300+ exam grade questions across every domain, powered by AI assisted learning that gives you instant feedback and a clear explanation on every question.
What is the smallest deployable unit of computing that you can create and manage in Kubernetes?
Pick an answer to reveal the explanation.
A Pod is the smallest deployable unit in Kubernetes. It is a group of one or more containers that share networking and storage. Containers run inside Pods, Deployments manage Pods, and Nodes are the worker machines that host Pods.
Which Kubernetes object should you use to declaratively run a stateless application with a specified number of identical Pod replicas, automatic rolling updates, and easy rollback?
Pick an answer to reveal the explanation.
A Deployment is the recommended object for stateless applications. It manages ReplicaSets under the hood and provides declarative updates, rolling updates, rollback, and pause/resume features. ReplicaSet only ensures pod count, DaemonSet runs one pod per node, and StatefulSet is for stateful workloads with stable identities.
A team needs to expose a web application running in their Kubernetes cluster to external users over the internet using a cloud provider load balancer. Which Service type should they use?
Pick an answer to reveal the explanation.
The LoadBalancer service type provisions a cloud provider load balancer (such as AWS ELB or GCP Cloud Load Balancing) and routes external traffic to Pods. ClusterIP is internal only, NodePort exposes a static port on every node IP without true load balancing, and ExternalName maps a service to an external DNS name.
What is the primary purpose of Kubernetes namespaces?
Pick an answer to reveal the explanation.
Namespaces provide a mechanism to divide cluster resources between multiple users, teams, or applications. They are virtual clusters within a physical cluster. Network isolation requires NetworkPolicies, sensitive data is stored in Secrets, and container images are stored in registries.
A developer wants to list all Pods in the "production" namespace using kubectl. Which command is correct?
Pick an answer to reveal the explanation.
The correct syntax is "kubectl get pods --namespace=production" (or the shorthand "-n production"). "kubectl list" is not a valid command, "describe" shows details of a single resource, and the last option is not valid syntax.
Which Kubernetes object should you use to store database connection passwords that will be injected into Pods at runtime?
Pick an answer to reveal the explanation.
Secrets are designed to hold sensitive data such as passwords, OAuth tokens, and SSH keys. They are base64 encoded by default and can be encrypted at rest in etcd. ConfigMaps store non-confidential configuration data, PersistentVolumes store data on disk, and annotations are key value metadata on objects.
A Pod runs three containers. How do these containers communicate with each other?
Pick an answer to reveal the explanation.
Containers within the same Pod share the same network namespace, so they communicate via localhost (127.0.0.1) using different ports. This is one of the key characteristics of a Pod, alongside shared storage volumes.
A Pod is being scheduled with a CPU "request" of 500m and a CPU "limit" of 1000m. What does the "request" value represent?
Pick an answer to reveal the explanation.
A CPU "request" is the minimum amount of CPU reserved on a Node for the container, used by the scheduler to find a Node with enough capacity. The "limit" is the maximum CPU the container can consume. 500m means 500 millicores, or 0.5 of a CPU core.
Which kubectl command applies the desired state defined in a YAML file, creating or updating resources as needed?
Pick an answer to reveal the explanation.
"kubectl apply -f" is the declarative command that creates resources if they do not exist and updates them if they do, tracking changes via the last-applied-configuration annotation. "create" fails if the resource exists, "run" is for one-off Pods, and "edit" opens an editor for an existing resource.
Which of the following is a container runtime that implements the Kubernetes Container Runtime Interface (CRI)?
Pick an answer to reveal the explanation.
containerd is a CRI compliant container runtime widely used in Kubernetes clusters. CRI-O is another popular choice. Docker Compose orchestrates containers on a single host, Helm is a package manager for Kubernetes, and kubectl is the Kubernetes CLI.
A team needs to route HTTP/HTTPS traffic to multiple services within their Kubernetes cluster based on host and path rules. Which Kubernetes resource should they use?
Pick an answer to reveal the explanation.
Ingress provides HTTP/HTTPS routing into a cluster with host and path based rules, terminating TLS, and supporting virtual hosting. It requires an Ingress controller (such as NGINX or Traefik) to actually implement the routing. ClusterIP is internal only, NetworkPolicy controls pod level traffic, and EndpointSlice tracks service endpoints.
Which Kubernetes control plane component is responsible for assigning newly created Pods to Nodes?
Pick an answer to reveal the explanation.
kube-scheduler watches for new Pods that have no Node assigned and selects an appropriate Node based on resource availability, taints, tolerations, affinity, and anti-affinity rules. kubelet runs on each Node to manage Pods after assignment, kube-proxy handles service networking, and etcd is the cluster key value store.
