KCNA Cloud Native Architecture Practice Question
You are a platform engineer at a fast-growing startup. The company runs a Kubernetes cluster with 50 worker nodes for its production microservices. Recently, the operations team has been struggling with manual configuration drift: developers SSH into nodes to install debugging tools, and some nodes have different kernel parameters or installed packages. This has caused intermittent outages when a pod is scheduled onto a non-standard node. The CTO wants a solution that ensures each node is identical, immutable, and reproducible. The cluster uses kubeadm for bootstrapping and runs on AWS EC2. Which approach best achieves the goal of immutable nodes?
⚠ Common exam trap
Many exam-takers confuse configuration management (Option A) with immutability, not realizing that periodic enforcement still allows drift and does not guarantee identical nodes at all times.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a golden AMI using Packer with all required configurations, then use Auto Scaling groups with a launch template that references the AMI and enable instance refresh for updates.
It uses a golden AMI built with Packer to create identical, immutable nodes that are reproducible via Auto Scaling groups and launch templates. This approach ensures that every EC2 instance launched has the exact same kernel parameters, packages, and configuration, eliminating configuration drift. Instance refresh allows rolling updates to the AMI without manual intervention, aligning with the goal of immutable infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a configuration management tool like Ansible to enforce desired state on each node via periodic runs.
Why it's wrong here
Ansible runs are imperative and can drift or fail; they also allow manual changes between runs.
- ✗
Apply Kubernetes node labels and taints to categorize nodes and prevent workloads from running on non-standard nodes.
Why it's wrong here
Labels and taints do not prevent configuration drift; they only control pod scheduling.
- ✓
Create a golden AMI using Packer with all required configurations, then use Auto Scaling groups with a launch template that references the AMI and enable instance refresh for updates.
Why this is correct
A golden AMI provides an identical, immutable base. Instance refresh replaces nodes rather than modifying them.
- ✗
Deploy a DaemonSet that runs a privileged container to enforce node configuration and remove debugging tools.
Why it's wrong here
A DaemonSet cannot modify kernel parameters or system packages reliably, and it does not prevent SSH access.
Go deeper
Related to this question
About these practice questions
One of 833 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.