CCNA Cloud Native Architecture Questions

Terraform is a dedicated Infrastructure as Code (IaC) tool that uses declarative configuration files (HCL) to provision and manage cloud resources, including Kubernetes clusters and their workloads. It maintains state to track resource dependencies and can orchestrate Kubernetes resources via its Kubernetes provider, making it the correct choice for managing Kubernetes infrastructure as code.

The Config factor (Factor III) of the 12-factor app methodology mandates that configuration—such as database URLs, credentials, or feature flags—be stored in environment variables. This decouples configuration from code, allowing the same build to be deployed across different environments without code changes, and prevents accidental commits of secrets to version control.

The sidecar proxy (e.g., Envoy) runs alongside each service instance and intercepts all network traffic, enabling features like traffic management and observability.

The 12-factor app's 'Config' factor (III) states that configuration should be stored in environment variables, not in code. Options A, B, and D correspond to other factors: Codebase, Dependencies, and Backing Services respectively.

The sidecar proxy (e.g., Envoy) intercepts all network traffic to and from the application container, providing observability, traffic management, and security.

The sidecar proxy intercepts all network traffic to/from the main container, enabling observability, traffic management, and security without modifying application code.

The CNCF defines cloud-native technologies as those that use microservices, containers, and dynamic orchestration. Serverless is an approach but not a core principle; agile development is a methodology, not unique to cloud-native.

The CNCF's primary purpose is to foster the adoption of cloud native technologies by hosting and governing open source projects like Kubernetes, Prometheus, and Envoy. It provides a neutral home for these projects, ensuring they are developed collaboratively under a vendor-neutral governance model. This aligns directly with option A, which captures both the promotional and hosting roles of the foundation.

In an event-driven architecture, the event broker acts as a middleware that decouples event producers from consumers by receiving events from producers and forwarding them to interested consumers. This intermediary role ensures asynchronous communication, scalability, and fault tolerance without requiring producers and consumers to be directly aware of each other. Technologies like Apache Kafka, RabbitMQ, or cloud-native services such as AWS EventBridge exemplify this pattern.

A service mesh, such as Istio or Linkerd, offloads cross-cutting concerns from application code into a dedicated infrastructure layer. Security is a core benefit because the service mesh can enforce mutual TLS (mTLS) between all service-to-service communications, providing encryption, identity verification, and fine-grained access policies without modifying application code.

Helm is a package manager for Kubernetes that allows you to define, install, and upgrade Kubernetes applications using charts. Terraform and Pulumi are IaC tools for infrastructure, but for Kubernetes-specific resources, Helm is more directly focused. Ansible can also manage Kubernetes but is not as specialized.

Istio's security features are managed by Citadel (now part of istiod), which handles certificate signing and identity. Envoy is the proxy, Pilot provides service discovery, and Mixer was an older component for policy (now deprecated).

Envoy is the most common sidecar proxy used in service meshes like Istio.

StatefulSet is the correct choice because it provides stable, unique network identities and persistent storage per pod, which are essential for stateful applications. A headless Service allows direct pod-to-pod communication without load balancing, while a regular Service with session affinity (using `externalTrafficPolicy: Local` or `sessionAffinity: ClientIP`) ensures client requests stick to the same pod, maintaining session state.

Bulkhead isolates resources into pools (e.g., thread pools) so that a failure in one pool does not cascade. Circuit breaker stops calls after failures, retry repeats failed calls, and timeout limits wait time.

Prometheus is a graduated CNCF project, indicating it has reached a high level of maturity and adoption.

Option C is correct because cloud-native applications are typically packaged as lightweight containers (e.g., Docker) that encapsulate the application and its dependencies, enabling fast startup, portability, and efficient resource utilization. Containers share the host OS kernel and have minimal overhead compared to virtual machines, which aligns with the cloud-native principle of agility and scalability.

An API gateway handles cross-cutting concerns like authentication, rate limiting, routing, and aggregation. Direct database access (A) is an antipattern, managing container orchestration (C) is Kubernetes' job, and storing application state (D) is not a gateway function.

Option B is correct because a global load balancer with active-passive regional failover provides a straightforward way to route traffic to a healthy secondary region when the primary fails, without the complexity of multi-region Kubernetes control planes or synchronous replication. This approach leverages DNS-based or anycast routing to detect region failure and redirect traffic, ensuring high availability while keeping the operational overhead low.

