KCNA Practice Exam 53 — 20 Questions

Question 1

A startup is designing a cloud-native application that processes IoT sensor data. The data arrives in bursts, and processing must be fault-tolerant with exactly-once semantics. The team considers Apache Kafka, RabbitMQ, and Amazon SQS. Which choice best meets the requirements of a cloud-native architecture?

Accepted Answer

Use Apache Kafka with idempotent producers and transactional APIs.. Apache Kafka with idempotent producers and transactional APIs is the correct choice because it provides exactly-once semantics (EOS) for bursty IoT data in a cloud-native architecture. Kafka's transactional API ensures atomic writes across partitions, while idempotent producers prevent duplicate records from retries, meeting the fault-tolerance and exactly-once requirements. Kafka also scales horizontally and handles high-throughput bursts natively, aligning with cloud-native principles.

Answer

Use Amazon SQS with FIFO queues for ordering and deduplication.

Answer

Use RabbitMQ with publisher confirms and consumer acknowledgements.

Answer

Implement an HTTP endpoint that the IoT devices call directly.

Question 2

The exhibit shows a Deployment manifest for a frontend service. After deployment, the pods are running but the service reports that no endpoints are available. What is the most likely cause?

Accepted Answer

The readiness probe is checking /ready which is not returning a 200 OK response.. The service reports no endpoints because the readiness probe is failing. A readiness probe determines whether a pod should receive traffic; if it does not return a 200 OK on the configured path (/ready), the pod is removed from the service’s endpoint list. Since the pods are running (liveness probe passes), the most likely cause is that the /ready endpoint is not serving a successful response.

Answer

The readiness probe periodSeconds is too short, causing the probe to overload the container.

Answer

The container image nginx:1.21 does not have the /healthz endpoint.

Answer

The liveness probe is failing, causing the pod to be restarted.

Question 3

A platform team is designing a monitoring strategy for a multi-tenant Kubernetes cluster. Each tenant runs workloads in separate namespaces. The team needs to ensure tenant isolation while providing aggregated cluster-wide dashboards. Which approach best meets these requirements?

Accepted Answer

Deploy a Prometheus instance per tenant and use Thanos to aggregate metrics globally. Option D is correct because deploying a Prometheus instance per tenant enforces strong tenant isolation by preventing cross-tenant metric access or resource contention, while Thanos provides a global view by aggregating metrics from all tenants via sidecar-based or query-frontend federation. This approach satisfies both isolation and aggregated dashboards without compromising security or scalability.

Answer

Deploy a single Prometheus instance with namespace labels on all metrics

Answer

Use a global Prometheus with recording rules to aggregate per-namespace metrics

Answer

Have each tenant deploy their own monitoring stack and view separately

Question 4

Which TWO of the following are best practices for structuring log output in cloud-native applications to maximize observability?

Accepted Answer

Output logs in structured format such as JSON. Option C is correct because structured logging (e.g., JSON) enables automated parsing, filtering, and querying by log aggregation tools like Fluentd, Logstash, or cloud-native observability backends (e.g., Elasticsearch, Loki). This format ensures each log entry has consistent key-value pairs, making it machine-readable and facilitating correlation across distributed services without manual text parsing.

Answer

Include verbose debug-level information in every log line

Answer

Use multi-line log entries for detailed error information

Answer

Avoid timestamps to reduce log size

Question 5

Which tool is used to manage infrastructure as code and can provision resources across multiple cloud providers?

Accepted Answer

Terraform. Terraform is the correct tool because it is an open-source infrastructure as code (IaC) software tool by HashiCorp that uses declarative configuration files (HCL) to provision and manage resources across multiple cloud providers (AWS, Azure, GCP, etc.) via provider plugins. Unlike single-cloud tools, Terraform's provider architecture allows it to manage heterogeneous environments consistently, making it the standard multi-cloud IaC solution.

