Easy To Download Linux Foundation KCNA Exam Dumps Updated 242 Questions
New Updated KCNA Exam Questions 2026
NEW QUESTION # 87
What is the use of labels in Kubernetes?
- A. All of the options
- B. It is used to assign annotation to an object
- C. It is used to assign a name to an object.
- D. It is used to assign key-value pair to an object
Answer: D
Explanation:
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
NEW QUESTION # 88
Which authentication method allows JWTs to authenticate?
- A. OPA gatekeeper
- B. OpenId connect
- C. Anonymous
- D. Client 'TLS' certificates
Answer: B
NEW QUESTION # 89
What native runtime is Open Container Initiative (OCI) compliant?
- A. gvisor
- B. kata-containers
- C. runV
- D. runC
Answer: D
Explanation:
The Open Container Initiative (OCI) publishes open specifications for container images and container runtimes so that tools across the ecosystem remain interoperable. When a runtime is "OCI-compliant," it means it implements the OCI Runtime Specification (how to run a container from a filesystem bundle and configuration) and/or works cleanly with OCI image formats through the usual layers (image → unpack → runtime). runC is the best-known, widely used reference implementation of the OCI runtime specification and is the low-level runtime underneath many higher-level systems. In Kubernetes, you typically interact with a higher-level container runtime (such as containerd or CRI-O) through the Container Runtime Interface (CRI). That higher-level runtime then uses a low-level OCI runtime to actually create Linux namespaces/cgroups, set up the container process, and start it. In many default installations, containerd delegates to runC for this low-level "create/start" work.
The other options are related but differ in what they are: Kata Containers uses lightweight VMs to provide stronger isolation while still presenting a container-like workflow; gVisor provides a user-space kernel for sandboxing containers; these can be used with Kubernetes via compatible integrations, but the canonical "native OCI runtime" answer in most curricula is runC. Finally, "runV" is not a common modern Kubernetes runtime choice in typical OCI discussions. So the most correct, standards-based answer here is A (runC) because it directly implements the OCI runtime spec and is commonly used as the default low-level runtime behind CRI implementations.
NEW QUESTION # 90
You are deploying a new microservice on Kubernetes. The microservice needs access to a shared configuration file stored in a ConfigMap. How would you access the configuration file from within your microservice container?
- A. Access the ConfigMap data directly using the Kubernetes API.
- B. Use a Kubernetes Secret to store the configuration file securely.
- C. Mount the ConfigMap as a volume into the container.
- D. Use the *kubectl get' command to retrieve the configuration file from the ConfigMap.
- E. Define an environment variable within the pod spec and map it to the ConfigMap data.
Answer: C,E
Explanation:
Both options A and C are valid ways to access configuration data from a ConfigMap within a container Option A (Mount as a volume): You can mount the ConfigMap as a volume into the container, allowing the microservice to access the configuration file directly from the mounted directory This is useful if the configuration file is large or has complex structure. Option C (Environment variable): You can define an environment variable in the pod spec and map it to the ConfigMap data This is simpler for smaller configuration values and can be easily accessed within the microservice code- The other options are not suitable for accessing ConfigMap data within a container.
NEW QUESTION # 91
The IPv4/IPv6 dual stack in Kubernetes:
- A. Requires NetworkPolicies to prevent Services from mixing requests.
- B. Translates an IPv4 request from a Service to an IPv6 Service.
- C. Allows you to create IPv4 and IPv6 dual stack Services.
- D. Allows you to access the IPv4 address by using the IPv6 address.
Answer: C
Explanation:
The correct answer is D: Kubernetes dual-stack support allows you to create Services (and Pods, depending on configuration) that use both IPv4 and IPv6 addressing. Dual-stack means the cluster is configured to allocate and route traffic for both IP families. For Services, this can mean assigning both an IPv4 ClusterIP and an IPv6 ClusterIP so clients can connect using either family, depending on their network stack and DNS resolution.
