74 of 161 questions · Page 2/3 · Cloud Native Architecture · Answers revealed
Which TWO of the following are CNCF graduated projects? (Select 2)
Prometheus is a graduated CNCF project.
Why this answer
Prometheus and Envoy are both CNCF graduated projects. CoreDNS is also graduated, but the question asks for two; Fluentd and Helm are both graduated as well, but the correct answers here are Prometheus and Envoy.
A development team wants to adopt a cloud-native architecture for a new application. Which set of principles BEST describes the cloud-native approach?
These are the core cloud-native principles as defined by the CNCF.
Why this answer
Cloud-native architectures leverage microservices, containers, dynamic orchestration, and DevOps to enable scalable, resilient applications.
Which command would you use to apply a manifest file 'deployment.yaml' to a Kubernetes cluster?
kubectl apply creates or updates resources declaratively.
Why this answer
The 'kubectl apply' command is used to apply or update resources from a manifest file.
What is the primary purpose of the CNCF (Cloud Native Computing Foundation)?
CNCF's mission is to make cloud native computing ubiquitous by hosting projects like Kubernetes, Prometheus, etc.
Why this answer
The CNCF hosts and nurtures open-source, vendor-neutral cloud native projects, fostering their growth and adoption.
What is the primary purpose of the sidecar container in a service mesh?
Sidecar proxies handle communication.
Why this answer
In a service mesh, the sidecar container (typically an Envoy or Linkerd proxy) is injected alongside the main application container to intercept and manage all inbound and outbound network traffic. This allows the service mesh to enforce traffic policies, handle service discovery, implement retries and circuit breaking, and collect telemetry without modifying the application code. The sidecar operates at the network layer (L4/L7), decoupling communication concerns from business logic.
Exam trap
CNCF often tests the misconception that the sidecar's primary role is logging and monitoring, but the correct answer is always traffic interception and management, as that is the core architectural purpose of a service mesh sidecar.
How to eliminate wrong answers
Option A is wrong because the sidecar container does not run application business logic; that is the responsibility of the main container. Option B is wrong because while the sidecar can collect telemetry data as a byproduct of traffic interception, its primary purpose is not logging and monitoring—those are separate concerns often handled by dedicated agents or the control plane. Option C is wrong because persistent storage is provided by volumes or CSI drivers, not by sidecar containers, which are ephemeral and focused on network functions.
A microservice logs errors when connecting to the database. The logs show 'connection refused'. Which troubleshooting step should be taken first?
Directly checks if the database service is available.
Why this answer
The 'connection refused' error indicates that the microservice is attempting to connect to a TCP port on the database endpoint, but no process is listening there. In Kubernetes, the first step is to verify that the database Service exists and that its Endpoints object contains the correct pod IPs and port. If the Endpoints are empty or missing, the Service is not routing traffic to any healthy database pod, which directly causes the refusal.
This aligns with the Kubernetes troubleshooting hierarchy: always check the Service and Endpoints before assuming application-level issues.
Exam trap
The trap here is that candidates often jump to restarting the pod or scaling the deployment, assuming the microservice itself is faulty, rather than recognizing that 'connection refused' is a network-level symptom pointing to the target (the database Service/Endpoints) not being available.
How to eliminate wrong answers
Option B is wrong because scaling up the microservice deployment will create more pods that all try to connect to the same unreachable database, multiplying the failure without addressing the root cause. Option C is wrong because restarting the microservice pod will only reattempt the same connection to the same database endpoint, which will still be refused if the database Service or its backing pods are misconfigured. Option D is wrong because checking logs of other microservices is a distraction; the 'connection refused' error is specific to the database connectivity and does not require cross-service log analysis to diagnose.
An organization uses GitOps with ArgoCD to manage Kubernetes deployments. What is the PRIMARY advantage of this approach over traditional imperative deployment methods?
GitOps uses Git as the authoritative source for desired state, enabling automated drift correction and audit trails.
Why this answer
GitOps uses a Git repository as the single source of truth, enabling declarative configuration, version control, and automated reconciliation. This is the primary advantage over traditional imperative methods. Option A is incorrect because manual approval processes can still be part of a GitOps workflow.
Option C is incorrect because GitOps does not eliminate the need for access controls. Option D is incorrect because GitOps does not directly reduce container count.
An application experiences intermittent failures when calling an external API. Which resilience pattern should be implemented to handle transient faults?
Retry handles transient failures by reattempting the operation.
Why this answer
(Retry) is correct because intermittent failures when calling an external API are typically transient faults (e.g., network glitches, temporary service unavailability). The Retry pattern automatically reattempts the failed operation a configured number of times, often with exponential backoff, to overcome these short-lived issues without changing the application's overall architecture. This directly addresses the scenario's requirement to handle transient faults.
Exam trap
CNCF often tests the distinction between handling transient faults (Retry) versus preventing cascading failures (Circuit breaker), leading candidates to choose Circuit breaker when the question explicitly mentions 'intermittent' or 'transient' faults.
How to eliminate wrong answers
Option A is wrong because Bulkhead isolates resources (e.g., thread pools) to prevent failures in one component from cascading, but it does not handle transient faults in API calls. Option B is wrong because Circuit breaker prevents repeated calls to a failing service by opening the circuit after a threshold of failures, which is designed for longer-term outages, not transient faults. Option C is wrong because Timeout sets a maximum wait time for a response but does not retry the call; it only prevents indefinite blocking, leaving the failure unhandled.
Which of the following is a core principle of the 12-factor app methodology?
Logs should be emitted as stdout/stderr and collected by a log aggregator.
Why this answer
The 12-factor app methodology emphasizes treating logs as event streams, not files, to enable centralized processing.
Which CNCF project maturity level indicates that a project has adopted the CNCF Code of Conduct and is considered early-stage?
Sandbox projects are early-stage and have accepted the CNCF Code of Conduct.
