View All KCNA Actual Exam Questions Answers and Explanations for Free Mar-2026 [Q54-Q74]

View All KCNA Actual Exam Questions Answers and Explanations for Free Mar-2026

The Most In-Demand Linux Foundation KCNA Pass Guaranteed Quiz 

The KCNA Exam is a performance-based exam that involves completing a set of tasks in a real-world environment. KCNA exam is conducted online and requires candidates to have access to a Linux environment with Kubernetes and other cloud-native tools installed. KCNA exam is designed to test the candidate's ability to deploy and manage containerized applications using Kubernetes and other cloud-native technologies.

 

NEW QUESTION # 54
Which option best represents the Pod Security Standards ordered from most permissive to most restrictive
?

• A. Baseline, Privileged, Restricted
• B. Baseline, Restricted, Privileged
• C. Privileged, Baseline, Restricted
• D. Privileged, Restricted, Baseline

Answer: C

Explanation:
Pod Security Standards define a set of security profiles for Pods in Kubernetes, establishing clear expectations for how securely workloads should be configured. These standards were introduced to replace the deprecated PodSecurityPolicies (PSP) and are enforced through the Pod Security Admission controller. The standards are intentionally ordered from least restrictive to most restrictive to allow clusters to adopt security controls progressively.
The correct order from most permissive to most restrictive is: Privileged # Baseline # Restricted, which makes option A the correct answer.
The Privileged profile is the least restrictive. It allows Pods to run with elevated permissions, including privileged containers, host networking, host PID/IPC namespaces, and unrestricted access to host resources.
This level is intended for trusted system components, infrastructure workloads, or cases where full access to the host is required. It offers maximum flexibility but minimal security enforcement.
The Baseline profile introduces a moderate level of security. It prevents common privilege escalation vectors, such as running privileged containers or using host namespaces, while still allowing typical application workloads to function without significant modification. Baseline is designed to be broadly compatible with most applications and serves as a reasonable default security posture for many clusters.
The Restricted profile is the most secure and restrictive. It enforces strong security best practices, such as requiring containers to run as non-root users, dropping unnecessary Linux capabilities, enforcing read-only root filesystems where possible, and preventing privilege escalation. Restricted is ideal for highly sensitive workloads or environments with strict security requirements, though it may require application changes to comply.
Options B, C, and D are incorrect because they misrepresent the intended progression of security strictness defined in Kubernetes documentation.
According to Kubernetes documentation, the Pod Security Standards are explicitly ordered to support gradual adoption: start permissive where necessary and move toward stronger security over time. Therefore, Privileged, Baseline, Restricted is the accurate and fully verified ordering, making option A the correct answer.

NEW QUESTION # 55
Which are the two primary modes for Service discovery within a Kubernetes cluster?

• A. Selectors and DHCP
• B. API calls and LDAP
• C. Environment variables and DNS
• D. Labels and RADIUS

Answer: C

Explanation:
Kubernetes supports two primary built-in modes of Service discovery for workloads: environment variables and DNS, making A correct.
* Environment variables: When a Pod is created, kubelet can inject environment variables for Services that exist in the same namespace at the time the Pod starts. These variables include the Service host and port (for example, MY_SERVICE_HOST and MY_SERVICE_PORT). This approach is simple but has limitations: values are captured at Pod creation time and don't automatically update if Services change, and it can become cluttered in namespaces with many Services.
* DNS-based discovery: This is the most common and flexible method. Kubernetes cluster DNS (usually CoreDNS) provides names like service-name.namespace.svc.cluster.local. Clients resolve the name and connect to the Service, which then routes to backend Pods. DNS scales better, is dynamic with endpoint updates, supports headless Services for per-Pod discovery, and is the default pattern for microservice communication.
The other options are not Kubernetes service discovery modes. Labels and selectors are used internally to relate Services to Pods, but they are not what application code uses for discovery (apps typically don't query selectors; they call DNS names). LDAP and RADIUS are identity/authentication protocols, not service discovery. DHCP is for IP assignment on networks, not for Kubernetes Service discovery.
Operationally, DNS is central: many applications assume name-based connectivity. If CoreDNS is misconfigured or overloaded, service-to-service calls may fail even if Pods and Services are otherwise healthy. Environment-variable discovery can still work for some legacy apps, but modern cloud-native practice strongly prefers DNS (and sometimes service meshes on top of it). The key exam concept is:
Kubernetes provides service discovery via env vars and DNS.
=========

NEW QUESTION # 56
What is the main purpose of a DaemonSet?