Option A is incorrect because dual-stack is not about protocol translation (that would be NAT64/other gateway mechanisms, not the core Kubernetes dual-stack feature). Option B is also a form of translation/aliasing that isn't what Kubernetes dual-stack implies; having both addresses available is different from "access IPv4 via IPv6." Option C is incorrect: dual-stack does not inherently require NetworkPolicies to "prevent mixing requests." NetworkPolicies are about traffic control, not IP family separation.
In Kubernetes, dual-stack requires support across components: the network plugin (CNI) must support IPv4/IPv6, the cluster must be configured with both Pod CIDRs and Service CIDRs, and DNS should return appropriate A and AAAA records for Service names. Once configured, you can specify preferences such as ipFamilyPolicy (e.g., PreferDualStack) and ipFamilies (IPv4, IPv6 order) for Services to influence allocation behavior.
Operationally, dual-stack is useful for environments transitioning to IPv6, supporting IPv6-only clients, or running in mixed networks. But it adds complexity: address planning, firewalling, and troubleshooting need to consider two IP families. Still, the definition in the question is straightforward: Kubernetes dual-stack enables dual-stack Services, which is option D.
NEW QUESTION # 92
Consider a pod with a "readinessProbe" that checks for a specific file existence. Explain what happens if the probe fails repeatedly, and how it affects the pod's lifecycle.
- A. The pod will be marked as "unhealthy", but will continue to run.
- B. The pod will be terminated and removed from the cluster.
- C. The pod will be automatically scaled down.
- D. The pod will be rescheduled to a different node in the cluster.
- E. The pod will be automatically restarted.
Answer: A
Explanation:
If the "readinessProbe" fails repeatedly, the pod will be marked as "unhealthy", but it will continue to run. The "readinessProbe" is responsible for ensuring that the pod is ready to receive traffic. If the probe fails, it indicates that the pod is not yet ready, and Kubernetes will not direct traffic to it. The pod will not be restarted, terminated, rescheduled, or scaled down. It will remain in an unhealthy state, and traffic will only be directed to it once the probe starts succeeding. This allows the pod to continue running while it resolves the issue causing the probe failures.
NEW QUESTION # 93
Which of the following are valid ways to define resource requests for a pod? (Select all that apply)
- A. Using the 'limits' field in the container's YAML definition.
- B. Using the resources field in the pod's YAML definition.
- C. Using the •tolerations' field in the pod's YAML definition.
- D. Using the •affinity' field in the pod's YAML definition.
- E. Using the requests' field in the container's YAML definition.
Answer: A,B,E
Explanation:
Resource requests and limits are defined within the container's definition (under the resourceS field). The •requests' field specifies the minimum resources a container needs to run, while the 'limits' field defines the maximum resources the container can use. The 'affinity' and •tolerations' fields are used for controlling pod scheduling preferences and tolerating specific node conditions, but they don't directly define resource requirements.
NEW QUESTION # 94
Which of the following statements is correct concerning Open Policy Agent (OPA)?
- A. Kubernetes can use it to validate requests and apply policies.
- B. Policies can only be tested when published.
- C. The policies must be written in Python language.
- D. It cannot be used outside Kubernetes.
Answer: A
Explanation:
Open Policy Agent (OPA) is a general-purpose policy engine used to define and enforce policy across different systems. In Kubernetes, OPA is commonly integrated through admission control (often via Gatekeeper or custom admission webhooks) to validate and/or mutate requests before they are persisted in the cluster. This makes B correct: Kubernetes can use OPA to validate API requests and apply policy decisions.
Kubernetes' admission chain is where policy enforcement naturally fits. When a user or controller submits a request (for example, to create a Pod), the API server can call external admission webhooks. Those webhooks can evaluate the request against policy-such as "no privileged containers," "images must come from approved registries," "labels must include cost-center," or "Ingress must enforce TLS." OPA's policy language (Rego) allows expressing these rules in a declarative form, and the decision ("allow/deny" and sometimes patches) is returned to the API server. This enforces governance consistently and centrally.