Why this answer
The CNCF has three maturity levels: sandbox (early-stage), incubating (growing), and graduated (mature). Sandbox projects are early-stage and have accepted the CNCF Code of Conduct.
Which of the following is a key principle of the 12-factor app methodology related to managing configuration?
Environment variables provide a clean separation between code and config, allowing easy changes across environments.
Why this answer
The 12-factor app methodology states that configuration should be stored in environment variables (or external to the code) to vary between deployments without changing code. Hardcoding is the opposite. ConfigMaps are Kubernetes-specific but the principle is broader.
Secrets are for sensitive data but not the only way.
Which service mesh component is responsible for handling inter-service communication as a sidecar proxy?
Why this answer
Envoy is the correct answer because it is the sidecar proxy component in Istio that handles all inter-service communication. It intercepts traffic between microservices and applies routing, load balancing, and security policies defined by the control plane. Envoy runs as a sidecar container alongside each service instance, managing inbound and outbound traffic at the L4/L7 layer.
Exam trap
CNCF often tests the distinction between data-plane and control-plane components, so the trap here is that candidates may confuse Pilot (control plane) with the sidecar proxy that actually handles traffic, or incorrectly associate Mixer with traffic management due to its former role in policy enforcement.
How to eliminate wrong answers
Option A (Mixer) is wrong because Mixer was a deprecated Istio component used for telemetry collection and policy enforcement, not for proxying inter-service traffic; it was removed in Istio 1.5. Option B (Pilot) is wrong because Pilot is the control plane component that translates high-level routing rules into Envoy configuration and distributes them to sidecars, but it does not handle data-plane traffic itself. Option D (Citadel) is wrong because Citadel is the Istio security component responsible for certificate issuance and key management for mTLS, not for proxying service-to-service communication.
Your organization runs a cloud-native e-commerce platform on Kubernetes. The platform consists of several microservices: a frontend service, an order service, a payment service, and a shipping service. All services communicate via HTTP REST APIs. Recently, during a flash sale event, the platform experienced a cascading failure. The order service became overwhelmed with requests and started responding slowly. This caused the frontend service to time out waiting for order responses, and eventually the frontend service crashed due to exhausted thread pools. The payment and shipping services were unaffected because they are called asynchronously via a message queue. You need to redesign the system to prevent such cascading failures in the future. Which approach is the most effective?
Circuit breakers prevent cascading failures by failing fast.
Why this answer
Implementing circuit breakers in the frontend service for calls to the order service prevents cascading failures by monitoring failure rates and automatically tripping the circuit when the order service becomes slow or unresponsive. This stops the frontend from exhausting its thread pools waiting for timeouts, allowing it to fail fast and return a fallback response. Circuit breakers are a proven resilience pattern in cloud-native architectures, especially for synchronous HTTP REST calls where latency spikes can propagate.
Exam trap
CNCF often tests the misconception that scaling or increasing timeouts is a sufficient fix for cascading failures, but the trap here is that these options treat symptoms rather than applying the circuit breaker pattern, which is the standard resilience mechanism for synchronous calls in cloud-native systems.
How to eliminate wrong answers
Option A is wrong because scaling up the frontend service only increases the number of concurrent requests it can handle, but does not address the root cause—the order service being overwhelmed—and may actually worsen the cascading failure by allowing more requests to pile up and exhaust thread pools faster. Option B is wrong because converting all inter-service communication to synchronous calls with retries would increase coupling and amplify failures; retries during overload can cause retry storms, further degrading the order service and increasing latency. Option C is wrong because increasing timeout values only delays the inevitable thread pool exhaustion, as the frontend will hold connections longer without reducing the load on the order service, and may lead to resource starvation under sustained high traffic.
In a service mesh architecture, which component is responsible for intercepting and managing traffic between microservices?
The sidecar proxy, such as Envoy, runs alongside each service and intercepts all network traffic to and from the service.
Why this answer
The sidecar proxy (usually Envoy) is deployed alongside each service instance and handles all incoming and outgoing traffic, enabling observability, traffic management, and security. The control plane manages configuration but does not handle data plane traffic. The API gateway is a separate component for external traffic.
The service registry is a pattern but not a specific service mesh component.
In a multi-cloud architecture, what is a common use case for a service mesh?
Service mesh provides mTLS and traffic management across clusters.
Why this answer
A service mesh, such as Istio or Linkerd, provides a dedicated infrastructure layer for handling service-to-service communication. In a multi-cloud architecture, its common use case is to enable secure, observable, and resilient communication between services running in different Kubernetes clusters across clouds, using mutual TLS (mTLS) for encryption and traffic policies for routing.
Exam trap
CNCF often tests the misconception that a service mesh is a general-purpose tool for all cross-cloud operations, when in reality it is specifically designed for service-to-service communication (east-west traffic) and does not handle resource synchronization, storage, or ingress gateway functions.
How to eliminate wrong answers
Option B is wrong because synchronizing Kubernetes resources across clouds is typically done by tools like Karmada, Cluster API, or Terraform, not by a service mesh, which focuses on network traffic management. Option C is wrong because cloud-agnostic block storage is provided by storage abstraction layers like CSI (Container Storage Interface) drivers or solutions like Rook/Ceph, not by a service mesh, which operates at Layer 7 (HTTP/gRPC) and Layer 4 (TCP). Option D is wrong because a single ingress gateway for all clouds is the role of a multi-cluster ingress controller or global load balancer (e.g., NGINX Ingress Controller with external-dns), while a service mesh handles east-west traffic between services, not north-south ingress traffic.
A developer creates the Pod manifest shown. When the Pod runs, the liveness probe fails and the container is restarted repeatedly. What is the most likely cause?
Correct. The probe checks port 8080, but Nginx listens on port 80, so the probe fails.
Why this answer
The liveness probe is configured to check TCP on port 8080, but the container exposes port 80 for Nginx. Since the probe will never successfully connect to port 8080, it always fails, causing the container to be restarted repeatedly. The probe must target the same port that the application is listening on.
