism for identifying a group of objects.
Question 40
Which item is a Kubernetes node component?
Show answer and explanation
Correct answer: C. kube-proxy
Kubernetes divides its components into control plane components and node components, and kube-proxy belongs to the node group. It runs on every node as a network proxy and maintains the network rules that implement Services, so traffic sent to a Service's virtual IP reaches one of its backing Pods. The other node components are the kubelet and the container runtime. Together they run and connect workloads on each machine, while the control plane makes cluster-wide decisions.
Why the other options are wrong
- A. kube-scheduler is a control plane component that assigns Pods to nodes; it does not run as a node component.
- B. kubectl is a command-line client used to talk to the API server, not a component that runs on nodes.
- D. etcd is the key-value store backing the control plane, not a node component.
Question 41
Which of these events will cause the kube-scheduler to assign a Pod to a node?
Show answer and explanation
Correct answer: D. When a new Pod is created and has no assigned node.
kube-scheduler watches for newly created Pods that have no node assigned, meaning their nodeName field is empty. For each one it filters out nodes that cannot run the Pod, scores the rest using factors such as resource requests, affinity rules, taints and tolerations, and binds the Pod to the best node. After binding, the kubelet on that node starts the Pod's containers. Placing unscheduled Pods is the event that drives the scheduler's work.
Why the other options are wrong
- A. When a container crashes, the kubelet restarts it in the same Pod based on its restart policy; the scheduler does not move it to a new node.
- B. Adding a node gives the scheduler more choices for future placements, but it does not move Pods that already have a node.
- C. kube-scheduler does not move running Pods when node CPU load rises; Pods are not rebalanced after they are bound.
Question 42
What helps an organization to deliver software more securely at a higher velocity?
Show answer and explanation
Correct answer: D. CI/CD Pipeline
A CI/CD pipeline automates the steps from a code change to production: building, testing, security scanning, packaging and deployment. Every change goes through the same repeatable checks, such as unit tests, vulnerability and dependency scans and policy checks, so problems are caught early and manual errors are reduced. Small, frequent, automated releases let an organization ship faster while keeping its security standards consistent, which is why CI/CD sits at the center of DevOps and DevSecOps practice.
Why the other options are wrong
- A. Kubernetes runs and scales containerized workloads, but it does not by itself build, test and secure releases.
- B. apt-get installs packages on Debian-based Linux systems and has nothing to do with organizational software delivery.
- C. Container images package applications for consistent deployment, but they are artifacts that a pipeline produces, not the delivery process.
Question 43
How to create a headless service?
Show answer and explanation
Correct answer: B. By specifying .spec.clusterIP: None
A headless Service is created by setting the clusterIP field in the Service spec to the literal value None. Kubernetes then allocates no cluster IP, kube-proxy does no load balancing or proxying for it, and the cluster DNS returns records for the individual backing Pods instead of one virtual IP. Clients can then discover and reach specific Pods directly, which is why StatefulSets use headless Services to give each replica a stable DNS name.
Why the other options are wrong
- A. The field is spelled clusterIP in lowercase camel case, and headless is not a valid value; only None makes a Service headless.
- C. 0.0.0.0 is not a valid cluster IP for a Service and does not tell Kubernetes to skip IP allocation.
- D. localhost is a hostname, not an accepted clusterIP value, and it does not produce a headless Service.
Question 44
Which is the correct kubectl command to display logs in real time?
Show answer and explanation
Correct answer: D. kubectl logs -f test-container-1
The -f flag, short for --follow, tells kubectl logs to keep the connection open and stream new log lines as the container writes them, much like tail -f. Running kubectl logs -f test-container-1 therefore prints the existing logs of that Pod and then continues showing output in real time until the command is interrupted. It is the standard way to watch an application live while debugging.
Why the other options are wrong
- A. The -p flag (--previous) prints logs from the previous terminated instance of a container, which helps after a crash but does not stream.
- B. The -c flag (--container) selects which container in a Pod to read logs from; it does not stream output.
- C. The -l flag (--selector) chooses Pods by label selector, so it filters which Pods are read rather than streaming logs in real time.
Question 45
What factors influence the Kubernetes scheduler when it places Pods on nodes?
Show answer and explanation
Correct answer: A. Pod memory requests, node taints, and Pod affinity.
The kube-scheduler first filters out nodes that cannot run a Pod and then scores the remaining ones. Resource requests matter because a node must have enough unreserved CPU and memory to fit the Pod's requests. Taints matter because a node repels any Pod that does not tolerate its taints. Affinity rules matter because node affinity and inter-Pod affinity or anti-affinity attract a Pod to, or keep it away from, certain nodes or other Pods. All three are standard inputs the scheduler weighs when choosing a node.
Why the other options are wrong
- B. Node labels can be matched through node selectors, but Pod labels alone do not place Pods and request labels are not a Kubernetes concept.
