Kubernetes and Cloud Native Associate KCNA Practice Test 56
Question 550
The platform team applies this control: Configure a scoped imagePullSecret on the appropriate Pod or service account. The original issue is: A Pod cannot retrieve a private image from its authorized enterprise registry. Which observation BEST validates the result?
- The final image runs the binary without development toolchains installed
- Image pulls succeed for the authorized registry while anonymous pulls fail
- The proxy remains independently observable while supporting the application Pod
- A rollout with the same digest runs the same image across nodes
Explanation
Correct Answer
B:Image pulls succeed for the authorized registry while anonymous pulls fail. This is stronger than observing a saved configuration because it tests the actual outcome of configure a scoped imagePullSecret on the appropriate Pod or service account. The underlying principle is that registry authentication is distinct from Kubernetes workload API authorization. The original risk was that mounting registry credentials as unrelated app secrets will not fix image pulls.
Incorrect Answers
A:Multi-stage builds copy only selected results into the final container image. The observation “The final image runs the binary without development toolchains installed” would validate that property, rather than the required “Image pulls succeed for the authorized registry while anonymous pulls fail”. Registry authentication is distinct from Kubernetes workload API authorization.
C:Pod-level co-location permits coordinated companion services and local networking. The observation “The proxy remains independently observable while supporting the application Pod” would validate that property, rather than the required “Image pulls succeed for the authorized registry while anonymous pulls fail”. Registry authentication is distinct from Kubernetes workload API authorization.
D:Image tags are mutable references while digests identify specific image content. The observation “A rollout with the same digest runs the same image across nodes” would validate that property, rather than the required “Image pulls succeed for the authorized registry while anonymous pulls fail”. Registry authentication is distinct from Kubernetes workload API authorization.
Question 551
An operator notices this unresolved gap: An administrator deletes a PVC and unexpectedly destroys critical underlying data. What consequence BEST explains the need to address it?
- Forcing the Pod to another zone can leave it waiting on an unattainable volume
- Relying on emptyDir for customer records loses data when the Pod is removed
- Assuming every PV is retained can cause permanent loss after claim deletion
- Manually replacing storage with an undersized volume risks loss or outage
Explanation
Correct Answer
C:Assuming every PV is retained can cause permanent loss after claim deletion. This is the direct concern in the stated scenario because reclaim policies such as Delete and Retain control backing-volume disposition. The matching mitigation is to review PV reclaim policy and lifecycle before deleting claims. Successful verification would show that a controlled test confirms the intended retain or delete behavior.
Incorrect Answers
A:Volume placement influences eligible nodes and availability zones for stateful workloads. That explains the warning “Forcing the Pod to another zone can leave it waiting on an unattainable volume”; this case instead concerns “Assuming every PV is retained can cause permanent loss after claim deletion”. Reclaim policies such as Delete and Retain control backing-volume disposition.
B:EmptyDir storage lives for a Pod's lifetime and is shared by its containers. That explains the warning “Relying on emptyDir for customer records loses data when the Pod is removed”; this case instead concerns “Assuming every PV is retained can cause permanent loss after claim deletion”. Reclaim policies such as Delete and Retain control backing-volume disposition.
D:PVC expansion depends on driver support and filesystem resizing behavior. That explains the warning “Manually replacing storage with an undersized volume risks loss or outage”; this case instead concerns “Assuming every PV is retained can cause permanent loss after claim deletion”. Reclaim policies such as Delete and Retain control backing-volume disposition.
Question 552
For this Kubernetes condition, An enterprise plans a dependency strategy using only a marketing list of CNCF-related tools. The proposed approach is: Review actual project scope, maturity, licensing, and stewardship before adoption. Which technical principle BEST supports that choice?
- CNCF maturity stages such as Sandbox, Incubating, and Graduated have distinct meanings
- Community release processes communicate API evolution and deprecation timelines
- Vendor-neutral communities can coordinate shared cloud-native standards and adoption
- CNCF ecosystem membership is a discovery aid, not a blanket production guarantee
Explanation
Correct Answer
D:CNCF ecosystem membership is a discovery aid, not a blanket production guarantee. That principle directly explains the selected remediation, review actual project scope, maturity, licensing, and stewardship before adoption, for this case. Without the distinction, choosing by branding alone may miss operational fit or maintenance risks. The expected confirmation is that the tool assessment cites project documentation and a successful proof of concept.
