KCNA Practice Test

KCNA practice test: what's covered

• K8s fundamentals
• CNCF
• GitOps
• observability

Free KCNA sample questions

1. When designing a microservices architecture on Kubernetes, you need to determine the fundamental unit of deployment. What is the smallest deployable unit in Kubernetes?

   • A. A standalone Docker container
   • B. Pod — one or more containers sharing network namespace + storage
   • C. A Kubernetes worker Node
   • D. A Kubernetes Cluster namespace
   Show answer

   Correct: B. Pods are ephemeral. Workloads are managed via higher-level controllers. A standalone container is not deployable on its own, nodes are physical/virtual machines, and clusters are the entire ecosystem.

2. Which of the following are responsibilities or characteristics of a Kubernetes Deployment? (Select two)

   • A. Manages just a single pod without any replica control
   • B. Manages a set of replica pods via a ReplicaSet — supports rolling updates and rollback
   • C. Provides declarative updates for Pods and ReplicaSets
   • D. Manages a physical or virtual node directly
   Show answer

   Correct: B and C. A Deployment provides declarative updates and manages ReplicaSets for scaling. It does not manage a single pod without control, nor does it manage physical nodes (that is the job of the kubelet/control plane).

3. Which of the following statements accurately describe a Kubernetes Service of type ClusterIP? (Select two)

   • A. It exposes the service to the public internet using a public IP
   • B. It provides a stable virtual IP reachable from inside the cluster
   • C. It load-balances traffic across pods matching its selector
   • D. It binds to a specific port on every node in the cluster
   Show answer

   Correct: B and C. ClusterIP is purely internal and provides a stable virtual IP + load balancing. Public IPs require LoadBalancer. Binding to node ports is done by NodePort services.

4. When configuring external access to HTTP services in a cluster, an Ingress provides which of the following capabilities? (Select two)

   • A. It is exactly the same as a NodePort Service
   • B. HTTP(S) routing rules that can route traffic by host/path to backend Services
   • C. The ability to terminate TLS/SSL connections
   • D. It functions solely as a persistent storage volume
   Show answer

   Correct: B and C. Ingress manages HTTP/S routing and can terminate TLS. It requires a controller to work. It is not a Service itself, nor is it a persistent storage volume.

5. Which of the following are true regarding the differences and use-cases of ConfigMaps and Secrets in Kubernetes? (Select two)

   • A. They are completely identical in function and structure
   • B. ConfigMaps are meant for storing non-sensitive configuration data
   • C. Secrets store base64-encoded values but are NOT encrypted by default
   • D. ConfigMaps execute much faster than Secrets in runtime
   Show answer

   Correct: B and C. ConfigMaps are for plain configs. Secrets are base64-encoded, not encrypted by default (unless KMS is configured). They aren't identical and performance is roughly the same.

Last updated: 2026-10-19

KCNA practice test FAQ