- C. Taints and priority do affect scheduling, but node level is not a scheduling factor in Kubernetes.
- D. The container command only defines what runs inside the container and plays no part in choosing a node.
Question 46
How do you deploy a workload to Kubernetes without additional tools?
Show answer and explanation
Correct answer: C. Create a manifest and apply it with kubectl.
The built-in way to deploy to Kubernetes is to describe the desired objects, such as a Deployment or Service, in a YAML or JSON manifest and send it to the API server with kubectl, usually with kubectl apply -f. kubectl is the standard command-line client for the Kubernetes API, so no extra packaging tools or custom scripts are needed. The control plane then stores the desired state and its controllers work to make the cluster match it.
Why the other options are wrong
- A. A Bash script on a worker node bypasses the Kubernetes API and declarative model, so it is not how workloads are deployed to the cluster.
- B. Helm is a separate package manager for Kubernetes, so using it means adding a tool beyond the base kubectl workflow.
- D. kubectl does not run Python scripts; it talks to the Kubernetes API using manifests and commands.
Question 47
What is the Kubernetes object used for running a recurring workload?
Show answer and explanation
Correct answer: D. CronJob
A CronJob creates Jobs on a repeating schedule written in standard cron format, such as running a backup every night at 2 a.m. or generating a report every hour. Each time the schedule fires, the CronJob controller creates a new Job, which in turn runs Pods until the task completes. Fields such as concurrencyPolicy and the job history limits control overlapping runs and how many finished Jobs are kept.
Why the other options are wrong
- A. A Job runs Pods until a task completes once; it does not repeat on a schedule by itself.
- B. Batch is the API group (batch/v1) that holds Job and CronJob, not a workload object itself.
- C. A DaemonSet keeps a long-running Pod on each eligible node and has no concept of a schedule.
Question 48
What are the advantages of adopting a GitOps approach for your deployments?
Show answer and explanation
Correct answer: B. Reduce failed deployments, configuration drift, and fragile release processes.
GitOps stores the desired state of a system declaratively in Git and uses agents that continuously reconcile the running system with it. Every change goes through version control and review, so deployments are consistent and easy to roll back, which reduces failed deployments. Continuous reconciliation detects and corrects differences between the cluster and Git, preventing configuration drift. Automated, repeatable delivery replaces manual, error-prone steps, reducing fragile release processes. These three benefits together describe what GitOps is designed to deliver.
Why the other options are wrong
- A. Lower operational costs may follow, but they are not a defining GitOps benefit; reducing configuration drift is the core gain this option misses.
- C. Learning Git is a prerequisite for working this way, not an advantage the approach delivers.
- D. Reputation is not a technical benefit of GitOps; the option leaves out the reduction of fragile release processes.
Question 49
What is the main role of the Kubernetes DNS within a cluster?
Show answer and explanation
Correct answer: D. Provides consistent DNS names for Pods and Services for workloads that need to communicate with each other.
Kubernetes creates DNS records for Services and Pods so that workloads can reach each other by consistent names instead of IP addresses that change as Pods come and go. The cluster DNS server, usually CoreDNS, watches the Kubernetes API for new Services and EndpointSlices, and the kubelet configures each container to use it for name resolution. A client Pod can then look up a name such as my-service.my-namespace.svc.cluster.local and reach the right backends. This built-in service discovery is the main purpose of DNS within a cluster.
Why the other options are wrong
- A. Cluster DNS exists to resolve names for workloads inside the cluster, not to act as a DNS server for virtual machines outside it.
- B. Hosting zones and records for domains that users own is a managed DNS service offered by cloud providers, not the role of cluster DNS.
- C. DNS resolves names to addresses and does not translate IPv6 traffic into IPv4; dual-stack Pods simply receive addresses from both families.
Question 50
What is a Kubernetes Service Endpoint?
Show answer and explanation
Correct answer: D. It is an object that gets IP addresses of individual Pods assigned to it.
When a Service has a selector, the control plane tracks which Pods match it and records their IP addresses and ports in endpoint objects (Endpoints and, in current clusters, EndpointSlices). These objects are updated automatically as Pods are created, deleted or become ready or unready. kube-proxy and other networking components read them to know where to send traffic for the Service. So a Service endpoint is an object holding the IP addresses of the individual Pods behind a Service.
Why the other options are wrong
- A. The cluster's API endpoint is the address of the kube-apiserver, which is a different thing from the endpoints of a Service.
- B. Endpoints are API objects that list Pod addresses, not a special Pod running in the kube-system namespace.
- C. Endpoint addresses are usually internal Pod IPs; reaching a Service from the Internet needs a LoadBalancer, NodePort or Ingress.
Question 51
Which of the following sentences is true about namespaces in Kubernetes?
Show answer and explanation
Correct answer: C. The default namespace exists when a new cluster is created.