Option A is incorrect because OPA policies are written in Rego, not Python. Option C is incorrect because policies can be tested locally and in CI pipelines before deployment; in fact, testability is a key advantage. Option D is incorrect because OPA is designed to be platform-agnostic-it can be used with APIs, microservices, CI/CD pipelines, service meshes, and infrastructure tools, not only Kubernetes.
From a Kubernetes fundamentals view, OPA complements RBAC: RBAC answers "who can do what to which resources," while OPA-style admission policies answer "even if you can create this resource, does it meet our organizational rules?" Together they help implement defense in depth: authentication + authorization + policy admission + runtime security controls. That is why OPA is widely used to enforce security and compliance requirements in Kubernetes environments.
NEW QUESTION # 95
What is Flux constructed with?
- A. GitOps Toolkit
- B. GitHub Actions Toolkit
- C. Helm Toolkit
- D. GitLab Environment Toolkit
Answer: A
Explanation:
The correct answer is B: GitOps Toolkit. Flux is a GitOps solution for Kubernetes, and in Flux v2 the project is built as a set of Kubernetes controllers and supporting components collectively referred to as the GitOps Toolkit. This toolkit provides the building blocks for implementing GitOps reconciliation: sourcing artifacts (Git repositories, Helm repositories, OCI artifacts), applying manifests (Kustomize/Helm), and continuously reconciling cluster state to match the desired state declared in Git.
This construction matters because it reflects Flux's modular architecture. Instead of being a single monolithic daemon, Flux is composed of controllers that each handle a part of the GitOps workflow: fetching sources, rendering configuration, and applying changes. This makes it more Kubernetes-native: everything is declarative, runs in the cluster, and can be managed like other workloads (RBAC, namespaces, upgrades, observability).
Why the other options are wrong:
"GitLab Environment Toolkit" and "GitHub Actions Toolkit" are not what Flux is built from. Flux can integrate with many SCM providers and CI systems, but it is not "constructed with" those.
"Helm Toolkit" is not the named foundational set Flux is built upon. Flux can deploy Helm charts, but that's a capability, not its underlying construction.
In cloud-native delivery, Flux implements the key GitOps control loop: detect changes in Git (or other declared sources), compute desired Kubernetes state, and apply it while continuously checking for drift. The GitOps Toolkit is the set of controllers enabling that loop.
Therefore, the verified correct answer is B.
NEW QUESTION # 96
You are running a microservice-based application in Kubernetes. Each service has its own HPA configured for scaling. How can you ensure that the scaling decisions for different services are coordinated to prevent resource contention?
- A. Utilize resource quotas to limit the resources allocated to each service, preventing resource contention.
- B. Create a custom controller to monitor resource usage across all services and coordinate scaling decisions.
- C. Configure each HPA to scale based on the resource usage of other services.
- D. Use a single HPA for all microservices to manage scaling centrally.
- E. Use a distributed cache to store and share scaling metrics across different HPAs
Answer: A,B
Explanation:
Both resource quotas and a custom controller can help prevent resource contention. Resource quotas limit the resources each service can consume, preventing one service from monopolizing resources- A custom controller can monitor resource usage across all services and make coordinated scaling decisions to avoid over-provisioning and resource exhaustion.
NEW QUESTION # 97
You need to restrict access to your Kubernetes cluster from a specific IP address range. How would you implement this security measure?
- A. Configure a NetworkPolicy to allow traffic only from the specified IP range.
- B. Use a Service of type 'LoadBalancer' with a specific IP address to restrict access.
- C. Use kubectl to modify the Kubernetes API server's authorization settings.
- D. Create a custom Admission Controller to filter requests based on the source P
- E. Configure firewall rules on the Kubernetes nodes to block traffic from unauthorized IP ranges.