Incorrect Answers
A:CNCF maturity stages such as Sandbox, Incubating, and Graduated have distinct meanings. The operation “CNCF maturity stages such as Sandbox, Incubating, and Graduated have distinct meanings” does not address the particular Kubernetes requirement “CNCF ecosystem membership is a discovery aid, not a blanket production guarantee”.
B:Community release processes communicate API evolution and deprecation timelines. The operation “Community release processes communicate API evolution and deprecation timelines” does not address the particular Kubernetes requirement “CNCF ecosystem membership is a discovery aid, not a blanket production guarantee”.
C:Vendor-neutral communities can coordinate shared cloud-native standards and adoption. The operation “Vendor-neutral communities can coordinate shared cloud-native standards and adoption” does not address the particular Kubernetes requirement “CNCF ecosystem membership is a discovery aid, not a blanket production guarantee”.
Question 553
A cloud-native operations team faces this condition: Several services emit telemetry in different proprietary formats and cannot share dashboards. Which response is MOST appropriate?
- Instrument with OpenTelemetry-compatible signals and a governed collection pipeline
- Alert on meaningful sustained user impact and tune severity and routing
- Replace unbounded identifiers with low-cardinality metric labels
- Define a user-focused service level indicator and an objective with a measurement window
Explanation
Correct Answer
A:Instrument with OpenTelemetry-compatible signals and a governed collection pipeline. This is appropriate for the described asset and control gap because openTelemetry standardizes telemetry generation and transport across languages. If the issue is left untreated, vendor-specific uncorrelated records make platform-wide diagnosis difficult. An assessor can verify remediation when a shared collector receives usable traces and metrics from multiple service runtimes.
Incorrect Answers
B:Alert on meaningful sustained user impact and tune severity and routing. The operation “Alert on meaningful sustained user impact and tune severity and routing” does not address the particular Kubernetes requirement “Instrument with OpenTelemetry-compatible signals and a governed collection pipeline”.
C:Replace unbounded identifiers with low-cardinality metric labels. The operation “Replace unbounded identifiers with low-cardinality metric labels” does not address the particular Kubernetes requirement “Instrument with OpenTelemetry-compatible signals and a governed collection pipeline”.
D:Define a user-focused service level indicator and an objective with a measurement window. The operation “Define a user-focused service level indicator and an objective with a measurement window” does not address the particular Kubernetes requirement “Instrument with OpenTelemetry-compatible signals and a governed collection pipeline”.
Question 554
An operator notices this unresolved gap: A team asks why a container starts faster than a traditional full virtual machine. What consequence BEST explains the need to address it?
- Running migrations and serving requests concurrently risks startup races
- Treating every container as a complete VM obscures shared kernel risks
- Shipping compilers and build caches unnecessarily increases image size and risk
- Placing frequently changed files early invalidates useful build cache
Explanation
Correct Answer
B:Treating every container as a complete VM obscures shared kernel risks. This is the direct concern in the stated scenario because containers package processes and dependencies without emulating a full guest OS. The matching mitigation is to explain process isolation using a shared host kernel and image filesystem. Successful verification would show that a basic experiment shows containers sharing the host kernel version.
Incorrect Answers
A:Init containers complete sequentially before ordinary application containers start. That explains the warning “Running migrations and serving requests concurrently risks startup races”; this case instead concerns “Treating every container as a complete VM obscures shared kernel risks”. Containers package processes and dependencies without emulating a full guest OS.
C:Multi-stage builds copy only selected results into the final container image. That explains the warning “Shipping compilers and build caches unnecessarily increases image size and risk”; this case instead concerns “Treating every container as a complete VM obscures shared kernel risks”. Containers package processes and dependencies without emulating a full guest OS.
D:Layered image caching can avoid rebuilding unchanged instructions. That explains the warning “Placing frequently changed files early invalidates useful build cache”; this case instead concerns “Treating every container as a complete VM obscures shared kernel risks”. Containers package processes and dependencies without emulating a full guest OS.
Question 555
For this Kubernetes condition, A dashboard needs extra human-readable incident ownership attached to workloads. The proposed approach is: Store nonidentifying descriptive metadata in annotations rather than selectors. Which technical principle BEST supports that choice?
