[Jun-2026] Linux Foundation KCNA Dumps – Reduce Your Chance of Failure in KCNA Exam
To help you achieve your ultimate goal, we suggest the actual Linux Foundation KCNA dumps for your Kubernetes and Cloud Native Associate exam preparation to use as your guideline.
NEW QUESTION # 125
Which of the following is the name of a container orchestration software?
- A. Docker
- B. CRI-O
- C. Apache Mesos
- D. OpenStack
Answer: C
Explanation:
C (Apache Mesos) is correct because Mesos is a cluster manager/orchestrator that can schedule and manage workloads (including containerized workloads) across a pool of machines. Historically, Mesos (often paired with frameworks like Marathon) was used to orchestrate services and batch jobs at scale, similar in spirit to Kubernetes' scheduling and cluster management role.
Why the other answers are not correct as "container orchestration software" in this context:
OpenStack (A) is primarily an IaaS cloud platform for provisioning compute, networking, and storage (VM-focused). It's not a container orchestrator, though it can host Kubernetes or containers.
Docker (B) is a container platform/tooling ecosystem (image build, runtime, local orchestration via Docker Compose/Swarm historically), but "Docker" itself is not the best match for "container orchestration software" in the multi-node cluster orchestration sense that the question implies.
CRI-O (D) is a container runtime implementing Kubernetes' CRI; it runs containers on a node but does not orchestrate placement, scaling, or service lifecycle across a cluster.
Container orchestration typically means capabilities like scheduling, scaling, service discovery integration, health management, and rolling updates across multiple hosts. Mesos fits that definition: it provides resource management and scheduling over a cluster and can run container workloads via supported containerizers. Kubernetes ultimately became the dominant orchestrator for many use cases, but Mesos is clearly recognized as orchestration software in this category.
So, among these choices, the verified orchestration platform is Apache Mesos (C).
NEW QUESTION # 126
You have configured Prometheus to scrape metrics from a Kubernetes cluster, but you notice that some pods are not being scraped. You suspect that the Prometheus server might be experiencing resource constraints. How can you troubleshoot this issue?
- A. Check the Prometheus logs for any errors related to scraping or resource limitations.
- B. Use the Prometheus •status/targets• endpoint to see which targets are currently being scraped and any errors encountered.
- C. Examine the Prometheus server's CPU and memory usage to identify any resource bottlenecks.
- D. All of the above
- E. Verify the Prometheus server's configuration and ensure that the scraping interval and target labels are correct.
Answer: A,B,C,D,E
Explanation:
All of the mentioned options are valuable for troubleshooting scraping issues caused by resource constraints. Checking logs, monitoring server resource usage, reviewing configuration, and using the 'status/targetS endpoint provide comprehensive insights into the problem. By investigating these aspects, you can pinpoint the root cause and take appropriate actions to resolve the issue.
NEW QUESTION # 127
Which of the following best describes the way kubernetes Role-based access control (RBAC) works?
- A. Kubernetes RBAC states which users can perform which actions against which re-source
- B. Kubernetes does not do RBAC
- C. Kubernetes RBAC lists which operations on which resources are denied to users
- D. Kubernetes RBAC is responsible for authenticating subjects such as users and groups
Answer: A
Explanation:
https://kubernetes.io/docs/reference/access-authn-authz/rbac/
NEW QUESTION # 128
Consider the followin Pod Securit Polic definition:
Which of the following statements is TRUE about this Pod Security Policy?
- A. The policy allows pods to run as specific user IDs, mount configMaps and secrets, and access specific capabilities.
- B. The policy allows pods to mount hostPath volumes.
- C. The policy allows pods to run as any user ID.
- D. The policy allows pods to access host processes.
- E. The policy allows pods to access the host network.
Answer: A
Explanation:
This Pod Security Policy restricts pods to run as specific user IDs (1000 and 1001 ), allows them to mount configMaps and secrets, and grants access to specific capabilities ('SYS_ADMIN' and 'CHOWN'). It does not allow access to the host network, host processes, or host PID namespace. This policy is designed to enforce security restrictions and prevent potential vulnerabilities within the Kubernetes cluster.