Answer: A
Explanation:
The most appropriate way to restrict access to a Kubernetes cluster from a specific IP address range is to configure a NetworkPolicy. NetworkPolicies allow you to define ingress and egress rules based on source and destination IP addresses, ports, and other network attributes. This provides a flexible and granular way to control network traffic to and from pods within the cluster. Options B, C, and D are not suitable for this scenario as they focus on API server authorization, admission control, or node-level firewall rules, which are not specifically designed for IP address-based access control. Option E is incorrect because Service of type 'LoadBalancer' primarily deals with external access and doesn't provide direct IP address-based access control within the cluster-
NEW QUESTION # 98
Explain the difference between a Docker image and a Docker container. Provide practical scenarios where they are used.
- A. A Docker container is a blueprint for creating an image, while an image is a running instance of that container.
- B. Docker images are used for running applications, while containers are used for storing data.
- C. A Docker image is a blueprint for creating a container, while a container is a running instance of that image.
- D. Docker images and containers are the same thing, just different names.
- E. Docker images are used for storing data, while containers are used for running applications.
Answer: C
Explanation:
A Docker image is a static, immutable template that contains all the necessary components (files, libraries, dependencies, etc.) to run a specific application. Think of it as a blueprint. A Docker container is a running instance of that image, meaning it's an actual process running on your system. You can create multiple containers from the same image. Practical Scenarios: Image: You create a Docker image for a web server application, including the web server software, configuration files, and application code. This image can be shared with others or deployed to different environments. Container: You run multiple instances of this web server image as containers on your server. Each container gets its own isolated environment, allowing you to scale your web application easily.
NEW QUESTION # 99
What is the main purpose of a DaemonSet?
- A. A DaemonSet ensures that all (or certain) nodes run a copy of a Pod.
- B. A DaemonSet ensures that the kubelet is constantly up and running.
- C. A DaemonSet ensures that a process (agent) runs on every node.
- D. A DaemonSet ensures that there are as many pods running as specified in the replicas field.
Answer: A
Explanation:
The correct answer is A. A DaemonSet is a workload controller whose job is to ensure that a specific Pod runs on all nodes (or on a selected subset of nodes) in the cluster. This is fundamentally different from Deployments/ReplicaSets, which aim to maintain a certain replica count regardless of node count. With a DaemonSet, the number of Pods is implicitly tied to the number of eligible nodes: add a node, and the DaemonSet automatically schedules a Pod there; remove a node, and its Pod goes away.
DaemonSets are commonly used for node-level services and background agents: log collectors, node monitoring agents, storage daemons, CNI components, or security agents-anything where you want a presence on each node to interact with node resources. This aligns with option D's phrasing ("agent on every node"), but option A is the canonical definition and is slightly broader because it covers "all or certain nodes" (via node selectors/affinity/taints-tolerations) and the fact that the unit is a Pod.
Why the other options are wrong: DaemonSets do not "keep kubelet running" (B); kubelet is a node service managed by the OS. DaemonSets do not use a replicas field to maintain a specific count (C); that's Deployment/ReplicaSet behavior.
Operationally, DaemonSets matter for cluster operations because they provide consistent node coverage and automatically react to node pool scaling. They also require careful scheduling constraints so they land only where intended (e.g., only Linux nodes, only GPU nodes). But the main purpose remains: ensure a copy of a Pod runs on each relevant node-option A.
=========
NEW QUESTION # 100
Which style of operations are preferred for K8S and cloud native applications?
- A. JSON
- B. Imperative
- C. Declarative
Answer: C
Explanation:
https://kubernetes.io/docs/tasks/manage-kubernetes-objects/declarative-config/#trade-offs
NEW QUESTION # 101
You are deploying a microservices application with several independent services that need to communicate with each other. What is the most suitable way to configure networking between these services in Kubernetes?
- A. Use host networking for all services so that they share the same network namespace.
- B. Use a separate Service of type 'ClusterlP' for each service to isolate their communication.
