Kubernetes and Cloud Native Associate (KCNA) #9: Full-Length Practice Exam — 50 Questions with Explanations
19 min read
This is the checkpoint that verifies whether the concepts laid out from #1 through #8 have actually settled into your head. You work through 50 questions matching the domain weights of the real KCNA. This is the final post of the series.
The real KCNA exam is 60 questions, but this mock is scored over 50 questions. The passing line is the same 75%, so 38 correct out of 50 puts you in passing territory.
How to take it #
- Work through it in 60–75 minutes (the real exam is 60 questions in 90 minutes; this mock is sized for 50)
- Answer one question at a time without peeking at the explanation; grade everything at the end
- 38+ correct (75%) puts you in passing territory
- If a domain stands out as weak, loop back to that post and review
Domain distribution #
| Domain | Questions | Range |
|---|---|---|
| Domain 1: Kubernetes Fundamentals (46%) | 23 | Q1 – Q23 |
| Domain 2: Container Orchestration (22%) | 11 | Q24 – Q34 |
| Domain 3: Cloud Native Architecture (16%) | 8 | Q35 – Q42 |
| Domain 4: Cloud Native Observability (8%) | 4 | Q43 – Q46 |
| Domain 5: Cloud Native Application Delivery (8%) | 4 | Q47 – Q50 |
Domain 1: Kubernetes Fundamentals #
Q1. Which component on the control plane stores all cluster state (both desired state and current state)?
Explanation
etcd is the distributed key-value store that holds the entire cluster state. The scheduler places Pods on nodes, the controller-manager runs the controller loops, and the kubelet runs containers on worker nodes — none of which is about storing state.
Q2. Which is the single entry point that every request interacting with the cluster passes through, and the only component that accesses etcd?
Explanation
kube-apiserver is the front door of the control plane that every kubectl, controller, and kubelet request passes through, and it is the only component that reads from and writes to etcd directly. kube-proxy handles a node’s network rules, and the kubelet handles container execution.
Q3. Which control plane component decides which worker node a newly created Pod runs on?
Explanation
kube-scheduler evaluates resource requests, node state, affinity, and more to place a Pod on a node. The kubelet is the agent that actually launches the containers on that node once the placement is done.
Q4. Which agent on a worker node receives the PodSpec from the control plane and makes sure the containers stay running as specified?
Explanation
The kubelet runs on each worker node and continuously ensures the containers are up according to the PodSpec. kube-proxy handles Service traffic routing, and containerd is the runtime that actually runs the containers.
Q5. What is the smallest deployable and manageable execution unit in Kubernetes?
Explanation
The smallest unit Kubernetes schedules and manages is the Pod. Containers run inside Pods; Kubernetes never schedules a container directly and always works in units of Pods.
Q6. When two or more containers sit together inside a single Pod, what do they share? (Choose TWO)
Explanation
Containers in the same Pod share the network namespace (same IP and localhost) and volumes. The image differs per container, and sharing a CPU core number or a single PID 1 is not part of the Pod sharing model.
Q7. Which resource guarantees that a specified number of identical Pod replicas is always kept running?
Explanation
A ReplicaSet maintains the desired number of replicas. A DaemonSet runs one per node, a Job is a one-off task aimed at completion, and a StatefulSet is for stateful workloads that need stable identifiers.
Q8. Compared with a ReplicaSet, what is the key extra capability a Deployment provides?
Explanation
A Deployment manages a ReplicaSet while providing rolling updates and rollback to a previous version. Per-node placement is the DaemonSet’s job, and cron scheduling is the CronJob’s.
Q9. Which resource fits a workload that needs stable network identifiers and ordered, persistent storage, like a database?
Explanation
A StatefulSet guarantees stable Pod names, ordering, and dedicated volumes, which suits stateful applications like databases. Deployment and ReplicaSet assume stateless workloads whose Pods are interchangeable.
Q10. Which resource do you use to run exactly one Pod replica on every (or a specific set of) node in the cluster?
Explanation
A DaemonSet runs one Pod per node, which suits per-node jobs like log collectors and node monitoring agents. A ReplicaSet only guarantees a total replica count, not a distribution across nodes.
Q11. Which resource do you use to automatically run a batch job at a fixed time once a day?
Explanation
A CronJob creates Jobs on a cron-expression schedule. A Job runs once and completes; it does not manage a recurring schedule itself.
Q12. Which resource gives a group of Pods a stable single virtual IP and DNS name and load-balances traffic into the group?
Explanation
A Service gives a set of Pods grouped by a selector a fixed ClusterIP and DNS name and distributes load across them. Ingress is an HTTP routing layer outside the cluster that operates a level above Services.
Q13. What is the default Service type that is reachable only from inside the cluster?