Envoy proxy is the correct answer because in Istio, each pod is deployed with an Envoy sidecar proxy that intercepts all inbound and outbound traffic. This proxy enforces traffic policies (e.g., routing rules, fault injection, rate limiting) and collects telemetry data (e.g., metrics, logs, traces) at the pod level, sending it to the observability backends. The sidecar model ensures policy enforcement and telemetry collection happen without modifying the application code.

The bulkhead pattern isolates resources into separate pools (e.g., thread pools) to limit the impact of a failure in one service on others.

Each workload resource addresses specific operational requirements.

Envoy proxy is the most common sidecar proxy in service meshes like Istio and Linkerd. Istiod is the control plane component, Kiali is a visualization tool, and Prometheus is a monitoring system.

Istio is correct because it provides native support for multi-cluster and multi-cloud deployments through its mesh federation capabilities, including features like multi-primary and primary-remote cluster models, as well as east-west gateways for cross-cluster traffic. It leverages Envoy proxies and a unified control plane to enable service discovery, traffic management, and security across clusters, making it the only option among the listed that offers built-in, production-ready multi-cluster support.

An API gateway acts as a single entry point for clients, providing request routing, composition, and cross-cutting concerns like authentication and rate limiting.

ArgoCD and Flux are both CNCF projects that implement GitOps principles, synchronizing cluster state with a Git repository. Helm is a package manager, Terraform is for infrastructure provisioning (not strictly GitOps for Kubernetes), and Jenkins is a CI/CD tool that can be used with GitOps but is not purpose-built for it.

Terraform is an infrastructure-as-code tool that supports multiple cloud providers (AWS, Azure, GCP, etc.) with a declarative configuration language. Pulumi also supports multiple clouds but is less widely adopted in the CNCF ecosystem.

Consul is a CNCF graduated project that provides service discovery and configuration management.

GitOps relies on a Git repository as single source of truth, a CI/CD pipeline to validate changes, and an operator to sync the cluster.

Option D is correct because using cloud-agnostic abstractions (e.g., Kubernetes for container orchestration, Terraform for infrastructure as code) allows the team to deploy across multiple clouds while still integrating cloud-specific services via provider-agnostic interfaces or abstraction layers. This pattern reduces vendor lock-in, enables consistent deployment workflows, and supports portability without sacrificing the ability to use unique services from each cloud provider.

The bulkhead pattern isolates resources (e.g., thread pools, connections) so that a failure in one part of the system doesn't bring down other parts. Circuit breaker is for handling failures of external calls, not isolation.

Multi-cloud refers to using services from multiple cloud providers simultaneously.

Service mesh provides observability (metrics, tracing, logs) and traffic management (routing, load balancing). Auto-scaling is not a service mesh feature; it's handled by Kubernetes HPA or Knative. Service discovery is also not a direct feature of service mesh; it's typically provided by Kubernetes DNS.

The Bulkhead pattern (D) is correct because it isolates failures by partitioning resources (e.g., thread pools, connections) into separate pools for different components or services. This prevents a failure in one component from exhausting shared resources and cascading to others, directly improving resilience by containing the blast radius.

Serverless computing is event-driven and auto-scales to zero when idle. Long-running processes are not suitable, and you do not manage the underlying servers. Reserved capacity is a concept for traditional cloud.

ArgoCD synchronizes the cluster state with the desired state defined in a Git repository.

The HorizontalPodAutoscaler (HPA) automatically scales the number of pod replicas in a deployment based on observed CPU/memory utilization or custom metrics. This directly addresses the need to handle a sudden traffic spike without manual intervention by adding more pod instances to distribute the load.

The 12-factor app methodology recommends storing configuration in environment variables to keep it separate from code and vary per deploy.

Service mesh provides traffic management (routing), observability (metrics, tracing), and security (mTLS, policies).

ArgoCD is a declarative GitOps tool built specifically for Kubernetes.

An API gateway acts as a single entry point for client requests, handling routing, authentication, rate limiting, and other cross-cutting concerns.

Option C is correct because cloud-native architecture principles advocate for decentralized data management, where each microservice owns its private data store and exposes functionality via well-defined APIs. This ensures loose coupling, independent scalability, and resilience, as services can evolve without impacting others. The pattern aligns with the Database per Service pattern, a core tenet of microservices design.

The Circuit Breaker pattern is correct because it prevents cascading failures by monitoring for failures and, once a threshold is exceeded (e.g., 5 consecutive timeouts), it opens the circuit and immediately fails fast without waiting for the downstream service. This allows the application to handle periodic timeouts gracefully by avoiding wasted resources and providing a fallback response, which is critical for cloud-native resilience in Kubernetes.

