Pass KCNA Exam in First Attempt Guaranteed 100% Cover Real Exam Questions [Jun-2026]
Valid KCNA test answers & Linux Foundation KCNA exam pdf
NEW QUESTION # 107
What does the "nodeSelector" within a PodSpec use to place Pods on the target nodes?
- A. Hostnames
- B. IP Addresses
- C. Annotations
- D. Labels
Answer: D
Explanation:
nodeSelector is a simple scheduling constraint that matches node labels, so the correct answer is D (Labels). In Kubernetes, nodes have key/value labels (for example, disktype=ssd, topology.kubernetes.io/zone=us-east-1a, kubernetes.io/os=linux). When you set spec.nodeSelector in a Pod template, you provide a map of required label key/value pairs. The kube-scheduler will then only consider nodes that have all those labels with matching values as eligible placement targets for that Pod.
This is different from annotations: annotations are also key/value metadata, but they are not intended for selection logic and are not used by the scheduler for nodeSelector. IP addresses and hostnames are not the mechanism used by nodeSelector either. While Kubernetes nodes do have hostnames and IPs, nodeSelector specifically operates on labels because labels are designed for selection, grouping, and placement constraints.
Operationally, nodeSelector is the most basic form of node placement control. It is commonly used to pin workloads to specialized hardware (GPU nodes), compliance zones, or certain OS/architecture pools. However, it has limitations: it only supports exact match on labels and cannot express more complex rules (like "in this set of zones" or "prefer but don't require"). For that, Kubernetes offers node affinity (requiredDuringSchedulingIgnoredDuringExecution, preferredDuringSchedulingIgnoredDuringExecution) which supports richer expressions.
Still, the underlying mechanism is the same concept: the scheduler evaluates your Pod's placement requirements against node metadata, and for nodeSelector, that metadata is labels. Therefore, the verified correct answer is D.
NEW QUESTION # 108
Consider the following Kubernetes resource definition:
What does the "resources" section define in this Deployment manifest?
- A. The network bandwidth allocated to the pod
- B. The storage capacity required for the pod
- C. The number of CPU cores and memory available on the node
- D. The minimum and maximum resource requirements for the container
- E. The number of replicas that Kubernetes should create for the Deployment
Answer: D
Explanation:
The "resources" section in the Deployment manifest defines the minimum (requests) and maximum (limits) resource requirements for the container This helps Kubernetes schedule pods effectively and prevents resource starvation or excessive resource consumption by individual pods.
NEW QUESTION # 109
Which of the following sentences is true about namespaces in Kubernetes?
- A. You can create a namespace within another namespace in Kubernetes.
- B. The default namespace exists when a new cluster is created.
- C. All the objects in the cluster are namespaced by default.
- D. You can create two resources of the same kind and name in a namespace.
Answer: B
Explanation:
The true statement is C: the default namespace exists when a new cluster is created. Namespaces are a Kubernetes mechanism for partitioning cluster resources into logical groups. When you set up a cluster, Kubernetes creates some initial namespaces (including default, and commonly kube-system, kube-public, and kube-node-lease). The default namespace is where resources go if you don't specify a namespace explicitly.
Option A is false because namespaces are not hierarchical; Kubernetes does not support "namespaces inside namespaces." Option B is false because within a given namespace, resource names must be unique per resource kind. You can't have two Deployments with the same name in the same namespace. You can have a Deployment named web in one namespace and another Deployment named web in a different namespace-namespaces provide that scope boundary. Option D is false because not all objects are namespaced. Many resources are cluster-scoped (for example, Nodes, PersistentVolumes, ClusterRoles, ClusterRoleBindings, and StorageClasses). Namespaces apply only to namespaced resources.
Operationally, namespaces support multi-tenancy and environment separation (dev/test/prod), RBAC scoping, resource quotas, and policy boundaries. For example, you can grant a team access only to their namespace and enforce quotas that prevent them from consuming excessive CPU/memory. Namespaces also make organization and cleanup easier: deleting a namespace removes most namespaced resources inside it (subject to finalizers).
So, the verified correct statement is C: the default namespace exists upon cluster creation.
