CCNA Kcna Cloud Native Arch Questions

Option D is correct because the circuit breaker pattern is a stability pattern that monitors for failures and prevents a service from making requests to a failing downstream service, allowing it to recover. When the failure rate exceeds a threshold (e.g., 50% of requests fail within a 10-second sliding window), the circuit 'opens' and subsequent calls fail immediately without consuming resources. This prevents cascading failures and resource exhaustion in distributed systems like Kubernetes or Spring Cloud.

The liveness probe failure is caused by the database service being unreachable, which prevents the application from completing its health check. When the database is down or network connectivity is lost, the application's health endpoint returns a non-200 status code, causing Kubernetes to restart the container. The 3 restarts indicate repeated probe failures, and the logs show connection errors to the database, confirming this as the root cause.

Apache Kafka with idempotent producers and transactional APIs is the correct choice because it provides exactly-once semantics (EOS) for bursty IoT data in a cloud-native architecture. Kafka's transactional API ensures atomic writes across partitions, while idempotent producers prevent duplicate records from retries, meeting the fault-tolerance and exactly-once requirements. Kafka also scales horizontally and handles high-throughput bursts natively, aligning with cloud-native principles.

FaaS enables functions to scale automatically from zero based on demand, often event-driven.

Knative Serving supports scale-to-zero, automatically scaling down pods when they are not receiving requests. This is a key feature of serverless on Kubernetes.

IaC is the practice of managing and provisioning infrastructure through machine-readable definition files, rather than manual processes.

Prometheus and Envoy are both CNCF graduated projects. CoreDNS is also graduated, but the question asks for two; Fluentd and Helm are both graduated as well, but the correct answers here are Prometheus and Envoy.

Cloud-native architectures leverage microservices, containers, dynamic orchestration, and DevOps to enable scalable, resilient applications.

The 'kubectl apply' command is used to apply or update resources from a manifest file.

The CNCF hosts and nurtures open-source, vendor-neutral cloud native projects, fostering their growth and adoption.

Terraform is a popular IaC tool for provisioning infrastructure across multiple cloud providers.

In a service mesh, the sidecar container (typically an Envoy or Linkerd proxy) is injected alongside the main application container to intercept and manage all inbound and outbound network traffic. This allows the service mesh to enforce traffic policies, handle service discovery, implement retries and circuit breaking, and collect telemetry without modifying the application code. The sidecar operates at the network layer (L4/L7), decoupling communication concerns from business logic.

Option D (Retry) is correct because intermittent failures when calling an external API are typically transient faults (e.g., network glitches, temporary service unavailability). The Retry pattern automatically reattempts the failed operation a configured number of times, often with exponential backoff, to overcome these short-lived issues without changing the application's overall architecture. This directly addresses the scenario's requirement to handle transient faults.

The 12-factor app methodology emphasizes treating logs as event streams, not files, to enable centralized processing.

The CNCF has three maturity levels: sandbox (early-stage), incubating (growing), and graduated (mature). Sandbox projects are early-stage and have accepted the CNCF Code of Conduct.

Envoy is the correct answer because it is the sidecar proxy component in Istio that handles all inter-service communication. It intercepts traffic between microservices and applies routing, load balancing, and security policies defined by the control plane. Envoy runs as a sidecar container alongside each service instance, managing inbound and outbound traffic at the L4/L7 layer.

Option D is correct because implementing circuit breakers in the frontend service for calls to the order service prevents cascading failures by monitoring failure rates and automatically tripping the circuit when the order service becomes slow or unresponsive. This stops the frontend from exhausting its thread pools waiting for timeouts, allowing it to fail fast and return a fallback response. Circuit breakers are a proven resilience pattern in cloud-native architectures, especially for synchronous HTTP REST calls where latency spikes can propagate.

A service mesh, such as Istio or Linkerd, provides a dedicated infrastructure layer for handling service-to-service communication. In a multi-cloud architecture, its common use case is to enable secure, observable, and resilient communication between services running in different Kubernetes clusters across clouds, using mutual TLS (mTLS) for encryption and traffic policies for routing.

The liveness probe is configured to check TCP on port 8080, but the container exposes port 80 for Nginx. Since the probe will never successfully connect to port 8080, it always fails, causing the container to be restarted repeatedly. The probe must target the same port that the application is listening on.

Option B is correct because a service mesh, such as Istio or Linkerd, transparently enables mutual TLS (mTLS) encryption between service sidecar proxies without requiring application code changes. This ensures all inter-service communication is encrypted and authenticated, which is a core security benefit in a zero-trust cloud-native architecture.

Argo CD is a CNCF graduated project for GitOps on Kubernetes.