A Pod fails to start with status "ImagePullBackOff". What is the most likely cause?
Pick an answer to reveal the explanation.
ImagePullBackOff indicates Kubernetes is repeatedly failing to pull the container image. Common causes include a wrong image name or tag, the registry requiring authentication (missing imagePullSecret), or the registry being unreachable. The other options describe unrelated failure modes.
Which of the following is a key benefit of a microservices architecture compared to a monolithic application?
Pick an answer to reveal the explanation.
Microservices allow each service to be developed, deployed, and scaled independently, enabling team autonomy and faster iteration. However, microservices increase operational complexity, debugging is harder across service boundaries, and network latency is introduced (not eliminated) compared to in-process calls inside a monolith.
What is the primary purpose of a service mesh such as Istio or Linkerd?
Pick an answer to reveal the explanation.
A service mesh handles service-to-service traffic management (routing, retries, timeouts), observability (metrics, traces), and security (mTLS, authorization) transparently through sidecar proxies injected next to application containers. It does not replace the API server, build images, or install Kubernetes.
Which organization governs the Kubernetes project along with related open source projects like Prometheus, Envoy, and containerd?
Pick an answer to reveal the explanation.
The Cloud Native Computing Foundation (CNCF), part of the Linux Foundation, hosts and governs Kubernetes, Prometheus, Envoy, containerd, and many other cloud native projects. The Apache Software Foundation hosts unrelated projects, Linux Foundation Networking focuses on networking projects like ONAP, and OCI defines container image and runtime specifications.
The three pillars of observability are commonly described as:
Pick an answer to reveal the explanation.
Logs (event records), metrics (numerical measurements over time), and traces (request paths across services) are the three pillars of observability. Together they allow engineers to understand what is happening inside a distributed system.
Which open source project is commonly used to collect time-series metrics from Kubernetes workloads and expose them via a query language called PromQL?
Pick an answer to reveal the explanation.
Prometheus is a CNCF graduated project that scrapes time-series metrics from configured targets and exposes them via the PromQL query language. Grafana is a visualization tool often paired with Prometheus, Fluentd is a logs collector, and Jaeger is a distributed tracing system.
Which of the following best describes the GitOps approach to application delivery?
Pick an answer to reveal the explanation.
GitOps uses a Git repository as the single source of truth for declarative configuration. An agent (such as Argo CD or Flux) continuously reconciles the cluster state to match what is in Git. The other options describe practices that contradict GitOps principles.
What is the primary purpose of Helm in a Kubernetes environment?
Pick an answer to reveal the explanation.
Helm is a package manager for Kubernetes. A Helm chart bundles templated YAML manifests, default values, and metadata so that an application can be installed, upgraded, and versioned consistently. Helm does not monitor cluster health, replace kubectl, or run containers.
The KCNA is an entry-level Linux Foundation certification administered by the Cloud Native Computing Foundation (CNCF) that validates foundational knowledge of Kubernetes and the broader cloud native ecosystem. It is designed for engineers, IT professionals, and managers who want to demonstrate baseline cloud native fluency without taking a hands-on practical exam.
The KCNA exam consists of 60 multiple choice questions delivered over 90 minutes through an online proctored environment. All questions are multiple choice, which distinguishes KCNA from the hands-on CKA, CKAD, and CKS exams that require performance-based tasks.
The KCNA exam requires a score of 75% or higher to pass. The score is calculated automatically based on the percentage of correct answers, and the result is delivered within 24 hours of completing the exam. The Linux Foundation aligned KCNA with other associate-level certifications at this 75% threshold.
The exam is organized into five domains: Kubernetes Fundamentals (46%), Container Orchestration (22%), Cloud Native Architecture (16%), Cloud Native Observability (8%), and Cloud Native Application Delivery (8%). Core projects to know include Kubernetes itself, container runtimes (containerd, CRI-O), Helm, Prometheus, and the broader CNCF landscape.
Yes. KCNA is positioned as the most accessible CNCF certification and assumes no prior production Kubernetes experience. Candidates with about two to three months of Kubernetes exposure typically pass with three to four weeks of focused study using realistic mock exams and the official curriculum.
The KCNA exam costs USD 250 and includes one free retake within twelve months of the initial purchase. The Linux Foundation regularly runs discount campaigns, including KubeCon and Cyber Monday promotions, that bring the price down significantly.
Start by reading the official KCNA curriculum on the Linux Foundation website. Work through the free CNCF "Introduction to Kubernetes" (LFS158) course on edX, then drill the five domains using realistic mock exams that mirror the real test interface. Review the explanation for every wrong answer, identify your weakest domains, and re-practice those until you consistently score above 85%.