NEW QUESTION # 110
Manual reclamation policy of a PV resource is known as:
- A. Retain
- B. Recycle
- C. claimRef
- D. Delete
Answer: A
Explanation:
The correct answer is C: Retain. In Kubernetes persistent storage, a PersistentVolume (PV) has a persistentVolumeReclaimPolicy that determines what happens to the underlying storage asset after its PersistentVolumeClaim (PVC) is deleted. The reclaim policy options historically include Delete and Retain (and Recycle, which is deprecated/removed in many modern contexts). "Manual reclamation" refers to the administrator having to manually clean up and/or rebind the storage after the claim is released-this behavior corresponds to Retain.
With Retain, when the PVC is deleted, the PV moves to a "Released" state, but the actual storage resource (cloud disk, NFS path, etc.) is not deleted automatically. Kubernetes will not automatically make that PV available for a new claim until an administrator takes action-typically cleaning the data, removing the old claim reference, and/or creating a new PV/PVC binding flow. This is important for data safety: you don't want to automatically delete sensitive or valuable data just because a claim was removed.
By contrast, Delete means Kubernetes (via the storage provisioner/CSI driver) will delete the underlying storage asset when the claim is deleted-useful for dynamic provisioning and disposable environments.
Recycle used to scrub the volume contents and make it available again, but it's not the recommended modern approach and has been phased out in favor of dynamic provisioning and explicit workflows.
So, the policy that implies manual intervention and manual cleanup/reuse is Retain, which is option C.
=========
NEW QUESTION # 111
Services and Pods in Kubernetes are ______ objects.
- A. YAML
- B. JSON
- C. REST
- D. Java
Answer: C
Explanation:
In Kubernetes, resources like Pods and Services are represented as API objects that you create, read, update, delete, and watch via the Kubernetes RESTful API. That makes D (REST) the correct answer.
Kubernetes is fundamentally API-driven: the API server exposes endpoints for each resource type (for example, /api/v1/namespaces/{ns}/pods and /api/v1/namespaces/{ns}/services). Clients such as kubectl, controllers, operators, and external systems interact with these resources by making REST-style calls using HTTP verbs (GET, POST, PUT/PATCH, DELETE) and using watch streams for event-driven updates. This API-first design is what enables Kubernetes' declarative model-users submit desired state to the API server, and controllers reconcile the cluster to that desired state.
Options A and B (JSON and YAML) are common serialization formats used to represent Kubernetes objects, but they are not what the objects "are." Kubernetes objects are logical API resources; they can be encoded as JSON (what the API uses) and often authored as YAML for human convenience. YAML is effectively a superset-friendly format that can be converted to JSON. The underlying API object model remains the same regardless of whether you wrote YAML or JSON. Option C (Java) is unrelated; Java is a programming language that can interact with Kubernetes via client libraries, but Kubernetes objects are not "Java objects" in the platform's definition.
So the accurate statement is: Pods and Services are Kubernetes REST API objects (resources) exposed and managed through the Kubernetes API server, which is why REST is the correct fill-in.
NEW QUESTION # 112
In the Kubernetes platform, which component is responsible for running containers?
- A. etcd
- B. kube-controller-manager
- C. CRI-O
- D. cloud-controller-manager
Answer: C
Explanation:
In Kubernetes, the actual act of running containers on a node is performed by the container runtime. The kubelet instructs the runtime via CRI, and the runtime pulls images, creates containers, and manages their lifecycle. Among the options provided, CRI-O is the only container runtime, so B is correct.
It's important to be precise: the component that "runs containers" is not the control plane and not etcd. etcd (option A) stores cluster state (API objects) as the backing datastore. It never runs containers. cloud- controller-manager (option C) integrates with cloud APIs for infrastructure like load balancers and nodes.
kube-controller-manager (option D) runs controllers that reconcile Kubernetes objects (Deployments, Jobs, Nodes, etc.) but does not execute containers on worker nodes.
CRI-O is a CRI implementation that is optimized for Kubernetes and typically uses an OCI runtime (like runc) under the hood to start containers. Another widely used runtime is containerd. The runtime is installed on nodes and is a prerequisite for kubelet to start Pods. When a Pod is scheduled to a node, kubelet reads the PodSpec and asks the runtime to create a "pod sandbox" and then start the container processes. Runtime behavior also includes pulling images, setting up namespaces/cgroups, and exposing logs/stdout streams back to Kubernetes tooling.