Exam trap
CNCF often tests the distinction between TCP and HTTP probes, and the trap here is that candidates assume a TCP probe can target any port without matching the container's listening port, or they confuse the probe port with the container port defined in the Pod spec.
How to eliminate wrong answers
Option B is wrong because an initialDelaySeconds of 3 is generally sufficient for Nginx to start, as Nginx starts very quickly (often under 1 second). Option C is wrong because a periodSeconds of 5 is a reasonable probing interval and does not cause failures; frequent probing alone does not cause restarts unless the probe itself is misconfigured. Option D is wrong because the liveness probe is a TCP check, not an HTTP GET request, so it does not require a /healthz endpoint; a TCP probe only checks that the port is open, which Nginx provides on port 80.
Which THREE are key benefits of using a service mesh in a cloud-native architecture? (Choose 3)
Service mesh can enforce mTLS for secure communication.
Why this answer
A service mesh, such as Istio or Linkerd, transparently enables mutual TLS (mTLS) encryption between service sidecar proxies without requiring application code changes. This ensures all inter-service communication is encrypted and authenticated, which is a core security benefit in a zero-trust cloud-native architecture.
Exam trap
CNCF often tests the misconception that a service mesh provides infrastructure-level features like storage or scaling, when in reality it is strictly a Layer 4/7 networking and security abstraction that operates independently of compute or storage resources.
Which GitOps tool is a CNCF graduated project that synchronizes Kubernetes clusters with a Git repository?
Argo CD is a CNCF graduated project.
Why this answer
Argo CD is a CNCF graduated project for GitOps on Kubernetes.
Which of the following is a graduated CNCF project?
Prometheus is a graduated project for monitoring.
Why this answer
Prometheus is a graduated CNCF project, having reached the graduation maturity level in August 2018. It is a core monitoring and alerting toolkit widely adopted in cloud-native environments, and its graduation status reflects its stability, widespread use, and strong governance within the CNCF ecosystem.
Exam trap
The trap here is that candidates may confuse 'graduated' with 'incubating' or 'sandbox' status, especially for popular projects like OpenTelemetry or KubeEdge that are widely used but have not yet reached the highest maturity level in the CNCF lifecycle.
How to eliminate wrong answers
Option A is wrong because OpenTelemetry is an incubating CNCF project, not graduated; it is a collection of APIs and SDKs for observability but has not yet reached the graduation maturity level. Option B is wrong because K3s is a CNCF sandbox project, not graduated; it is a lightweight Kubernetes distribution designed for edge and resource-constrained environments, but it remains at the sandbox maturity level. Option C is wrong because KubeEdge is a CNCF incubating project, not graduated; it extends Kubernetes to edge computing but has not achieved graduation status.
In an event-driven architecture using a message broker, which component is responsible for receiving events and forwarding them to subscribed services?
Message broker decouples event producers and consumers.
Why this answer
A message broker (like Kafka or RabbitMQ) receives and forwards events. An API gateway routes HTTP requests, a service mesh handles service-to-service communication, and a load balancer distributes network traffic.
What is the primary purpose of the CNCF (Cloud Native Computing Foundation)?
CNCF hosts projects like Kubernetes, Prometheus, and Envoy, providing governance and support.
Why this answer
The CNCF's primary purpose is to host and nurture open-source cloud-native projects, such as Kubernetes, Prometheus, and Envoy, by providing governance, community support, and a neutral home for their development. It does not provide cloud infrastructure services itself, nor does it develop proprietary technologies; instead, it fosters an ecosystem of interoperable, vendor-neutral projects. The CNCF also manages the Cloud Native Landscape and defines standards like the Open Container Initiative (OCI) for container runtimes and images, but its scope extends far beyond just standardizing container runtimes.
Exam trap
The trap here is that candidates often confuse the CNCF's role with that of a cloud provider or a standards body focused solely on containers, leading them to choose Option A or C, but the CNCF's core function is to host and nurture a broad ecosystem of open-source cloud-native projects under a neutral governance model.
How to eliminate wrong answers
Option A is wrong because the CNCF does not provide cloud infrastructure services (e.g., compute, storage, or networking); those are offered by cloud providers like AWS, Azure, or GCP. Option B is wrong because the CNCF explicitly promotes open-source, vendor-neutral projects, not proprietary technologies; its charter prohibits vendor lock-in and encourages community-driven development. Option C is wrong because while the CNCF hosts the OCI specification for container runtimes (e.g., runc), its mission encompasses the entire cloud-native stack, including orchestration (Kubernetes), service meshes (Istio), observability (Prometheus), and serverless (Knative), not just container runtimes.
Which of the following is a benefit of using a service mesh?
Service mesh provides detailed observability and traffic management features.
Why this answer
A service mesh provides observability (metrics, tracing), traffic management (routing, load balancing), and security (mTLS) without requiring changes to application code. It does not directly manage storage or scaling.
According to the 12-factor app methodology, how should an application store configuration that varies between deployments (e.g., database connection strings)?
Environment variables provide a clean separation and are easy to change per deployment.
Why this answer
The 12-factor app recommends strict separation of config from code, storing config in environment variables.
What is the purpose of a circuit breaker pattern in microservices?
The circuit breaker opens when failures reach a threshold, stopping calls and allowing the service to recover.
Why this answer
The circuit breaker pattern prevents an application from repeatedly trying to execute an operation that is likely to fail, allowing it to recover gracefully.
Which TWO of the following are core principles of the 12-factor app? (Choose 2.)
Why this answer
The 12-factor app includes principles such as explicit dependency declaration (Dependencies) and strict separation of config from code (Config).
In the context of the 12-factor app methodology, which factor emphasizes storing configuration in environment variables?
Config is the factor that recommends storing configuration in environment variables.
Why this answer
Factor III of the 12-factor app methodology states that config should be stored in environment variables to keep it separate from code.
