KCNA Container Orchestration Practice Question
Which TWO statements about container images are correct? (Choose two.)
⚠ Common exam trap
CNCF often tests the misconception that images are stored directly on the host filesystem like regular files, when in reality they are stored in a runtime-managed cache (e.g., /var/lib/docker) and are not directly accessible as ordinary files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Each layer is identified by a unique hash
Each layer in a container image is identified by a unique content-addressable hash (typically a SHA-256 digest). This hash is computed from the layer's contents and metadata, ensuring integrity and enabling layer caching and deduplication across images. The hash is used in the image manifest (as defined by the OCI Image Specification) to reference each layer uniquely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Images are always pulled from a private registry
Why it's wrong here
Images can be pulled from public registries like Docker Hub.
- ✓
Each layer is identified by a unique hash
Why this is correct
Layers are content-addressable and identified by their digest.
- ✗
Images can be modified at runtime by writing to the container layer
Why it's wrong here
At runtime, the container has a writable layer, but the image itself is immutable.
- ✓
Images are built from a series of read-only layers
Why this is correct
Images are composed of layers that are stacked.
- ✗
Images are stored on the host filesystem after being pulled
Why it's wrong here
Images are stored in the local image cache, but this is not a defining statement; they are also stored in registries.
Go deeper
Related to this question
About these practice questions
This KCNA question is part of Courseiva's 833-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO statements about container images are correct? (Choose two.)
medium- A.Container images include a full operating system kernel
- ✓ B.Container images can be stored in a registry like Docker Hub
- ✓ C.Container images are built from a series of layers
- D.Container images are immutable once built
- E.Container images can only be built on Linux
Why B: Container images are built in layers and can be stored in registries. They are not immutable once built (they can be overwritten), and they include only the application and dependencies, not a full OS kernel.
Variation 2. Which TWO of the following are true about container images? (Choose 2)
easy- A.Container images include a full operating system kernel
- ✓ B.Container images are immutable once created
- C.Container images are stored in a container registry
- ✓ D.Container images consist of read-only layers
- E.Container images are built using a Dockerfile
Why B: Container images are immutable once created (B) and consist of read-only layers (D). They do not include a full OS kernel (A); they share the host kernel. While images are often stored in registries (C), this is not an inherent property of the image itself; images can exist locally without being in a registry. A Dockerfile is used to build an image but is not part of the image (E).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.