NEW QUESTION # 129
You're developing a serverless application using AWS Lambda that requires access to environment variables for configuration purposes. How would you securely manage and access these environment variables within your Lambda functions?
- A. Store environment variables directly in the Lambda function's code.
- B. Utilize AWS Parameter Store to manage environment variables as parameters.
- C. Use AWS Secrets Manager to store and retrieve sensitive environment variables.
- D. Store environment variables in a separate file and upload it along with the Lambda function's code.
- E. Configure environment variables within the AWS Lambda console.
Answer: B,C
Explanation:
The most secure and recommended approaches for managing environment variables in AWS Lambda are to use AWS Secrets Manager (B) and AWS Parameter Store (D). Secrets Manager is specifically designed for storing and retrieving sensitive data like API keys, passwords, and other confidential information. Parameter Store allows you to manage configuration parameters, including environment variables, in a centralized and hierarchical manner. Storing environment variables directly in the code (A) is insecure. Configuring them in the Lambda console (C) is not suitable for managing sensitive data. Storing them in a separate file (E) is less secure and less manageable.
NEW QUESTION # 130
What Linux namespace is shared by default by containers running within a Kubernetes Pod?
- A. Network
- B. Process ID
- C. Host Network
- D. Process Name
Answer: A
Explanation:
By default, containers in the same Kubernetes Pod share the network namespace, which means they share the same IP address and port space. Therefore, the correct answer is B (Network).
This shared network namespace is a key part of the Pod abstraction. Because all containers in a Pod share networking, they can communicate with each other over localhost and coordinate tightly, which is the basis for patterns like sidecars (service mesh proxies, log shippers, config reloaders). It also means containers must coordinate port usage: if two containers try to bind the same port on 0.0.0.0, they'll conflict because they share the same port namespace.
Option A ("Host Network") is different: hostNetwork: true is an optional Pod setting that puts the Pod into the node's network namespace, not the Pod's shared namespace. It is not the default and is generally used sparingly due to security and port-collision risks. Option C ("Process ID") is not shared by default in Kubernetes; PID namespace sharing requires explicitly enabling process namespace sharing (e.g., shareProcessNamespace: true). Option D ("Process Name") is not a Linux namespace concept.
The Pod model also commonly implies shared storage volumes (if defined) and shared IPC namespace in some configurations, but the universally shared-by-default namespace across containers in the same Pod is the network namespace. This default behavior is why Kubernetes documentation explains a Pod as a "logical host" for one or more containers: the containers are co-located and share certain namespaces as if they ran on the same host.
So, the correct, verified answer is B: containers in the same Pod share the Network namespace by default.
=========
NEW QUESTION # 131
What is not semantic versioning?
- A. 2022-05-04
- B. 1.0.0-alpha
- C. 1.0.0
- D. 1.0.0-beta.2
Answer: A
Explanation:
https://semver.org/
RegEx SemVer at https://regex101.com/r/vkijKf/1/
NEW QUESTION # 132
You are setting up Prometheus to monitor a Kubernetes cluster. You need to ensure that Prometheus can collect metrics from pods running different applications. Which Kubernetes object is typically used to configure Prometheus for scraping these pods?
- A. pod
- B. ConfigMap
- C. Deployment
- D. Service
- E. Secret
Answer: B
Explanation:
A ConfigMap is typically used to provide Prometheus with the necessary configuration for scraping pods. The ConfigMap can contain details such as scraping intervals, target labels, and authentication credentials. This configuration allows Prometheus to effectively monitor pods running different applications within the Kubernetes cluster.
NEW QUESTION # 133
Which of the following is not a stop on the cloud native trailmap?
- A. Containerization
- B. Software distribution
- C. CI/CD
- D. Microservices
Answer: D
Explanation:
https://github.com/cncf/landscape#trail-map
NEW QUESTION # 134
In a cloud native environment, who is usually responsible for maintaining the workloads running across the different platforms?
- A. The Site Reliability Engineering (SRE) team.
- B. The cloud provider.
- C. The team of developers.
- D. The Support Engineering team (SE).
Answer: A
Explanation:
B (the Site Reliability Engineering team) is correct. In cloud-native organizations, SREs are commonly responsible for the reliability, availability, and operational health of workloads across platforms (multiple clusters, regions, clouds, and supporting services). While responsibilities vary by company, the classic SRE charter is to apply software engineering to operations: build automation, standardize runbooks, manage incident response, define SLOs/SLIs, and continuously improve system reliability.