Explanation
ClusterIP is the default type and exposes only an internal cluster IP. NodePort opens a port on each node, LoadBalancer provisions an external load balancer, and ExternalName maps to an external DNS name.
Q14. Which Service type automatically provisions an external load balancer in a cloud environment so the Service is reachable from the internet?
Explanation
The LoadBalancer type creates the cloud provider’s load balancer to receive external traffic. NodePort also opens external access but requires using the node IP and port directly, while ClusterIP is internal-only.
Q15. Which L7 resource routes external HTTP/HTTPS traffic to multiple Services based on host and path rules?
Explanation
Ingress is an L7 resource that routes HTTP/HTTPS traffic to internal Services using host- and path-based rules, and it needs an Ingress Controller to actually function. A Service handles L4-level exposure of a group.
Q16. Which resource stores configuration values (environment variables, config files) in plain text, decoupled from the container image?
Explanation
A ConfigMap stores non-sensitive configuration data in plain text, decoupled from the image. Sensitive information like passwords and tokens goes in a Secret, which is base64-encoded.
Q17. Which of the following correctly describes the most important difference between a ConfigMap and a Secret?
Explanation
A Secret is the resource for sensitive information like passwords, tokens, and keys, applying base64 encoding and extra protections like RBAC and encryption options. Both can be injected as environment variables or volumes, so A is wrong.
Q18. Which resource logically separates a single physical cluster by team or project and prevents name collisions?
Explanation
A Namespace logically partitions a cluster, scoping resource names and applying quotas and access control. Labels and Annotations are key-value metadata attached to resources and do not serve as isolation boundaries.
Q19. Which statement most accurately describes Kubernetes’ operating model?
Explanation
Kubernetes uses a declarative model: you declare the desired state, and the controller loops constantly compare and reconcile the current state. This contrasts with the imperative model where you run steps procedurally by hand.
Q20. Which key-value metadata does a Service use to pick the set of Pods to send traffic to, and a Deployment use to decide which Pods to manage?
Explanation
A Label is key-value metadata attached to a Pod, and a selector is the query that picks the target set of Pods by that Label. Service, ReplicaSet, and Deployment all group targets with this pair. Annotations are for storing extra information, not identification, so they are not selector targets.
Q21. Which probe determines whether a container is ready to receive traffic and removes it from the Service endpoints if it is not ready?
Explanation
When a readiness probe fails, the Pod is taken out of the Service endpoints and receives no traffic. A liveness probe restarts the container on failure, and a startup probe checks the initial boot of apps that are slow to start.
Q22. What action does the kubelet take when a liveness probe fails repeatedly?
Explanation
When a liveness probe fails, the kubelet restarts the container to recover from a deadlock or hung state. Removing it from the Service endpoints is the readiness probe’s behavior.
Q23. What is the standard kubectl command that applies a declaratively written manifest file to the cluster to bring it to the desired state?
Explanation
kubectl apply -f is the standard command that applies a manifest’s declarative state to the cluster. run creates resources imperatively on the fly, exec runs a command inside a container, and describe shows resource details.
Domain 2: Container Orchestration #
Q24. Which contract is the standard interface between the kubelet and the container runtime, letting it communicate the same way regardless of which runtime is used?
Explanation
CRI (Container Runtime Interface) is the standard interface through which the kubelet talks to runtimes like containerd and CRI-O. CNI is for networking, CSI for storage, and OCI for image and runtime format standards — different boundaries.
Q25. Which plugin standard assigns IPs to Pods and configures network connectivity between Pods?
Explanation
CNI (Container Network Interface) is the standard by which plugins like Calico, Cilium, and Flannel configure Pod networking. CRI is the runtime standard, CSI the storage standard, and OCI the image format standard.
Q26. Which standard interface connects external storage systems to Kubernetes to provision and mount volumes?
Explanation
CSI (Container Storage Interface) is the standard by which external storage providers supply volumes to Kubernetes. CRI draws the boundary with runtimes, and CNI with networking.
Q27. Which of the following are CRI-compatible container runtimes commonly used in Kubernetes? (Choose TWO)
Explanation
containerd and CRI-O both implement CRI as container runtimes. Calico is a CNI plugin, etcd is the state store, and Prometheus is a monitoring tool — none of which are runtimes.
Q28. Which standard defines the industry standards for container image format and runtime behavior, making images compatible across multiple tools?
Explanation
OCI standardizes the image format and runtime spec so Docker, containerd, Podman, and others can handle the same image. CRI, CNI, and CSI are the runtime, networking, and storage interfaces inside Kubernetes respectively.
Q29. Which Kubernetes authorization model controls “who can perform which action on which resource” on a role basis?
