KCNA Cloud Native Architecture — 100 Questions

Question 1

A startup is designing a cloud-native application that processes IoT sensor data. The data arrives in bursts, and processing must be fault-tolerant with exactly-once semantics. The team considers Apache Kafka, RabbitMQ, and Amazon SQS. Which choice best meets the requirements of a cloud-native architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Apache Kafka with idempotent producers and transactional APIs.. Apache Kafka with idempotent producers and transactional APIs is the correct choice because it provides exactly-once semantics (EOS) for bursty IoT data in a cloud-native architecture. Kafka's transactional API ensures atomic writes across partitions, while idempotent producers prevent duplicate records from retries, meeting the fault-tolerance and exactly-once requirements. Kafka also scales horizontally and handles high-throughput bursts natively, aligning with cloud-native principles.

Answer

Use Amazon SQS with FIFO queues for ordering and deduplication.

Answer

Use RabbitMQ with publisher confirms and consumer acknowledgements.

Answer

Implement an HTTP endpoint that the IoT devices call directly.

Question 2

Which CNCF project is commonly used for Infrastructure as Code to provision cloud resources?

Accepted Answer

Crossplane. Crossplane is a CNCF project that extends the Kubernetes API to provision and manage cloud infrastructure declaratively — Infrastructure as Code using Kubernetes-style manifests and controllers. Terraform is the better-known IaC tool but is a HashiCorp product, not a CNCF project, which is exactly the distinction this question tests. Envoy is a service proxy, Prometheus is a monitoring system, and CoreDNS is a DNS server — all CNCF projects, but none of them do infrastructure provisioning.

Answer

Envoy

Answer

Prometheus

Answer

CoreDNS

Question 3

Which TWO of the following are CNCF graduated projects? (Choose two.)

Accepted Answer

Helm. Helm and Kubernetes are both CNCF graduated projects. Envoy is also a graduated project, but the question requires selecting only two; Helm and Kubernetes are the correct choices as per the exam objectives.

Answer

Linkerd

Answer

Knative

Answer

Envoy

Question 4

Which of the following is a graduated CNCF project?

Accepted Answer

Prometheus. Prometheus is a graduated CNCF project (graduated August 2018, the second project ever to graduate after Kubernetes). Backstage, Flux, and ArgoCD are CNCF projects at lower maturity levels in this context — the question tests knowledge of the CNCF project maturity ladder: sandbox, incubating, graduated.

Answer

Flux

Answer

Backstage

Answer

ArgoCD

Question 5

Which CNCF project provides a graduated service mesh implementation that includes features like traffic management, security, and observability?

Accepted Answer

Linkerd. Linkerd is a graduated CNCF project that provides a service mesh with features like traffic management, security (mTLS), and observability. Istio is also a service mesh but is incubating, not graduated. Envoy is a graduated proxy but not a full service mesh. Consul is not a CNCF project.

Answer

Consul

Answer

Envoy

Answer

Istio

Question 6

A team wants to implement Infrastructure as Code (IaC) for managing Kubernetes resources. Which tool is BEST suited for this purpose?

Accepted Answer

Terraform. Terraform is an Infrastructure as Code (IaC) tool that allows you to define and manage Kubernetes resources declaratively using HCL. It is cloud-agnostic and supports Kubernetes provider for managing clusters, pods, services, etc. While Pulumi also provides IaC capabilities, Terraform is more widely adopted for managing Kubernetes infrastructure. Helm, on the other hand, is a package manager for deploying pre-packaged applications, not an IaC tool.

Answer

Pulumi

Answer

Ansible

Answer

Helm

Question 7

An organization wants to manage infrastructure across multiple cloud providers using a single declarative configuration language. Which tool is best suited for this requirement?

Accepted Answer

Pulumi. Pulumi supports multiple clouds and allows infrastructure definition using general-purpose programming languages, enabling multi-cloud management with a single tool.

Answer

Kustomize

Answer

Helm

Answer

Terraform

Question 8

In the context of the 12-factor app methodology, which factor is addressed by storing configuration in environment variables?