A new Kubernetes cluster starts with several namespaces, including default, kube-system, kube-public and kube-node-lease. The default namespace is where namespaced objects go when no namespace is specified, so it lets you use a cluster without creating any namespaces first. Namespaces provide a scope for names and a way to divide cluster resources between users or teams, and names only have to be unique within a namespace.
Why the other options are wrong
- A. Namespaces cannot be nested; every namespace is a flat, cluster-scoped object.
- B. Names must be unique per kind within a namespace, so two resources of the same kind and name cannot coexist there.
- D. Many objects are cluster-scoped, including Nodes, PersistentVolumes, StorageClasses, ClusterRoles and Namespaces themselves.
Question 52
What is a key feature of a container network?
Show answer and explanation
Correct answer: B. Allowing containers running on separate hosts to communicate.
A single host can connect its own containers with a simple local bridge, so the defining job of a container network is connecting containers that run on different hosts. In Kubernetes this is the job of the network plugin, which gives every Pod a cluster-wide IP address and makes it reachable from Pods on any other node, using techniques such as overlay encapsulation or routing through the underlying network. Without this cross-host connectivity, workloads spread across a cluster could not work together as one application.
Why the other options are wrong
- A. Proxying REST requests across containers is the job of a proxy, gateway or service mesh, not the main feature of a container network.
- C. Containers on one host can already communicate through a local bridge or shared network namespace; spanning hosts is what a container network adds.
- D. Caching remote disk access is a storage concern and has nothing to do with connecting containers over a network.
Question 53
Kubernetes ___ allows you to automatically manage the number of nodes in your cluster to meet demand.
Show answer and explanation
Correct answer: B. Cluster Autoscaler
The Cluster Autoscaler automatically adjusts the number of nodes in a Kubernetes cluster. When Pods stay pending because no existing node has enough free resources, it asks the cloud provider or infrastructure to add nodes, and when nodes remain underutilized and their Pods can be placed elsewhere, it removes them. This keeps capacity in line with demand and avoids paying for idle machines. It is maintained by the Kubernetes autoscaling SIG.
Why the other options are wrong
- A. Node autoscaling is a general concept, but the Kubernetes component named for adjusting node count is the Cluster Autoscaler.
- C. The Horizontal Pod Autoscaler changes the number of Pod replicas in a workload based on metrics; it does not add or remove nodes.
- D. The Vertical Pod Autoscaler adjusts the CPU and memory requests of Pods; it does not change the number of nodes.
Question 54
What is the goal of load balancing?
Show answer and explanation
Correct answer: D. Automatically distribute requests across instances of an application.
Load balancing spreads incoming requests across several instances of the same application so that no single instance is overloaded. This improves throughput and response times, and because unhealthy instances can be taken out of rotation, it also improves availability. In Kubernetes, a Service balances traffic across its ready Pod endpoints, and Services of type LoadBalancer or Ingress controllers do the same for traffic entering from outside the cluster. Whatever the layer, the goal is the automatic distribution of requests across instances.
Why the other options are wrong
- A. Measuring request performance is monitoring; a load balancer may expose such data, but measurement is not its goal.
- B. Splitting requests between different versions is a traffic-shifting technique used for canary releases, not the basic goal of load balancing.
- C. Placing application instances across the cluster is scheduling, handled by the kube-scheduler, not load balancing.
Question 55
Which of these is a valid container restart policy?
Show answer and explanation
Correct answer: D. On failure
Kubernetes defines three restart policy values for the containers in a Pod: Always, OnFailure and Never. With OnFailure, the kubelet restarts a container only when it exits with a non-zero code, and leaves it stopped after a successful exit. This makes it a common choice for Jobs, where a task should be retried if it fails but not rerun once it completes. Restarts use an exponential back-off delay. Docker offers a similar on-failure restart policy.
Why the other options are wrong
- A. On login is not a container restart policy; containers are not tied to user logins.
- B. On update is not a restart policy; changing a Pod template creates new Pods rather than triggering a restart policy.
- C. On start is not a restart policy; the supported Kubernetes values are Always, OnFailure and Never.
Question 56
What does the "nodeSelector" within a PodSpec use to place Pods on the target nodes?
Show answer and explanation
Correct answer: D. Labels
nodeSelector is a map of key-value pairs in the PodSpec, and the scheduler only places the Pod on nodes whose labels include every one of those pairs. For example, a Pod with nodeSelector disktype: ssd can only land on nodes labeled disktype=ssd. Administrators add labels to nodes with kubectl label, and Kubernetes also sets well-known node labels such as kubernetes.io/hostname and kubernetes.io/os automatically. It is the simplest form of node selection constraint, with node affinity offering more expressive rules.
Why the other options are wrong
- A. Annotations hold non-identifying metadata for tools and are not used by the scheduler to select nodes.