Explanation
RBAC (Role-Based Access Control) controls the permissions of users and service accounts through Roles, ClusterRoles, and bindings. NetworkPolicy is for traffic control and SecurityContext is for container execution permissions — different from an authentication/authorization model.
Q30. Which resource defines rules that allow or block network traffic between Pods?
Explanation
A NetworkPolicy allows or blocks a Pod’s ingress and egress traffic based on label selectors. Note that enforcing a NetworkPolicy requires a CNI plugin that supports it. Ingress is for external HTTP routing — a different role.
Q31. Which field specifies container- and Pod-level security settings, such as running a container as a non-root user or blocking privilege escalation?
Explanation
A SecurityContext holds container- and Pod-level security settings like runAsNonRoot, readOnlyRootFilesystem, and capability restrictions. RBAC handles API permissions and NetworkPolicy handles network traffic.
Q32. Which pair correctly matches the actual storage resource an admin provisions in advance with the resource a user uses to request a needed capacity and access mode?
Explanation
A PV is the actual storage resource and a PVC is the user’s storage request. A PVC binds to a PV that meets its conditions, and the Pod then uses the volume. The other pairs are configuration, networking, and permissions — different areas.
Q33. What is the layer that handles service-to-service communication with mTLS encryption, traffic management, and observability without changing application code?
Explanation
A Service Mesh (Istio, Linkerd, etc.) uses sidecar proxies to add mTLS, traffic routing, and observability to service-to-service communication without code changes. An Ingress Controller handles external ingress routing, and CNI handles basic networking.
Q34. What is the name of the pattern in a Service Mesh where a proxy is deployed alongside each application Pod to intercept its traffic?
Explanation
A Service Mesh uses the sidecar pattern, attaching a proxy (e.g., Envoy) to each Pod to intercept and manage communication. An init container runs once and exits before the main container starts — a different role.
Domain 3: Cloud Native Architecture #
Q35. Which component automatically scales the number of a workload’s Pod replicas up or down based on a metric like CPU utilization?
Explanation
HPA adjusts the replica count (horizontal direction) according to load. VPA adjusts a Pod’s CPU and memory requests (vertical direction), and Cluster Autoscaler adjusts the number of nodes.
Q36. Which component automatically adjusts an individual Pod’s CPU and memory requests and limits to match its usage pattern?
Explanation
VPA (Vertical Pod Autoscaler) adjusts a Pod’s resource requests and limits vertically. It is distinguished from HPA, which handles replica count, and Cluster Autoscaler, which handles node count.
Q37. Which component adds nodes from the cloud when Pods end up Pending because there is not enough node capacity to schedule them?
Explanation
Cluster Autoscaler adds nodes when Pods are Pending with nowhere to be placed, and shrinks when nodes are empty to save cost. HPA and VPA handle Pod-level scaling.
Q38. Which cloud native execution model runs a function only when a request comes in and scales down to zero when idle to cut cost?
Explanation
Serverless (FaaS, Function as a Service) runs functions in an event-driven way and scales down to zero when idle. On Kubernetes, Knative is the representative serverless platform.
Q39. Which representative CNCF project provides serverless workloads and scale-to-zero on top of Kubernetes?
Explanation
Knative provides serverless deployment, autoscaling (down to zero), and event handling on top of Kubernetes. Prometheus is for monitoring, ArgoCD for GitOps, and Envoy is a proxy — different areas.
Q40. Which lists the CNCF project maturity levels correctly from lowest to highest?
Explanation
The CNCF maturity levels go Sandbox (early) → Incubating (growing) → Graduated (mature). Kubernetes, Prometheus, Envoy, and others are at the Graduated level.
Q41. Which of the following is hard to consider a core characteristic of cloud native architecture?
Explanation
Cloud native aims for microservices, self-healing, and declarative automation. Forcibly bundling into a monolith is the opposite direction, so it is hard to consider a core characteristic.
Q42. Which CNCF open-standard project standardizes how observability data (metrics, logs, traces) is generated and collected so you are not locked into a specific vendor?
Explanation
OpenTelemetry is a vendor-neutral project that standardizes the collection and transmission of telemetry data. Prometheus focuses on metric storage and querying, Jaeger on the tracing backend, and Fluentd on log collection — each on a specific area.
Domain 4: Cloud Native Observability #
Q43. Which correctly groups the three pillars of observability?
Explanation
The three pillars of observability are metrics, logs, and traces. SLI, SLO, and SLA are a reliability-target metric system, and CPU and memory are just one example of a metric.
Q44. Which monitoring tool, the most widely used in cloud native, collects and stores time-series metrics and queries them with PromQL?
Explanation
Prometheus collects and stores time-series metrics via a pull model and queries them with PromQL. Jaeger is for distributed tracing, Fluentd for log collection, and Grafana for visualization dashboards — the roles are split.