Accepted Answer

III. Config. The 12-factor app methodology's Config factor (III) mandates that configuration be stored in environment variables to ensure strict separation of config from code. This allows the app to be deployed in different environments without code changes. Options A, C, and D correspond to other factors: Backing Services (IV), Dependencies (II), and Codebase (I) respectively.

Answer

IV. Backing Services

Answer

II. Dependencies

Answer

I. Codebase

Question 9

Which CNCF project is at the 'Graduated' maturity level and is widely used for container orchestration?

Accepted Answer

Kubernetes. Kubernetes is the correct answer because it is the only CNCF project at the 'Graduated' maturity level that is specifically designed and widely adopted for container orchestration. It automates deployment, scaling, and management of containerized applications, making it the de facto standard in cloud-native environments.

Answer

Prometheus

Answer

Envoy

Answer

Helm

Question 10

A company wants to migrate its monolithic application to a cloud-native architecture on Kubernetes. The application currently uses a shared database and communicates via internal HTTP calls. Which design pattern should be applied first to increase resilience and enable independent scaling of components?

Accepted Answer

Use the strangler fig pattern to gradually replace monolith functionality. The strangler fig pattern is the correct first step because it allows the team to incrementally replace specific functionalities of the monolithic application with microservices without disrupting the existing system. This pattern routes requests to either the old monolith or new services, enabling gradual migration, independent scaling of extracted components, and improved resilience by isolating failures. It directly addresses the need to move from a shared-database, HTTP-calling monolith to a cloud-native architecture on Kubernetes.

Answer

Adopt CQRS pattern to separate reads and writes

Answer

Implement database-per-service pattern

Answer

Deploy a sidecar container for each service

Question 11

A cloud-native application is designed with multiple microservices that need to handle a sudden spike in traffic without manual intervention. Which Kubernetes feature best enables this?

Accepted Answer

HorizontalPodAutoscaler. The HorizontalPodAutoscaler (HPA) automatically scales the number of pod replicas in a deployment based on observed CPU/memory utilization or custom metrics. This directly addresses the need to handle a sudden traffic spike without manual intervention by adding more pod instances to distribute the load.

Answer

VerticalPodAutoscaler

Answer

Cluster Autoscaler

Answer

PodDisruptionBudget

Question 12

A team is designing a cloud-native system that must maintain high availability across multiple cloud regions. The application uses Kubernetes clusters in each region. Which approach best ensures that the system can tolerate a full region failure while minimizing complexity?

Accepted Answer

Use a global load balancer with active-passive regional failover. A global load balancer with active-passive regional failover provides a straightforward way to route traffic to a healthy secondary region when the primary fails, without the complexity of multi-region Kubernetes control planes or synchronous replication. This approach leverages DNS-based or anycast routing to detect region failure and redirect traffic, ensuring high availability while keeping the operational overhead low.

Answer

Deploy a single Kubernetes cluster spanning all regions

Answer

Run active-active in all regions with synchronous data replication

Answer

Implement manual failover procedures documented in runbooks

Question 13

A microservice logs errors when connecting to the database. The logs show 'connection refused'. Which troubleshooting step should be taken first?

Accepted Answer

Verify the database Service and Endpoints in Kubernetes. The 'connection refused' error indicates that the microservice is attempting to connect to a TCP port on the database endpoint, but no process is listening there. In Kubernetes, the first step is to verify that the database Service exists and that its Endpoints object contains the correct pod IPs and port. If the Endpoints are empty or missing, the Service is not routing traffic to any healthy database pod, which directly causes the refusal. This aligns with the Kubernetes troubleshooting hierarchy: always check the Service and Endpoints before assuming application-level issues.

Answer

Scale up the microservice deployment

Answer

Restart the microservice pod

Answer

Check the logs of other microservices

Question 14

Which practice is a key principle of cloud-native architecture?