- B. IP addresses are not a matching criterion for nodeSelector, which only compares key-value pairs against node labels.
- C. nodeSelector does not match hostnames directly; a hostname can only be targeted through the kubernetes.io/hostname node label.
Question 57
Which of the following is a definition of Hybrid Cloud?
Show answer and explanation
Correct answer: C. A cloud native architecture that uses a combination of services running in different public and private clouds, including on-premises data centers.
Hybrid cloud combines different kinds of environments, such as public cloud services, private clouds and on-premises data centers, and runs them together as one architecture. Workloads and data can move between them or be placed wherever cost, compliance, latency or capacity needs are best met. Cloud native tools like Kubernetes help by giving a consistent platform across these environments. What makes it hybrid is the mix of public and private infrastructure, which may come from different providers.
Why the other options are wrong
- A. Hybrid cloud is not limited to one cloud provider; it usually joins a provider's public cloud with infrastructure the organization runs itself or with other providers.
- B. Using only public clouds without private or on-premises infrastructure is a public or multi-cloud setup, and availability zones have nothing to do with the definition.
- D. Hybrid cloud does not exclude serverless functions; serverless services can be part of a hybrid architecture.
Question 58
Which of the following are tasks performed by a container orchestration tool?
Show answer and explanation
Correct answer: A. Schedule, scale, and manage the health of containers.
A container orchestrator automates running containers across a group of machines. Its core jobs are scheduling, which places workloads on nodes with enough resources, scaling, which changes the number of running replicas to match demand, and health management, which restarts failed containers, replaces unhealthy instances and keeps the actual state matching the desired state. Kubernetes does all three through its scheduler, its controllers such as Deployments and the Horizontal Pod Autoscaler, and liveness and readiness probes run by the kubelet.
Why the other options are wrong
- B. Building container images is done by build tools and CI pipelines, not by the orchestrator.
- C. Debugging application code is a developer activity; an orchestrator offers some troubleshooting access but does not debug applications as a core task.
- D. Storing images is the job of a container registry; the orchestrator pulls images from it but does not store them.
Question 59
What is the difference between a Deployment and a ReplicaSet?
Show answer and explanation
Correct answer: D. A Deployment is a higher-level concept that manages ReplicaSets.
A ReplicaSet has one job: keep a stable set of replica Pods running at any time. A Deployment is a higher-level object that owns and manages ReplicaSets and provides declarative updates to Pods. When the Pod template changes, the Deployment creates a new ReplicaSet and gradually shifts replicas to it according to its strategy, keeps old ReplicaSets for rollback, and supports pausing and resuming rollouts. For this reason the Kubernetes docs recommend using Deployments rather than managing ReplicaSets directly.
Why the other options are wrong
- A. A Deployment controls the replica count through spec.replicas and passes it to the ReplicaSet it manages.
- B. Guaranteeing a stable set of running replica Pods is exactly what a ReplicaSet is for.
- C. A Deployment adds rollout, rollback and revision management on top of ReplicaSets; it is not just a ReplicaSet with annotations.
Question 60
Which of the following options is true about considerations for large Kubernetes clusters?
Show answer and explanation
Correct answer: C. Kubernetes supports up to 5000 nodes and recommends no more than 110 pods per node.
The Kubernetes documentation on large clusters states that a cluster is designed to support no more than 5,000 nodes, no more than 110 Pods per node, no more than 150,000 total Pods and no more than 300,000 total containers. These figures reflect the limits within which the project tests performance and scalability, and staying within them keeps the control plane, the scheduler and each kubelet responsive as the cluster grows.
Why the other options are wrong
- A. Kubernetes supports up to 5,000 nodes, not 1,000, and the per-node guideline is 110 Pods, not 1,000 containers.
- B. The 5,000 node figure is right, but the per-node guideline is no more than 110 Pods, not 500.
- D. Fifty nodes is far below the supported 5,000, and the per-node guideline counts Pods (110), not 1,000 containers.
Question 61
Which of the following is a responsibility of the governance board of an open source project?
Show answer and explanation
Correct answer: C. Outline the project's "terms of engagement".
A governance board sets the rules for how an open source project runs, its terms of engagement. That covers how decisions are made and disputes settled, how contributors gain roles such as maintainer, how the community is expected to behave, and how leaders are chosen or replaced. With those rules written down and public, anyone can see how to take part and how authority is shared, which builds trust and keeps the project healthy as it grows. Day-to-day engineering work and promotional work happen inside that framework rather than being the board's own job.
Why the other options are wrong
- A. Marketing and outreach are usually handled by a foundation, a marketing group or volunteers, not set as a core duty of the governance board.
- B. Reviewing and merging pull requests is daily technical work done by maintainers and reviewers, not the governance board.
- D. The license is normally picked when a project is created or joins a foundation, which often has its own licensing policy; it is not a routine board task.
Question 62
Which of the following is a lightweight tool that manages traffic flows between services, enforces access policies, and aggregates telemetry data, all without requiring changes to application code?
Show answer and explanation
Correct answer: B. Linkerd
Linkerd is a lightweight service mesh and a graduated CNCF project. It adds an ultralight proxy as a sidecar next to each application instance, and these proxies transparently handle service-to-service traffic. That gives the mesh automatic mutual TLS, authorization policies, retries, timeouts and load balancing, along with golden metrics such as success rate, request rate and latency for every service. Because all of this happens in the proxy layer, applications get traffic management, policy enforcement and telemetry without changes to their code.
Why the other options are wrong
- A. NetworkPolicy only allows or denies traffic at the IP and port level and neither manages traffic flows nor collects telemetry.
- C. kube-proxy implements Service virtual IPs on each node but provides no access policies or telemetry aggregation.
- D. Nginx is a web server, reverse proxy and ingress controller, but on its own it is not a mesh that manages traffic between all services.
Question 63
How is application data maintained in containers?
Show answer and explanation
Correct answer: D. Store data into volumes.
Files written to a container's own filesystem are ephemeral: they are lost when the container crashes and is restarted, and they cannot easily be shared with other containers. Kubernetes solves this with volumes, which are mounted into containers at specified paths. Ephemeral volumes such as emptyDir live as long as the Pod, while persistent volumes, requested through a PersistentVolumeClaim, keep data independently of any Pod. Storing application data in volumes is therefore how data is maintained across container restarts and shared within a Pod.
Why the other options are wrong
- A. A data folder inside the container filesystem is still ephemeral and is lost when the container restarts unless a volume backs it.
- B. Separate folders in the container filesystem do not change its ephemeral nature; only a mounted volume preserves the data.
- C. Sidecar containers are helper processes that run alongside the main container; they do not by themselves persist application data.
Question 64
In a serverless computing architecture:
Show answer and explanation
Correct answer: A. Users of the cloud provider are charged based on the number of requests to a function.
In a serverless model the cloud provider manages the servers and scales functions automatically, and users pay for what they use. Billing is typically based on the number of requests or invocations and the compute time those invocations consume, rather than on servers reserved in advance. When no requests arrive, functions can scale down to zero and there is little or no charge. This pay-per-use pricing is one of the defining characteristics of serverless computing in CNCF descriptions.
Why the other options are wrong
- B. Serverless and containers work together; many platforms, including Knative on Kubernetes, run functions as containers.
- C. Reserving capacity from an estimate is the traditional provisioning model that serverless removes; capacity scales automatically with demand.
- D. Serverless platforms scale idle workloads down, often to zero, instead of keeping containers running in the background.
Question 65
Which of the following best describes horizontally scaling an application deployment?
Show answer and explanation
Correct answer: C. The act of adding/removing application instances of the same application to meet demand.
Horizontally scaling an application means changing the number of running instances of that same application to match demand. In Kubernetes this means increasing or decreasing the replica count of a Deployment or StatefulSet, either manually with kubectl scale or automatically with a HorizontalPodAutoscaler, so the load is spread across more or fewer identical Pods. It differs from vertical scaling, which gives existing instances more or less CPU and memory, and from cluster scaling, which changes the number of nodes.
Why the other options are wrong
- A. Adding or removing nodes is cluster or infrastructure scaling, handled by tools such as the Cluster Autoscaler, not scaling of an application deployment.
- B. Adding or removing different applications changes what is deployed; it does not scale any single application.
- D. Giving existing instances more or less CPU and memory is vertical scaling, not horizontal scaling.
Question 66
What is a Dockerfile?
Show answer and explanation
Correct answer: C. A text file that contains all the commands a user could call on the command line to assemble an image.
A Dockerfile is a plain text document that holds, in order, all the commands a user could call on the command line to assemble an image. The builder reads instructions such as FROM, RUN, COPY, ENV and ENTRYPOINT and executes them step by step, with most filesystem-changing instructions producing a new image layer. Keeping the build steps in a versioned text file makes image builds repeatable, reviewable and easy to automate in CI pipelines.
Why the other options are wrong
- A. A Dockerfile is not a bash script; it uses its own instruction syntax that the image builder interprets, although RUN steps may invoke a shell.
- B. The target registry is chosen by the image tag and the push command, not defined in a Dockerfile.
- D. A writable layer created by a running container is container state on the host, not a Dockerfile, which is a build recipe.
Question 67
To visualize data from Prometheus you can use the expression browser or console templates. What is the other data visualization tool commonly used together with Prometheus?
Show answer and explanation
Correct answer: A. Grafana
Grafana is the dashboarding tool most commonly used with Prometheus, and the Prometheus documentation describes it alongside the built-in expression browser and console templates. Grafana includes a Prometheus data source, so dashboards can run PromQL queries directly against a Prometheus server and render the results as graphs, tables and other panels. Teams use it to build shared, reusable dashboards for metrics collected by Prometheus, which the expression browser is not designed to provide.
