KCNA Container Orchestration Practice Question
A container image is built from a Dockerfile with multiple layers. Which statement about container image layers is TRUE?
⚠ Common exam trap
CNCF often tests the misconception that all layers are writable at runtime, but in reality only the container's writable layer is mutable, while the underlying image layers remain read-only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layers are read-only and can be reused across different images
Container image layers are read-only and are stored in a content-addressable storage (e.g., overlayfs, aufs). These layers can be reused across different images when they share the same content hash, which is a fundamental efficiency of Docker's union filesystem. This layer sharing reduces disk usage and speeds up image pulls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Each layer is created by a RUN instruction and can be modified after the image is built
Why it's wrong here
Image layers are immutable; they cannot be modified after the image is built.
- ✗
Each layer is unique to the image and cannot be shared with other images
Why it's wrong here
Layers are often shared between images, especially base layers, to reduce storage.
- ✓
Layers are read-only and can be reused across different images
Why this is correct
Image layers are read-only and are shared across images that use the same base or intermediate layers, improving efficiency.
- ✗
All layers in a container image are writable at runtime
Why it's wrong here
Only the topmost container layer is writable; image layers are read-only.
Go deeper
Related to this question
About these practice questions
One of 833 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A container image built using a Dockerfile with multiple layers is stored in a registry. When a node pulls this image, which statement about layers is true?
medium- ✓ A.Layers that are already cached on the node are reused and only new layers are downloaded
- B.Layers are merged into a single layer before download
- C.All layers must be downloaded each time the image is pulled
- D.Only the topmost layer is downloaded; lower layers are streamed from the registry
Why A: Container images are composed of read-only layers, each representing a set of filesystem changes. When a node pulls an image, the container runtime (e.g., containerd or CRI-O) checks its local layer cache against the manifest's layer digests (SHA256 hashes). Layers already present locally are reused, and only missing layers are downloaded from the registry, which optimizes bandwidth and storage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.