Practice Exam KCNA: Kubernetes and Cloud Native Associate

Question bank: 110 · timed mock exam: 90 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab)

Exam guide: format, domains and how to prepare

Compare: CCA vs KCNA

Compare: KCNA vs KCSA

  • Kubernetes Fundamentals 48 questions
  • Container Orchestration 31 questions
  • Cloud Native Application Delivery 18 questions
  • Cloud Native Architecture 13 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 110 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for Kubernetes and Cloud Native Associate with InfraPrep

The 110 questions cover 4 domains: Kubernetes Fundamentals, Container Orchestration, Cloud Native Application Delivery, Cloud Native Architecture. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 90 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Kubernetes Fundamentals

A platform engineer is explaining Kubernetes basics to a new hire. The new hire asks what the smallest deployable unit is and how it relates to containers. What is the correct description?

  1. A Node, which runs exactly one container per Node
  2. A Pod, a group of one or more containers that share storage and network resources
  3. A Deployment, which is the smallest unit and always contains exactly one container
  4. A container, which Kubernetes schedules directly onto Nodes without any wrapping object
Show the answer and the explanation

Correct answer: B

The documentation defines a Pod as a group of one or more containers, with shared storage and network resources, and a specification for how to run the containers — this is the smallest deployable unit in Kubernetes.

Source: official documentation

Question 2 Container Orchestration

How does the documentation define a Kubernetes Service?

  1. A tool for building container images before they are pushed to a registry
  2. A controller that restarts failed containers on the same Node
  3. A storage object that persists data for a Pod
  4. A method for exposing a network application running as Pods in the cluster
Show the answer and the explanation

Correct answer: D

A Service is described as a method for exposing a network application that is running as one or more Pods in the cluster.

Source: official documentation

Question 3 Cloud Native Application Delivery

A team wants to package a related set of Kubernetes resources (Deployment, Service, ConfigMap) so they can be installed together and customized per environment. Which Helm concept fits, and how are defaults customized?

  1. A Helm chart, files describing a related set of Kubernetes resources
  2. A Helm release, which cannot be customized once created
  3. A Kubernetes Namespace, which packages resources for installation
  4. A Deployment strategy, which replaces the need for any packaging format
Show the answer and the explanation

Correct answer: A

A chart is described as a collection of files that describe a related set of Kubernetes resources, and when a user supplies custom values, those values override the values in the chart's values.yaml file.

Source: official documentation

Question 4 Cloud Native Architecture

A team is naming a new Prometheus metric that counts the total number of HTTP requests received by a service. Which approach matches the documented guidance on metric names and the data model?

  1. Name it after the general feature measured, such as `http_requests_total`,
  2. Name it randomly, since Prometheus stores metrics without any name at all
  3. Use the same name for every metric in the system and rely only on timestamps to tell them apart
  4. Store the value as a single number with no labels or time dimension
Show the answer and the explanation

Correct answer: A

Prometheus documentation gives `http_requests_total` as an example of a metric name that specifies the general feature of a system being measured, and states that metric names SHOULD specify that general feature.

Source: official documentation

Question 5 Kubernetes Fundamentals

A startup runs a single Kubernetes cluster with a handful of engineers and no plan to separate teams or environments on that cluster. Someone proposes creating a namespace per engineer before deploying anything. What does the documentation suggest?

  1. There is no need to create or think about namespaces at all for a cluster with a few to tens of users
  2. Namespaces are mandatory before any Pod can be created, regardless of cluster size
  3. A namespace must be created per container to isolate network traffic
  4. Namespace names must be globally unique across every Kubernetes cluster the company runs
Show the answer and the explanation

Correct answer: A

Namespaces provide a mechanism for isolating groups of resources within a single cluster, but the documentation explicitly says that for clusters with a few to tens of users, there is no need to create or think about namespaces at all.

Source: official documentation

Question 6 Container Orchestration

A small team wants to reach a Service from outside the cluster without deploying any extra controller, by opening the same port on every Node and forwarding traffic to the Service. Which Service type fits, and why not rely on an Ingress instead for this constraint?

  1. Ingress, because it exposes HTTP and HTTPS routes from outside the cluster
  2. ClusterIP, because it assigns a virtual IP address usable from outside the cluster
  3. NodePort, which gives freedom for load balancing without needing an Ingress controller
  4. NodePort, because it disables the ClusterIP mechanism entirely
Show the answer and the explanation

Correct answer: C

Using a NodePort gives the freedom to set up your own load balancing solution, to configure environments not fully supported by Kubernetes, or to expose Node IP addresses directly — without extra components. An Ingress, by contrast, requires an Ingress controller, since only creating an Ingress resource has no effect.

Source: official documentation

Question 7 Cloud Native Application Delivery

After running `helm upgrade` on a release, the new version misbehaves in production. What is the documented way to return to the previous working release, and how does that differ from running `helm upgrade` again with the old chart?

  1. `helm upgrade` again, since upgrade and rollback are described as identical operations
  2. `helm rollback [RELEASE] [REVISION]`
  3. Deleting the release and letting Kubernetes recreate it automatically
  4. Editing the underlying Deployment object directly, bypassing Helm entirely
Show the answer and the explanation

Correct answer: B

The documentation says it is easy to roll back to a previous release using `helm rollback [RELEASE] [REVISION]`, while an upgrade takes an existing release and upgrades it according to the information provided — a forward operation, not a documented revert.

Source: official documentation

Question 8 Cloud Native Architecture

How does the CNCF glossary describe "cloud native technologies", and how does that compare to a microservices architecture?

  1. Cloud native technologies are the technologies used to build cloud native applications (also called the cloud native stack)
  2. Cloud native technologies and microservices architecture are defined as the exact same thing
  3. Cloud native technologies refer only to virtual machines, and microservices are a deployment method for them
  4. A microservices architecture is a single monolithic service, according to the glossary
Show the answer and the explanation

Correct answer: A

The glossary defines cloud native technologies, also referred to as the cloud native stack, as the technologies used to build cloud native applications, and separately defines a microservices architecture as an architectural approach that breaks applications into individual independent (micro) services, each focused on a specific functionality.

Source: official documentation

Question 9 Kubernetes Fundamentals

An operator notices that a Deployment's ReplicaSet has drifted and considers editing that ReplicaSet directly to fix the Pod count, instead of changing the Deployment. What does the documentation recommend?

  1. Editing the ReplicaSet directly is the documented way to scale a Deployment
  2. Deployments only manage Pods, never ReplicaSets, so editing the ReplicaSet is unrelated
  3. The ReplicaSet should be deleted and recreated manually outside of the Deployment
  4. ReplicaSets owned by a Deployment should not be managed directly
Show the answer and the explanation

Correct answer: D

A Deployment provides declarative updates for Pods and ReplicaSets, and the documentation states plainly that ReplicaSets owned by a Deployment should not be managed directly.

Source: official documentation

Question 10 Container Orchestration

A cluster admin wants a Pod Security Standard level that prevents known privilege escalations while remaining minimally restrictive for broad workload compatibility. Which level matches, and how does it differ from the strictest level?

  1. Restricted, which the documentation calls minimally restrictive
  2. Baseline, a minimally restrictive policy preventing known privilege escalations
  3. Privileged, which prevents known privilege escalations by design
  4. Baseline and Restricted are documented as strictly identical policies
Show the answer and the explanation

Correct answer: B

Baseline is described as a minimally restrictive policy which prevents known privilege escalations, while Restricted is described as heavily restricted, following current Pod hardening best practices — a clearly stricter level.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.