KCNA Hard Questions — 25 Difficult Questions

Question 1

A cloud-native application experiences intermittent failures when calling an external API. The team implements a pattern that allows the application to temporarily stop calling the failing API and serve stale data or a fallback response. Which resiliency pattern does this describe?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Circuit Breaker pattern. The circuit breaker pattern prevents repeated calls to a failing service, allowing the system to degrade gracefully.

Answer

Retry pattern

Answer

Bulkhead pattern

Answer

Timeout pattern

Question 2

Which of the following is a key principle of the 12-factor app methodology related to managing configuration?

Accepted Answer

Use environment variables for configuration. The 12-factor app methodology states that configuration should be stored in environment variables (or external to the code) to vary between deployments without changing code. Hardcoding is the opposite. ConfigMaps are Kubernetes-specific but the principle is broader. Secrets are for sensitive data but not the only way.

Answer

Store configuration in the application code

Answer

Embed configuration in the build process

Answer

Use a configuration file in the application directory

Question 3

Which GitOps tool is a CNCF graduated project that synchronizes Kubernetes clusters with a Git repository?

Accepted Answer

Argo CD. Argo CD is a CNCF graduated project for GitOps on Kubernetes.

Answer

Tekton

Answer

Jenkins X

Answer

Flux

Question 4

A pod is in CrashLoopBackOff state. 'kubectl logs pod' shows 'Error: cannot connect to database at db-service:5432'. The database Service exists and is reachable from other pods. What is the most likely cause?

Accepted Answer

The application's configuration has incorrect database connection details. The error indicates the application cannot connect to the database. Since other pods can reach the database, the issue is specific to this pod. A common cause is that the pod's configuration (e.g., environment variables, config file) contains wrong connection details, such as incorrect service name, port, or credentials.

Answer

The kube-proxy is not functioning

Answer

The pod's resource limits are too low

Answer

The database pod is not running

Question 5

Which THREE of the following are true about the Open Container Initiative (OCI)? (Choose 3)

Accepted Answer

OCI defines both an image spec and a runtime spec. The OCI defines the image spec and runtime spec, ensuring interoperability between container tools. containerd is an OCI-compliant runtime. Docker images are OCI-compliant. Docker itself is not a runtime spec but a platform that uses runtimes.

Answer

Docker is an OCI runtime specification

Answer

OCI is governed by the Cloud Native Computing Foundation (CNCF)

Question 6

In the context of the 12-factor app methodology, which factor requires that an app's configuration be stored in environment variables?

Accepted Answer

Config. Factor III (Config) states that configuration should be stored in environment variables to decouple it from code.

Answer

Dependencies

Answer

Codebase

Answer

Backing services

Question 7

Which THREE of the following are features typically provided by a service mesh? (Choose three.)

Accepted Answer

Observability through metrics and tracing. Service mesh provides traffic management (routing, canary releases), observability (metrics, tracing), and security (mTLS, authorization). Auto-scaling is handled by Horizontal Pod Autoscaler or custom metrics, not by the service mesh. Service discovery is often built into Kubernetes itself, though service mesh can enhance it, but it's not a core feature.

Answer

Auto-scaling of pods based on CPU

Answer

Service discovery

Question 8

A team uses ArgoCD with a Git repository that contains Helm charts. They want ArgoCD to automatically sync when a new image tag is pushed to the container registry. Which approach should they use?

Accepted Answer

Use ArgoCD Image Updater. ArgoCD Image Updater is the official tool to automatically update image tags in Kubernetes manifests (including Helm values) and commit changes to Git, triggering ArgoCD to sync.

Answer

Use Flux Image Automation Controller

Answer

Configure a webhook from the registry to ArgoCD API server

Answer

Manually update the Helm values and commit

Question 9

Which THREE of the following are important considerations when defining SLOs (Service Level Objectives)? (Select three.)

Accepted Answer

They must be aligned with business impact. SLOs should be based on SLIs, define a target (e.g., 99.9%), and include a measurement window. Cost is not a direct consideration for SLO definition.

Answer

They should include an error budget

Answer

They should minimize infrastructure cost

Question 10

Which THREE are valid container runtimes that implement the Kubernetes CRI? (Choose three.)

Accepted Answer

Docker (via dockershim, deprecated). containerd, CRI-O, and Docker (via dockershim, deprecated) implement CRI. rkt is discontinued and not CRI-compliant; runc is a low-level runtime, not a CRI implementation.

Answer

runc

Answer

rkt

Question 11

Which TWO of the following are recommended practices for achieving observability in a Kubernetes cluster?

