KCNA Cloud Native Observability Practice Question
Which tool is commonly used for log aggregation in Kubernetes and is designed to be lightweight?
⚠ Common exam trap
KCNA often tests the observability triad confusion — candidates see 'logs' and pick Fluentd or Grafana, or see 'lightweight' and pick Prometheus, forgetting that Fluent Bit is the purpose-built lightweight log forwarder.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fluent Bit
Fluent Bit is a CNCF-graduated, lightweight log processor and forwarder written in C with a tiny memory footprint (often under 1 MB), specifically designed for high-performance log aggregation in containerized and edge environments. It is commonly deployed as a DaemonSet in Kubernetes to collect container logs from /var/log/containers and ship them to backends like Elasticsearch, Loki, or CloudWatch. Its low resource usage distinguishes it from heavier aggregators like Fluentd.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Fluent Bit
Why this is correct
Fluent Bit is a CNCF log processor and forwarder written in C with a small memory and CPU footprint, designed for constrained environments. It collects container logs and ships them to backends, satisfying the lightweight log aggregation requirement in Kubernetes.
- ✗
Jaeger
Why it's wrong here
Jaeger provides distributed tracing, capturing spans across microservices to diagnose latency; it does not aggregate container logs, so it fails the log-collection requirement. It tempts because it is a lightweight CNCF observability tool, yet its telemetry is trace data, whereas Fluent Bit gathers and ships log streams.
- ✗
Prometheus
Why it's wrong here
Prometheus scrapes and stores numeric time-series metrics; it does not aggregate log lines, so it fails the log-aggregation requirement. It tempts because it is a lightweight CNCF monitoring tool often deployed alongside logging, yet its data model is metrics, whereas Fluent Bit collects and forwards logs.
- ✗
Grafana
Why it's wrong here
Grafana visualises metrics and logs from backends such as Loki; it does not itself aggregate or store log streams, so it fails the lightweight aggregation requirement. It tempts because dashboards display log data, yet Grafana is the presentation layer, whereas Fluent Bit performs the collection and forwarding.
Go deeper
Related to this question
About these practice questions
Courseiva writes every KCNA question from scratch — 930 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.