KCNA Practice Questions — Free

Question 1 of 25

What is the difference between 'kubectl exec' and 'kubectl attach'?

• A.The two commands are functionally identical and can always be used interchangeably
• B.kubectl exec is only usable in combination with the --dry-run flag on a live cluster
• C.kubectl attach can only be used against Job-managed Pods, never Deployment-managed ones
• D.kubectl exec starts a new process inside a running container; kubectl attach connects to the existing main process's consoleCorrect

Question 2 of 25

By default, before any NetworkPolicy is applied, how do Pods in a cluster communicate?

• A.All Pods can communicate with all other Pods, with no restrictionCorrect
• B.Only Pods that happen to share the same Namespace are able to communicate
• C.No Pods are able to communicate with any other Pod whatsoever
• D.Only Pods that share an identical set of labels are able to communicate

Question 3 of 25

What is the Kubernetes API server's role in the cluster?

• A.It is a component that only handles direct Node-to-Node networking traffic
• B.It is a component used exclusively for handling user authentication
• C.It is the front end for the control plane, exposing the Kubernetes APICorrect
• D.It stores all of the cluster's data directly to disk, without relying on etcd

Question 4 of 25

In a Kubernetes resource request like 'cpu: 500m', what does the 'm' suffix represent?

• A.A measurement of milliseconds of delay added to the scheduling process
• B.Millicpu - 500m equals half of one CPU coreCorrect
• C.A measurement of megabytes allocated specifically to the CPU's own cache
• D.A measurement of megahertz describing the CPU's underlying clock speed

Question 5 of 25

What does 'kubectl auth can-i --list' show?

• A.A list of every RBAC Role defined cluster-wide
• B.A list of all Namespaces the cluster currently has
• C.A list of all actions the current user is permitted to performCorrect
• D.A list of every user who has ever accessed the cluster

Question 6 of 25

What is a headless Service (a Service with 'clusterIP: None')?

• A.A Service that has been created without any label selector defined at all
• B.A Service whose configuration prevents it from routing any traffic whatsoever
• C.A Service that returns the individual Pod IPs directly via DNS instead of a single virtual IPCorrect
• D.A Service type that Kubernetes deprecated and no longer supports in current versions

Question 7 of 25

What does setting 'immutable: true' on a ConfigMap or Secret do?

• A.Makes the object's data readable by Pods running in every Namespace in the cluster
• B.Prevents further updates to its data, protecting against accidental changes and improving API server performanceCorrect
• C.Prevents the object from ever being deleted, even by a cluster administrator with full access
• D.Encrypts the ConfigMap or Secret's data automatically using the cluster's default KMS provider

Question 8 of 25

Which kubectl command marks a Node as unschedulable ahead of maintenance, without evicting existing Pods?

• A.kubectl drain
• B.kubectl cordonCorrect
• C.kubectl delete node
• D.kubectl taint

Question 9 of 25

Besides CPU and memory totals, what else can a ResourceQuota limit in a Namespace?

• A.How many total days a given Namespace is permitted to continue existing
• B.Which specific container images are permitted to be used in that Namespace
• C.The count of objects, such as the number of Pods, Services, or PVCs allowedCorrect
• D.The maximum number of characters permitted in an object's name field

Question 10 of 25

What is the purpose of the 'imagePullSecrets' field on a Pod spec?

• A.Providing credentials needed to pull container images from a private registryCorrect
• B.Restricting which Namespace is permitted to pull a given container image
• C.Encrypting a container's image after it has already been pulled onto the Node
• D.Explicitly setting the image pull policy that should be applied to a container

Question 11 of 25

What does setting 'nodeName' directly in a Pod spec do?

• A.Assigns the Pod to that specific Node, bypassing the scheduler entirelyCorrect
• B.Renames the target Node itself to match the value given in the field
• C.Creates only a soft preference the scheduler is still free to disregard
• D.Simply adds a descriptive label to the named Node, with no scheduling effect

Question 12 of 25

What is the effect of a 'NoExecute' taint on a Node, unlike 'NoSchedule'?

• A.It evicts existing Pods that don't tolerate the taint, in addition to blocking new ones from schedulingCorrect
• B.It only blocks new Pods from scheduling, behaving identically to a NoSchedule taint
• C.It applies exclusively to Pods managed by a DaemonSet, ignoring all other Pods
• D.It permanently prevents the tainted Node from ever rejoining the cluster again

Question 13 of 25

What advantage does KEDA add over the standard Horizontal Pod Autoscaler using only CPU/memory metrics?