So while "the container runtime" is the most general answer, the question's option list makes CRI-O the correct selection because it is a container runtime responsible for running containers in Kubernetes.
=========
NEW QUESTION # 113
To specify a Kubernetes object which language is used?
- A. Node
- B. Python
- C. YAML
- D. JSON
- E. Go
Answer: C
Explanation:
https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/
NEW QUESTION # 114
In Kubernetes, if the API version of feature is v2beta3, it means that:
- A. The version will remain available for all future releases within a Kubernetes major version.
- B. The software may contain bugs. Enabling a feature may expose bugs.
- C. The software is well tested. Enabling a feature is considered safe.
- D. The API may change in incompatible ways in a later software release without notice.
Answer: D
Explanation:
The correct answer is B. In Kubernetes API versioning, the stability level is encoded in the version string: alpha, beta, and stable (v1). A version like v2beta3 indicates the API is in a beta stage. Beta APIs are more mature than alpha, but they are not fully guaranteed stable in perpetuity the way v1 stable APIs are intended to be. The key implication is that while beta APIs are generally usable, they can still undergo incompatible changes in future releases as the API design evolves.
Option B captures that meaning: a beta API may change in ways that break compatibility. This is why teams should treat beta APIs with some caution in production: verify upgrade plans, monitor deprecation notices, and be prepared to adjust manifests or client code when moving between Kubernetes versions.
Why the other options are incorrect:
A implies permanence across all future releases in a major version, which is not a beta guarantee. Kubernetes has deprecation and graduation processes, but beta does not equal "forever." C overstates safety; beta is typically "tested and enabled by default" for some features, but it's not the same as stable API guarantees.
D is too vague and misaligned. While any software may contain bugs, the defining point of "beta API" is about stability/compatibility guarantees, not merely "bugs." In practice, Kubernetes communicates API lifecycle clearly: alpha is experimental and may be disabled by default; beta is feature-complete-ish but may change; stable v1 is strongly compatibility-focused with formal deprecation policies. So, a v2beta3 API signals: usable, but not fully locked-hence B.
NEW QUESTION # 115
You are tasked with deploying a microservices application on Kubernetes. The application relies heavily on communication between its different services, and you need to ensure reliable and secure communication. Which of the following open standards are most relevant for this scenario?
- A. Service Level Objectives (SLOs)
- B. Open Service Mesh (OSM)
- C. Open Container Initiative (OCI)
- D. Kubernetes API
- E. Cloud Native Computing Foundation (CNCF)
Answer: B
Explanation:
Open Service Mesh (OSM) is an open standard focused on providing a secure and reliable way to connect microservices. It helps with service discovery, load balancing, traffic management, and security features, making it ideal for deploying microservices applications on Kubernetes.
NEW QUESTION # 116
You are running a Kubernetes cluster with multiple nodes. Your application's Pods need to be scheduled across different nodes for high availability. Which Kubernetes concept allows you to control the distribution of Pods across the cluster?
- A. Node Affinity
- B. Ingress
- C. Service
- D. Pod Security Policy
- E. Deployment
Answer: A
Explanation:
Node Affinity lets you define rules to control where your Pods are scheduled. You can specify hard (required) or soft (preferred) preferences for nodes based on labels or other criteria. This helps to distribute Pods across the cluster for better resource utilization and fault tolerance.
NEW QUESTION # 117
How do you perform a command in a running container of a Pod?
- A. kubectl run <pod> -- <command>
- B. kubectl exec <pod> -- <command>
- C. kubectl attach <pod> -i <command>
- D. docker exec <pod> <command>
Answer: B
Explanation:
In Kubernetes, the standard way to execute a command inside a running container is kubectl exec, which is why A is correct. kubectl exec calls the Kubernetes API (API server), which then coordinates with the kubelet on the target node to run the requested command inside the container using the container runtime's exec mechanism. The -- separator is important: it tells kubectl that everything after -- is the command to run in the container rather than flags for kubectl itself.
