Kubernetes core concepts, container orchestration, application delivery, and the cloud native ecosystem, for the entry point to the CNCF certification ladder.
Exam domains and weighting
The KCNA blueprint is split across 4 domains. See the official exam guide for the authoritative breakdown.
Free sample questions
No account needed. Every question explains why every answer is right or wrong, just like the full bank.
lock_openFree sampleContainer Orchestrationmedium
A team runs a Redis cache Pod that only other Pods inside the same cluster need to reach. They want a stable virtual IP and DNS name for the cache, but the cache must never be reachable from outside the cluster. Which Service type meets this requirement with the least exposure?
- AA ClusterIP Service, which allocates an internal virtual IP and cluster DNS name reachable only from within the cluster.check_circle Correct
- BA NodePort Service, which reserves a port on every node so internal Pods can connect through any node address reliably.
- CA LoadBalancer Service, which provisions an external cloud load balancer to front the cache with a stable public address.
- DAn ExternalName Service, which maps the cache name to an external DNS record through a returned CNAME entry.
Select ClusterIP when a workload only needs a stable internal address reachable from within the cluster. ClusterIP is the default Service type and allocates a virtual IP from the service CIDR plus a cluster DNS name that kube-proxy routes only to backing Pods, so traffic never leaves the cluster boundary.
Why A is correct: ClusterIP provides a stable internal virtual IP and DNS record while remaining unreachable from outside the cluster, which exactly matches an internal-only cache.
Why B is wrong: NodePort is tempting because it also gives a stable target, but it opens a port on every node's external IP, exposing the cache beyond the cluster, which the requirement forbids.
Why C is wrong: LoadBalancer looks safe because it also yields a stable address, but it provisions an externally reachable cloud load balancer, violating the internal-only constraint.
Why D is wrong: ExternalName seems relevant because it involves DNS, but it aliases to an external hostname rather than fronting an in-cluster Pod, so it does not expose the local cache at all.
lock_openFree sampleCloud Native Application Deliverymedium
A platform team wants to adopt GitOps for cluster configuration. Which statement best captures the defining principle that distinguishes GitOps from other delivery approaches?
- AA Git repository holds the declared desired state, and an in-cluster agent continuously reconciles the running state to match what is committed.check_circle Correct
- BA CI server holds the authoritative configuration and issues kubectl apply commands to the cluster whenever a build succeeds.
- CDevelopers connect to the cluster with kubectl and make live changes directly, then export the result back into a Git repository as a backup.
- DContainer images are signed and stored in a registry, and the cluster pulls the newest image tag on a fixed schedule regardless of any repository.
Understand that GitOps means a Git-declared desired state continuously reconciled into the cluster by an agent. GitOps rests on two pillars: a declarative desired state versioned in Git, and a reconciliation loop running in or against the cluster that continuously drives actual state to match the committed state, making Git the single source of truth.
Why A is correct: This is correct because GitOps uses a versioned declarative source of truth in Git and a reconciliation agent that continuously converges actual cluster state towards the committed desired state.
Why B is wrong: This is tempting because CI pipelines do deploy to clusters, but it describes a push model where an external system imperatively applies changes rather than a Git repository being the declarative source of truth that the cluster reconciles against.
Why C is wrong: This inverts the flow and is tempting because it involves Git, but here Git is a passive backup rather than the authoritative source, so live manual edits are the real source of truth, which GitOps forbids.
Why D is wrong: This is tempting because it uses the word pull, but it describes image polling, not reconciliation of declared manifests from Git, and it ignores the declarative desired-state repository entirely.
lock_openFree sampleKubernetes Fundamentalseasy
A cluster administrator needs a log-collection agent to run on every node, including any new node that later joins the cluster, with exactly one copy of the agent per node. Which Kubernetes workload object is purpose-built to guarantee one Pod on each node automatically?
- AA Deployment, because it keeps a fixed number of identical Pod replicas running across the cluster
- BA StatefulSet, because it gives each Pod a stable network identity tied to a specific node
- CA Job, because it runs one Pod per node until each completes its task
- DA DaemonSet, because it schedules one copy of the Pod onto every eligible node and onto new nodes as they joincheck_circle Correct
A DaemonSet runs exactly one copy of a Pod on every eligible node, including nodes that join later. The DaemonSet controller watches the set of nodes and reconciles one matching Pod per eligible node, adding Pods when nodes join and removing them when nodes leave, which is why it fits cluster-wide agents like log or metrics collectors.
Why A is wrong: A Deployment maintains a chosen replica count and lets the scheduler place those Pods anywhere, so it is tempting for any 'run this everywhere' need, but it cannot guarantee one Pod per node and will not react to new nodes joining.
Why B is wrong: A StatefulSet provides ordered, stably named Pods for stateful apps, which sounds node-related, but its replica count is fixed and its Pods are not placed one-per-node, so it does not track node membership.
Why C is wrong: A Job runs Pods to completion for batch work, which can feel like a per-node task, but it targets a completion count rather than node coverage and does not maintain a long-running agent on every node.
Why D is correct: A DaemonSet ensures each eligible node runs exactly one copy of the Pod, and it automatically adds a Pod to any node that later joins, which is precisely the node-agent pattern described.
More free KCNA practice questions, every answer explainedFrequently asked questions
- How many questions are on the Kubernetes certification exam?
- The Kubernetes and Cloud Native Associate (KCNA) exam has Not published by CNCF questions and runs for 90 minutes. The format is online proctored, multiple choice.
- What score do I need to pass Kubernetes certification?
- The pass mark is 75%. Examworthy gives you a per-domain readiness score so you can see which domains are holding you back before you book.
- How much does the Kubernetes certification exam cost?
- The exam costs 250 USD to sit. Practising on Examworthy is free to start, and every answer is explained, right and wrong.
- Is there a Kubernetes certification practice exam?
- Yes. Examworthy's exam mode runs a timed Kubernetes certification practice exam (mock) paced to match the real exam, scored per domain so you can see exactly where you stand. Timed mocks are free with an account.
- How does Examworthy help me prepare for Kubernetes certification?
- Every practice question explains why the right answer is right and why each wrong one is wrong, mapped to the official blueprint domains. You learn the reasoning, not just the letter.
- Is Examworthy affiliated with Cloud Native Computing Foundation?
- No. Examworthy is not affiliated with or endorsed by Cloud Native Computing Foundation. Our questions are original, blueprint-aligned practice material; we never reproduce live exam items.
Examworthy is not affiliated with or endorsed by Cloud Native Computing Foundation. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. KCNA and related marks belong to their respective owners.