- C. Use a single Service of type 'ClusterlP' for all services to share a common endpoint.
- D. Use a combination of Services and Ingress resources to manage network traffic between services and external access.
- E. Use a Service of type 'NodePort' for each service to expose them on the node's IP address.
Answer: B
Explanation:
The most suitable way to configure networking between independent services in Kubernetes is to use a separate Service of type 'ClusterlP' for each service. This allows for isolated communication between services and avoids conflicts or unexpected interactions. Option A is incorrect because using host networking can lead to security risks and complexities in managing network resources. Option B is incorrect because using a single Service for all services doesn't allow for independent access or scaling of individual services. Option D is incorrect because using 'NodePort' exposes services to the node's IP address, which is not necessary for internal communication. Option E is correct for managing external access and ingress but not for internal communication between services.
NEW QUESTION # 102
When a Kubernetes Secret is created, how is the data stored by default in etcd?
- A. As encrypted records automatically protected using the Kubernetes control plane master key.
- B. As Base64-encoded strings that provide simple encoding but no actual encryption.
- C. As compressed binary objects that are optimized for space but not secured against access.
- D. As plain text values that are directly stored without any obfuscation or additional encoding.
Answer: B
Explanation:
By default, Kubernetes Secrets are stored in etcd as Base64-encoded values, which makes option A the correct answer. This is a common point of confusion because Base64 encoding is often mistaken for encryption, but in reality, it provides no security-only a reversible text encoding.
When a Secret is defined in a Kubernetes manifest or created via kubectl, its data fields are Base64-encoded before being persisted in etcd. This encoding ensures that binary data (such as certificates or keys) can be safely represented in JSON and YAML formats, which require text-based values. However, anyone with access to etcd or the Secret object via the Kubernetes API can easily decode these values.
Option B is incorrect because Secrets are not stored as raw plaintext; they are encoded using Base64 before storage. Option C is incorrect because Kubernetes does not compress Secret data by default. Option D is incorrect because Secrets are not encrypted at rest by default. Encryption at rest must be explicitly configured using an encryption provider configuration in the Kubernetes API server.
Because of this default behavior, Kubernetes strongly recommends additional security measures when handling Secrets. These include enabling encryption at rest for etcd, restricting access to Secrets using RBAC, using short-lived ServiceAccount tokens, and integrating with external secret management systems such as HashiCorp Vault or cloud provider key management services.
Understanding how Secrets are stored is critical for designing secure Kubernetes clusters. While Secrets provide a convenient abstraction for handling sensitive data, they rely on cluster-level security controls to ensure confidentiality. Without encryption at rest and proper access restrictions, Secret data remains vulnerable to unauthorized access.
Therefore, the correct and verified answer is Option A: Kubernetes stores Secrets as Base64-encoded strings in etcd by default, which offers encoding but not encryption.
NEW QUESTION # 103
Explain the difference between a container image and a container runtime?
- A. A container image is a pre-built package of an application, while a container runtime is a virtual machine that runs the application.
- B. A container runtime is a pre-built package of an application, while a container image is a virtual machine that runs the application.
- C. Both container images and container runtimes are the same thing, just different names.
- D. A container runtime is a blueprint for creating a container, while a container image is the software that executes the container.
- E. A container image is a blueprint for creating a container, while a container runtime is the software that executes the container.
Answer: E
Explanation:
A container image is a blueprint for creating a container, while a container runtime is the software that executes the container. A container image contains all the necessary components, libraries, and dependencies to run an application in a container. It's a snapshot of a specific point in time. Container runtimes, such as Docker, containerd, or CRI-O, are responsible for loading the image, creating a container, and managing its lifecycle. They provide the environment and resources for the container to run.
NEW QUESTION # 104
Consider the following Kubernetes YAML definition for a Deployment:
How many Pods will be running when this Deployment is created?