Which CNCF project maturity level indicates that a project has successfully adopted the CNCF governance and is considered stable for production use?
Graduated is the highest level, indicating production readiness.
Why this answer
The Graduated maturity level is the highest in the CNCF project lifecycle, indicating that a project has both successfully adopted CNCF governance and is considered stable for production use. To achieve Graduated, a project must meet rigorous criteria including adoption by multiple end users, a defined governance structure, and completion of a security audit. This distinguishes it from lower maturity levels such as Sandbox (early-stage) and Incubating (growing but not yet stable).
Exam trap
CNCF often tests the distinction between Sandbox and Incubating, where candidates mistakenly think Sandbox implies production readiness, but Sandbox is explicitly for early-stage projects that have not yet demonstrated stability or adopted full CNCF governance.
How to eliminate wrong answers
Option A is wrong because Incubating is an intermediate stage where projects have shown initial adoption and are working toward graduation, but they are not yet considered fully stable for production use. Option B is wrong because Experimental is not a CNCF maturity level; the CNCF uses Sandbox, Incubating, and Graduated, while Experimental is a term used by other foundations or early-stage projects outside the CNCF. Option D is wrong because Sandbox is the entry-level stage for early-stage projects that are not yet ready for production use and have not fully adopted CNCF governance.
Which TWO of the following are key principles of cloud native architecture?
Automation is essential for managing dynamic cloud environments.
Why this answer
Infrastructure automation (B) is a key principle of cloud native architecture because it enables consistent, repeatable, and error-free provisioning and management of infrastructure through code (e.g., Terraform, AWS CloudFormation, Ansible). This aligns with the cloud native goal of reducing manual toil and enabling rapid, reliable deployments. Microservices (C) is also a core principle, as it structures applications as a collection of loosely coupled, independently deployable services that can be scaled and updated individually, which is fundamental to cloud native agility and resilience.
Exam trap
CNCF often tests the distinction between 'key principles' (like microservices and automation) and 'operational patterns' (like immutable infrastructure), leading candidates to select immutable infrastructure as a principle when it is actually a best practice derived from those principles.
What is the primary purpose of the CNCF (Cloud Native Computing Foundation)?
The CNCF hosts projects like Kubernetes, Prometheus, and others to advance cloud native technologies.
Why this answer
The CNCF's mission is to make cloud native computing ubiquitous by fostering and sustaining open source projects that follow cloud native principles.
Which THREE of the following are benefits of using a service mesh? (Select three.)
Service mesh enables advanced traffic routing.
Why this answer
A service mesh, such as Istio or Linkerd, provides fine-grained traffic control through features like traffic splitting, header-based routing, and weighted load balancing. This enables canary deployments by directing a small percentage of traffic to a new version of a service, allowing safe testing in production without affecting all users.
Exam trap
CNCF often tests the misconception that a service mesh improves performance or handles autoscaling, when in fact it focuses on traffic management, security, and observability at the cost of some latency.
Which TWO of the following are core principles of the 12-factor app methodology? (Select TWO.)
Config should be stored in environment variables.
Why this answer
The 12-factor app methodology mandates strict separation of config from code. Config includes things like database connection strings, API keys, and environment-specific values that vary between deployments. Storing these in environment variables (or external config files not checked into version control) ensures that the same codebase can be deployed to different environments without modification, which is a core principle for cloud-native portability and security.
Exam trap
CNCF often tests the misconception that logs should be stored locally for reliability, but the 12-factor methodology treats logs as event streams to stdout, relying on the execution environment (e.g., kubectl logs, log shippers) for aggregation and persistence.
What is the primary purpose of the CNCF (Cloud Native Computing Foundation)?
CNCF provides governance, marketing, and support for cloud-native open-source projects.
Why this answer
The CNCF hosts, supports, and sustains open-source cloud-native projects, ensuring they are vendor-neutral and fostering community collaboration. It does not develop projects itself but provides a governance model.
Which component in an event-driven architecture is responsible for decoupling event producers from consumers?
Event broker (e.g., Kafka, RabbitMQ) decouples producers and consumers by managing event streams.
Why this answer
An event broker (or message broker) acts as an intermediary that receives events from producers and delivers them to consumers, allowing loose coupling. The API gateway handles synchronous requests. The service mesh handles service-to-service communication.
The config server manages configuration.
In a microservices architecture, which pattern is used to prevent cascading failures by limiting the number of concurrent requests to a service?
Bulkhead limits concurrent requests to protect resources.
Why this answer
The bulkhead pattern isolates resources to prevent failure propagation. Circuit breaker stops calls after failures, retry reattempts, and timeout limits wait time.
Which practice is a key principle of cloud-native architecture?
Enables rapid and reliable deployments.
Why this answer
Automated CI/CD pipelines are a key principle of cloud-native architecture because they enable rapid, reliable, and repeatable delivery of microservices. By automating build, test, and deployment stages, teams can achieve continuous integration and continuous delivery, which aligns with the cloud-native goals of agility, scalability, and resilience. This automation reduces human error and accelerates the feedback loop, essential for managing distributed systems in dynamic cloud environments.
Exam trap
CNCF often tests the misconception that manual configuration management is acceptable in cloud-native environments, but the trap here is that candidates confuse traditional IT operations with the automated, declarative approach required for cloud-native scalability and resilience.
How to eliminate wrong answers
Option B is wrong because manual configuration management contradicts the cloud-native principle of declarative, automated infrastructure (e.g., using Kubernetes manifests or Terraform), leading to configuration drift and reduced scalability. Option C is wrong because tight coupling of services violates the microservices tenet of loose coupling, which is fundamental to independent deployability and fault isolation in cloud-native architectures. Option D is wrong because cloud-native architecture prefers stateless applications over stateful ones, as stateless services scale horizontally more easily and are simpler to manage; state is typically offloaded to external stores like databases or caches.
Which TWO of the following are essential components of a GitOps workflow? (Select two.)
The operator continuously watches Git and applies changes.
