KCNA Practice Test 25 — 15 Questions

Question 1

Which TWO of the following are benefits of using a multi-cloud strategy? (Select TWO.)

Accepted Answer

Improved resilience and disaster recovery. A multi-cloud strategy distributes workloads across multiple cloud providers, so if one provider experiences an outage, applications can failover to another provider, improving overall resilience and disaster recovery. Option C is correct because using multiple cloud providers prevents dependency on a single vendor's proprietary services, avoiding vendor lock-in and giving you leverage for pricing and feature negotiations.

Answer

Reduced network latency

Answer

Simplified compliance

Answer

Increased vendor lock-in

Question 2

A user creates a Pod with a PersistentVolumeClaim (PVC) that requests 5Gi of storage. The cluster has two PersistentVolumes (PVs): PV1 (3Gi, AccessModes: ReadWriteOnce) and PV2 (10Gi, AccessModes: ReadOnlyMany). The PVC specifies storageClassName: "" and AccessModes: ReadWriteOnce. Which PV will bind to the PVC?

Accepted Answer

Neither PV will bind; the PVC will remain pending.. The PVC specifies storageClassName: "", which means it requires a PV with the same empty storage class (i.e., a statically provisioned PV without a StorageClass). PV1 has 3Gi capacity, which is less than the requested 5Gi, so it fails capacity matching. PV2 has ReadOnlyMany access mode, which does not match the PVC's ReadWriteOnce. Since neither PV satisfies all binding criteria (capacity, access modes, and storage class), the PVC remains Pending.

Answer

PV2 will bind because it has sufficient capacity.

Answer

PV1 will bind because it has matching AccessModes.

Answer

Both PVs will bind to satisfy the request.

Question 3

In a serverless architecture using Knative, what happens to a service that has not received traffic for an extended period?

Accepted Answer

It scales down to zero replicas and is reactivated on the next request. Knative scales to zero when idle, meaning no pods are running, thus no cost incurred.

Answer

It throws an error and must be redeployed

Answer

It continues running with one replica to reduce cold start latency

Answer

It is automatically deleted

Question 4

In Prometheus, what is the purpose of the Alertmanager component?

Accepted Answer

To manage, group, and route alerts to notification channels like email or Slack. Alertmanager is a separate component from the Prometheus server that receives alerts generated by Prometheus alerting rules. Its core purpose is to deduplicate, group, and route those alerts to the correct receiver—such as email, Slack, PagerDuty, or a webhook—based on routing rules and labels. It also handles silencing and inhibition to reduce noise during incidents, which is essential for effective on-call alerting.

Answer

To scrape metrics from targets

Answer

To provide a graphical dashboard for metrics

Answer

To store historical metrics data long-term

Question 5

Which THREE are typical characteristics of a cloud-native application?

Accepted Answer

Packaged as lightweight containers. Option C is correct because cloud-native applications are typically packaged as lightweight containers (e.g., Docker images orchestrated by Kubernetes), which enables portability, fast startup, and consistent deployment across environments. Option D is correct because cloud-native design favors horizontal scaling—adding more stateless instances behind a load balancer—rather than scaling up a single large server, allowing elasticity to match demand. Option E is correct because cloud-native applications are commonly built using a microservices architecture, where loosely coupled, independently deployable services communicate over lightweight protocols such as HTTP/REST or gRPC. Option A is not typical, since cloud-native apps aim for fast startup and rapid initialization to support scaling and resilience. Option B is not a characteristic but a risk; cloud-native patterns like circuit breakers, retries, and bulkheads are used specifically to prevent cascading failures.

Answer

Long startup times due to heavy initialization

Answer

Vulnerable to cascading failures

Question 6

Which THREE are key benefits of using a service mesh in a cloud-native architecture? (Choose 3)

Accepted Answer

Mutual TLS (mTLS) encryption between services.. Option B is correct because a service mesh like Istio or Linkerd transparently provisions mutual TLS (mTLS) between sidecar proxies, giving every service-to-service call strong identity-based encryption and authentication without application code changes. Option D is correct because service meshes emit uniform telemetry from their sidecars — distributed traces (e.g., via Envoy and Zipkin/Jaeger), request metrics (latency, error rates, throughput), and access logs — providing consistent observability across heterogeneous services. Option E is correct because the mesh's control plane configures traffic routing rules that enable canary releases, blue/green rollouts, retries, timeouts, and circuit breaking at the proxy layer. Option A is not a service mesh benefit; persistent storage for stateful workloads is handled by CSI drivers, PersistentVolumes, and StatefulSets, not by the mesh data plane. Option C is also not a mesh function; automatic horizontal pod scaling is performed by the Kubernetes Horizontal Pod Autoscaler (HPA) based on metrics, independent of the service mesh.

Answer

Persistent storage management for stateful applications.

Answer

Automatic horizontal scaling of pods.

Question 7

You have a microservices application where Service A needs to discover the IP of Service B. Both services run in the same Kubernetes cluster. Which approach is the most Kubernetes-native way for Service A to reach Service B?

Accepted Answer

Use the Kubernetes DNS service to resolve the Service name 'service-b'. Kubernetes has a built-in DNS service (typically CoreDNS) that automatically creates DNS records for Services. When Service A resolves the name 'service-b' (or 'service-b.<namespace>.svc.cluster.local'), the DNS returns the cluster IP of Service B's Service object, which then load-balances traffic to the healthy Pods. This is the most Kubernetes-native approach because it leverages the platform's own service discovery mechanism without external dependencies.