Accepted Answer

Include correlation IDs in structured logs to enable tracing across services.. Including correlation IDs in structured logs is a key observability practice that enables distributed tracing across microservices. In Kubernetes, where requests often traverse multiple pods and services, correlation IDs allow you to link logs from different components into a single transaction flow, which is essential for debugging and understanding system behavior.

Answer

Use a single centralized logging solution to aggregate logs from all components.

Answer

Store all debug logs for a minimum of 90 days for compliance.

Answer

Disable leader election for monitoring components to reduce complexity.

Question 12

You run 'kubectl logs my-pod' and see: "Error from server (BadRequest): container "my-container" in pod "my-pod" is waiting to start: PodInitializing". What does this mean?

Accepted Answer

The Pod is in the process of initializing and logs are not yet available. The error 'PodInitializing' indicates that the pod's init containers are still running or the main container is waiting for init containers to complete. During this phase, the container has not started, so logs are not yet available. Option D correctly identifies that the pod is initializing and logs cannot be retrieved until the container enters the 'Running' state.

Answer

The container is running but producing no output

Answer

The container runtime is failing to start the container

Answer

The container has crashed and is restarting

Question 13

Which THREE of the following are true about the Open Container Initiative (OCI)? (Select 3)

Accepted Answer

OCI defines the container image format specification. The Open Container Initiative (OCI) defines the Image Specification, which standardizes the format and content of container images. This ensures that any OCI-compliant image can be run by any OCI-compliant runtime, enabling interoperability across different container platforms.

Answer

OCI is governed solely by Docker Inc.

Answer

OCI only applies to Linux containers

Question 14

A company uses Prometheus for monitoring and wants to alert when the average CPU usage over 5 minutes exceeds 80%. Which PromQL query would correctly define this alert rule?

Accepted Answer

avg(rate(node_cpu_seconds_total{mode!="idle"}[5m])) > 0.8. The query should calculate the average CPU usage rate over 5 minutes and compare it to 0.8 (80%).

Answer

avg(rate(node_cpu_seconds_total{mode="idle"}[5m])) > 0.8

Answer

avg(node_cpu_seconds_total{mode!="idle"}[5m]) > 0.8

Answer

sum(rate(node_cpu_seconds_total{mode!="idle"}[5m])) > 0.8

Question 15

A Prometheus alert rule fires when the error rate exceeds 5% for 5 minutes. The alert is sent to Alertmanager. What must be configured in Alertmanager to ensure the alert is deduplicated, grouped, and routed to the correct team?

Accepted Answer

A route configuration. Alertmanager uses routes to match alerts and receivers to send notifications. Routes define grouping and routing logic.

Answer

An inhibition rule

Answer

A recording rule

Answer

A silence rule

Question 16

In event-driven architecture, which pattern is commonly used to decouple producers and consumers, allowing asynchronous communication?

Accepted Answer

Event broker (message queue or event bus). Event-driven architecture decouples producers and consumers via an event broker (e.g., message queue or event bus), enabling asynchronous communication. Direct synchronous calls would couple them.

Answer

Shared database

Answer

Circuit breaker pattern

Answer

Synchronous REST API calls

Question 17

When using Kustomize, how do you apply a common label to all resources in the base?

Accepted Answer

By setting 'commonLabels' in the kustomization.yaml. Kustomize's commonLabels field adds labels to all resources, including selectors.

Answer

By editing each YAML file individually

Answer

By using the 'patches' field to add labels

Answer

By using a Helm chart instead of Kustomize

Question 18

A company uses OpenTelemetry to instrument their microservices. They want to ensure that traces from one service can be correlated with those from another service across network calls. Which OpenTelemetry concept enables this correlation?

Accepted Answer

Context propagation. Context propagation allows trace context to be passed between services, enabling distributed tracing correlation.

Answer

Exporter configuration

Answer

Span attributes

Answer

Sampling

Question 19

Which THREE are common features of progressive delivery?

Accepted Answer

Feature flags to enable/disable features. Progressive delivery uses gradual rollout, feature flags, and analysis to reduce risk.

Answer

All-at-once deployment

Answer

Manual verification for every change

Question 20

A team wants to deploy a workload that must run on every node in a Kubernetes cluster, including new nodes added later. Which resource type should they use?

Accepted Answer

DaemonSet. A DaemonSet ensures that a copy of the pod runs on every node, and automatically runs on new nodes when they are added.

Answer

Deployment

Answer

Job

Answer

StatefulSet