Why this answer
A GitOps workflow relies on an operator (such as Argo CD or Flux) that continuously reconciles the actual cluster state with the desired state declared in a Git repository. This operator automatically detects drift and applies changes to ensure the cluster matches the Git source, which is the core feedback loop of GitOps.
Exam trap
CNCF often tests the misconception that a CI/CD pipeline is the core of GitOps, but the trap here is that GitOps replaces manual or pipeline-driven deployments with an automated reconciliation loop driven by an operator and a Git repository as the source of truth.
Which of the following best describes the purpose of the CNCF (Cloud Native Computing Foundation)?
The CNCF manages projects through graduated, incubating, and sandbox stages to foster the cloud native ecosystem.
Why this answer
The CNCF's primary purpose is to foster and sustain the ecosystem of cloud native technologies through project lifecycle management, including sandbox, incubation, and graduation stages. Option B is incorrect because the CNCF is not a standards body for cloud APIs; that is the role of other organizations. Option C is incorrect because the CNCF does not exclusively own Kubernetes; Kubernetes is a CNCF graduated project but governed by the community.
Option D is incorrect because the CNCF does not provide cloud infrastructure services; it supports open source projects but does not offer cloud services.
In event-driven architecture, which pattern is commonly used to decouple producers and consumers, allowing asynchronous communication?
An event broker decouples producers and consumers by acting as an intermediary.
Why this answer
Event-driven architecture decouples producers and consumers via an event broker (e.g., message queue or event bus), enabling asynchronous communication. Direct synchronous calls would couple them.
Which TWO tools are commonly used for GitOps? (Choose two.)
Flux is a GitOps operator for Kubernetes.
Why this answer
ArgoCD and Flux are two popular GitOps tools that automate deployment of applications from Git repositories.
Which TWO are benefits of using a service mesh in cloud-native applications?
Traffic routing, retries, etc.
Why this answer
A service mesh provides advanced traffic management capabilities such as fine-grained routing, canary deployments, and circuit breaking through sidecar proxies (e.g., Envoy). These capabilities allow operators to control traffic flow between microservices without modifying application code, enabling resilient and observable communication patterns.
Exam trap
CNCF often tests the misconception that a service mesh reduces latency or replaces monitoring, when in fact it adds a small overhead and complements, rather than replaces, existing monitoring tools.
Drag and drop the steps to configure a Kubernetes Service of type LoadBalancer in a cloud environment into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
First deploy the app, then define and create the LoadBalancer service, retrieve the IP, and access it.
Which of the following is an example of Infrastructure as Code (IaC) tool?
Terraform is a declarative IaC tool for provisioning infrastructure.
Why this answer
Terraform is a widely used IaC tool that allows declarative definition of infrastructure across multiple cloud providers.
In the context of the 12-factor app methodology, which factor requires that an app's configuration be stored in environment variables?
Why this answer
Factor III (Config) states that configuration should be stored in environment variables to decouple it from code.
What is the primary purpose of the CNCF (Cloud Native Computing Foundation)?
CNCF's mission is to make cloud-native computing ubiquitous by hosting projects and fostering community.
Why this answer
The CNCF fosters the adoption of cloud-native technologies by hosting and nurturing open-source projects like Kubernetes, Prometheus, and Envoy.
You are a platform engineer at a fast-growing startup. The company runs a Kubernetes cluster with 50 worker nodes for its production microservices. Recently, the operations team has been struggling with manual configuration drift: developers SSH into nodes to install debugging tools, and some nodes have different kernel parameters or installed packages. This has caused intermittent outages when a pod is scheduled onto a non-standard node. The CTO wants a solution that ensures each node is identical, immutable, and reproducible. The cluster uses kubeadm for bootstrapping and runs on AWS EC2. Which approach best achieves the goal of immutable nodes?
A golden AMI provides an identical, immutable base. Instance refresh replaces nodes rather than modifying them.
Why this answer
It uses a golden AMI built with Packer to create identical, immutable nodes that are reproducible via Auto Scaling groups and launch templates. This approach ensures that every EC2 instance launched has the exact same kernel parameters, packages, and configuration, eliminating configuration drift. Instance refresh allows rolling updates to the AMI without manual intervention, aligning with the goal of immutable infrastructure.
Exam trap
The trap here is that candidates often confuse configuration management (Option A) with immutability, not realizing that periodic enforcement still allows drift and does not guarantee identical nodes at all times.
How to eliminate wrong answers
Option A is wrong because configuration management tools like Ansible enforce desired state via periodic runs, which still allows drift between runs and does not achieve true immutability; nodes remain mutable and can deviate. Option B is wrong because node labels and taints only control workload scheduling, they do not enforce node configuration or prevent nodes from being modified via SSH. Option D is wrong because a DaemonSet running a privileged container can attempt to enforce configuration but cannot prevent manual SSH changes or guarantee identical state across nodes, and it introduces security risks without solving the root cause of drift.
Which Kubernetes resource is commonly used to implement the sidecar pattern for injecting a service mesh proxy?
Service meshes like Istio use a mutating webhook to automatically inject the Envoy sidecar proxy.
Why this answer
A MutatingAdmissionWebhook intercepts Pod creation requests and automatically injects a sidecar container (e.g., Envoy or Linkerd-proxy) into the Pod spec. This is the standard mechanism used by service mesh control planes like Istio and Linkerd to transparently add the proxy without modifying application manifests.
Exam trap
CNCF often tests the misconception that a Service or NetworkPolicy is responsible for sidecar injection, when in fact only a mutating admission webhook can automatically modify Pod specs at creation time.
How to eliminate wrong answers
Option A is wrong because NetworkPolicy controls ingress/egress traffic at the network layer using labels and CIDR rules, not container injection. Option B is wrong because a Service provides a stable IP and DNS name for Pod discovery and load balancing, not sidecar injection. Option D is wrong because a ConfigMap stores non-sensitive configuration data as key-value pairs or files, but cannot mutate Pod specs at creation time.