Prometheus is a graduated CNCF project, having reached the graduation maturity level in August 2018. The CNCF graduation criteria require projects to demonstrate adoption, governance maturity, and long-term stability, which Prometheus meets as a core monitoring and alerting toolkit widely used in cloud-native environments.

The Database-per-service pattern is the correct answer because it ensures each microservice owns and manages its own database, enforcing loose coupling and data encapsulation. This aligns with the cloud-native principle of decentralized data management, where services communicate only via APIs and never access each other's databases directly. It prevents tight coupling at the data layer, which is critical for independent scaling, deployment, and resilience in a microservices architecture.

The CNCF defines cloud native as using microservices, containers, dynamic orchestration, and DevOps. The three correct options are microservices, containers, and dynamic orchestration. DevOps is also a principle, but the question asks for three; the other options are not core principles.

Service mesh provides observability (e.g., metrics, tracing) and traffic management (e.g., routing, retries) between services.

The CNCF's mission is to make cloud native computing ubiquitous by fostering and sustaining open source projects.

The circuit breaker pattern prevents repeated calls to a failing service, allowing the system to degrade gracefully.

Pulumi supports multiple clouds and allows infrastructure definition using general-purpose programming languages, enabling multi-cloud management with a single tool.

The CNCF defines cloud native architecture as using microservices, containers, dynamic orchestration, and DevOps.

ArgoCD is a declarative GitOps continuous delivery tool for Kubernetes that syncs application state with a Git repository.

Knative is a Kubernetes-based platform to build, deploy, and manage serverless workloads, including event-driven functions. AWS Lambda is a proprietary service, not a cloud native project.

Cloud-native applications are designed as microservices and use containers for deployment, enabling scalability and resilience.

Option B is correct because the Twelve-Factor App methodology mandates that dependencies must be explicitly declared and isolated via a dependency declaration manifest (e.g., Gemfile, package.json, requirements.txt) and a dependency isolation tool (e.g., Bundler, npm, pip). This ensures that the application never implicitly depends on system-wide packages, eliminating 'it works on my machine' issues and guaranteeing consistent behavior across all environments.

A service mesh provides observability, traffic management, and security for microservices communication.

Option B is correct because cloud-native applications are fundamentally defined by their ability to operate in dynamic, distributed environments. They leverage principles like microservices, containerization, and orchestration (e.g., Kubernetes) to achieve resilience, scalability, and manageability. This characteristic is the core tenet of cloud-native architecture as defined by the CNCF, enabling the app to handle failures gracefully and scale on demand.

Event-driven architecture enables loose coupling, scalability, and asynchronous processing.

The 12-factor app includes the principle of treating logs as event streams, not as files.

API gateway can offload cross-cutting concerns like authentication from individual microservices.

In Istio, the sidecar proxy (Envoy) intercepts all inbound and outbound traffic for the application container. Misconfigured proxy settings—such as incorrect timeouts, retry policies, or circuit breaker thresholds—can introduce significant latency by causing unnecessary retries, connection delays, or queueing. This is the most common and immediate cause of increased latency in a service mesh, as the data plane is directly in the request path.

An API gateway acts as a single entry point for clients, routing requests to appropriate microservices and providing cross-cutting concerns like authentication and rate limiting.

GitOps uses Git as the single source of truth for declarative infrastructure and application configuration. ArgoCD is a CNCF graduated project that implements GitOps for Kubernetes. Flux is also a GitOps tool but ArgoCD is more widely recognized as the primary GitOps project.

Option C is correct because health check endpoints (e.g., /healthz or /ready) are a fundamental pattern in cloud-native microservices. They allow orchestration platforms like Kubernetes to perform liveness and readiness probes, ensuring that traffic is only routed to healthy instances and that unhealthy pods are automatically restarted. This aligns with the cloud-native principle of designing for resilience and self-healing.

Option C is correct because a Service in Kubernetes provides a stable network endpoint (IP address and DNS name) to expose a set of pods, which are ephemeral and can be replaced. Services use selectors to identify target pods and load-balance traffic across them, enabling reliable communication within or outside the cluster.

Knative scales the function to zero replicas when idle, which is a key feature of serverless platforms.

ArgoCD is a popular GitOps tool that continuously monitors a Git repository and reconciles the cluster state with the desired state defined in the repo.

The strangler fig pattern is the correct first step because it allows the team to incrementally replace specific functionalities of the monolithic application with microservices without disrupting the existing system. This pattern routes requests to either the old monolith or new services, enabling gradual migration, independent scaling of extracted components, and improved resilience by isolating failures. It directly addresses the need to move from a shared-database, HTTP-calling monolith to a cloud-native architecture on Kubernetes.