Accepted Answer

Automated CI/CD pipelines. Automated CI/CD pipelines are a key principle of cloud-native architecture because they enable rapid, reliable, and repeatable delivery of microservices. By automating build, test, and deployment stages, teams can achieve continuous integration and continuous delivery, which aligns with the cloud-native goals of agility, scalability, and resilience. This automation reduces human error and accelerates the feedback loop, essential for managing distributed systems in dynamic cloud environments.

Answer

Manual configuration management

Answer

Tight coupling of services

Answer

Preferring stateful applications over stateless

Question 15

A cloud-native application uses a service mesh (Istio) for traffic management. The team notices increased latency in inter-service communication. Which likely cause should be investigated first?

Accepted Answer

Misconfigured sidecar proxy settings. In Istio, the sidecar proxy (Envoy) intercepts all inbound and outbound traffic for the application container. Misconfigured proxy settings—such as incorrect timeouts, retry policies, or circuit breaker thresholds—can introduce significant latency by causing unnecessary retries, connection delays, or queueing. This is the most common and immediate cause of increased latency in a service mesh, as the data plane is directly in the request path.

Answer

Kubernetes Network Policies blocking traffic

Answer

Application code is not optimized for the mesh

Answer

mTLS encryption overhead

Question 16

A team is designing a cloud-native application that requires each microservice to have its own database. This pattern is known as:

Accepted Answer

Database-per-service pattern. The Database-per-service pattern is the correct answer because it ensures each microservice owns and manages its own database, enforcing loose coupling and data encapsulation. This aligns with the cloud-native principle of decentralized data management, where services communicate only via APIs and never access each other's databases directly. It prevents tight coupling at the data layer, which is critical for independent scaling, deployment, and resilience in a microservices architecture.

Answer

Saga pattern

Answer

Shared database pattern

Answer

CQRS pattern

Question 17

Which resource in Kubernetes is used to expose a set of pods as a network service?

Accepted Answer

Service. A Service in Kubernetes provides a stable network endpoint (IP address and DNS name) to expose a set of pods, which are ephemeral and can be replaced. Services use selectors to identify target pods and load-balance traffic across them, enabling reliable communication within or outside the cluster.

Answer

Pod

Answer

Deployment

Answer

Ingress

Question 18

A cloud-native application experiences periodic timeouts when calling a downstream service. The downstream service is running in the same Kubernetes cluster. Which design pattern should be implemented to handle this gracefully?

Accepted Answer

Circuit breaker pattern. The Circuit Breaker pattern is correct because it prevents cascading failures by monitoring for failures and, once a threshold is exceeded (e.g., 5 consecutive timeouts), it opens the circuit and immediately fails fast without waiting for the downstream service. This allows the application to handle periodic timeouts gracefully by avoiding wasted resources and providing a fallback response, which is critical for cloud-native resilience in Kubernetes.

Answer

Bulkhead pattern

Answer

Retry with exponential backoff

Answer

Health check endpoint

Question 19

Which TWO statements are true about cloud-native architecture?

Accepted Answer

Infrastructure is treated as immutable. Immutable infrastructure (e.g., replacing servers rather than patching) ensures consistency and reduces configuration drift, a key cloud-native principle. Option D is correct because microservices in cloud-native architectures are designed to be independently scalable, allowing efficient resource use. Option A is wrong because cloud-native applications typically use microservices, not monolithic architectures. Option C is wrong because cloud-native environments favor automated scaling (horizontal pod autoscaling, etc.) over manual scaling. Option E is wrong because stateful components introduce complexity and are generally avoided unless necessary; stateless components are preferred for scalability and resilience.

Answer

Applications are typically monolithic for simplicity

Answer

Manual scaling is the default approach

Answer

Stateful components are preferred for performance

Question 20

Which TWO are benefits of using a service mesh in cloud-native applications?

Accepted Answer

Advanced traffic management capabilities. A service mesh provides advanced traffic management capabilities such as fine-grained routing, canary deployments, and circuit breaking through sidecar proxies (e.g., Envoy). These capabilities allow operators to control traffic flow between microservices without modifying application code, enabling resilient and observable communication patterns.

Answer

Eliminates need for application monitoring

Answer

Simplified persistent storage management

Answer

Reduced network latency