- Kubernetes garbage collection uses owner references while finalizers can delay removal
- ConfigMaps separate ordinary configuration data from immutable image content
- Annotations hold auxiliary object information that need not identify selection groups
- Namespaces partition names and policy scope for namespaced Kubernetes resources
Explanation
Correct Answer
C:Annotations hold auxiliary object information that need not identify selection groups. That principle directly explains the selected remediation, store nonidentifying descriptive metadata in annotations rather than selectors, for this case. Without the distinction, using mutable ticket text as a Service selector can disconnect endpoints. The expected confirmation is that the ownership annotation changes without modifying the selected backend set.
Incorrect Answers
A:Kubernetes garbage collection uses owner references while finalizers can delay removal. The operation “Kubernetes garbage collection uses owner references while finalizers can delay removal” does not address the particular Kubernetes requirement “Annotations hold auxiliary object information that need not identify selection groups”.
B:ConfigMaps separate ordinary configuration data from immutable image content. The operation “ConfigMaps separate ordinary configuration data from immutable image content” does not address the particular Kubernetes requirement “Annotations hold auxiliary object information that need not identify selection groups”.
D:Namespaces partition names and policy scope for namespaced Kubernetes resources. The operation “Namespaces partition names and policy scope for namespaced Kubernetes resources” does not address the particular Kubernetes requirement “Annotations hold auxiliary object information that need not identify selection groups”.
Question 556
The platform team applies this control: Use workload identity with narrowly scoped external permissions. The original issue is: A public API Deployment accidentally mounts a broad cloud administrator credential. Which observation BEST validates the result?
- Approved probes succeed and unrelated Pod-to-Pod connections remain rejected
- The projected token expires and unauthorized audiences cannot reuse it
- A negative connection test shows cross-namespace traffic blocked by enforced policy
- The workload accesses its allowed resource but is denied other cloud services
Explanation
Correct Answer
D:The workload accesses its allowed resource but is denied other cloud services. This is stronger than observing a saved configuration because it tests the actual outcome of use workload identity with narrowly scoped external permissions. The underlying principle is that workload identity binds a Pod or service account to defined cloud authority. The original risk was that static shared admin credentials can let one app reach unrelated cloud resources.
Incorrect Answers
A:Least-privilege network controls require enumerating all legitimate communication paths. The observation “Approved probes succeed and unrelated Pod-to-Pod connections remain rejected” would validate that property, rather than the required “The workload accesses its allowed resource but is denied other cloud services”. Workload identity binds a Pod or service account to defined cloud authority.
B:Bound tokens reduce exposure compared with indefinite reusable credentials. The observation “The projected token expires and unauthorized audiences cannot reuse it” would validate that property, rather than the required “The workload accesses its allowed resource but is denied other cloud services”. Workload identity binds a Pod or service account to defined cloud authority.
C:Namespaces partition resource names and policy scope but are not automatic network firewalls. The observation “A negative connection test shows cross-namespace traffic blocked by enforced policy” would validate that property, rather than the required “The workload accesses its allowed resource but is denied other cloud services”. Workload identity binds a Pod or service account to defined cloud authority.
Question 557
Consider this Kubernetes scenario: An incident requires interactive inspection but the application image lacks a shell. What is the BEST next action?
- Use kubectl debug or a suitable ephemeral debug container where permitted
- Inspect kubelet, runtime, node conditions, and network status
- Add a startup probe so liveness is deferred until startup completes
- Inspect Service targetPort and the container's actual listening endpoint
Explanation
Correct Answer
A:Use kubectl debug or a suitable ephemeral debug container where permitted. This is appropriate for the described asset and control gap because ephemeral containers can supply troubleshooting tools without rebuilding application images. If the issue is left untreated, repackaging production images with shell tools just for inspection increases risk. An assessor can verify remediation when an authorized debug container collects evidence without changing the main image.
Incorrect Answers
B:Inspect kubelet, runtime, node conditions, and network status. The operation “Inspect kubelet, runtime, node conditions, and network status” does not address the particular Kubernetes requirement “Use kubectl debug or a suitable ephemeral debug container where permitted”.
C:Add a startup probe so liveness is deferred until startup completes. The operation “Add a startup probe so liveness is deferred until startup completes” does not address the particular Kubernetes requirement “Use kubectl debug or a suitable ephemeral debug container where permitted”.
D:Inspect Service targetPort and the container's actual listening endpoint. The operation “Inspect Service targetPort and the container's actual listening endpoint” does not address the particular Kubernetes requirement “Use kubectl debug or a suitable ephemeral debug container where permitted”.
Question 558
A Kubernetes platform team observes this situation: A platform team wants a neutral venue for collaboration across competing cloud providers. Which action BEST addresses the requirement?