Answer

Helm

Answer

Ansible

Answer

AWS CloudFormation

Question 6

Which Kubernetes control plane component is responsible for maintaining the desired state of the cluster by running controller loops?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs controller loops, which are continuous processes that watch the shared state of the cluster through the kube-apiserver and make changes to drive the current state toward the desired state. Each controller (e.g., ReplicaSet, Node, Deployment) is a separate loop that handles a specific aspect of cluster management, ensuring that the actual cluster state matches the desired configuration defined in the API objects.

Answer

etcd

Answer

kube-apiserver

Answer

kube-scheduler

Question 7

In event-driven architecture, which component is responsible for decoupling event producers from consumers?

Accepted Answer

Event broker. The event broker (e.g., Apache Kafka, RabbitMQ, or AWS EventBridge) acts as an intermediary that receives events from producers and forwards them to consumers. By decoupling the two, the producer does not need to know the consumer's location or status, and the consumer does not need to be actively listening when the event is published. This enables asynchronous, scalable, and fault-tolerant communication in event-driven architectures.

Answer

Event consumer

Answer

Event producer

Answer

API gateway

Question 8

Which TWO of the following are examples of context propagation mechanisms used in distributed tracing?

Accepted Answer

HTTP headers. Option A is correct because HTTP headers, such as the `traceparent` and `tracestate` headers defined in the W3C Trace Context specification, are the standard mechanism for propagating trace context across service boundaries in distributed tracing. When a service receives an incoming HTTP request, it extracts the trace ID and span ID from these headers to continue the same trace. This allows trace data to be correlated across multiple microservices as the request flows through the system.

Answer

Environment variables

Answer

Database queries

Answer

Shared filesystem

Question 9

When using OpenTelemetry, what is the role of the 'Collector'?

Accepted Answer

To receive, process, and export telemetry data in a vendor-neutral way. Option C is correct because the OpenTelemetry Collector is a vendor-agnostic proxy that receives telemetry data (traces, metrics, logs) from instrumented applications, processes it (e.g., batching, filtering, enrichment), and exports it to one or more backends (e.g., Jaeger, Prometheus, or any OTLP-compatible system). It decouples data generation from data storage, enabling flexible, scalable observability pipelines without vendor lock-in.

Answer

To alert on abnormal metrics

Answer

To store traces for long-term retention

Answer

To instrument application code manually

Question 10

Which THREE of the following are valid ways to expose a Service to external traffic?

Accepted Answer

ExternalName. Option A (ExternalName) is correct because it exposes a Service to external traffic by mapping the Service to an external DNS name (e.g., `my-service.default.svc.cluster.local` to `example.com`) via a CNAME record. This allows internal pods to reach an external service using a stable Kubernetes Service name, effectively exposing the Service to external traffic through DNS resolution.

Answer

Headless

Answer

ClusterIP

Question 11

Which of the following is a worker node component responsible for ensuring that containers are running in a pod as specified in the pod's spec?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each worker node. It receives PodSpecs (via the API server or a file) and ensures that the containers described in those PodSpecs are running and healthy. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers as required.

Answer

kube-scheduler

Answer

kube-proxy

Answer

etcd

Question 12

A Pod is stuck in 'Pending' state. Which command is most helpful to diagnose the issue?

Accepted Answer

kubectl describe pod my-pod. Option C is correct because 'kubectl describe pod my-pod' provides detailed information about the pod's current state, including events, conditions, and resource constraints. When a pod is stuck in 'Pending', it typically means the scheduler cannot place it on a node due to issues like insufficient CPU/memory, persistent volume claims not being bound, or node selector mismatches. The 'describe' command surfaces these specific reasons in the 'Events' section and 'Conditions' field, making it the most direct diagnostic tool.

Answer

kubectl logs my-pod

Answer

kubectl get events

Answer

kubectl top pod my-pod

Question 13

In a multi-cloud architecture, what is a common use case for a service mesh?

Accepted Answer

To enable secure service-to-service communication across clusters. A service mesh, such as Istio or Linkerd, provides a dedicated infrastructure layer for handling service-to-service communication. In a multi-cloud architecture, its common use case is to enable secure, observable, and resilient communication between services running in different Kubernetes clusters across clouds, using mutual TLS (mTLS) for encryption and traffic policies for routing.

