Free Linux Foundation KCNA practice questions

10 free Linux Foundation KCNA practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 300 questions. Work through them, then open each answer to check your reasoning.

Get all 300 questions (US$39) · Download these 10 as a PDF

Question 1

What native runtime is Open Container Initiative (OCI) compliant?

  1. runC
  2. runV
  3. kata-containers
  4. gvisor
Show answer and explanation

Correct answer: A. runC

runC is the reference implementation of the OCI runtime specification and is the native, officially OCI-compliant container runtime. It is the most widely used OCI runtime and serves as the standard low-level engine for container execution, invoked by higher-level runtimes such as containerd and CRI-O.

Why the other options are wrong

  • B. runV is a VM-based runtime, not the OCI reference one.
  • C. Kata Containers is a runtime that provides lightweight virtual machines but is not the native OCI reference implementation.
  • D. gVisor is a sandbox runtime but is not the native OCI runtime reference implementation.

Question 2

Which API object is the recommended way to run a scalable, stateless application on your cluster?

  1. ReplicaSet
  2. Deployment
  3. DaemonSet
  4. Pod
Show answer and explanation

Correct answer: B. Deployment

Deployment is the recommended API object for running scalable, stateless applications in Kubernetes. Deployments provide declarative updates for Pods and ReplicaSets, making it easy to manage replicas, perform rolling updates, and handle scaling. ReplicaSets are lower-level and typically managed by Deployments, DaemonSets are for node-level workloads, and Pods are the basic unit but not suitable for managing scalability directly.

Why the other options are wrong

  • A. ReplicaSet is a lower-level construct typically managed by Deployments rather than used directly.
  • C. DaemonSet ensures a Pod runs on every node, not suitable for general scalable stateless applications.
  • D. Pod is the basic unit but provides no scaling or management capabilities on its own.

Question 3

A CronJob is scheduled to run by a user every one hour.

What happens in the cluster when it's time for this CronJob to run?

  1. Kubelet watches API Server for CronJob objects. When it's time for a Job to run, it runs the Pod directly.
  2. Kube-scheduler watches API Server for CronJob objects, and this is why it's called kube-scheduler.
  3. CronJob controller component creates a Pod and waits until it finishes to run.
  4. CronJob controller component creates a Job. Then the Job controller creates a Pod and waits until it finishes to run.
Show answer and explanation

Correct answer: D. CronJob controller component creates a Job. Then the Job controller creates a Pod and waits until it finishes to run.

the Job controller creates a Pod and waits until it finishes to run. The CronJob controller component creates a Job object when the scheduled time arrives. The Job controller then creates a Pod based on that Job specification, and the Job controller waits until the Pod completes execution. This two-level hierarchy (CronJob → Job → Pod) is the proper architecture in Kubernetes. The kubelet does not watch for CronJobs, and the kube-scheduler is not primarily responsible for CronJob management.

Why the other options are wrong

  • A. Kubelet does not watch API Server for CronJob objects; the CronJob controller does.
  • B. Kube-scheduler is not responsible for watching CronJob objects; the CronJob controller is.
  • C. The CronJob controller creates a Job, not a Pod directly; the Job controller then creates the Pod.

Question 4

What is the purpose of the kubelet component within a Kubernetes cluster?

  1. A dashboard for Kubernetes Clusters that allows management and troubleshooting of applications.
  2. A network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept.
  3. A component that watches for newly created Pods with no assigned node, and selects a node for them to run on.
  4. An agent that runs on each node in the cluster. It makes sure that containers are running in a Pod.
Show answer and explanation

Correct answer: D. An agent that runs on each node in the cluster. It makes sure that containers are running in a Pod.

makes sure that containers are running in a Pod. Kubelet is an agent that runs on each node in a Kubernetes cluster and ensures that containers are running in Pods as expected. It communicates with the API server, manages the Pod lifecycle, mounts volumes, and reports node status. Option A describes a dashboard (Kubernetes Dashboard), Option B describes kube-proxy, and Option C describes kube-scheduler.

Why the other options are wrong

  • A. A dashboard is the Kubernetes Dashboard or similar management UI, not the kubelet.
  • B. kube-proxy is the network proxy component that implements the Service concept.
  • C. Kube-scheduler selects nodes for newly created Pods; the kubelet ensures containers run on the node.

Question 5

What is the default value for authorization-mode in Kubernetes API server?

  1. –authorization-mode=RBAC
  2. –authorization-mode=AlwaysAllow
  3. –authorization-mode=AlwaysDeny
  4. –authorization-mode=ABAC
Show answer and explanation

Correct answer: B. –authorization-mode=AlwaysAllow

The default authorization mode for the Kubernetes API server is AlwaysAllow, which permits all requests without any authorization checks. This is the permissive default, though it is typically overridden with more restrictive modes like RBAC in production environments. While RBAC is recommended for security, AlwaysAllow remains the actual default if not explicitly configured.

