2026 KCNA Question Bank Free PDF Download Recently Updated Questions [Q18-Q34]

admin KCNA Linux Foundation August 25, 2026

Rate this post

2026 KCNA Question Bank: Free PDF Download Recently Updated Questions

KCNA Certification Exam Dumps with 242 Practice Test Questions

Linux Foundation KCNA (Kubernetes and Cloud Native Associate) Certification Exam is a comprehensive exam designed to test the knowledge and skills of individuals in the field of cloud-native computing. KCNA exam covers a range of topics, including Kubernetes, containerization, microservices, and cloud-native architecture. Kubernetes and Cloud Native Associate certification is ideal for individuals who want to demonstrate their expertise in designing, deploying, and managing cloud-native applications.

The KCNA exam is ideal for IT professionals who are looking to advance their careers in cloud-native computing. KCNA exam covers a wide range of topics, including containerization, Kubernetes architecture, deployment, and maintenance. It also covers other important topics such as networking, storage, security, and troubleshooting.

NEW QUESTION 18
What is Helm?

An open source dashboard for Kubernetes.

A package manager for Kubernetes applications.

A custom scheduler for Kubernetes.

An end-to-end testing project for Kubernetes applications.

NEW QUESTION 19
What sentence is true about CronJobs in Kubernetes?

A CronJob creates one or multiple Jobs on a repeating schedule.

A CronJob creates one container on a repeating schedule.

CronJobs are useful on Linux but are obsolete in Kubernetes.

The CronJob schedule format is different in Kubernetes and Linux.

NEW QUESTION 20
What is CloudEvents?

It is a specification for describing event data in common formats for Kubernetes network traffic management and cloud providers.

It is a specification for describing event data in common formats in all cloud providers including major cloud providers.

It is a specification for describing event data in common formats to provide interoperability across services, platforms and systems.

It is a Kubernetes specification for describing events data in common formats for iCloud services, iOS platforms and iMac.

NEW QUESTION 21
You are deploying a web application with a frontend and backend service. The frontend service requires access to the backend service on a specific port. What is the most appropriate way to configure this communication within a Kubernetes cluster?

Use a Service of type ‘NodePort’ for the backend service and access it directly from the frontend service.

Use a Service of type ‘ClusterlP’ for the backend service and configure a Pod’s container to access the backend service using its cluster IR

Use a Service of type ‘LoadBalancer’ for the backend service and expose the public IP to the frontend

Use a ConfigMap to define the backend service’s port and access it directly from the frontend service.

Use a Service of type ‘LoadBalancer’ for both frontend and backend services to create an external endpoint for the application.

NEW QUESTION 22
Your Kubernetes cluster has a limited number of nodes, and you need to efficiently utilize those resources. You are deploying a highly scalable web application with multiple pods. What Kubernetes concept can help you optimize resource allocation and ensure pods are scheduled across all available nodes?

NodeSelector

PodAntiAffinity

Tolerations

Taints

ResourceQuota

NEW QUESTION 23
What is the reference implementation of the OCI runtime specification?

lxc

CRI-O

runc

Docker

NEW QUESTION 24
To visualize data from Prometheus you can use expression browser or console templates. What is the other data visualization tool commonly used together with Prometheus?

Grafana

Graphite

Nirvana

GraphQL

NEW QUESTION 25
Which Prometheus metric represents a single value that can go up and down?

Counter

Gauge

Summary

Histogram

NEW QUESTION 26
What Kubernetes component handles network communications inside and outside of a cluster, using operating system packet filtering if available?

kube-proxy

kubelet

etcd

kube-controller-manager

NEW QUESTION 27
How does Horizontal Pod autoscaling work in Kubernetes?

The Horizontal Pod Autoscaler controller adds more CPU or memory to the pods when the load is above the configured threshold, and reduces CPU or memory when the load is below.

The Horizontal Pod Autoscaler controller adds more pods when the load is above the configured threshold, but does not reduce the number of pods when the load is below.

The Horizontal Pod Autoscaler controller adds more pods to the specified DaemonSet when the load is above the configured threshold, and reduces the number of pods when the load is below.

The Horizontal Pod Autoscaler controller adds more pods when the load is above the configured threshold, and reduces the number of pods when the load is below.

NEW QUESTION 28
What is the role of a NetworkPolicy in Kubernetes?

The ability to cryptic and obscure all traffic.

The ability to classify the Pods as isolated and non isolated.

The ability to prevent loopback or incoming host traffic.

The ability to log network security events.

