KCNA: Kubernetes and Cloud Native Associate Practice Exam

What the KCNA exam covers

• Kubernetes Fundamentals311 questions
• Container Orchestration198 questions
• Cloud Native Application Delivery118 questions
• Cloud Native Architecture85 questions

Free KCNA sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 712.

1. Question 1Kubernetes Fundamentals

   What is the smallest deployable unit in Kubernetes?

   • AA PodCorrect
   • BA Deployment
   • CA container
   • DA node
   ✓ Correct answer: A

   A Pod is the smallest deployable unit in Kubernetes, serving as the fundamental abstraction for managing containerized workloads. Even though a Pod can contain one or more containers, Kubernetes cannot manage individual containers directly-you must always work with Pods. The Pod encapsulates containers and defines shared networking, storage, and lifecycle management for those containers.

   Why the other options are wrong

   • BA Deployment is incorrect because Deployments are higher-level controllers that manage Pods and provide features like rolling updates and scaling; they are not the smallest unit.
   • CA container is incorrect because Kubernetes does not manage containers directly-containers are wrapped in Pods.
   • DA node is incorrect because nodes are cluster infrastructure components that run Pods, not deployable units.
2. Question 2Container Orchestration

   A namespace has no NetworkPolicy objects. What is the default pod-to-pod connectivity?

   • AAll ingress and egress traffic is allowed (default-allow) until a policy selects the podsCorrect
   • BOnly traffic between pods on the same worker node is allowed
   • COnly DNS traffic to CoreDNS is permitted by default
   • DAll pod-to-pod traffic is denied until a policy allows it
   ✓ Correct answer: A

   Kubernetes NetworkPolicy uses an additive, opt-in model. In a namespace with no NetworkPolicy objects, every Pod can freely communicate with every other Pod in any namespace and with external endpoints - both inbound and outbound. A NetworkPolicy only takes effect for Pods selected by its podSelector; once a policy selects a Pod, only traffic explicitly listed in that policy is allowed for the applicable direction, and all other traffic for that direction is implicitly denied.

   Why the other options are wrong

   • BKubernetes does not restrict traffic to the same node by default; the flat network is fully open.
   • CThere is no default DNS-only restriction; all traffic is permitted until a policy applies.
   • DDefault-deny only takes effect once a NetworkPolicy selects the pods, not by default.
3. Question 3Kubernetes Fundamentals

   You want a DaemonSet's pod to run only on GPU nodes rather than on every node. How do you restrict it?

   • ASet the replicas count to match the number of GPU nodes
   • BAdd a nodeSelector or node affinity for the GPU node labelCorrect
   • CConvert the DaemonSet object into a Deployment instead
   • DApply a NoExecute taint to each one of the GPU nodes
   ✓ Correct answer: B

   A DaemonSet normally targets all eligible nodes, but adding a nodeSelector or node affinity restricts its pods to the subset of nodes carrying the specified label, such as a GPU label. Only matching nodes then receive a DaemonSet pod.

   Why the other options are wrong

   • ADaemonSets have no replicas field; the count follows the matching nodes.
   • CA Deployment does not give the one-pod-per-node behavior a DaemonSet provides.
   • DA NoExecute taint would repel the agent from the GPU nodes, the opposite of the goal.
4. Question 4Kubernetes FundamentalsSelect all that apply

   Which TWO statements correctly distinguish liveness and readiness probes? (Choose TWO)

   • AA failing liveness probe makes the kubelet restart the containerCorrect
   • BA failing readiness probe removes the Pod from Service endpointsCorrect
   • CA failing readiness probe immediately restarts the container
   • DA failing liveness probe drains the node the Pod runs on
   • EBoth probes are required for every container in a Pod
   ✓ Correct answer: A, B

   A failing liveness probe tells the kubelet the container is unhealthy, so it is restarted per the restartPolicy. A failing readiness probe leaves the container running but marks it not ready, so the Service removes it from its endpoints and stops routing traffic until it recovers.

   Why the other options are wrong

   • CA readiness probe does not restart the container; it only affects whether the Pod receives traffic.
   • DA liveness failure restarts the container; it does not drain the node.
   • EProbes are optional; a container can run with none, one, or several probes configured.
5. Question 5Kubernetes FundamentalsSelect all that apply

   Which TWO changes to a Deployment add a new revision to its rollout history? (Choose TWO)

   • AIncreasing spec.replicas from three to five.
   • BUpdating the container image referenced in the pod template.Correct
   • CRunning kubectl scale to change the replica count.
   • DAdding a new environment variable to the pod template.Correct
   • ELowering revisionHistoryLimit from ten to five.
   ✓ Correct answer: B, D

   A new revision is recorded only when the pod template changes, such as updating the container image or adding an environment variable. Scaling the replica count, whether by editing spec.replicas or using kubectl scale, does not create a revision. Changing revisionHistoryLimit is a Deployment-level field and also does not add a revision.