Why the other options are wrong

  • A. RBAC is a recommended mode but is not the default; it must be explicitly configured.
  • C. AlwaysDeny is overly restrictive and is never a default; it would block all requests.
  • D. ABAC (Attribute-Based Access Control) is an older authorization mode but is not the default.

Question 6

Let's assume that an organization needs to process large amounts of data in bursts, on a cloud-based Kubernetes cluster. For instance: each Monday morning, they need to run a batch of 1000 compute jobs of 1 hour each, and these jobs must be completed by Monday night.

What's going to be the most cost-effective method?

  1. Run a group of nodes with the exact required size to complete the batch on time, and use a combination of taints, tolerations, and nodeSelectors to reserve these nodes to the batch jobs.
  2. Leverage the Kubernetes Cluster Autoscaler to automatically start and stop nodes as they're needed.
  3. Commit to a specific level of spending to get discounted prices (with e.g. “reserved instances” or similar mechanisms).
  4. Use PriorityClasses so that the weekly batch job gets priority over other workloads running on the cluster, and can be completed on time.
Show answer and explanation

Correct answer: B. Leverage the Kubernetes Cluster Autoscaler to automatically start and stop nodes as they're needed.

automatically start and stop nodes as they're needed. The Kubernetes Cluster Autoscaler is the most cost-effective solution for burst workloads. It adds nodes when Pods cannot be scheduled and removes underutilized nodes, using resource requests to make those decisions, so you pay for the extra compute only while the Monday batch runs and the cluster shrinks again once the jobs complete.

Why the other options are wrong

  • A. Maintaining a fixed group of nodes 24/7 is wasteful when you only need them one day per week.
  • C. Reserved instances reduce per-unit cost but don't eliminate the cost of idle resources.
  • D. PriorityClasses ensure jobs complete on time but do not address cost optimization or resource scaling.

Question 7

What is a Kubernetes service with no cluster IP address called?

  1. Headless Service
  2. Nodeless Service
  3. IPLess Service
  4. Specless Service
Show answer and explanation

Correct answer: A. Headless Service

A Headless Service is a Kubernetes service that has no cluster IP address assigned to it. It is created by setting clusterIP: None in the service specification and is useful for stateful applications where you need direct Pod-to-Pod communication rather than load balancing through a single cluster IP. The other options are not standard Kubernetes terminology.

Why the other options are wrong

  • B. Nodeless Service is not a recognized Kubernetes service type.
  • C. IPLess Service is not the correct term; the proper term is Headless Service.
  • D. Specless Service is not a recognized Kubernetes service type or concept.

Question 8

What default level of protection is applied to the data in Secrets in the Kubernetes API?

  1. The values use AES Symmetric Encryption
  2. The values are stored in plain text
  3. The values are encoded with SHA256 hashes
  4. The values are base64 encoded
Show answer and explanation

Correct answer: D. The values are base64 encoded

By default, Kubernetes Secrets are stored with base64 encoding in the etcd backend. Base64 is an encoding scheme, not encryption, it is easily reversible and provides no cryptographic protection. This is why additional security measures like encryption at rest are recommended for production clusters.

Why the other options are wrong

  • A. AES symmetric encryption is not applied by default; it must be explicitly configured.
  • B. While base64 is not encryption, the data is technically encoded, not stored in plain text.
  • C. SHA256 hashing is not used for Secrets storage; hashing is one-way and inappropriate for retrievable secret values.

Question 9

What function does kube-proxy provide to a cluster?

  1. Implementing the Ingress resource type for application traffic.
  2. Forwarding data to the correct endpoints for Services.
  3. Managing data egress from the cluster nodes to the network.
  4. Managing access to the Kubernetes API.
Show answer and explanation

Correct answer: B. Forwarding data to the correct endpoints for Services.

Services. kube-proxy is a network proxy that runs on each node and is responsible for forwarding traffic to the correct endpoints behind Services. It implements network routing rules to enable Service discovery and load balancing across pod endpoints.

Why the other options are wrong

  • A. Ingress resources are managed by an Ingress controller, not kube-proxy.
  • C. kube-proxy is not responsible for managing egress traffic from nodes.
  • D. API server access is managed by the Kubernetes control plane and authentication mechanisms, not kube-proxy.

Question 10

How long should a stable API element in Kubernetes be supported (at minimum) after deprecation?

  1. 9 months
  2. 24 months
  3. 12 months
  4. 6 months
Show answer and explanation

Correct answer: C. 12 months

According to the Kubernetes deprecation policy, stable API elements must remain supported for a minimum of 12 months after deprecation is announced. This ensures users have adequate time to migrate to replacement APIs.

Why the other options are wrong

  • A. 9 months is shorter than the required minimum support period.
  • B. While 24 months provides extended support, 12 months is the stated minimum requirement.
  • D. 6 months is insufficient time for users to plan and execute migration strategies.

That was 10 of 300.

The full Linux Foundation KCNA pack has all 300 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack