KCNA Container Orchestration Practice Question
A Kubernetes cluster is experiencing network latency. The team suspects that the number of services and endpoints is causing iptables performance degradation. Which CNI plugin or network policy approach is most likely to improve performance?
⚠ Common exam trap
Watch out — candidates often assume any CNI change or network policy adjustment can fix iptables performance, but only eBPF-based solutions fundamentally change the data path to avoid iptables scaling limitations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an eBPF-based CNI plugin like Cilium
C is correct because eBPF-based CNI plugins like Cilium bypass the traditional iptables chains entirely, using a kernel-level BPF (Berkeley Packet Filter) program to handle service load balancing and network policy enforcement. This eliminates the O(n) scaling issue of iptables rules with the number of services and endpoints, significantly reducing latency in large clusters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch to Flannel with host-gw backend
Why it's wrong here
Flannel still uses iptables for policy enforcement, not addressing the issue.
- ✗
Use Calico with iptables mode
Why it's wrong here
Calico with iptables mode would not alleviate iptables performance issues.
- ✓
Use an eBPF-based CNI plugin like Cilium
Why this is correct
eBPF bypasses iptables, reducing latency and improving scalability.
- ✗
Apply a default-deny NetworkPolicy
Why it's wrong here
NetworkPolicy does not affect the performance of iptables-based service routing.
Go deeper
Related to this question
About these practice questions
This KCNA question is part of Courseiva's 833-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.