Maintaining workloads "across different platforms" implies cross-cutting operational ownership: deployments need to behave consistently, rollouts must be safe, monitoring and alerting must be uniform, and incident practices must work across environments. SRE teams typically own or heavily influence the observability stack (metrics/logs/traces), operational readiness, capacity planning, and reliability guardrails (error budgets, progressive delivery, automated rollback triggers). They also collaborate closely with platform engineering and application teams, but SRE is often the group that ensures production workloads meet reliability targets.
Why other options are less correct:
* The cloud provider (A) maintains the underlying cloud services, but not your application workloads' correctness, SLOs, or operational processes.
* Developers (C) do maintain application code and may own on-call in some models, but the question asks "usually" in cloud-native environments; SRE is the widely recognized function for workload reliability across platforms.
* Support Engineering (D) typically focuses on customer support and troubleshooting from a user perspective, not maintaining platform workload reliability at scale.
So, the best and verified answer is B: SRE teams commonly maintain and ensure reliability of workloads across cloud-native platforms.
=========
NEW QUESTION # 135
Which of the following is a definition of Hybrid Cloud?
- A. A combination of services running in public and private data centers, excluding serverless functions.
- B. A cloud native architecture that uses services running in different public and private clouds, including on-premises data centers.
- C. A combination of services running in public and private data centers, only including data centers from the same cloud provider.
- D. A cloud native architecture that uses services running in public clouds, excluding data centers in different availability zones.
Answer: B
Explanation:
A hybrid cloud architecture combines public cloud and private/on-premises environments, often spanning multiple infrastructure domains while maintaining some level of portability, connectivity, and unified operations. Option C captures the commonly accepted definition: services run across public and private clouds, including on-premises data centers, so C is correct.
Hybrid cloud is not limited to a single cloud provider (which is why A is too restrictive). Many organizations adopt hybrid cloud to meet regulatory requirements, data residency constraints, latency needs, or to preserve existing investments while still using public cloud elasticity. In Kubernetes terms, hybrid strategies often include running clusters both on-prem and in one or more public clouds, then standardizing deployment through Kubernetes APIs, GitOps, and consistent security/observability practices.
Option B is incorrect because excluding data centers in different availability zones is not a defining property; in fact, hybrid deployments commonly use multiple zones/regions for resilience. Option D is a distraction:
serverless inclusion or exclusion does not define hybrid cloud. Hybrid is about the combination of infrastructure environments, not a specific compute model.
A practical cloud-native view is that hybrid architectures introduce challenges around identity, networking, policy enforcement, and consistent observability across environments. Kubernetes helps because it provides a consistent control plane API and workload model regardless of where it runs. Tools like service meshes, federated identity, and unified monitoring can further reduce fragmentation.
So, the most accurate definition in the given choices is C: hybrid cloud combines public and private clouds, including on-premises infrastructure, to run services in a coordinated architecture.
=========
NEW QUESTION # 136
What is the Kubernetes object used for running a recurring workload?
- A. Batch
- B. Job
- C. DaemonSet
- D. CronJob
Answer: D
Explanation:
A recurring workload in Kubernetes is implemented with a CronJob, so the correct choice is D. A CronJob is a controller that creates Jobs on a schedule defined in standard cron format (minute, hour, day of month, month, day of week). This makes CronJobs ideal for periodic tasks like backups, report generation, log rotation, and cleanup tasks.
A Job (option A) is run-to-completion but is typically a one-time execution; it ensures that a specified number of Pods successfully terminate. You can use a Job repeatedly, but something else must create it each time-CronJob is that built-in scheduler. Option B ("Batch") is not a standard workload resource type (batch is an API group, not the object name used here). Option C (DaemonSet) ensures one Pod runs on every node (or selected nodes), which is not "recurring," it's "always present per node." CronJobs include operational controls that matter in real clusters. For example, concurrencyPolicy controls what happens if a scheduled run overlaps with a previous run (Allow, Forbid, Replace). startingDeadlineSeconds can handle missed schedules (e.g., if the controller was down). History limits (successfulJobsHistoryLimit, failedJobsHistoryLimit) help manage cleanup and troubleshooting. Each scheduled execution results in a Job with its own Pods, which can be inspected with kubectl get jobs and kubectl logs.