- A. 0
- B. 1
- C. 2
- D. 3
- E. 4
Answer: D
Explanation:
The 'replicas: 3' field in the Deployment specification indicates that Kubernetes should create and manage three Pods for this Deployment. The Deployment ensures that there are always three running Pods matching the specified labels.
NEW QUESTION # 105
You are implementing a GitOps workflow for your Kubernetes cluster. Which of the following best practices should you consider?
- A. Ensure that all changes to your Kubernetes configurations are reviewed and approved before being deployed.
- B. Organize your Git repository with a clear directory structure for different namespaces and applications.
- C. Store all your Kubernetes configurations in a single Git repository, regardless of their purpose or scope.
- D. IJse Git tags to mark specific releases of your Kubernetes configurations.
- E. IJse a separate Git repository for each Kubernetes resource, such as deployments, services, and ingress.
Answer: A,B,D
Explanation:
Option C promotes organization and maintainability by structuring your repository, while option D enables tracking specific releases through Git tags. Option E emphasizes the importance of code reviews and approvals to ensure the integrity of your deployments. These practices collectively contribute to a robust and well-managed GitOps workflow.
NEW QUESTION # 106
You are building a serverless application on Google Cloud Functions that needs to interact with a Google Cloud SQL database. How can you securely connect your Cloud Functions to the Cloud SQL instance?
- A. Utilize Google Cloud IAM to grant Cloud Functions access to the Cloud SQL instance.
- B. Use Google Cloud Functions' built-in database connector to access Cloud SQL.
- C. Use a dedicated virtual machine (VM) to host a database connector that communicates with both Cloud Functions and Cloud SQL.
- D. Configure a Cloud SQL proxy service to forward connections to the Cloud SQL instance.
- E. Use a service account with appropriate permissions to connect to Cloud SQL from Cloud Functions.
Answer: E
Explanation:
The most secure and recommended approach is to use a service account with appropriate permissions to connect to Cloud SQL from Cloud Functions. This method provides granular control over access and ensures that Cloud Functions only have the necessary permissions to interact with the database. Option A is not a standard feature. Option B is an alternative but adds complexity. Option C introduces extra infrastructure and potential security risks. Option D, while important for overall security, doesnt specifically address database connections.
NEW QUESTION # 107
What feature must a CNI support to control specific traffic flows for workloads running in Kubernetes?
- A. Pod Security Policy
- B. IP Address Management
- C. Network Policies
- D. Border Gateway Protocol
Answer: C
Explanation:
To control which workloads can communicate with which other workloads in Kubernetes, you use NetworkPolicy resources-but enforcement depends on the cluster's networking implementation. Therefore, for traffic-flow control, the CNI/plugin must support Network Policies, making D correct.
Kubernetes defines the NetworkPolicy API as a declarative way to specify allowed ingress and egress traffic based on selectors (Pod labels, namespaces, IP blocks) and ports/protocols. However, Kubernetes itself does not enforce NetworkPolicy rules; enforcement is provided by the network plugin (or associated dataplane components). If your CNI does not implement NetworkPolicy, the objects may exist in the API but have no effect-Pods will communicate freely by default.
Option B (IP Address Management) is often part of CNI responsibilities, but IPAM is about assigning addresses, not enforcing L3/L4 security policy. Option A (BGP) is used by some CNIs to advertise routes (for example, in certain Calico deployments), but BGP is not the general requirement for policy enforcement. Option C (Pod Security Policy) is a deprecated/removed Kubernetes admission feature related to Pod security settings, not network flow control.
From a Kubernetes security standpoint, NetworkPolicies are a key tool for implementing least privilege at the network layer-limiting lateral movement, reducing blast radius, and segmenting environments. But they only work when the chosen CNI supports them. Thus, the correct answer is D: Network Policies.
NEW QUESTION # 108
......
Updated Free Linux Foundation KCNA Test Engine Questions with 242 Q&As: https://examdumps.passcollection.com/KCNA-valid-vce-dumps.html