Prometheus is a graduated CNCF project, having reached the graduation maturity level in August 2018. It is a core monitoring and alerting toolkit widely adopted in cloud-native environments, and its graduation status reflects its stability, widespread use, and strong governance within the CNCF ecosystem.

A message broker (like Kafka or RabbitMQ) receives and forwards events. An API gateway routes HTTP requests, a service mesh handles service-to-service communication, and a load balancer distributes network traffic.

A service mesh provides observability (metrics, tracing), traffic management (routing, load balancing), and security (mTLS) without requiring changes to application code. It does not directly manage storage or scaling.

The 12-factor app recommends strict separation of config from code, storing config in environment variables.

Kubernetes is the correct answer because it is the only CNCF project at the 'Graduated' maturity level that is specifically designed and widely adopted for container orchestration. It automates deployment, scaling, and management of containerized applications, making it the de facto standard in cloud-native environments.

The circuit breaker pattern prevents an application from repeatedly trying to execute an operation that is likely to fail, allowing it to recover gracefully.

The 12-factor app includes principles such as explicit dependency declaration (Dependencies) and strict separation of config from code (Config).

Factor III of the 12-factor app methodology states that config should be stored in environment variables to keep it separate from code.

The Graduated maturity level is the highest in the CNCF project lifecycle, indicating that a project has successfully adopted CNCF governance, demonstrated long-term stability, and is considered safe for production use. This requires meeting rigorous criteria including adoption by multiple end users, a defined governance structure, and completion of a security audit.

Infrastructure automation (B) is a key principle of cloud native architecture because it enables consistent, repeatable, and error-free provisioning and management of infrastructure through code (e.g., Terraform, AWS CloudFormation, Ansible). This aligns with the cloud native goal of reducing manual toil and enabling rapid, reliable deployments. Microservices (C) is also a core principle, as it structures applications as a collection of loosely coupled, independently deployable services that can be scaled and updated individually, which is fundamental to cloud native agility and resilience.

The CNCF's mission is to make cloud native computing ubiquitous by fostering and sustaining open source projects that follow cloud native principles.

Option C is correct because a service mesh, such as Istio or Linkerd, provides fine-grained traffic control through features like traffic splitting, header-based routing, and weighted load balancing. This enables canary deployments by directing a small percentage of traffic to a new version of a service, allowing safe testing in production without affecting all users.

Option D is correct because the 12-factor app methodology mandates strict separation of config from code. Config includes things like database connection strings, API keys, and environment-specific values that vary between deployments. Storing these in environment variables (or external config files not checked into version control) ensures that the same codebase can be deployed to different environments without modification, which is a core principle for cloud-native portability and security.

The CNCF hosts, supports, and sustains open-source cloud-native projects, ensuring they are vendor-neutral and fostering community collaboration. It does not develop projects itself but provides a governance model.

The bulkhead pattern isolates resources to prevent failure propagation. Circuit breaker stops calls after failures, retry reattempts, and timeout limits wait time.

Automated CI/CD pipelines are a key principle of cloud-native architecture because they enable rapid, reliable, and repeatable delivery of microservices. By automating build, test, and deployment stages, teams can achieve continuous integration and continuous delivery, which aligns with the cloud-native goals of agility, scalability, and resilience. This automation reduces human error and accelerates the feedback loop, essential for managing distributed systems in dynamic cloud environments.

Option D is correct because a GitOps workflow relies on an operator (such as Argo CD or Flux) that continuously reconciles the actual cluster state with the desired state declared in a Git repository. This operator automatically detects drift and applies changes to ensure the cluster matches the Git source, which is the core feedback loop of GitOps.

Event-driven architecture decouples producers and consumers via an event broker (e.g., message queue or event bus), enabling asynchronous communication. Direct synchronous calls would couple them.

ArgoCD and Flux are two popular GitOps tools that automate deployment of applications from Git repositories.

Option B is correct because a service mesh provides advanced traffic management capabilities such as fine-grained routing, canary deployments, and circuit breaking through sidecar proxies (e.g., Envoy). These capabilities allow operators to control traffic flow between microservices without modifying application code, enabling resilient and observable communication patterns.

First deploy the app, then define and create the LoadBalancer service, retrieve the IP, and access it.

Terraform is a widely used IaC tool that allows declarative definition of infrastructure across multiple cloud providers.

Factor III (Config) states that configuration should be stored in environment variables to decouple it from code.

The CNCF fosters the adoption of cloud-native technologies by hosting and nurturing open-source projects like Kubernetes, Prometheus, and Envoy.