So the correct Kubernetes object for a recurring workload is CronJob (D): it provides native scheduling and creates Jobs automatically according to the defined cadence.
NEW QUESTION # 137
What is the name of the Kubernetes resource used to expose an application?
- A. DNS
- B. Port
- C. Deployment
- D. Service
Answer: D
Explanation:
To expose an application running on Pods so that other components can reliably reach it, Kubernetes uses a Service, making B the correct answer. Pods are ephemeral: they can be recreated, rescheduled, and scaled, which means Pod IPs change. A Service provides a stable endpoint (virtual IP and DNS name) and load- balances traffic across the set of Pods selected by its label selector.
Services come in multiple forms. The default is ClusterIP, which exposes the application inside the cluster.
NodePort exposes the Service on a static port on each node, and LoadBalancer (in supported clouds) provisions an external load balancer that routes traffic to the Service. ExternalName maps a Service name to an external DNS name. But across these variants, the abstraction is consistent: a Service defines how to access a logical group of Pods.
Option A (Port) is not a Kubernetes resource type; ports are fields within resources. Option C (DNS) is a supporting mechanism (CoreDNS creates DNS entries for Services), but DNS is not the resource you create to expose the app. Option D (Deployment) manages Pod replicas and rollouts, but it does not directly provide stable networking access; you typically pair a Deployment with a Service to expose it.
This is a core cloud-native pattern: controllers manage compute, Services manage stable connectivity, and higher-level gateways like Ingress provide L7 routing for HTTP/HTTPS. So, the Kubernetes resource used to expose an application is Service (B).
=========
NEW QUESTION # 138
What is the default value for authorization-mode in Kubernetes API server?
- A. --authorization-mode=RBAC
- B. --authorization-mode=AlwaysAllow
- C. --authorization-mode=AlwaysDeny
- D. --authorization-mode=ABAC
Answer: B
Explanation:
The Kubernetes API server supports multiple authorization modes that determine whether an authenticated request is allowed to perform an action (verb) on a resource. Historically, the API server's default authorization mode was AlwaysAllow, meaning that once a request was authenticated, it would be authorized without further checks. That is why the correct answer here is B.
However, it's crucial to distinguish "default flag value" from "recommended configuration." In production clusters, running with AlwaysAllow is insecure because it effectively removes authorization controls-any authenticated user (or component credential) could do anything the API permits. Modern Kubernetes best practices strongly recommend enabling RBAC (Role-Based Access Control), often alongside Node and Webhook authorization, so that permissions are granted explicitly using Roles/ClusterRoles and RoleBindings
/ClusterRoleBindings. Many managed Kubernetes distributions and kubeadm-based setups commonly enable RBAC by default as part of cluster bootstrap profiles, even if the API server's historical default flag value is AlwaysAllow.
So, the exam-style interpretation of this question is about the API server flag default, not what most real clusters should run. With RBAC enabled, authorization becomes granular: you can control who can read Secrets, who can create Deployments, who can exec into Pods, and so on, scoped to namespaces or cluster- wide. ABAC (Attribute-Based Access Control) exists but is generally discouraged compared to RBAC because it relies on policy files and is less ergonomic and less commonly used. AlwaysDeny is useful for hard lockdown testing but not for normal clusters.
In short: AlwaysAllow is the API server's default mode (answer B), but RBAC is the secure, recommended choice you should expect to see enabled in almost any serious Kubernetes environment.
=========
NEW QUESTION # 139
Consider the following Kubernetes YAML configuration for a Deployment:
What is the purpose of the 'replicas' field in this configuration, and how does it affect the Deployment? The 'replicas'' field specifies the number of Pods that should be created and maintained by the Deployment. It controls the desired number of running instances of the application.
- A. The 'replicas' field defines the minimum number of Pods that should be available at all times. It ensures that the application remains available even if some Pods fail.
- B. The 'replicas' field specifies the maximum number of Pods that can be created by the Deployment. It limits the amount of resources that the application can consume.