• A. A DaemonSet ensures that the kubelet is constantly up and running.
• B. A DaemonSet ensures that there are as many pods running as specified in the replicas field.
• C. A DaemonSet ensures that a process (agent) runs on every node.
• D. A DaemonSet ensures that all (or certain) nodes run a copy of a Pod.

Answer: D

Explanation:
The correct answer is A. A DaemonSet is a workload controller whose job is to ensure that a specific Pod runs on all nodes (or on a selected subset of nodes) in the cluster. This is fundamentally different from Deployments/ReplicaSets, which aim to maintain a certain replica count regardless of node count. With a DaemonSet, the number of Pods is implicitly tied to the number of eligible nodes: add a node, and the DaemonSet automatically schedules a Pod there; remove a node, and its Pod goes away.
DaemonSets are commonly used for node-level services and background agents: log collectors, node monitoring agents, storage daemons, CNI components, or security agents-anything where you want a presence on each node to interact with node resources. This aligns with option D's phrasing ("agent on every node"), but option A is the canonical definition and is slightly broader because it covers "all or certain nodes" (via node selectors/affinity/taints-tolerations) and the fact that the unit is a Pod.
Why the other options are wrong: DaemonSets do not "keep kubelet running" (B); kubelet is a node service managed by the OS. DaemonSets do not use a replicas field to maintain a specific count (C); that's Deployment/ReplicaSet behavior.
Operationally, DaemonSets matter for cluster operations because they provide consistent node coverage and automatically react to node pool scaling. They also require careful scheduling constraints so they land only where intended (e.g., only Linux nodes, only GPU nodes). But the main purpose remains: ensure a copy of a Pod runs on each relevant node-option A.
=========

NEW QUESTION # 57
The IPv4/IPv6 dual stack in Kubernetes:

• A. Requires NetworkPolicies to prevent Services from mixing requests.
• B. Allows you to create IPv4 and IPv6 dual stack Services.
• C. Allows you to access the IPv4 address by using the IPv6 address.
• D. Translates an IPv4 request from a Service to an IPv6 Service.

Answer: B

Explanation:
The correct answer is D: Kubernetes dual-stack support allows you to create Services (and Pods, depending on configuration) that use both IPv4 and IPv6 addressing. Dual-stack means the cluster is configured to allocate and route traffic for both IP families. For Services, this can mean assigning both an IPv4 ClusterIP and an IPv6 ClusterIP so clients can connect using either family, depending on their network stack and DNS resolution.
Option A is incorrect because dual-stack is not about protocol translation (that would be NAT64/other gateway mechanisms, not the core Kubernetes dual-stack feature). Option B is also a form of translation
/aliasing that isn't what Kubernetes dual-stack implies; having both addresses available is different from
"access IPv4 via IPv6." Option C is incorrect: dual-stack does not inherently require NetworkPolicies to
"prevent mixing requests." NetworkPolicies are about traffic control, not IP family separation.
In Kubernetes, dual-stack requires support across components: the network plugin (CNI) must support IPv4
/IPv6, the cluster must be configured with both Pod CIDRs and Service CIDRs, and DNS should return appropriate A and AAAA records for Service names. Once configured, you can specify preferences such as ipFamilyPolicy (e.g., PreferDualStack) and ipFamilies (IPv4, IPv6 order) for Services to influence allocation behavior.
Operationally, dual-stack is useful for environments transitioning to IPv6, supporting IPv6-only clients, or running in mixed networks. But it adds complexity: address planning, firewalling, and troubleshooting need to consider two IP families. Still, the definition in the question is straightforward: Kubernetes dual-stack enables dual-stack Services, which is option D.
=========

NEW QUESTION # 58
What is a DaemonSet?