This is fundamentally different from docker exec. In Kubernetes, you don't normally target containers through Docker/CRI tools directly because Kubernetes abstracts the runtime behind CRI. Also, "Docker" might not even be installed on nodes in modern clusters (containerd/CRI-O are common). So option B is not the Kubernetes-native approach and often won't work.
kubectl run (option C) is for creating a new Pod (or generating workload resources), not for executing a command in an existing container. kubectl attach (option D) attaches your terminal to a running container's process streams (stdin/stdout/stderr), which is useful for interactive sessions, but it does not execute an arbitrary new command like exec does.
In real usage, you often specify the container when a Pod has multiple containers: kubectl exec -it <pod> -c
<container> -- /bin/sh. This is common for debugging, verifying config files mounted from ConfigMaps
/Secrets, testing DNS resolution, or checking network connectivity from within the Pod network namespace.
Because exec uses the API and kubelet, it respects Kubernetes access control (RBAC) and audit logging- another reason it's the correct operational method.
=========
NEW QUESTION # 118
What are the key differences between a Kubernetes Pod and a Docker container? Provide examples of how they are used in a Kubernetes deployment.
- A. A Pod is a cloud-native application, while a Docker container is a traditional application.
- B. A Pod is a single running container, while a Docker container can run multiple applications.
- C. A Docker container is managed by Kubernetes, while a Pod is managed by Docker.
- D. A Pod is a logical grouping of one or more containers, while a Docker container is a single running instance of an image.
- E. A Pod is a physical machine, while a Docker container is a virtual machine.
Answer: D
Explanation:
A Pod in Kubernetes is the smallest deployable unit. It represents a group of one or more containers that share resources and networking. Docker containers, on the other hand, are individual running instances of Docker images. Examples: Pod: You could have a Pod that runs a web server container, a database container, and a logging container, all working together as a single unit. Kubernetes manages the scheduling, networking, and resource allocation for the entire Pod. Docker Container: You could run a single Docker container for a web server application on a single machine.
NEW QUESTION # 119
What is a cloud native application?
- A. It is an application designed to run all its functions in separate containers.
- B. It is a monolithic application that has been containerized and is running now on the cloud.
- C. It is an application designed to be scalable and take advantage of services running on the cloud.
- D. It is any application that runs in a cloud provider and uses its services.
Answer: C
Explanation:
B is correct. A cloud native application is designed to be scalable, resilient, and adaptable, and to leverage cloud/platform capabilities rather than merely being "hosted" on a cloud VM. Cloud-native design emphasizes principles like elasticity (scale up/down), automation, fault tolerance, and rapid, reliable delivery.
While containers and Kubernetes are common enablers, the key is the architectural intent: build applications that embrace distributed systems patterns and cloud-managed primitives.
Option A is not enough. Simply containerizing a monolith and running it in the cloud does not automatically make it cloud native; that may be "lift-and-shift" packaging. The application might still be tightly coupled, hard to scale, and operationally fragile. Option C is too narrow and prescriptive; cloud native does not require
"all functions in separate containers" (microservices are common but not mandatory). Many cloud-native apps use a mix of services, and even monoliths can be made more cloud native by adopting statelessness, externalized state, and automated delivery. Option D is too broad; "any app running in a cloud provider" includes legacy apps that don't benefit from elasticity or cloud-native operational models.
Cloud-native applications typically align with patterns: stateless service tiers, declarative configuration, health endpoints, horizontal scaling, graceful shutdown, and reliance on managed backing services (databases, queues, identity, observability). They are built to run reliably in dynamic environments where instances are replaced routinely-an assumption that matches Kubernetes' reconciliation and self-healing model.
So, the best verified definition among these options is B.
=========
NEW QUESTION # 120
You have a critical application that must always be running on a specific node for high availability purposes. Which of the following Kubernetes features can be used to enforce this requirement?
