KCNA Cloud Native Observability Practice Question
Which log aggregation tool is designed specifically for Kubernetes and is often used as a lightweight alternative to Fluentd?
⚠ Common exam trap
Many exam-takers confuse the collector/forwarder role with the storage/backend role; candidates who know Loki or Elasticsearch from dashboards may pick them, forgetting the question asks for a lightweight log shipper designed for Kubernetes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fluent Bit
Fluent Bit is a CNCF-graduated, lightweight log processor and forwarder written in C with a small memory footprint, explicitly designed for containerized and Kubernetes environments. It is commonly deployed as a DaemonSet to collect node and pod logs and forward them to backends like Elasticsearch, Loki, or S3. Its low resource usage makes it the standard 'lightweight alternative to Fluentd' in Kubernetes logging stacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Logstash
Why it's wrong here
Logstash is a general-purpose pipeline that ingests from many sources via plugins, but it is not Kubernetes-native and carries a JVM footprint, so it fails the "designed specifically for Kubernetes" and "lightweight" criteria. It is tempting because it is the classic ELK shipper for VM and application logs.
- ✓
Fluent Bit
Why this is correct
Fluent Bit is a CNCF-hosted, C-based log processor and forwarder built for containerised environments, with a far smaller memory and CPU footprint than Fluentd. That lightweight design makes it the common Kubernetes alternative to Fluentd for node-level log collection.
- ✗
Loki
Why it's wrong here
Loki is Grafana's log aggregation system, but it is not the lightweight Fluentd alternative the question describes; that role belongs to Fluent Bit, a CNCF project using the same plugin model with far lower memory use.
- ✗
Elasticsearch
Why it's wrong here
Elasticsearch is a search and analytics engine storing indexed logs, not a Kubernetes-native aggregator with a Fluentd-compatible lightweight agent. It would be correct as the storage and query backend behind a collector such as Fluent Bit.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every KCNA question from scratch — 930 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.