Answer

To synchronize Kubernetes resources across clouds

Answer

To provide cloud-agnostic block storage

Answer

To provide a single ingress gateway for all clouds

Question 14

You want to ensure that a Pod runs on every Node in the cluster. Which resource should you use?

Accepted Answer

DaemonSet. A DaemonSet ensures that a copy of a Pod runs on every Node in the cluster, including when new Nodes are added. This is the correct resource for cluster-wide services like log collectors, monitoring agents, or kube-proxy, as it automatically schedules a Pod on each Node and respects node taints and tolerations.

Answer

Deployment

Answer

ReplicaSet

Answer

StatefulSet

Question 15

Which TWO are benefits of using a container orchestration platform like Kubernetes? (Select TWO.)

Accepted Answer

Automatic service discovery and load balancing. Option C is correct because Kubernetes includes built-in service discovery and load balancing. Services in Kubernetes get a stable virtual IP and DNS name, and kube-proxy implements load balancing across pods using iptables or IPVS rules, distributing traffic without manual configuration.

Answer

Increases application complexity

Answer

Requires a dedicated hypervisor for each container

Answer

Manual scaling of applications

Question 16

Which Kubernetes control plane component is the primary entry point for all administrative tasks and serves the Kubernetes API?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative operations. It exposes the Kubernetes REST API, validates and processes requests (including authentication, authorization, and admission control), and updates the corresponding objects in etcd. Without the API server, no kubectl command, automation, or internal component communication can occur.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

etcd

Question 17

You need to inspect the logs of a container named 'app' in a pod called 'web-1'. Which kubectl command should you use?

Accepted Answer

kubectl logs web-1 -c app. Option B is correct because the `kubectl logs` command requires the pod name first, and the `-c` flag (or `--container`) specifies the container name within that pod. Since the pod 'web-1' contains a container named 'app', `kubectl logs web-1 -c app` retrieves the logs from that specific container. This is the standard syntax for targeting a container in a multi-container pod.

Answer

kubectl logs web-1 --container app

Answer

kubectl logs app web-1

Answer

kubectl logs -p web-1 app

Question 18

Which TWO of the following are characteristics of a Kubernetes Pod?

Accepted Answer

Pods are the smallest deployable units in Kubernetes. B is correct because Pods are the smallest and most fundamental deployable units in Kubernetes, representing a single instance of a running process in the cluster. A Pod encapsulates one or more containers, storage resources, and a unique network IP, and is the atomic unit of scheduling. This is defined in the Kubernetes core API and is a foundational concept for the KCNA exam.

Answer

Pods can only run a single container

Answer

Pods are designed to be long-lived and rarely replaced

Answer

Pods are typically replicated by a Deployment or ReplicaSet

Question 19

You have a Deployment that runs a web application. You need to expose this application externally on a fixed port using a cloud load balancer. Which Service type should you use?

Accepted Answer

LoadBalancer. A LoadBalancer Service type provisions an external cloud load balancer (e.g., AWS ELB, GCP TCP/UDP Load Balancer) that exposes the application on a fixed port (typically 80/443) and distributes traffic to the Pods. This is the correct choice because the requirement explicitly asks for a cloud load balancer with a fixed external port, which is exactly what LoadBalancer provides by integrating with the underlying cloud provider's API.

Answer

NodePort

Answer

ExternalName

Answer

ClusterIP

Question 20

What is the Container Runtime Interface (CRI)?

Accepted Answer

A plugin interface that allows kubelet to use a variety of container runtimes. The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to communicate with different container runtimes (e.g., containerd, CRI-O) without needing to know their internal implementation details. It defines a gRPC-based protocol for managing container lifecycles, image operations, and pod sandboxes, allowing Kubernetes to remain runtime-agnostic.

Answer

A specification for container images

Answer

A registry for storing container images

Answer

A command-line tool for managing containers