• A. It's a type of workload that provides guarantees about ordering, uniqueness, and identity of a set of Pods.
• B. It's a type of workload responsible for maintaining a stable set of replica Pods running in any node.
• C. It's a type of workload that ensures a specific set of nodes run a copy of a Pod.
• D. It's a type of workload that needs to be run periodically on a given schedule.

Answer: C

Explanation:
A DaemonSet ensures that a copy of a Pod runs on each node (or a selected subset of nodes), which matches option A and makes it correct. DaemonSets are ideal for node-level agents that should exist everywhere, such as log shippers, monitoring agents, CNI components, storage daemons, and security scanners.
DaemonSets differ from Deployments/ReplicaSets because their goal is not "N replicas anywhere," but "one replica per node" (subject to node selection). When nodes are added to the cluster, the DaemonSet controller automatically schedules the DaemonSet Pod onto the new nodes. When nodes are removed, the Pods associated with those nodes are cleaned up. You can restrict placement using node selectors, affinity rules, or tolerations so that only certain nodes run the DaemonSet (for example, only Linux nodes, only GPU nodes, or only nodes with a dedicated label).
Option B sounds like a ReplicaSet/Deployment behavior (stable set of replicas), not a DaemonSet. Option C describes CronJobs (scheduled, recurring run-to-completion workloads). Option D describes StatefulSets, which provide stable identity, ordering, and uniqueness guarantees for stateful replicas.
Operationally, DaemonSets matter because they often run critical cluster services. During maintenance and upgrades, DaemonSet update strategy determines how those node agents roll out across the fleet. Since DaemonSets can tolerate taints (like master/control-plane node taints), they can also be used to ensure essential agents run across all nodes, including special pools. Thus, the correct definition is A.
=========

NEW QUESTION # 59
Which command will list the resource types that exist within a cluster?

• A. kubectl get namespaces
• B. kubectl api-resources
• C. kubectl api-versions
• D. curl https://kubectrl/namespaces

Answer: B

Explanation:
To list the resource types available in a Kubernetes cluster, you use kubectl api-resources, so A is correct.
This command queries the API server's discovery endpoints and prints a table of resources (kinds) that the cluster knows about, including their names, shortnames, API group/version, whether they are namespaced, and supported verbs. It's extremely useful for learning what objects exist in a cluster-especially when CRDs are installed, because those custom resource types will also appear in the output.
Option C (kubectl api-versions) lists available API versions (group/version strings like v1, apps/v1, batch/v1) but does not directly list the resource kinds/types. It's related discovery information but answers a different question. Option B (kubectl get namespaces) lists namespaces, not resource types. Option D is invalid (typo in URL and conceptually not the Kubernetes discovery mechanism).
Practically, kubectl api-resources is used during troubleshooting and exploration: you might use it to confirm whether a CRD is installed (e.g., certificates.cert-manager.io kinds), to check whether a resource is namespaced, or to find the correct kind name for kubectl get. It also helps understand what your cluster supports at the API layer (including aggregated APIs).
So, the verified correct command to list resource types that exist in the cluster is A: kubectl api-resources.

NEW QUESTION # 60
What's the difference between a security profile and a security context?

• A. Security Profiles configure Clusters and Namespaces at runtime. Security Contexts are control plane mechanisms to enforce specific settings in the Security Profile.
• B. Security Profiles configure Pods and Containers at runtime. Security Contexts are control plane mechanisms to enforce specific settings in the Security Profile.
• C. Security Contexts configure Clusters and Namespaces at runtime. Security profiles are control plane mechanisms to enforce specific settings in the Security Context.
• D. Security Contexts configure Pods and Containers at runtime. Security profiles are control plane mechanisms to enforce specific settings in the Security Context.