In event-driven architecture, which component is responsible for decoupling event producers from consumers?
Why this answer
The event broker (e.g., Apache Kafka, RabbitMQ, or AWS EventBridge) acts as an intermediary that receives events from producers and forwards them to consumers. By decoupling the two, the producer does not need to know the consumer's location or status, and the consumer does not need to be actively listening when the event is published. This enables asynchronous, scalable, and fault-tolerant communication in event-driven architectures.
Exam trap
CNCF often tests the distinction between synchronous and asynchronous communication patterns, and the trap here is that candidates mistakenly think an API gateway (which handles synchronous requests) can decouple producers and consumers in an event-driven architecture, when in fact it only routes requests without persistent event storage or asynchronous delivery.
How to eliminate wrong answers
Option B (Event consumer) is wrong because the consumer is the recipient of events, not the component that decouples producers from consumers; it relies on the broker for decoupling. Option C (Event producer) is wrong because the producer generates events but has no built-in mechanism to decouple itself from consumers without an intermediary. Option D (API gateway) is wrong because an API gateway is designed for synchronous request-response patterns (e.g., REST APIs) and does not provide the persistent, asynchronous event buffering and routing that decouples producers from consumers.
A company wants to manage its Kubernetes resources using Git as the single source of truth, with automated synchronization. Which approach should they use?
GitOps uses Git as the source of truth and automatically syncs the cluster state to the desired state in Git.
Why this answer
GitOps is a practice where the entire system state is described declaratively in Git, and automated tools synchronize the cluster to match. ArgoCD and Flux are popular GitOps tools.
What is the primary purpose of a service mesh in a cloud-native architecture?
The service mesh adds a layer of proxies to manage communication securely and reliably.
Why this answer
A service mesh provides observability, traffic management, and security for microservices communication, offloading these concerns from application code.
Which TWO of the following are examples of Infrastructure as Code (IaC) tools? (Choose two.)
Terraform is an IaC tool by HashiCorp.
Why this answer
Terraform (B) is an Infrastructure as Code (IaC) tool that uses declarative configuration files (HashiCorp Configuration Language, HCL) to define and provision cloud and on-premises resources. It manages the full lifecycle of infrastructure through a state file and provider plugins, enabling version-controlled, repeatable deployments.
Exam trap
CNCF often tests the distinction between containerization/orchestration tools (Docker, Kubernetes) and actual IaC tools, leading candidates to confuse tools that manage applications with those that provision infrastructure.
Which THREE of the following are resiliency patterns commonly used in cloud native applications? (Choose three.)
Retrying failed operations can handle transient failures.
Why this answer
The Retry pattern is a fundamental resiliency mechanism in cloud-native applications. When a transient failure occurs (e.g., a network timeout or a temporary database unavailability), the application automatically reattempts the failed operation. This pattern is often implemented with exponential backoff and jitter to avoid overwhelming the downstream service, as seen in libraries like Netflix Hystrix or Kubernetes client-go retry logic.
Exam trap
CNCF often tests the distinction between design patterns (like Singleton) and cloud-native resiliency patterns (like Retry, Timeout, Circuit Breaker), so candidates mistakenly select Singleton because it is a well-known pattern, but it does not address fault tolerance or failure recovery.
In a serverless architecture using Knative, what happens to a service that has not received traffic for an extended period?
Knative supports auto-scaling to zero for idle services.
Why this answer
Knative scales to zero when idle, meaning no pods are running, thus no cost incurred.
Which THREE of the following are features typically provided by a service mesh? (Choose three.)
Service mesh collects telemetry data for monitoring.
Why this answer
Service mesh provides traffic management (routing, canary releases), observability (metrics, tracing), and security (mTLS, authorization). Auto-scaling is handled by Horizontal Pod Autoscaler or custom metrics, not by the service mesh. Service discovery is often built into Kubernetes itself, though service mesh can enhance it, but it's not a core feature.
A team is implementing a multi-cloud strategy to avoid vendor lock-in. Which Kubernetes feature is most helpful for abstracting the underlying cloud provider?
The API abstracts infrastructure differences.
Why this answer
The Kubernetes API server provides a consistent interface regardless of the underlying infrastructure. Namespaces organize resources, Services provide networking abstractions, and ConfigMaps store configuration.
A retail company runs its e-commerce platform on Kubernetes. During a flash sale, the application experiences high latency. The team notices that the database pods are CPU-bound and the application pods are waiting on database responses. Which architectural change would best address this bottleneck?
Read replicas distribute the read load, reducing CPU pressure on the primary database.
Why this answer
The bottleneck is caused by the database being CPU-bound, meaning it cannot process requests fast enough. Implementing read replicas offloads read queries from the primary database, reducing its CPU load and allowing it to handle write operations more efficiently. The application can be configured to route read operations to the replicas, which directly addresses the latency caused by waiting on database responses.
Exam trap
CNCF often tests the misconception that scaling application pods (Option C) is a universal fix for performance issues, but here it would amplify the database bottleneck rather than resolve it.
How to eliminate wrong answers
Option A is wrong because changing the service type from ClusterIP to NodePort exposes the database externally but does nothing to reduce its CPU load or improve query processing speed. Option C is wrong because increasing application pod replicas would only increase the number of requests hitting the already CPU-bound database, worsening the bottleneck. Option D is wrong because storing database configuration in a ConfigMap improves manageability and startup time but has no impact on runtime database CPU utilization or query latency.
A development team wants to deploy a serverless function that scales to zero when not in use. Which CNCF project or platform is BEST suited for this requirement?
Knative is a Kubernetes-based platform for building, deploying, and managing serverless workloads that can scale to zero, and it is a CNCF project.
Why this answer
Knative is a Kubernetes-based platform to build, deploy, and manage serverless workloads that can scale to zero. AWS Lambda is a proprietary offering, not CNCF. OpenFaaS and Kubeless are also serverless frameworks but Knative is the most prominent CNCF serverless project.