Q45. Which observability data follows the full path of a request as it passes through multiple microservices, along with the latency of each segment, to find bottlenecks?
Explanation
A distributed trace stitches together the path a request takes through the services and the time spent in each segment. Metrics are aggregate numbers and logs are records of individual events, neither of which traces the end-to-end path of a single request.
Q46. What is the practice of making resource usage visible and reducing waste to manage cost in a cloud native environment called?
Explanation
FinOps is the practice of cloud cost visibility and optimization, using tools like Kubecost. GitOps is Git-based deployment and DevSecOps is security-integrated dev and ops — their focus is different from cost management.
Domain 5: Cloud Native Application Delivery #
Q47. Which operating approach uses a Git repository as the single source of the desired state and automatically syncs cluster state to match it?
Explanation
GitOps puts Git as the single source of truth for the desired state, and an agent continuously syncs the cluster to that state. Changes always go through a Git commit or PR, which makes auditing and rollback easy.
Q48. Which of the following correctly groups the representative CNCF tools that implement GitOps? (Choose TWO)
Explanation
ArgoCD and Flux are the representative GitOps tools that sync Git state to the cluster. Helm is for package management, Prometheus for monitoring, and Istio is a Service Mesh — none of which handle GitOps syncing itself.
Q49. In GitOps, what is the most appropriate reason operators go only through Git changes instead of making imperative changes to the cluster directly with kubectl?
Explanation
The key benefit of GitOps is that every change goes through one place — Git — making history, review, and rollback possible. Modifying the cluster directly creates drift from the Git state and breaks automatic syncing.
Q50. What is the umbrella term for a pipeline that automatically builds and tests code changes and then automates deployment as well?
Explanation
CI/CD is an automation pipeline that bundles Continuous Integration and Continuous Delivery/Deployment. RBAC is for permissions, CRD is a custom resource, and CRI is the runtime interface — different areas.
Scoring #
Total Score
Correct 0 / 0
Answered 0 / 0
| Score range | Verdict | Next step |
|---|---|---|
| 45+ (90%+) | Very stable. Book the exam | Take the exam |
| 38–44 (76–88%) | Passing zone. One more loop on weak domains | Re-read weak-domain posts #2–#8 |
| 30–37 (60–74%) | Not there yet. Focused study on weak domains | Two weak domains plus another mock |
| 29 or fewer | Need another full loop | Re-read the entire series |
Per-domain score analysis #
Count correct answers per domain to find your weak spots.
| Domain | Questions | Target (75%) | Review if short |
|---|---|---|---|
| Domain 1 (Q1–Q23) | 23 | 17+ | #2 , #3 |
| Domain 2 (Q24–Q34) | 11 | 8+ | #4 |
| Domain 3 (Q35–Q42) | 8 | 6+ | #5 |
| Domain 4 (Q43–Q46) | 4 | 3+ | #6 |
| Domain 5 (Q47–Q50) | 4 | 3+ | #7 |
Securing your score in Domain 1, the largest at 46%, is the key to passing. Domain 1 and Domain 2 together make up 68% of the total, so if these two are shaky, clearing the passing score with the other three domains alone is difficult.
If you cleared the passing line #
- If you got 38 or more correct, you are in passing territory. Go book the exam (Linux Foundation training portal)
- Right before you sit, skim the exam tips and frequently missed patterns in #8 one last time
- Pick an exam date within the next 1–2 weeks while study momentum is still high
- Finish the online-proctored (PSI) environment check the day before the exam
If you didn’t clear the passing line #
- Look at the per-domain score and start re-organizing from the weakest domain
- Re-read that post in the series, focusing on the tables, mappings, and trap sections
- Try other question patterns from the official KCNA study materials provided by CNCF
- Retake this mock about a week later to check your progress
Series wrap-up #
All nine posts of the KCNA series are done. Here is what this series built:
- #1 — Exam structure and study strategy
- #2 — Domain 1 architecture and core resources
- #3 — Domain 1 API, containers, scheduling
- #4 — Domain 2 runtime, security, networking, storage, Service Mesh
- #5 — Domain 3 autoscaling, serverless, community, open standards
- #6 — Domain 4 telemetry, Prometheus, cost management
- #7 — Domain 5 GitOps, CI/CD
- #8 — Exam tips and frequently missed patterns
- #9 — 50-question mock exam ← This post
If the 26-post K8s practical track built the hands-on feel of working with minikube and kubectl, this series layered on the vocabulary that turns that feel into multiple-choice exam answers. After passing KCNA, the next step is the hands-on CKAD (app developer) and CKA (cluster administrator) certifications where you work the cluster directly from the terminal — each will be organized into its own standalone series.
Good luck with the exam.