- C. The 'replicas' field specifies the number of nodes in the Kubernetes cluster. It determines the number of Pods that can be scheduled
- D. The 'replicas' field specifies the initial number of Pods that should be created when the Deployment is deployed. It does not affect the number of Pods that are running after the initial deployment.
Answer: A
Explanation:
The 'replicas' field in a Deployment specifies the number of Pods that should be created and maintained by the Deployment. It controls the desired number of running instances of the application. If a Pod fails, the Deployment will automatically create a new Pod to replace it, ensuring that the desired number of replicas is maintained.
NEW QUESTION # 140
You have a Kubernetes deployment running on a cluster that includes multiple nodes. You need to ensure that Pods from this deployment are scheduled only on nodes with a specific label 'gpu=true'. How can you achieve this?
- A. By applying a NodeAffinity to the deployments pod template.
- B. By using a PodDisruptionBudget to ensure that only nodes with the 'gpu=true' label are considered for scheduling.
- C. By creating a custom resource definition that defines the GPU constraint and applying it to the deployment.
- D. By using a ReplicaSet to control the deployments replicas on nodes with the 'gpu=true' label.
- E. By using a daemonset to run the deployment only on nodes with the 'gpu=true' label.
Answer: A
Explanation:
Applying a NodeAffinity to the deployment's pod template is the correct way to schedule Pods on nodes with a specific label. NodeAffinity allows you to specify preferences or requirements for node selection based on labels, taints, and other criteria. Option 'B' is incorrect as PodDisruptionBudget deals with graceful pod termination during node maintenance. Options 'C' and 'D' are not the appropriate approach in this situation. Option 'E' is also incorrect because a ReplicaSet is used for managing replicas, not for node scheduling.
NEW QUESTION # 141
What's the difference between a security profile and a security context?
- A. Security Profiles configure Pods and Containers at runtime. Security Contexts are control plane mechanisms to enforce specific settings in the Security Profile.
- B. Security Contexts configure Clusters and Namespaces at runtime. Security profiles are control plane mechanisms to enforce specific settings in the Security Context.
- C. Security Contexts configure Pods and Containers at runtime. Security profiles are control plane mechanisms to enforce specific settings in the Security Context.
- D. Security Profiles configure Clusters and Namespaces at runtime. Security Contexts are control plane mechanisms to enforce specific settings in the Security Profile.
Answer: C
Explanation:
The correct answer is B. In Kubernetes, a securityContext is part of the Pod and container specification that configures runtime security settings for that workload-things like runAsUser, runAsNonRoot, Linux capabilities, readOnlyRootFilesystem, allowPrivilegeEscalation, SELinux options, seccomp profile selection, and filesystem group (fsGroup). These settings directly affect how the Pod's containers run on the node.
A security profile, in contrast, is a higher-level policy/standard enforced by the cluster control plane (typically via admission control) to ensure workloads meet required security constraints. In modern Kubernetes, this concept aligns with mechanisms like Pod Security Standards (Privileged, Baseline, Restricted) enforced through Pod Security Admission. The "profile" defines what is allowed or forbidden (for example, disallow privileged containers, disallow hostPath mounts, require non-root, restrict capabilities).
The control plane enforces these constraints by validating or rejecting Pod specs that do not comply- ensuring consistent security posture across namespaces and teams.
Option A and D are incorrect because security contexts do not "configure clusters and namespaces at runtime"; security contexts apply to Pods/containers. Option C reverses the relationship: security profiles don' t configure Pods at runtime; they constrain what security context settings (and other fields) are acceptable.
Practically, you can think of it as:
* SecurityContext = workload-level configuration knobs (declared in manifests, applied at runtime).
* SecurityProfile/Standards = cluster-level guardrails that determine which knobs/settings are permitted.
This separation supports least privilege: developers declare needed runtime settings, and cluster governance ensures those settings stay within approved boundaries. Therefore, B is the verified answer.
=========
NEW QUESTION # 142
......
100% Free KCNA Demo-Trial [Pdf], get it now: https://drive.google.com/open?id=17EHpx11z1b4yDfMn6KYyEPhzZAozNt6k
Accurate & Verified Answers As Seen in the Real Exam here: https://www.dumpsactual.com/KCNA-actualtests-dumps.html
