KCNA Practice Test 43 — 15 Questions

Question 1

What is the primary purpose of continuous integration (CI) in a cloud-native application delivery pipeline?

Accepted Answer

To automatically build and test code changes upon commit. CI automates building and testing code changes upon commit to catch integration issues early. Option A correctly describes this. Option B refers to infrastructure provisioning, which is typically managed by Infrastructure as Code (IaC) tools. Option C refers to managing container images and registries, which is part of container management. Option D describes continuous deployment (CD), which automatically deploys code to production after passing CI.

Answer

To manage infrastructure provisioning

Answer

To manage container images and registries

Answer

To automatically deploy code changes to production

Question 2

Which TWO of the following are true about Pod resource limits? (Select TWO)

Accepted Answer

CPU limits are enforced using CFS quotas. Option B is correct because Kubernetes enforces CPU limits via the Linux Completely Fair Scheduler (CFS) quota mechanism, specifically the cpu.cfs_quota_us and cpu.cfs_period_us cgroup settings, which throttle a container's CPU usage once it hits its limit. Option D is correct because Kubernetes validates that a container's limit must be greater than or equal to its request for each resource; otherwise the Pod is rejected, since a limit below the request would be logically inconsistent. Option A is wrong because memory limits are hard limits — the kernel OOM killer terminates the container if it exceeds its memory limit, regardless of free node memory. Option C is wrong because memory limits are not soft; only requests act as soft guarantees, while limits are hard caps enforced by the kernel. Option E is wrong because CPU limits cap maximum usage but do not guarantee CPU allocation; only CPU requests influence scheduling and provide a minimum share under contention.

Answer

A container can use more memory than its limit if the node has free memory

Answer

Memory limits are soft and can be exceeded temporarily

Answer

Setting CPU limits guarantees that a container will always get that much CPU

Question 3

Which THREE of the following are important security practices in a container image CI/CD pipeline?

Accepted Answer

Signing images to ensure integrity. Option C is correct because cryptographically signing container images (e.g., with Docker Content Trust/Notary or Sigstore cosign) lets the pipeline and runtime verify image integrity and provenance, preventing tampered or unauthorized images from being deployed. Option D is correct because using minimal base images (such as distroless, Alpine, or scratch) removes unnecessary packages, shells, and libraries, directly shrinking the attack surface and reducing the number of exploitable CVEs. Option E is correct because integrating vulnerability scanning (e.g., Trivy, Clair, or Grype) into the CI pipeline catches known CVEs in OS packages and dependencies before the image is published, enabling early remediation. Option A is wrong because hardcoding credentials in an image bakes secrets into layers where they can be extracted, violating secret-management best practices. Option B is wrong because running containers as root grants excessive privileges and increases the impact of a container escape, whereas least-privilege non-root users are recommended.

Answer

Hardcoding credentials in the image

Answer

Running containers as root user

Question 4

What is the primary purpose of a continuous integration (CI) pipeline in cloud native application delivery?

Accepted Answer

To build and test code changes automatically. CI automates building and testing code changes to catch integration issues early, ensuring that code is always in a deployable state.

Answer

To provision infrastructure resources

Answer

To automatically deploy code to production

Answer

To manage container images in a registry

Question 5

Which THREE are common features of progressive delivery?

Accepted Answer

Feature flags to enable/disable features. Progressive delivery is an extension of continuous delivery that reduces release risk by exposing changes to a subset of users before full rollout, and feature flags (A) are a core mechanism because they decouple deployment from release, letting you enable or disable functionality for specific users, cohorts, or percentages without redeploying. Gradual traffic shifting (B) is also fundamental, as it incrementally routes a growing percentage of traffic to the new version (e.g., canary or blue/green with weighted routing) so impact can be observed at small blast radius. Automated analysis and rollback (C) is the third key feature, since progressive delivery relies on metrics/health signals (e.g., error rates, latency) to automatically promote or revert the release when thresholds are breached. By contrast, all-at-once deployment (D) is the opposite of progressive delivery because it exposes every user simultaneously with no staged risk control, and manual verification for every change (E) contradicts the automation and continuous, data-driven promotion that progressive delivery depends on.

Answer

All-at-once deployment

Answer

Manual verification for every change

Question 6

Which tool is primarily used for distributed tracing in cloud native environments?

Accepted Answer

Jaeger. Jaeger is an open-source, CNCF-graduated distributed tracing system originally built by Uber, designed to collect, store, and visualize traces across microservices. It implements the OpenTracing/OpenTelemetry data model and provides a UI for trace analysis, making it the canonical tracing tool in cloud native environments. Its architecture (agents, collectors, query service, storage backends) is purpose-built for distributed tracing.

Answer

Grafana

Answer

Fluentd

Answer

Prometheus

Question 7

A container image is being pushed to a private registry. What is the correct workflow?

Accepted Answer

Build, tag, push. The correct container image workflow is build the image from a Dockerfile, tag it with a meaningful name (including registry host, repository, and tag), then push it to the registry. Tagging before pushing is required because the push command references the tagged image name. This sequence ensures the registry receives an image with the intended identifier.

Answer

Push first, then build

Answer

Push, tag, build

Answer

Tag after push

Question 8

What is the primary purpose of a container registry in a CI/CD pipeline?