• A.It completely removes the need to run a Kubernetes cluster in the first place
• B.It is a mechanism that functions only when applied to StatefulSet workloads
• C.It can scale based on external event-driven metrics, such as queue length, and can scale a workload down to zeroCorrect
• D.It removes any need to define resource requests and limits on a container

Question 14 of 25

What does a Deployment's 'revisionHistoryLimit' control?

• A.The maximum number of times a given Pod is permitted to restart
• B.How many old ReplicaSets are retained to allow rollbackCorrect
• C.The maximum total number of Pods that are permitted to run at once
• D.The maximum amount of time a rollout is permitted to take before timing out

Question 15 of 25

In a manual canary pattern using plain Kubernetes objects, how is traffic split between the stable and canary versions?

• A.The scheduler decides how to route traffic based purely on each Node's relative age
• B.A special field named 'canary: true' is set directly on the Service object itself
• C.Two Deployments share a common label matched by one Service, so traffic distributes roughly by replica ratioCorrect
• D.It's only possible after the stable Deployment has been deleted from the cluster

Question 16 of 25

What does minReadySeconds on a Deployment or StatefulSet control?

• A.The minimum time a readiness probe itself is allowed to take
• B.The minimum time a Pod must exist before it can be deleted
• C.The minimum time the scheduler waits before placing a new Pod
• D.The minimum time a new Pod must be ready before it's considered available, affecting rollout progressCorrect

Question 17 of 25

What do SPIFFE and SPIRE provide in cloud native environments?

• A.A web-based dashboard for visualizing and managing Kubernetes RBAC role bindings
• B.A build system that compiles container images directly from source without a Dockerfile
• C.A standard and implementation for issuing cryptographic identities to workloads, enabling secure service-to-service authenticationCorrect
• D.A centralized log aggregation pipeline optimized for high-cardinality structured event data

Question 18 of 25

What is 'platform engineering' in a cloud native organization?

• A.Building internal platforms and golden paths that let product teams deploy and operate services with less frictionCorrect
• B.The engineering discipline focused on designing and manufacturing physical server hardware
• C.Writing native mobile applications that target both iOS and Android from one codebase
• D.Managing an organization's presence and posting schedule across social media platforms

Question 19 of 25

What is an API gateway's typical role in a microservices architecture?

• A.A build tool that compiles multiple microservices into a single deployable container image
• B.A single entry point that routes, and may handle cross-cutting concerns like auth, for client requests to backend servicesCorrect
• C.A Kubernetes-specific component responsible for scheduling Pods onto appropriate Nodes
• D.A database connection proxy used exclusively to pool queries between microservices and their datastores

Question 20 of 25

What is Helm, in the context of the CNCF landscape?

• A.A monitoring system used for collecting and visualizing cluster metrics
• B.A general-purpose service mesh used to manage service-to-service traffic
• C.A package manager for Kubernetes applicationsCorrect
• D.A container runtime responsible for actually creating and running containers

Question 21 of 25

In distributed tracing terminology, what is a 'span'?

• A.A single unit of work or operation within a trace, with a start and end timeCorrect
• B.A distinct Kubernetes object type used specifically to represent tracing data
• C.The total, end-to-end duration of an entire distributed trace from start to finish
• D.A metric type native to Prometheus used for recording distributed request counts

Question 22 of 25

What problem does Thanos solve for Prometheus deployments?

• A.Collecting structured log data instead of the numeric metrics Prometheus normally handles
• B.Rendering visual dashboards, a role otherwise handled separately by tools like Grafana
• C.Replacing PromQL entirely with a different, incompatible query language
• D.Long-term metric storage and a global query view across multiple Prometheus serversCorrect

Question 23 of 25

What are commonly referred to as the 'four golden signals' in monitoring, per Google's SRE practices?

• A.CPU, memory, disk, and network
• B.Latency, traffic, errors, and saturationCorrect
• C.Uptime, downtime, MTTR, and MTBF
• D.Logs, metrics, traces, and profiles

Question 24 of 25

What is a container image digest, and why pin deployments to one?

• A.A cryptographic signature that is only available when pulling from a private registry
• B.A brief summary of an image's documentation, automatically generated at build time
• C.A content-based sha256 identifier that uniquely and immutably references exact image contents, unlike tags which can be movedCorrect
• D.A number representing the image's total file size, measured in bytes, after compression

Question 25 of 25

Why are unit tests typically run in the earliest stages of a CI pipeline?

• A.They're the only category of test that any CI platform is technically capable of automating
• B.They're fast and cheap, so failures are caught before spending time on slower stages like integration tests or buildsCorrect
• C.Unit tests require direct production access that earlier pipeline stages don't have
• D.Later pipeline stages are architecturally incapable of reporting a test failure back to the developer