Answer: D

Explanation:
The correct answer is B. In Kubernetes, a securityContext is part of the Pod and container specification that configures runtime security settings for that workload-things like runAsUser, runAsNonRoot, Linux capabilities, readOnlyRootFilesystem, allowPrivilegeEscalation, SELinux options, seccomp profile selection, and filesystem group (fsGroup). These settings directly affect how the Pod's containers run on the node.
A security profile, in contrast, is a higher-level policy/standard enforced by the cluster control plane (typically via admission control) to ensure workloads meet required security constraints. In modern Kubernetes, this concept aligns with mechanisms like Pod Security Standards (Privileged, Baseline, Restricted) enforced through Pod Security Admission. The "profile" defines what is allowed or forbidden (for example, disallow privileged containers, disallow hostPath mounts, require non-root, restrict capabilities). The control plane enforces these constraints by validating or rejecting Pod specs that do not comply-ensuring consistent security posture across namespaces and teams.
Option A and D are incorrect because security contexts do not "configure clusters and namespaces at runtime"; security contexts apply to Pods/containers. Option C reverses the relationship: security profiles don't configure Pods at runtime; they constrain what security context settings (and other fields) are acceptable.
Practically, you can think of it as:
SecurityContext = workload-level configuration knobs (declared in manifests, applied at runtime).
SecurityProfile/Standards = cluster-level guardrails that determine which knobs/settings are permitted.
This separation supports least privilege: developers declare needed runtime settings, and cluster governance ensures those settings stay within approved boundaries. Therefore, B is the verified answer.

NEW QUESTION # 61
What is CRD?

• A. Custom Restricted Definition
• B. Custom RUST Definition
• C. Custom Resource Definition
• D. Customized RUST Definition

Answer: C

Explanation:
A CRD is a CustomResourceDefinition, making A correct. Kubernetes is built around an API-driven model:
resources like Pods, Services, and Deployments are all objects served by the Kubernetes API. CRDs allow you to extend the Kubernetes API by defining your own resource types. Once a CRD is installed, the API server can store and serve custom objects (Custom Resources) of that new type, and Kubernetes tooling (kubectl, RBAC, admission, watch mechanisms) can interact with them just like built-in resources.
CRDs are a core building block of the Kubernetes ecosystem because they enable operators and platform extensions. A typical pattern is: define a CRD that represents the desired state of some higher-level concept (for example, a database cluster, a certificate request, an application release), and then run a controller (often called an "operator") that watches those custom resources and reconciles the cluster to match. That controller may create Deployments, StatefulSets, Services, Secrets, or cloud resources to implement the desired state encoded in the custom resource.
The incorrect answers are made-up expansions. CRDs are not related to Rust in Kubernetes terminology, and
"custom restricted definition" is not the standard meaning.
So the verified meaning is: CRD = CustomResourceDefinition, used to extend Kubernetes APIs and enable Kubernetes-native automation via controllers/operators.

NEW QUESTION # 62
What are the two major components of service mesh?

• A. Control plane and Data plane
• B. Master plane and Data plane
• C. Master plane and User plane
• D. None of the options
• E. Controller plane and User plane

Answer: A

Explanation:
https://istio.io/latest/about/service-mesh/

NEW QUESTION # 63
Which kubernetes object do deployments use behind the scenes when they need to scale pods?

• A. kubectl
• B. Horizontal pod autoscaler
• C. Replication controller
• D. ReplicaSets

Answer: D

Explanation:
https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/

NEW QUESTION # 64
You are running a Kubernetes cluster with three nodes. One node experiences a hardware failure. Which of the following Kubernetes features ensures that your application remains available and running?

• A. Node affinity
• B. Pod Disruption Budgets
• C. Rolling updates
• D. Self-healing
• E. Horizontal Pod Autoscaling

Answer: D

Explanation:
Kubernetes' self-healing capabilities ensure that your application remains available even when a node fails. It automatically detects and restarts failed Pods on healthy nodes, maintaining the desired number of replicas.

NEW QUESTION # 65
If kubectl is failing to retrieve information from the cluster, where can you find Pod logs to troubleshoot?