Why the other options are wrong
- B. Graphite is a separate metrics storage and graphing system, not the visualization tool typically paired with Prometheus.
- C. Nirvana is not a data visualization tool used with Prometheus.
- D. GraphQL is a query language for APIs, not a tool for visualizing Prometheus metrics.
Question 68
What is the name of the lightweight Kubernetes distribution built for IoT and edge computing?
Show answer and explanation
Correct answer: B. k3s
k3s is a lightweight, fully conformant Kubernetes distribution designed for IoT, edge computing and other resource-constrained environments. It is packaged as a single small binary, trims optional components, and uses a lightweight datastore by default, which greatly reduces memory and disk requirements while keeping the standard Kubernetes API. Its simplicity makes it easy to install on small devices such as ARM boards. k3s was created by Rancher and is a CNCF project.
Why the other options are wrong
- A. OpenShift is Red Hat's full enterprise Kubernetes platform with many added services; it is not a lightweight edge distribution.
- C. RKE (Rancher Kubernetes Engine) is a Rancher installer for full Kubernetes clusters, not the lightweight distribution built for IoT and edge.
- D. k1s is not the name of a recognized lightweight Kubernetes distribution; the established IoT and edge distribution is k3s.
Question 69
What is CloudEvents?
Show answer and explanation
Correct answer: C. It is a specification for describing event data in common formats to provide interoperability across services, platforms and systems
CloudEvents is a CNCF specification for describing event data in a common way so that events can be produced, routed and consumed consistently across services, platforms and systems. It defines a standard set of attributes, such as id, type and the event origin, plus bindings for protocols like HTTP and formats like JSON. Because every producer describes events the same way, consumers and middleware can process them without custom adapters for each publisher, which is the interoperability goal the project was created for.
Why the other options are wrong
- A. CloudEvents is not about Kubernetes network traffic management; it standardizes how event data itself is described.
- B. CloudEvents is not limited to cloud providers; it targets interoperability across any services, platforms and systems that exchange events.
- D. CloudEvents has nothing to do with iCloud, iOS or iMac, and it is a CNCF specification rather than a Kubernetes one.
Question 70
In which framework do the developers no longer have to deal with capacity, deployments, scaling and fault tolerance, and OS?
Show answer and explanation
Correct answer: D. Serverless
Serverless computing is a model in which the platform provider handles the underlying infrastructure on the developer's behalf. Developers supply code, often as functions triggered by events, and the platform provisions capacity, deploys the code, scales it automatically (including down to zero), handles fault tolerance, and maintains the servers and operating system. Users are typically billed only for actual usage. This lets teams focus on business logic instead of managing servers or clusters.
Why the other options are wrong
- A. Docker Swarm is a container orchestrator; teams still define services, size the cluster and manage the nodes and their operating systems.
- B. Kubernetes automates deployment and scaling, but users still manage cluster capacity, node operating systems and workload configuration.
- C. Apache Mesos is a cluster resource manager; operators still run the machines and frameworks and plan capacity themselves.
Question 71
Which cloud native tool keeps Kubernetes clusters in sync with sources of configuration (like Git repositories), and automates updates to configuration when there is new code to deploy?
Show answer and explanation
Correct answer: A. Flux and ArgoCD
Flux and Argo CD are both CNCF graduated GitOps projects that keep Kubernetes clusters in sync with configuration stored in Git repositories and similar sources. Each runs controllers inside the cluster that continuously compare the live state with the declared state and reconcile any difference. When new commits land, they pull the change and apply it automatically, and Flux can also automate image updates by writing new image tags back to Git. This continuous, pull-based reconciliation is exactly the behavior the stem describes.
Why the other options are wrong
- B. The GitOps Toolkit is the set of composable controllers and APIs that Flux is built from, rather than the end-user tools the stem describes.
- C. Linkerd and Istio are service meshes that manage service-to-service traffic, not tools that sync clusters with Git.
- D. Helm and Kustomize package and customize manifests; they do not watch Git and continuously reconcile a cluster on their own.
Question 72
Which of the following is a correct definition of a Helm chart?
Show answer and explanation
Correct answer: D. A Helm chart is similar to a package and contains all the resource definitions to run an application on Kubernetes.
Helm is the package manager for Kubernetes, and a chart is its package format. A chart is a collection of files, including Chart.yaml metadata, a values.yaml file of defaults and a templates directory, that together describe all the resource definitions needed to run an application, tool or service on Kubernetes. Helm renders the templates with the chosen values and installs the result as a release that can be upgraded or rolled back, much like apt or yum packages on Linux.
Why the other options are wrong
- A. This describes only the optional packaged archive, not what a chart is, and wrongly implies the archive is applied to the cluster directly rather than rendered by Helm.