- Verify the project status in the official CNCF landscape or governance records
- Evaluate CNCF community structures and Linux Foundation open governance principles
- Describe contributor, maintainer, adopter, and platform operator responsibilities
- Follow the public Kubernetes contribution process and relevant SIG discussions
Explanation
Correct Answer
B:Evaluate CNCF community structures and Linux Foundation open governance principles. This is appropriate for the described asset and control gap because vendor-neutral communities can coordinate shared cloud-native standards and adoption. If the issue is left untreated, relying solely on one provider's private roadmap may increase dependency risk. An assessor can verify remediation when multiple stakeholders participate through documented open community channels.
Incorrect Answers
A:Verify the project status in the official CNCF landscape or governance records. The operation “Verify the project status in the official CNCF landscape or governance records” does not address the particular Kubernetes requirement “Evaluate CNCF community structures and Linux Foundation open governance principles”.
C:Describe contributor, maintainer, adopter, and platform operator responsibilities. The operation “Describe contributor, maintainer, adopter, and platform operator responsibilities” does not address the particular Kubernetes requirement “Evaluate CNCF community structures and Linux Foundation open governance principles”.
D:Follow the public Kubernetes contribution process and relevant SIG discussions. The operation “Follow the public Kubernetes contribution process and relevant SIG discussions” does not address the particular Kubernetes requirement “Evaluate CNCF community structures and Linux Foundation open governance principles”.
Question 559
A platform engineer recommends: Review discovery labels, target endpoints, and scrape configuration. The original problem is: A Prometheus server scrapes only half the exporters because labels point to the wrong port. Which concept explains the remedy?
- Distributed tracing requires correlation propagation to connect spans across boundaries
- Metrics summarize quantities while logs and traces provide event and request context
- Prometheus gathers time-series metrics from configured scrape targets
- Actionable alerting links signals to service health and response decisions
Explanation
Correct Answer
C:Prometheus gathers time-series metrics from configured scrape targets. That principle directly explains the selected remediation, review discovery labels, target endpoints, and scrape configuration, for this case. Without the distinction, an exporter being Running does not mean Prometheus successfully collects it. The expected confirmation is that all expected targets report UP and sample metrics arrive with useful labels.
Incorrect Answers
A:Distributed tracing requires correlation propagation to connect spans across boundaries. The operation “Distributed tracing requires correlation propagation to connect spans across boundaries” does not address the particular Kubernetes requirement “Prometheus gathers time-series metrics from configured scrape targets”.
B:Metrics summarize quantities while logs and traces provide event and request context. The operation “Metrics summarize quantities while logs and traces provide event and request context” does not address the particular Kubernetes requirement “Prometheus gathers time-series metrics from configured scrape targets”.
D:Actionable alerting links signals to service health and response decisions. The operation “Actionable alerting links signals to service health and response decisions” does not address the particular Kubernetes requirement “Prometheus gathers time-series metrics from configured scrape targets”.
Question 560
Consider this Kubernetes scenario: An operator needs to restore a node to scheduling after a completed upgrade. What is the BEST next action?
- Check Deployment rollout status and its progressing and available conditions
- Create a dedicated service account and bind the narrow required permissions
- Scale the Deployment replica count or configured autoscaling target appropriately
- Uncordon the validated node and monitor its health and workload placements
Explanation
Correct Answer
D:Uncordon the validated node and monitor its health and workload placements. This is appropriate for the described asset and control gap because uncordon reverses the unschedulable scheduling designation. If the issue is left untreated, leaving nodes cordoned after maintenance reduces available cluster capacity. An assessor can verify remediation when the node is Ready and becomes eligible for new suitable workloads.
Incorrect Answers
A:Check Deployment rollout status and its progressing and available conditions. The operation “Check Deployment rollout status and its progressing and available conditions” does not address the particular Kubernetes requirement “Uncordon the validated node and monitor its health and workload placements”.
B:Create a dedicated service account and bind the narrow required permissions. The operation “Create a dedicated service account and bind the narrow required permissions” does not address the particular Kubernetes requirement “Uncordon the validated node and monitor its health and workload placements”.
C:Scale the Deployment replica count or configured autoscaling target appropriately. The operation “Scale the Deployment replica count or configured autoscaling target appropriately” does not address the particular Kubernetes requirement “Uncordon the validated node and monitor its health and workload placements”.