- A. Node anti-affinity
- B. Node affinity
- C. Pod anti-affinity
- D. Pod affinity
- E. Taints and tolerations
Answer: B,E
Explanation:
You can use both •nodeAffinity• and •taints and tolerationS to enforce scheduling on a specific node: •nodeAffinity•: Define a strong preference for scheduling on the desired node using 'requiredDuringSchedulinglgnoredDuringExecution'. This ensures that the pod is scheduled on the target node initially. *Taints and TolerationS: You can taint the desired node with a specific key-value pair. Then, configure the pod to tolerate that specific taint. This ensures that the pod can only be scheduled on the node that has that taint applied. While 'podAffinity• can be used for grouping pods together, it does not directly enforce scheduling on a specific node. •nodeAntiAffinity• and •podAntiAffinity• are used to prevent pods from being scheduled on the same or similar nodes, not to force them onto specific node.
NEW QUESTION # 121
Which of the following observability data streams would be most useful when desiring to plot resource consumption and predicted future resource exhaustion?
- A. Metrics
- B. Logs
- C. Traces
- D. stdout
Answer: A
Explanation:
The correct answer is D: Metrics. Metrics are numeric time-series measurements collected at regular intervals, making them ideal for plotting resource consumption over time and forecasting future exhaustion. In Kubernetes, this includes CPU usage, memory usage, disk I/O, network throughput, filesystem usage, Pod restarts, and node allocatable vs requested resources. Because metrics are structured and queryable (often with Prometheus), you can compute rates, aggregates, percentiles, and trends, and then apply forecasting methods to predict when a resource will run out.
Logs and traces have different purposes. Logs are event records (strings) that are great for debugging and auditing, but they are not naturally suited to continuous quantitative plotting unless you transform them into metrics (log-based metrics). Traces capture end-to-end request paths and latency breakdowns; they help you find slow spans and dependency bottlenecks, not forecast CPU/memory exhaustion. stdout is just a stream where logs might be written; by itself it's not an observability data type used for capacity trending.
In Kubernetes observability stacks, metrics are typically scraped from components and workloads: kubelet/cAdvisor exports container metrics, node exporters expose host metrics, and applications expose business/system metrics. The metrics pipeline (Prometheus, OpenTelemetry metrics, managed monitoring) enables dashboards and alerting. For resource exhaustion, you often alert on "time to fill" (e.g., predicted disk fill in < N hours), high sustained utilization, or rapidly increasing error rates due to throttling.
Therefore, the most appropriate data stream for plotting consumption and predicting exhaustion is Metrics, option D.
NEW QUESTION # 122
Which one of the following is an open source runtime security tool?
- A. containerd
- B. lxd
- C. falco
- D. gVisor
Answer: C
Explanation:
The correct answer is C: Falco. Falco is a widely used open-source runtime security tool (originally created by Sysdig and now a CNCF project) designed to detect suspicious behavior at runtime by monitoring system calls and other kernel-level signals. In Kubernetes environments, Falco helps identify threats such as unexpected shell access in containers, privilege escalation attempts, access to sensitive files, anomalous network tooling, crypto-mining patterns, and other behaviors that indicate compromise or policy violations.
The other options are not primarily "runtime security tools" in the detection/alerting sense:
* containerd is a container runtime responsible for executing containers; it's not a security detection tool.
* lxd is a system container and VM manager; again, not a runtime threat detection tool.
* gVisor is a sandboxed container runtime that improves isolation by interposing a user-space kernel; it's a security mechanism, but the question asks for a runtime security tool (monitoring/detection). Falco fits that definition best.
In cloud-native security practice, Falco typically runs as a DaemonSet so it can observe activity on every node. It uses rules to define what "bad" looks like and can emit alerts to SIEM systems, logging backends, or incident response workflows. This complements preventative controls like RBAC, Pod Security Admission, seccomp, and least privilege configurations. Preventative controls reduce risk; Falco provides visibility and detection when something slips through.
Therefore, among the provided choices, the verified runtime security tool is Falco (C).
=========
NEW QUESTION # 123
......
KCNA Exam Questions – Valid KCNA Dumps Pdf: https://www.dumpstests.com/KCNA-latest-test-dumps.html
Verified KCNA dumps Q&As - Pass Guarantee: https://drive.google.com/open?id=1SO85xL3nFB6Fd9Mc2M3_lTTBhtaOJZ7L