• A. ~/.kube/config
• B. /etc/kubernetes/
• C. /var/log/pods/
• D. /var/log/k8s/

Answer: C

Explanation:
The correct answer is A: /var/log/pods/. When kubectl logs can't retrieve logs (for example, API connectivity issues, auth problems, or kubelet/API proxy issues), you can often troubleshoot directly on the node where the Pod ran. Kubernetes nodes typically store container logs on disk, and a common location is under /var/log
/pods/, organized by namespace, Pod name/UID, and container. This directory contains symlinks or files that map to the underlying container runtime log location (often under /var/log/containers/ as well, depending on distro/runtime setup).
Option B (~/.kube/config) is your local kubeconfig file; it contains cluster endpoints and credentials, not Pod logs. Option D (/etc/kubernetes/) contains Kubernetes component configuration/manifests on some installations (especially control plane), not application logs. Option C (/var/log/k8s/) is not a standard Kubernetes log path.
Operationally, the node-level log locations depend on the container runtime and logging configuration, but the Kubernetes convention is that kubelet writes container logs to a known location and exposes them through the API so kubectl logs works. If the API path is broken, node access becomes your fallback. This is also why secure node access is sensitive: anyone with node root access can potentially read logs (and other data), which is part of the threat model.
So, the best answer for where to look on the node for Pod logs when kubectl can't retrieve them is /var/log
/pods/, option A.
=========

NEW QUESTION # 66
You are running a multi-cluster Kubernetes environment with Istio deployed. You need to ensure that communication between services across different clusters is secure and encrypted. What Istio configuration would you use to achieve this?

• A. Use the 'ingress' and 'egress' settings in the 'istio.io/gateway' configuration
• B. Configure the 'mtls' setting to 'STRICT' in the Istio control plane
• C. Use the 'peerAuthentication' setting in the 'istio.io/auth' annotation on services
• D. Enable 'Mutual TLS' authentication for all services in the Istio configuration
• E. Deploy a dedicated Istio control plane for each cluster and configure cross-cluster communication

Answer: D

Explanation:
To secure inter-cluster communication with Istio, you need to enable Mutual TLS (mTLS) authentication. This ensures that all communication between services, even across different clusters, is encrypted and verified. Options A and B are partially correct but dont cover the full scope of inter-cluster security. Option C is not recommended as it creates complexity in managing multiple control planes. Option E is used for managing ingress and egress traffic but doesn't directly address inter-cluster security

NEW QUESTION # 67
Which of the following factors does scheduling take into account when selecting a Node?

• A. Resource requirements
• B. Services
• C. How many replicas there are in a Deployment
• D. The number of existing Pods on a Node

Answer: A

Explanation:
Scheduling takes resource requirements into account in the form of resource requests.

NEW QUESTION # 68
What is the purpose of the CRI?

• A. Support container replication and scaling on nodes.
• B. To provide runtime integration control when multiple runtimes are used.
• C. Provide an interface allowing Kubernetes to support pluggable container runtimes.
• D. Allow the definition of dynamic resource criteria across containers.

Answer: C

Explanation:
The Container Runtime Interface (CRI) exists so Kubernetes can support pluggable container runtimes behind a stable interface, which makes C correct. In Kubernetes, the kubelet is responsible for managing Pods on a node, but it does not implement container execution itself. Instead, it delegates container lifecycle operations (pull images, create pod sandbox, start/stop containers, fetch logs, exec/attach streaming) to a container runtime through a well-defined API. CRI is that API contract.
Because of CRI, Kubernetes can run with different container runtimes-commonly containerd or CRI-O-without changing kubelet core logic. This improves portability and keeps Kubernetes modular: runtime innovation can happen independently while Kubernetes retains a consistent operational model. CRI is accessed via gRPC and defines the services and message formats kubelet uses to communicate with runtimes.
Option B is incorrect because replication and scaling are handled by controllers (Deployments/ReplicaSets) and schedulers, not by CRI. Option D is incorrect because resource criteria (requests/limits) are expressed in Pod specs and enforced via OS mechanisms (cgroups) and kubelet/runtime behavior, but CRI is not "for defining dynamic resource criteria." Option A is vague and not the primary statement; while CRI enables runtime integration, its key purpose is explicitly to make runtimes pluggable and interoperable.
This design became even more important as Kubernetes moved away from Docker Engine integration (dockershim removal from kubelet). With CRI, Kubernetes focuses on orchestrating Pods, while runtimes focus on executing containers. That separation of responsibilities is a core container orchestration principle and is exactly what the question is testing.
So the verified answer is C.

NEW QUESTION # 69
How to load and generate data required before the Pod startup?

• A. Use an init container with shared file storage.
• B. Use a sidecar container with shared volume.
• C. Use a PVC volume.
• D. Use another Pod with a PVC.

