KCNA Cloud Native Architecture Practice Question
In a service mesh architecture, which component is responsible for intercepting and managing traffic between microservices?
⚠ Common exam trap
KCNA often tests the distinction between the control plane (management) and data plane (traffic interception), causing candidates to incorrectly choose the control plane as the component that handles traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sidecar proxy
In a service mesh, the sidecar proxy is deployed alongside each microservice instance and transparently intercepts all inbound and outbound network traffic. It enforces policies, collects telemetry, and manages routing without requiring changes to the application code. The control plane configures these proxies but does not handle the actual data path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Control plane
Why it's wrong here
The control plane distributes configuration and policy to proxies; it does not intercept or forward service-to-service packets itself. It is tempting because it governs mesh behaviour, yet actual traffic interception and management occur in the data plane's sidecar proxies.
- ✗
API gateway
Why it's wrong here
An API gateway handles north-south traffic entering the cluster from external clients, not east-west traffic between internal microservices. It is tempting because it also proxies and applies policy, but mesh interception is done by sidecar proxies deployed with each service.
- ✗
Service registry
Why it's wrong here
A service registry only stores service endpoint locations for discovery; it does not sit in the data path or proxy requests. It is tempting because discovery underpins mesh routing, but interception and traffic management are performed by the sidecar proxy alongside each service instance.
- ✓
Sidecar proxy
Why this is correct
A sidecar proxy runs alongside each microservice instance, transparently intercepting all inbound and outbound network traffic. This satisfies the service mesh requirement for per-service traffic management, since the sidecar enforces routing, retries, mutual TLS and telemetry policies without modifying application code.
Go deeper
Related to this question
Learn chapter
Cloud Native Architecture and Concepts
Key term
Service Mesh
A service mesh is a dedicated infrastructure layer that manages communication between microservices, handling tasks like service discovery, load balancing, encryption, and observability without requiring changes to application code.
About these practice questions
Courseiva writes every KCNA question from scratch — 930 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.