Answer

Use an external service registry like Consul or etcd

Answer

Hardcode the cluster IP of Service B in the configuration of Service A

Answer

Use environment variables injected by the Kubernetes API into each pod

Question 8

In Istio, which component is responsible for enforcing traffic policies and collecting telemetry data at the pod level?

Accepted Answer

Envoy proxy. Envoy proxy is the correct answer because in Istio, each pod is deployed with an Envoy sidecar proxy that intercepts all inbound and outbound traffic. This proxy enforces traffic policies (e.g., routing rules, fault injection, rate limiting) and collects telemetry data (e.g., metrics, logs, traces) at the pod level, sending it to the observability backends. The sidecar model ensures policy enforcement and telemetry collection happen without modifying the application code.

Answer

Mixer

Answer

Pilot

Answer

Citadel

Question 9

You have a Deployment that manages 3 replicas. You want to perform a rolling update with a maximum of 2 Pods unavailable during the update. Which field should you set in the Deployment spec?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. The `maxUnavailable` field in `spec.strategy.rollingUpdate.maxUnavailable` specifies the maximum number of Pods that can be unavailable during a rolling update. Setting it to 2 allows up to 2 Pods to be taken down at a time, ensuring that at least 1 Pod remains available (since the Deployment has 3 replicas). This field directly controls the availability tolerance during the update process.

Answer

spec.minReadySeconds

Answer

spec.strategy.rollingUpdate.maxSurge

Answer

spec.replicas

Question 10

Which of the following is NOT one of the three pillars of observability?

Accepted Answer

Alerts. The three pillars of observability are metrics, logs, and traces. Metrics are numeric measurements aggregated over time, logs are timestamped records of discrete events, and traces follow a request's path through distributed systems. Alerts are not a pillar; they are a downstream action or notification triggered by conditions derived from the pillars. Therefore, alerts is the correct answer as the item that is NOT a pillar.

Answer

Metrics

Answer

Logs

Answer

Traces

Question 11

Which component of the metrics-server provides resource metrics like CPU and memory usage?

Accepted Answer

metrics-server. The metrics-server is the component that collects and provides resource metrics such as CPU and memory usage in a Kubernetes cluster. It aggregates metrics from kubelets via the Summary API and exposes them through the Kubernetes API for use by Horizontal Pod Autoscaler and kubectl top. It is the canonical source for core resource metrics in KCNA-level Kubernetes.

Answer

kube-apiserver

Answer

kubelet

Answer

Prometheus

Question 12

Which TWO statements about Docker Compose and Kubernetes are correct?

Accepted Answer

Kubernetes provides built-in auto-scaling and self-healing capabilities. Option C is correct because Kubernetes natively provides controllers such as the Horizontal Pod Autoscaler (HPA) for auto-scaling and ReplicaSets/Deployments with liveness and readiness probes for self-healing, restarting or rescheduling failed pods automatically. Option D is correct because Docker Compose orchestrates containers on a single Docker host using a docker-compose.yml file and the docker compose CLI, without any native multi-node scheduling. Option A is wrong because Kubernetes is also widely used in development, testing, edge, and CI environments, not only production. Option B is wrong because although both use YAML, their manifest schemas differ: Compose uses keys like services, image, and ports, while Kubernetes uses apiVersion, kind, metadata, and spec. Option E is wrong because Docker Compose has no built-in multi-node clustering; Docker Swarm or Kubernetes are needed for that.

Answer

Kubernetes is only used in production environments

Answer

Docker Compose and Kubernetes use the same YAML manifest format

Answer

Docker Compose supports multi-node clustering out-of-the-box

Question 13

Which component in a service mesh is responsible for collecting telemetry data and enforcing traffic policies?

Accepted Answer

Sidecar proxy (data plane). In a service mesh, the sidecar proxy (part of the data plane) is the component that actually intercepts service-to-service traffic, enforces traffic policies (routing, retries, timeouts, mTLS), and emits telemetry (metrics, logs, traces) for each request. The control plane configures the sidecars but does not handle live traffic itself.

Answer

Control plane

Answer

Certificate authority

Answer

Service mesh ingress gateway

Question 14

Which deployment strategy updates pods incrementally, replacing old pods with new ones while ensuring availability?

Accepted Answer

Rolling update. The Rolling update strategy is the correct answer because it incrementally replaces old pods with new ones while maintaining application availability. In Kubernetes, a rolling update updates pods one by one (or in small batches), ensuring that a specified number of pods remain available throughout the process. This is achieved by gradually scaling down the old ReplicaSet and scaling up the new one, controlled by parameters like `maxSurge` and `maxUnavailable` in the Deployment spec.

Answer

Canary deployment

Answer

Blue-green deployment

Answer

Recreate

Question 15

What is the role of an API gateway in a microservices architecture?

Accepted Answer

To provide a single entry point for external clients to access multiple backend services. An API gateway acts as a single entry point for client requests, handling routing, authentication, rate limiting, and other cross-cutting concerns.

Answer

To schedule pods on nodes

Answer

To store application configuration

Answer

To monitor container resource usage