KCNA Container Orchestration Practice Question
A container image is built from a Dockerfile with multiple layers. Which statement about container image layers is TRUE?
⚠ Common exam trap
CNCF often tests the misconception that all layers are writable at runtime, but in reality only the container's writable layer is mutable, while the underlying image layers remain read-only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layers are read-only and can be reused across different images
Container image layers are read-only and are stored in a content-addressable storage (e.g., overlayfs, aufs). These layers can be reused across different images when they share the same content hash, which is a fundamental efficiency of Docker's union filesystem. This layer sharing reduces disk usage and speeds up image pulls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Each layer is created by a RUN instruction and can be modified after the image is built
Why it's wrong here
Layers are immutable once built; a RUN instruction creates a new layer rather than altering an existing one, and later changes add further layers. This immutability enables caching and content-addressable distribution. The statement would hold only for mutable build steps, which container images deliberately avoid.
- ✗
Each layer is unique to the image and cannot be shared with other images
Why it's wrong here
Layers are content-addressed by digest, so identical layers are shared across images and pulled once from a registry. The option inverts this deduplication model. It tempts because layers are immutable and image-specific in ordering, but sharing of identical layer blobs is precisely what makes registries and node caches efficient.
- ✓
Layers are read-only and can be reused across different images
Why this is correct
Each image layer is immutable and content-addressed, so identical layers are stored once and shared by every image referencing them. This deduplication reduces registry storage and speeds up pulls, since unchanged layers need not be transferred again.
- ✗
All layers in a container image are writable at runtime
Why it's wrong here
Only the thin writable container layer created at runtime is writable; image layers are read-only and immutable, enforced by the union filesystem. It tempts because containers clearly write data at runtime, but those writes land in the ephemeral layer, not the underlying image layers, which never change.
Go deeper
Related to this question
About these practice questions
One of 930 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A container image built using a Dockerfile with multiple layers is stored in a registry. When a node pulls this image, which statement about layers is true?
medium- ✓ A.Layers that are already cached on the node are reused and only new layers are downloaded
- B.Layers are merged into a single layer before download
- C.All layers must be downloaded each time the image is pulled
- D.Only the topmost layer is downloaded; lower layers are streamed from the registry
Why A: Container images are composed of read-only layers, each representing a set of filesystem changes. When a node pulls an image, the container runtime (e.g., containerd or CRI-O) checks its local layer cache against the manifest's layer digests (SHA256 hashes). Layers already present locally are reused, and only missing layers are downloaded from the registry, which optimizes bandwidth and storage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.