Which TWO of the following are examples of Infrastructure as Code (IaC) tools? (Choose 2.)
Why this answer
Terraform and Pulumi are popular IaC tools that allow infrastructure provisioning via code.
A team wants to deploy a serverless function using Knative. Which core primitive does Knative rely on to run serverless workloads on Kubernetes?
Knative Service is the top-level resource.
Why this answer
Knative Serving uses the 'Service' resource to manage serverless workloads. 'Deployment' is a lower-level resource, 'Function' is not a Kubernetes resource, and 'Pod' is too granular.
A team wants to deploy a serverless function that scales to zero when not in use. Which CNCF project is specifically designed for this purpose?
Knative provides serverless containers with scale-to-zero.
Why this answer
Knative is the correct answer because it is a CNCF project built on Kubernetes that provides a serverless platform specifically designed to scale workloads to zero when not in use. It achieves this through its Serving component, which automatically scales pods down to zero replicas based on traffic, and scales up from zero on the first request, enabling true serverless behavior.
Exam trap
CNCF often tests the distinction between infrastructure tools (Helm, Prometheus, Envoy) and serverless platforms (Knative), trapping candidates who confuse package management, monitoring, or proxy functions with serverless scaling capabilities.
How to eliminate wrong answers
Option A is wrong because Helm is a package manager for Kubernetes that deploys applications using charts, but it does not provide any serverless scaling or scale-to-zero functionality. Option B is wrong because Prometheus is a monitoring and alerting toolkit that collects metrics, not a serverless platform; it cannot scale functions to zero. Option C is wrong because Envoy is a high-performance sidecar proxy used for service mesh communication (e.g., in Istio), not a serverless framework for scaling functions to zero.
Which TWO of the following are principles of the 12-factor app? (Choose two.)
Config is a 12-factor principle.
Why this answer
Config is a core principle of the 12-factor app methodology, which mandates strict separation of configuration from code. Configuration (such as database URLs, credentials, or hostnames) must be stored in environment variables, not hardcoded in the application source. This allows the same codebase to be deployed across different environments (development, staging, production) without modification, adhering to the principle of config-driven behavior.
Exam trap
CNCF often tests the 12-factor app principles by pairing a correct principle like 'Config' with a plausible-sounding but incorrect option like 'Stateful sessions', exploiting the common misconception that statefulness is acceptable in cloud-native apps when in fact it must be externalized.
In event-driven architecture, what is the role of an event broker?
The broker persists events and routes them to interested consumers.
Why this answer
An event broker acts as a central intermediary that receives events from producers, stores them durably (often in a log or queue), and delivers them to consumers asynchronously. This decouples producers and consumers, allowing them to operate independently without blocking or direct knowledge of each other. Technologies like Apache Kafka, RabbitMQ, or AWS Kinesis exemplify this role by persisting events and enabling replay, fan-out, and load-leveling.
Exam trap
CNCF often tests the distinction between the broker's role (storage and routing) and the consumer's role (processing logic), so candidates mistakenly pick B when they conflate event handling with event brokering.
How to eliminate wrong answers
Option B is wrong because executing business logic in response to events is the role of an event consumer or a serverless function (e.g., AWS Lambda), not the broker itself — the broker only routes and stores events. Option C is wrong because providing a user interface to view events is a monitoring or management tool (e.g., Kafka UI or Confluent Control Center), not a core function of the event broker. Option D is wrong because converting events into HTTP requests is a protocol translation task typically performed by an adapter or gateway (e.g., Kafka REST Proxy), not the event broker's native role — brokers use their own protocols (e.g., Kafka protocol, AMQP) for communication.
Which TWO of the following are benefits of using a service mesh? (Choose two.)
Service mesh captures metrics, traces, and logs for inter-service traffic.
Why this answer
Service mesh provides improved observability and enables traffic management features like canary deployments.
An organization wants to manage infrastructure using code to ensure consistent and repeatable deployments across multiple cloud providers. Which tool is MOST suitable for this multi-cloud Infrastructure as Code approach?
Terraform supports many providers including AWS, Azure, GCP, and others.
Why this answer
Terraform is a cloud-agnostic IaC tool that supports multiple providers, enabling consistent management across clouds.
A development team is designing a new microservices application to run on a Kubernetes cluster. They want to ensure that each microservice can be developed, deployed, and scaled independently. Which cloud native architecture principle are they primarily applying?
Loose coupling allows services to be developed, deployed, and scaled independently.
Why this answer
The principle of loose coupling ensures that each microservice can be developed, deployed, and scaled independently by minimizing dependencies between services. In Kubernetes, this is achieved through well-defined APIs and service boundaries, allowing teams to update or scale one service without affecting others. This directly supports the team's goal of independent lifecycle management for each microservice.
Exam trap
The trap here is that candidates often confuse 'statelessness' with 'loose coupling' because both enable scaling, but statelessness is about session data management, not the architectural independence of service development and deployment.
How to eliminate wrong answers
Option B (Immutable infrastructure) is wrong because it focuses on replacing rather than modifying infrastructure components, which supports consistency and reliability but does not directly address independent development and scaling of microservices. Option C (Statelessness) is wrong because it refers to services not storing session state locally, which aids scalability but is not the primary principle for independent development and deployment; stateful services can also be loosely coupled. Option D (Service discovery) is wrong because it is a mechanism for services to find each other dynamically, which enables loose coupling but is not the principle itself; it is an implementation detail that supports the broader goal of loose coupling.
Which THREE are key characteristics of event-driven architecture? (Choose three.)
Events can fan out to multiple consumers.
Why this answer
Event-driven architecture is based on producing, detecting, and reacting to events, with loose coupling between components and asynchronous communication.
The exhibit shows a Deployment manifest for a frontend service. After deployment, the pods are running but the service reports that no endpoints are available. What is the most likely cause?