Accepted Answer

To host container images for deployment. A container registry is a centralized repository that stores and distributes container images, typically organized by repository and tagged by version. In a CI/CD pipeline, the build stage produces an image, pushes it to the registry, and the deployment stage pulls it from the registry onto the target runtime. Option D captures this hosting/distribution role precisely.

Answer

To manage Kubernetes secrets

Answer

To store source code and trigger builds

Answer

To run CI/CD pipelines

Question 9

Which TWO of the following are valid Prometheus metric types? (Select two)

Accepted Answer

Counter. Prometheus defines Counter as a core metric type: a cumulative value that only increases (or resets to zero on restart), typically used for counts like total requests or errors, and queried with rate()/increase(). Option E (Gauge) is also correct because Prometheus defines Gauge as a metric type representing a value that can arbitrarily go up and down, such as temperature, memory usage, or current queue depth. The other options are not Prometheus metric types: Set, Timer, and Meter are metric abstractions found in other monitoring libraries/systems (for example, Dropwizard Metrics or Micrometer), not in the Prometheus client data model, whose four types are Counter, Gauge, Histogram, and Summary.

Answer

Set

Answer

Timer

Answer

Meter

Question 10

Which THREE are key characteristics of event-driven architecture? (Choose three.)

Accepted Answer

Event processing can trigger multiple downstream actions. Event-driven architecture is based on producing, detecting, and reacting to events, with loose coupling between components and asynchronous communication.

Answer

Requires a central database for state

Answer

Synchronous communication between components

Question 11

Which component of the Kubernetes control plane is responsible for storing the cluster state?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as Kubernetes' primary data store, persisting all cluster state including configuration, secrets, and resource specifications. The kube-apiserver is the only component that interacts directly with etcd, ensuring consistency and providing a RESTful interface for all other components and users.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager

Question 12

Drag and drop the steps to create a Kubernetes deployment using kubectl into the correct order.

Accepted Answer

Create a YAML definition file, then run kubectl apply, then verify the deployment, then check pods, then expose the deployment as a service.. First, define the deployment in a YAML file, then apply it, verify creation, check pods, and optionally expose it as a service.

Answer

Create a YAML definition file, then verify the deployment, then run kubectl apply, then check pods, then expose the deployment as a service.

Answer

Run kubectl apply, then create a YAML definition file, then verify the deployment, then expose the deployment as a service, then check pods.

Answer

Create a YAML definition file, then run kubectl apply, then expose the deployment as a service, then check pods, then verify the deployment.

Question 13

Drag and drop the steps to configure a Kubernetes Service of type LoadBalancer in a cloud environment into the correct order.

Accepted Answer

Step 1: Deploy the application. Step 2: Define and create the LoadBalancer service. Step 3: Retrieve the external IP. Step 4: Access the application using the IP.. First deploy the app, then define and create the LoadBalancer service, retrieve the IP, and access it.

Answer

Step 1: Define and create the LoadBalancer service. Step 2: Deploy the application. Step 3: Retrieve the external IP. Step 4: Access the application.

Answer

Step 1: Retrieve the external IP. Step 2: Deploy the application. Step 3: Define and create the LoadBalancer service. Step 4: Access the application.

Answer

Step 1: Deploy the application. Step 2: Retrieve the external IP. Step 3: Define and create the LoadBalancer service. Step 4: Access the application.

Question 14

Which TWO of the following are valid Prometheus metric types? (Select two.)

Accepted Answer

Counter. Counter is one of the four core Prometheus metric types, representing a cumulative value that only increases (or resets to zero on restart), such as http_requests_total. Option D (Histogram) is also correct because Histogram is a core Prometheus metric type that samples observations into configurable buckets and exposes _bucket, _sum, and _count series, commonly used for request durations or response sizes. The other options do not belong: Log (A) and Trace (E) are observability signal categories (logs and distributed traces) rather than Prometheus metric types, and Event (C) is not a Prometheus metric type—Prometheus has Gauge and Summary as its other two types, but neither is listed here.

Answer

Log

Answer

Event

Answer

Trace

Question 15

Which TWO of the following are benefits of implementing progressive delivery techniques (e.g., canary releases)?

Accepted Answer

Allows testing new features with a subset of users. Option B is correct because progressive delivery techniques such as canary releases deliberately expose a new version to a small subset of users (often a percentage of traffic) so that real-world behavior and feedback can be gathered before a full rollout. Option E is correct because by limiting the initial blast radius to that subset, a faulty release can be detected and rolled back before it reaches the entire user base, thereby reducing the risk of deploying a bad version to all users. Option A is incorrect because progressive delivery complements, rather than replaces, a CI/CD pipeline — the pipeline still builds, tests, and deploys the artifacts that progressive delivery then releases gradually. Option C is incorrect because progressive delivery depends heavily on monitoring and alerting to detect regressions and trigger rollbacks. Option D is incorrect because progressive delivery reduces risk but does not guarantee zero downtime, which depends on architecture and deployment mechanics.

Answer

Replaces the need for a CI/CD pipeline

Answer

Eliminates the need for monitoring and alerting

Answer

Guarantees zero downtime