   Why the other options are wrong

   • AChanging spec.replicas scales the ReplicaSet but does not alter the pod template, so no revision is created.
   • Ckubectl scale changes the replica count only and creates no new revision.
   • ErevisionHistoryLimit is a Deployment field outside the pod template, so editing it adds no revision.
6. Question 6Cloud Native ArchitectureSelect all that apply

   Select TWO characteristics that distinguish a cloud native application from a traditional enterprise application.

   • ADesigned to run on a single high-memory server to simplify operations
   • BComposed of small, loosely coupled services that can be independently deployedCorrect
   • CUses static, long-lived VMs provisioned manually by the operations team
   • DRecovers automatically from failures through self-healing mechanismsCorrect
   ✓ Correct answer: B, D

   Cloud native applications are architected as loosely coupled, independently deployable services (microservices) and are built with the assumption that infrastructure will fail. They rely on self-healing platforms like Kubernetes to restart failed containers, reschedule evicted pods, and maintain the desired state without manual intervention.

   Why the other options are wrong

   • ADesigning for a single high-memory server is a monolithic, scale-up approach that is the opposite of cloud native horizontal scaling.
   • CStatic, manually provisioned VMs represent a traditional infrastructure model; cloud native favors immutable, automated, and ephemeral infrastructure.
7. Question 7Kubernetes Fundamentals

   Which component on the control plane embeds several logically distinct controllers (such as the Node, Job, and EndpointSlice controllers) into a single binary?

   • Akube-controller-managerCorrect
   • Bkube-scheduler
   • Ccloud-controller-manager
   • Dkubelet
   ✓ Correct answer: A

   To reduce complexity, Kubernetes compiles multiple core controllers (Node, Job, ReplicaSet, EndpointSlice, ServiceAccount, and others) into one binary called the kube-controller-manager, which runs as a single process on the control plane. Each controller still operates as a logically separate reconcile loop.

   Why the other options are wrong

   • BThe kube-scheduler only assigns pending pods to nodes; it does not run reconcile controllers like the Node or Job controllers.
   • CThe cloud-controller-manager runs only the controllers that integrate with a specific cloud provider, not the generic core controllers.
   • DThe kubelet is a node agent that manages container lifecycles on its host; it is not a control-plane controller binary.
8. Question 8Container Orchestration

   Which object provides automatic horizontal scaling of a Deployment based on observed CPU utilization or custom metrics?

   • APodDisruptionBudget
   • BHorizontalPodAutoscalerCorrect
   • CResourceQuota
   • DLimitRange
   ✓ Correct answer: B

   A HorizontalPodAutoscaler (HPA) periodically reads metrics from the metrics server (or custom metrics adapters) and scales the target workload's replica count up or down to meet the target utilization. This scales out by adding pods rather than resizing them.

   Why the other options are wrong

   • AA PodDisruptionBudget limits voluntary disruptions; it does not scale replicas based on metrics.
   • CA ResourceQuota caps aggregate resource usage in a namespace; it does not autoscale.
   • DA LimitRange sets default and bounding resource values for containers; it does not change replica counts.
9. Question 9Kubernetes Fundamentals

   You run 'kubectl get pod api -o yaml' on a running Pod. Which section appears in the output that you would not have written in your original manifest?

   • AapiVersion
   • Bkind
   • Cspec
   • DstatusCorrect
   ✓ Correct answer: D

   You author apiVersion, kind, metadata, and spec, but you do not write status. The control plane populates the status section at runtime with observed state such as phase, conditions, and IP, and it is returned when you read the live object.

   Why the other options are wrong

   • A'apiVersion' is part of every manifest you author, so it is not new in the output.
   • B'kind' is something you specify in your manifest, not added by the system.
   • C'spec' is the desired state you author; the system reports observed state under 'status'.
10. Question 10Container Orchestration

    Which setting prevents a ServiceAccount's API token from being automatically mounted into a pod?

    • AautomountServiceAccountToken: falseCorrect
    • BrunAsNonRoot: true
    • CreadOnlyRootFilesystem: true
    • DenableServiceLinks: false
    ✓ Correct answer: A

    Setting automountServiceAccountToken to false, either on the ServiceAccount or in the pod spec, tells Kubernetes not to mount the API token into the pod. This is a least-privilege best practice for workloads that never call the Kubernetes API. It reduces the blast radius if a container is compromised.

    Why the other options are wrong

    • BrunAsNonRoot controls the user a container runs as, not token mounting.
    • CreadOnlyRootFilesystem makes the container filesystem read-only; it does not affect the token.
    • DenableServiceLinks controls injection of Service environment variables, not the API token.

Related Cloud Native resources

• KCNA study guideKey concepts
• Cloud Native practice examsAll Cloud Native
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• KCSA practice examRelated
• CKS practice examRelated
• CKA practice examRelated

KCNA practice exam FAQ