If the readiness probe fails, the pod is not considered ready and is removed from service endpoints.
Why this answer
The service reports no endpoints because the readiness probe is failing. A readiness probe determines whether a pod should receive traffic; if it does not return a 200 OK on the configured path (/ready), the pod is removed from the service’s endpoint list. Since the pods are running (liveness probe passes), the most likely cause is that the /ready endpoint is not serving a successful response.
Exam trap
CNCF often tests the distinction between readiness and liveness probes: candidates confuse a failing liveness probe (which restarts pods) with a failing readiness probe (which removes traffic but keeps the pod running).
How to eliminate wrong answers
Option A is wrong because a short periodSeconds does not cause the probe to overload the container; it merely increases the frequency of checks, and the symptom would be high CPU usage, not missing endpoints. Option C is wrong because the readiness probe is checking /ready, not /healthz; the absence of /healthz is irrelevant unless that path is configured. Option D is wrong because a failing liveness probe would restart the pod, but the pods are running, so the liveness probe is passing.
Which component of an API gateway pattern is responsible for routing requests to the appropriate microservice based on the request path?
The API gateway routes, enforces policies, and aggregates responses.
Why this answer
The API gateway acts as a reverse proxy and routes requests to the correct backend service.
Which TWO of the following are principles of the 12-factor app methodology? (Choose two.)
This is the 'Disposability' factor.
Why this answer
The 12-factor app includes 'Config' (store config in environment variables) and 'Disposability' (start fast and shut down gracefully). 'Monolithic architecture' is not a principle; 12-factor encourages microservices. 'Stateful sessions' are discouraged; apps should be stateless. 'Manual deployment' is not a principle; CI/CD is recommended.
Which of the following is a key difference between a service mesh and an API gateway?
This correctly describes the primary traffic direction each handles.
Why this answer
Service mesh focuses on internal service-to-service communication within the cluster, while API gateway handles external traffic entering the cluster (north-south traffic). Both can perform traffic management, but their scopes differ.
A developer wants to deploy a function that reacts to image upload events in a cloud storage bucket. The function should scale to zero when idle. Which architecture best fits this use case?
FaaS platforms are event-driven and automatically scale to zero when idle.
Why this answer
FaaS (Function-as-a-Service) platforms like AWS Lambda are event-driven and can scale to zero when idle, making them ideal for sporadic event-triggered workloads.
Which of the following is a benefit of using a service mesh?
These are primary benefits.
Why this answer
A service mesh provides observability, traffic management, and security (mTLS) without changing application code. It does not reduce the number of microservices, replace Kubernetes, or provide storage.
Which of the following best describes the GitOps pattern?
GitOps relies on a Git repository and an operator like ArgoCD.
Why this answer
GitOps is a pattern where the entire system's desired state is declared in a Git repository, and an automated controller (such as Argo CD or Flux) continuously reconciles the live cluster state with that declarative configuration. This ensures that Git is the single source of truth, and any drift from the declared state is automatically corrected without manual intervention.
Exam trap
CNCF often tests the misconception that GitOps is simply about storing YAML files in Git or using Git as a trigger for CI/CD, when the defining characteristic is the automated reconciliation loop that enforces the desired state from Git.
How to eliminate wrong answers
Option A is wrong because GitOps relies on declarative configuration, not imperative commands; imperative commands (like kubectl run) are applied directly and are not idempotent or easily reconciled, violating the core GitOps principle of desired state stored in Git. Option B is wrong because Git is not used merely as a backup; it is the single source of truth for the desired state, and the controller actively enforces that state, not just stores copies. Option C is wrong because Git hooks are external triggers for CI/CD pipelines, but GitOps uses a pull-based model where the controller inside the cluster watches the Git repository for changes, not a push-based pipeline triggered by hooks.
Which TWO of the following are benefits of using a multi-cloud strategy? (Select TWO.)
If one cloud fails, workloads can run on another.
Why this answer
A multi-cloud strategy distributes workloads across multiple cloud providers, so if one provider experiences an outage, applications can failover to another provider, improving overall resilience and disaster recovery. Option C is correct because using multiple cloud providers prevents dependency on a single vendor's proprietary services, avoiding vendor lock-in and giving you leverage for pricing and feature negotiations.
Exam trap
The trap here is that candidates confuse multi-cloud with hybrid cloud, assuming multi-cloud automatically improves latency or simplifies compliance, when in fact multi-cloud often increases complexity in both areas.
Which tool is used to manage infrastructure as code and can provision resources across multiple cloud providers?
Terraform supports multiple providers.
Why this answer
Terraform is the correct tool because it is an open-source infrastructure as code (IaC) software tool by HashiCorp that uses declarative configuration files (HCL) to provision and manage resources across multiple cloud providers (AWS, Azure, GCP, etc.) via provider plugins. Unlike single-cloud tools, Terraform's provider architecture allows it to manage heterogeneous environments consistently, making it the standard multi-cloud IaC solution.
Exam trap
CNCF often tests the distinction between configuration management tools (Ansible) and infrastructure provisioning tools (Terraform), leading candidates to pick Ansible because they associate 'automation' with infrastructure, but Ansible lacks native multi-cloud resource lifecycle management and state tracking.
How to eliminate wrong answers
Option A is wrong because Helm is a package manager for Kubernetes that deploys and manages applications on Kubernetes clusters using charts, not a tool for provisioning infrastructure across multiple cloud providers. Option C is wrong because Ansible is primarily a configuration management and automation tool that uses procedural playbooks (YAML) and agentless SSH/PowerShell connections, but it is not designed as a declarative IaC tool for multi-cloud resource provisioning; it focuses on state enforcement on existing servers rather than resource lifecycle management. Option D is wrong because AWS CloudFormation is a native AWS service that provisions resources only within the AWS ecosystem using JSON/YAML templates, and it cannot manage resources across other cloud providers like Azure or GCP.
Ready to test yourself?
Try a timed practice session using only Cloud Native Architecture questions.