- B. Chart metadata, values and templates are written in YAML, not as a collection of JSON files.
- C. Chart templates contain Go template directives that Helm must render first, so a chart is not applied with kubectl as is.
Question 73
What is the role of a NetworkPolicy in Kubernetes?
Show answer and explanation
Correct answer: B. The ability to classify the Pods as isolated and non-isolated.
A NetworkPolicy controls traffic at the IP and port level (layers 3 and 4) for the Pods it selects. Pods are non-isolated by default and accept traffic from any source. Once a NetworkPolicy selects a Pod for ingress or egress, that Pod becomes isolated in that direction, and only the connections allowed by the policy rules are permitted. NetworkPolicy therefore sorts Pods into isolated and non-isolated groups and defines what traffic isolated Pods may send and receive. A network plugin that supports NetworkPolicy must enforce these rules.
Why the other options are wrong
- A. NetworkPolicy allows or denies connections; it does not encrypt or hide traffic, which is done by mechanisms such as mTLS in a service mesh.
- C. The Kubernetes docs note that traffic to and from the Pod's own node is always allowed, and NetworkPolicy does not target loopback traffic.
- D. The NetworkPolicy API has no logging of security events; any logging or auditing comes from the network plugin or other tools.
Question 74
Which Prometheus metric represents a single value that can go up and down?
Show answer and explanation
Correct answer: B. Gauge
In Prometheus, a gauge is a metric that holds a single number that can go up or down at any time. It suits values that are measured at a point in time, such as current memory use, temperature, queue length or the number of active connections. That sets it apart from a counter, which only rises or resets to zero, and from histograms and summaries, which describe the distribution of many observations rather than one current value.
Why the other options are wrong
- A. A counter is a total that only increases or resets to zero on restart, so it cannot go down like the value described.
- C. A summary samples observations and reports a count, a sum and configurable quantiles, not one value that rises and falls.
- D. A histogram counts observations in configurable buckets and also exposes a sum and count, rather than one fluctuating value.
Question 75
What Kubernetes control plane component exposes the programmatic interface used to create, manage and interact with the Kubernetes objects?
Show answer and explanation
Correct answer: C. kube-apiserver
The kube-apiserver is the control plane component that exposes the Kubernetes API, the front end of the control plane. Every create, read, update, delete and watch request on Kubernetes objects, whether it comes from kubectl, a controller, the scheduler, a kubelet or an external tool, goes through it. The API server authenticates and authorizes each request, runs admission control and validation, and then persists the result in etcd. It is designed to scale horizontally, so several instances can share the load.
Why the other options are wrong
- A. The kube-controller-manager runs controllers that reconcile state through the API, but it does not expose the API.
- B. kube-proxy is a node component that maintains network rules for Services and does not serve the Kubernetes API.
- D. etcd stores cluster data behind the API server; clients do not manage Kubernetes objects by talking to etcd directly.
Question 76
Imagine you're releasing open-source software for the first time. Which of the following is a valid semantic version?
Show answer and explanation
Correct answer: C. 0.1.0-rc
Semantic Versioning requires a version number of the form MAJOR.MINOR.PATCH, with each part a non-negative integer, optionally followed by a hyphen and a pre-release identifier. The value 0.1.0-rc has all three numeric parts and a valid pre-release label, so it is a valid semantic version. A major version of zero also signals initial development, where the public API should not yet be considered stable, which suits a first release of new software.
Why the other options are wrong
- A. 1.0 has only two numeric parts; semantic versioning requires major, minor and patch, as in 1.0.0.
- B. 2021-10-11 is a calendar date, not a MAJOR.MINOR.PATCH version number.
- D. v1beta1 is a Kubernetes API version label, not a semantic version with three dot-separated numbers.
Question 77
Which of the following is a challenge derived from running cloud native applications?
Show answer and explanation
Correct answer: B. The cost optimization is complex to maintain across different public cloud environments.
Cloud native applications are often spread across several public clouds and many dynamic, autoscaling resources. Each provider prices compute, storage and network traffic differently, and resources are created and removed continuously, so it is hard to see where money goes and to keep spending optimized across environments. Maintaining cost optimization across different public clouds is therefore a real challenge that comes with running cloud native applications, and it is why practices such as FinOps have developed.
Why the other options are wrong
- A. Maintaining a company data center is a cost of traditional on-premises infrastructure, not a challenge that comes from running cloud native applications.
- C. Public image repositories offer a very large choice of container images, so a lack of images is not a challenge.
- D. Major public clouds offer a broad range of services, so a lack of services is not the challenge.
Question 78
What does vertical scaling an application deployment describe best?
Show answer and explanation
Correct answer: C. The act of adding/removing resources to applications to meet demand.