A Kubernetes NetworkPolicy defines which traffic is allowed to and from Pods by selecting Pods and specifying ingress/egress rules. A key conceptual effect is that it can make Pods “isolated” (default deny except what is allowed) versus “non-isolated” (default allow). This aligns best with option B, so B is correct.
By default, Kubernetes networking is permissive: Pods can typically talk to any other Pod. When you apply a NetworkPolicy that selects a set of Pods, those selected Pods become “isolated” for the direction(s) covered by the policy (ingress and/or egress). That means only traffic explicitly allowed by the policy is permitted; everything else is denied (again, for the selected Pods and direction). This classification concept-isolated vs non-isolated-is a common way the Kubernetes documentation explains NetworkPolicy behavior.
Option A is incorrect: NetworkPolicy does not encrypt (“cryptic and obscure”) traffic. Encryption is typically handled by mTLS via a service mesh or application-layer TLS. Option C is not the primary role; loopback and host traffic handling depend on the network plugin and node configuration, and NetworkPolicy is not a
“prevent loopback” mechanism. Option D is incorrect because NetworkPolicy is not a logging system; while some CNIs can produce logs about policy decisions, logging is not NetworkPolicy’s role in the API.
One critical Kubernetes detail: NetworkPolicy enforcement is performed by the CNI/network plugin. If your CNI doesn’t implement NetworkPolicy, creating these objects won’t change runtime traffic. In CNIs that do support it, NetworkPolicy becomes a foundational security primitive for segmentation and least privilege:
restricting database access to app Pods only, isolating namespaces, and reducing lateral movement risk.
So, in the language of the provided answers, NetworkPolicy’s role is best captured as the ability to classify Pods into isolated/non-isolated by applying traffic-allow rules-option B.
=========

NEW QUESTION 29
What happens with a regular Pod running in Kubernetes when a node fails?

A new Pod with the same UID is scheduled to another node after a while.

A new, near-identical Pod but with different UID is scheduled to another node.

By default, a Pod can only be scheduled to the same node when the node fails.

A new Pod is scheduled on a different node only if it is configured explicitly.

NEW QUESTION 30
Which access control component of Kubernetes is responsible for authorization and decides what requestor is allowed to do?

Service Account

Role-based access control ‘RBAC’

Deployment

NEW QUESTION 31
The 4C’s of Cloud Native security

Chroot, Compute, Cluster and Container

Cluster, Cloud, Compute, and Containers

Code, Containers, Compute, and Cloud

Cloud, Clusters, Containers, and Code

NEW QUESTION 32
Explain the difference between a Kubernetes Deployment and a ReplicaSet. When would you use each of these resources?

Deployment is a high-level resource that manages the lifecycle of ReplicaSets, while ReplicaSet is a low-level resource that manages a set of Pods with the same template.

ReplicaSet is a high-level resource that manages the lifecycle of Deployments, while Deployment is a low-level resource that manages a set of Pods with the same template.

Deployment is a low-level resource that manages the lifecycle of ReplicaSets, while ReplicaSet is a high-level resource that manages a set of Pods with the same template.

ReplicaSet is a low-level resource that manages the lifecycle of Deployments, while Deployment is a high-level resource that manages a set of Pods with the same template-

Deployment and ReplicaSet are interchangeable, and both manage the lifecycle of Pods with the same template.

NEW QUESTION 33
Imagine there is a requirement to run a database backup every day. Which Kubernetes resource could be used to achieve that?

kube-scheduler

CronJob

Task

Job

NEW QUESTION 34
A Pod has been created, but when checked with kubectl get pods, the READY column shows 0/1. What Kubernetes feature causes this behavior?

Node Selector

Readiness Probes

DNS Policy

Security Contexts

The READY column in the output of kubectl get pods indicates how many containers in a Pod are currently considered ready to serve traffic, compared to the total number of containers defined in that Pod. A value of 0
/1 means that the Pod has one container, but that container is not yet marked as ready. The Kubernetes feature responsible for determining this readiness state is the readiness probe.
Readiness probes are used by Kubernetes to decide when a container is ready to accept traffic. These probes can be configured to perform HTTP requests, execute commands, or check TCP sockets inside the container.
If a readiness probe is defined and it fails, Kubernetes marks the container as not ready, even if the container is running successfully. As a result, the READY column will show 0/1, and the Pod will be excluded from Service load balancing until the probe succeeds.
Option A (Node Selector) is incorrect because node selectors influence where a Pod is scheduled, not whether its containers are considered ready after startup. Option C (DNS Policy) affects how DNS resolution works inside a Pod and has no direct impact on readiness reporting. Option D (Security Contexts) define security- related settings such as user IDs, capabilities, or privilege levels, but they do not control the READY status shown by kubectl.
Readiness probes are particularly important for applications that take time to initialize, load configuration, or warm up caches. By using readiness probes, Kubernetes ensures that traffic is only sent to containers that are fully prepared to handle requests. This improves reliability and prevents failed or premature connections.
According to Kubernetes documentation, a container without a readiness probe is considered ready by default once it is running. However, when a readiness probe is defined, its result directly controls the READY state.
Therefore, the presence and behavior of readiness probes is the verified and correct reason why a Pod may show 0/1 in the READY column, making option B the correct answer.