Option C is correct because it uses a golden AMI built with Packer to create identical, immutable nodes that are reproducible via Auto Scaling groups and launch templates. This approach ensures that every EC2 instance launched has the exact same kernel parameters, packages, and configuration, eliminating configuration drift. Instance refresh allows rolling updates to the AMI without manual intervention, aligning with the goal of immutable infrastructure.

Option C is correct because a MutatingAdmissionWebhook intercepts Pod creation requests and automatically injects a sidecar container (e.g., Envoy or Linkerd-proxy) into the Pod spec. This is the standard mechanism used by service mesh control planes like Istio and Linkerd to transparently add the proxy without modifying application manifests.

The event broker (e.g., Apache Kafka, RabbitMQ, or AWS EventBridge) acts as an intermediary that receives events from producers and forwards them to consumers. By decoupling the two, the producer does not need to know the consumer's location or status, and the consumer does not need to be actively listening when the event is published. This enables asynchronous, scalable, and fault-tolerant communication in event-driven architectures.

GitOps is a practice where the entire system state is described declaratively in Git, and automated tools synchronize the cluster to match. ArgoCD and Flux are popular GitOps tools.

A service mesh provides observability, traffic management, and security for microservices communication, offloading these concerns from application code.

Terraform (B) is an Infrastructure as Code (IaC) tool that uses declarative configuration files (HashiCorp Configuration Language, HCL) to define and provision cloud and on-premises resources. It manages the full lifecycle of infrastructure through a state file and provider plugins, enabling version-controlled, repeatable deployments.

The Retry pattern is a fundamental resiliency mechanism in cloud-native applications. When a transient failure occurs (e.g., a network timeout or a temporary database unavailability), the application automatically reattempts the failed operation. This pattern is often implemented with exponential backoff and jitter to avoid overwhelming the downstream service, as seen in libraries like Netflix Hystrix or Kubernetes client-go retry logic.

Knative scales to zero when idle, meaning no pods are running, thus no cost incurred.

Service mesh provides traffic management (routing, canary releases), observability (metrics, tracing), and security (mTLS, authorization). Auto-scaling is handled by Horizontal Pod Autoscaler or custom metrics, not by the service mesh. Service discovery is often built into Kubernetes itself, though service mesh can enhance it, but it's not a core feature.

The Kubernetes API server provides a consistent interface regardless of the underlying infrastructure. Namespaces organize resources, Services provide networking abstractions, and ConfigMaps store configuration.

The bottleneck is caused by the database being CPU-bound, meaning it cannot process requests fast enough. Implementing read replicas offloads read queries from the primary database, reducing its CPU load and allowing it to handle write operations more efficiently. The application can be configured to route read operations to the replicas, which directly addresses the latency caused by waiting on database responses.

Knative is a Kubernetes-based platform to build, deploy, and manage serverless workloads that can scale to zero. AWS Lambda is a proprietary offering, not CNCF. OpenFaaS and Kubeless are also serverless frameworks but Knative is the most prominent CNCF serverless project.

Terraform and Pulumi are popular IaC tools that allow infrastructure provisioning via code.

Knative Serving uses the 'Service' resource to manage serverless workloads. 'Deployment' is a lower-level resource, 'Function' is not a Kubernetes resource, and 'Pod' is too granular.

Knative is the correct answer because it is a CNCF project built on Kubernetes that provides a serverless platform specifically designed to scale workloads to zero when not in use. It achieves this through its Serving component, which automatically scales pods down to zero replicas based on traffic, and scales up from zero on the first request, enabling true serverless behavior.

Config is a core principle of the 12-factor app methodology, which mandates strict separation of configuration from code. Configuration (such as database URLs, credentials, or hostnames) must be stored in environment variables, not hardcoded in the application source. This allows the same codebase to be deployed across different environments (development, staging, production) without modification, adhering to the principle of config-driven behavior.

An event broker acts as a central intermediary that receives events from producers, stores them durably (often in a log or queue), and delivers them to consumers asynchronously. This decouples producers and consumers, allowing them to operate independently without blocking or direct knowledge of each other. Technologies like Apache Kafka, RabbitMQ, or AWS Kinesis exemplify this role by persisting events and enabling replay, fan-out, and load-leveling.

Service mesh provides improved observability and enables traffic management features like canary deployments.

Terraform is a cloud-agnostic IaC tool that supports multiple providers, enabling consistent management across clouds.

The principle of loose coupling ensures that each microservice can be developed, deployed, and scaled independently by minimizing dependencies between services. In Kubernetes, this is achieved through well-defined APIs and service boundaries, allowing teams to update or scale one service without affecting others. This directly supports the team's goal of independent lifecycle management for each microservice.

Event-driven architecture is based on producing, detecting, and reacting to events, with loose coupling between components and asynchronous communication.