Vertical scaling means changing the resources given to the existing instances of an application, such as raising or lowering their CPU and memory, instead of changing how many instances run. In Kubernetes this means adjusting container resource requests and limits, and the Vertical Pod Autoscaler can do it automatically based on observed usage. Horizontal scaling works the other way, adding or removing replicas, which is what the Horizontal Pod Autoscaler does.
Why the other options are wrong
- A. Adding or removing whole different applications is not a scaling method; scaling changes capacity for an existing application.
- B. Adding or removing nodes is cluster scaling, done by tools such as the Cluster Autoscaler, not vertical scaling of an application.
- D. Changing the number of instances of the same application is horizontal scaling, the opposite approach.
Question 79
Which of the following observability data streams would be most useful when desiring to plot resource consumption and predicted future resource exhaustion?
Show answer and explanation
Correct answer: D. Metrics
Metrics are numeric measurements collected at regular intervals and stored as time series, such as CPU usage, memory consumption or free disk space. Because they are already numbers with timestamps, they can be graphed directly, aggregated and analyzed for trends. Tools like Prometheus can even extrapolate a series, for example with its predict_linear function, to estimate when a resource will run out. This makes metrics the most useful signal for plotting resource consumption and forecasting exhaustion.
Why the other options are wrong
- A. stdout is a container's text output stream; it is not a structured numeric series suited to plotting resource consumption.
- B. Traces follow individual requests across services to show latency and call paths, not resource consumption over time.
- C. Logs are event records in text form; extracting resource trends from them is indirect and inefficient compared with metrics.
Question 80
In a cloud native world, what does the IaC abbreviation stand for?
Show answer and explanation
Correct answer: B. Infrastructure as Code
IaC stands for Infrastructure as Code. It is the practice of describing infrastructure such as networks, virtual machines, clusters and their configuration in machine-readable definition files instead of setting it up by hand. Those files are stored in version control, reviewed like application code, and applied by automation tools, so environments can be recreated consistently and changes are traceable. Infrastructure as Code is a foundation of GitOps and other cloud native operating practices.
Why the other options are wrong
- A. Infrastructure and Code is not the expansion; the term means infrastructure is defined as code.
- C. Infrastructure above Code is not a recognized term in cloud native computing.
- D. Infrastructure across Code is not a recognized term; the abbreviation stands for Infrastructure as Code.
Question 81
What fields must exist in any Kubernetes object (e.g. YAML) file?
Show answer and explanation
Correct answer: A. apiVersion, kind, metadata
Every Kubernetes object manifest must include apiVersion, kind and metadata. The apiVersion field states which version of the Kubernetes API is used to create the object, kind states the type of object, such as Pod or Deployment, and metadata holds identifying data such as the name, plus an optional namespace, labels and annotations. Most objects also carry a spec describing the desired state, but its contents differ by kind, while the other three fields appear in every object.
Why the other options are wrong
- B. namespace is not a top-level field; it is an optional field inside metadata, and data appears only in some kinds such as ConfigMaps and Secrets.
- C. apiVersion and metadata are required, but kind is missing, and namespace is an optional field nested under metadata.
- D. kind and metadata are required, but apiVersion is missing, and data exists only in certain kinds such as ConfigMaps and Secrets.
Question 82
What is a best practice to minimize the container image size?
Show answer and explanation
Correct answer: B. Use multi-stage builds.
Multi-stage builds use several FROM instructions in one Dockerfile. Early stages contain the compilers, package managers and build dependencies needed to produce the application, and the final stage starts from a small base image and copies in only the finished artifacts with COPY --from. Everything left behind in the build stages is excluded from the final image, which makes it smaller, faster to pull and less exposed to vulnerabilities, without needing separate build scripts or Dockerfiles.
Why the other options are wrong
- A. A Dockerfile is simply the build recipe; having one does not by itself make an image smaller.
- C. Tags are only names that point to images; giving an image different tags does not change its contents or size.
- D. A build.sh wrapper script only automates running commands and does nothing by itself to reduce the size of the resulting image.
Question 83
Which of the following is the correct command to run an nginx deployment with 2 replicas?
Show answer and explanation
Correct answer: B. kubectl create deploy nginx --image=nginx --replicas=2
kubectl create deployment, which accepts the short alias deploy, creates a Deployment with the given name. The --image flag sets the container image and the --replicas flag sets how many Pods the Deployment should run. The command kubectl create deploy nginx --image=nginx --replicas=2 therefore creates a Deployment called nginx that keeps two nginx Pods running, which can later be changed with kubectl scale.
Why the other options are wrong
- A. kubectl run creates a single Pod, not a Deployment, and does not accept a deploy argument or a --replicas flag.
- C. kubectl create expects the resource type before the name, and nginx is not a resource type it can create.
- D. kubectl create deployment has no --count flag; the replica count is set with --replicas.
That was 83 of 333.
The full Linux Foundation KCNA pack has all 333 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 166 free as one PDF by email. Get the Half Pack →