KCNA Cloud Native Observability Practice Question
A platform team is designing a monitoring strategy for a multi-tenant Kubernetes cluster. Each tenant runs workloads in separate namespaces. The team needs to ensure tenant isolation while providing aggregated cluster-wide dashboards. Which approach best meets these requirements?
⚠ Common exam trap
CNCF often tests the misconception that namespace labels alone provide sufficient isolation, but in practice, labels do not enforce access control or resource boundaries, making a single Prometheus instance a security and reliability risk in multi-tenant clusters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a Prometheus instance per tenant and use Thanos to aggregate metrics globally
Deploying a Prometheus instance per tenant enforces strong tenant isolation by preventing cross-tenant metric access or resource contention, while Thanos provides a global view by aggregating metrics from all tenants via sidecar-based or query-frontend federation. This approach satisfies both isolation and aggregated dashboards without compromising security or scalability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a single Prometheus instance with namespace labels on all metrics
Why it's wrong here
Single Prometheus does not enforce access control; any user could query metrics across namespaces.
- ✗
Use a global Prometheus with recording rules to aggregate per-namespace metrics
Why it's wrong here
This does not provide isolation; all metrics are accessible in one place.
- ✗
Have each tenant deploy their own monitoring stack and view separately
Why it's wrong here
Lacks aggregated cluster-wide dashboards, violating the requirement.
- ✓
Deploy a Prometheus instance per tenant and use Thanos to aggregate metrics globally
Why this is correct
Per-tenant Prometheus ensures isolation, and Thanos sidecar allows secure global aggregation with proper RBAC.
Go deeper
Related to this question
Learn chapter
Kubernetes Overview and Core Components
Key term
Namespaces
A Namespace in Kubernetes is a virtual cluster within a physical cluster that allows you to organize and isolate resources, like an apartment building with separate units for different tenants.
Key term
ReplicaSet and Replication
A ReplicaSet ensures a specified number of identical pod instances are running at all times in Kubernetes, using replication to maintain availability and stability.
About these practice questions
This KCNA question is part of Courseiva's 833-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.