KCNA Kubernetes Fundamentals Practice Question
Which Kubernetes control plane component is the primary entry point for all administrative tasks and serves the Kubernetes API?
⚠ Common exam trap
CNCF often tests the misconception that etcd is the primary entry point because it stores all cluster data, but the trap here is that etcd is a data store, not an API endpoint — all interactions must go through the kube-apiserver, which is the only component that communicates directly with etcd.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kube-apiserver
The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative operations. It exposes the Kubernetes REST API, validates and processes requests (including authentication, authorization, and admission control), and updates the corresponding objects in etcd. Without the API server, no kubectl command, automation, or internal component communication can occur.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kube-scheduler
Why it's wrong here
kube-scheduler assigns pending pods to nodes by evaluating resource requests and constraints; it exposes no API endpoint for administrative requests. It is the component to examine when pods remain Pending because of taints, affinity rules or insufficient capacity.
- ✗
kube-controller-manager
Why it's wrong here
kube-controller-manager runs reconciliation loops that drive cluster state toward the declared spec; it does not expose the API server endpoint that kubectl and other clients call. It is the right component when diagnosing failed deployments, replica or node lifecycle controllers.
- ✓
kube-apiserver
Why this is correct
kube-apiserver serves the Kubernetes API and is the sole entry point for administrative tasks, validating and persisting every request to etcd. It satisfies the stem's requirement for the primary administrative entry point exposing the Kubernetes API.
- ✗
etcd
Why it's wrong here
etcd stores the cluster's key-value state and is accessed only by the API server, not by administrators directly, so it cannot serve as the administrative entry point. It is the correct focus when investigating quorum loss or backing up cluster state.
Go deeper
Related to this question
About these practice questions
This KCNA question is part of Courseiva's 930-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which Kubernetes control plane component is the entry point for all REST API requests?
easy- A.kube-controller-manager
- ✓ B.kube-apiserver
- C.kube-scheduler
- D.etcd
Why B: The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all REST API requests. It validates and processes API calls (e.g., via kubectl, client libraries, or internal components) before persisting state to etcd or triggering other controllers. No other component directly exposes an API endpoint for external or internal management operations.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.