Answer: A

Explanation:
The Kubernetes-native mechanism to run setup steps before the main application containers start is an init container, so A is correct. Init containers run sequentially and must complete successfully before the regular containers in the Pod are started. This makes them ideal for preparing configuration, downloading artifacts, performing migrations, generating files, or waiting for dependencies.
The question specifically asks how to "load and generate data required before Pod startup." The most common pattern is: an init container writes files into a shared volume (like an emptyDir volume) mounted by both the init container and the app container. When the init container finishes, the app container starts and reads the generated files. This is deterministic and aligns with Kubernetes Pod lifecycle semantics.
A sidecar container (option C) runs concurrently with the main container, so it is not guaranteed to complete work before startup. Sidecars are great for ongoing concerns (log shipping, proxies, config reloaders), but they are not the primary "before startup" mechanism. A PVC volume (option B) is just storage; it doesn't itself perform generation or ensure ordering. "Another Pod with a PVC" (option D) introduces coordination complexity and still does not guarantee the data is prepared before this Pod starts unless you build additional synchronization.
Init containers are explicitly designed for this kind of pre-flight work, and Kubernetes guarantees ordering: all init containers complete in order, then the app containers begin. That guarantee is why A is the best and verified answer.

NEW QUESTION # 70
Which one of the following is an open source runtime security tool?

• A. gVisor
• B. falco
• C. containerd
• D. lxd

Answer: B

Explanation:
The correct answer is C: Falco. Falco is a widely used open-source runtime security tool (originally created by Sysdig and now a CNCF project) designed to detect suspicious behavior at runtime by monitoring system calls and other kernel-level signals. In Kubernetes environments, Falco helps identify threats such as unexpected shell access in containers, privilege escalation attempts, access to sensitive files, anomalous network tooling, crypto-mining patterns, and other behaviors that indicate compromise or policy violations.
The other options are not primarily "runtime security tools" in the detection/alerting sense:
* containerd is a container runtime responsible for executing containers; it's not a security detection tool.
* lxd is a system container and VM manager; again, not a runtime threat detection tool.
* gVisor is a sandboxed container runtime that improves isolation by interposing a user-space kernel; it's a security mechanism, but the question asks for a runtime security tool (monitoring/detection). Falco fits that definition best.
In cloud-native security practice, Falco typically runs as a DaemonSet so it can observe activity on every node. It uses rules to define what "bad" looks like and can emit alerts to SIEM systems, logging backends, or incident response workflows. This complements preventative controls like RBAC, Pod Security Admission, seccomp, and least privilege configurations. Preventative controls reduce risk; Falco provides visibility and detection when something slips through.
Therefore, among the provided choices, the verified runtime security tool is Falco (C).
=========

NEW QUESTION # 71
You are troubleshooting a performance issue with an application running in a Kubernetes cluster. You have access to Prometheus and Jaeger, but the Jaeger Ul shows that a specific request took an unusually long time to process. Which metric in Prometheus can help you identify the specific component or service within the application that caused the delay?

• A. kube_deployment_status_replicas
• B. kube_pod_container_status_restart_count
• C. kube_pod_container_resource_requests_cpu_cores
• D. kube_pod_status_phase
• E. http_request_duration_seconds

Answer: E

Explanation:
The correct answer is E . The metric 'http_request_duration_seconds* is typically used to track the time taken for HTTP requests to be processed. In this case, by looking at the 'http_request_duration_seconds' metric for the specific request identified in Jaeger, you can see the duration of each stage of the request processing. This can pinpoint the specific component or service where the delay occurred. The other options are not relevant to identifying the specific component or service causing the delay: A : Shows CPU resource requests for a pod. B : Shows the pod's phase. C : Shows the number of replicas in a deployment. D : Shows the restart count for a pod's containers. These metrics do not provide information about the processing time of individual requests.

NEW QUESTION # 72
In which framework do the developers no longer have to deal with capacity, deployments, scaling and fault tolerance, and OS?

• A. Mesos
• B. Kubernetes
• C. Docker Swarm
• D. Serverless

Answer: D

Explanation:
Serverless is the model where developers most directly avoid managing server capacity, OS operations, and much of the deployment/scaling/fault-tolerance mechanics, which is why D is correct. In serverless computing (commonly Function-as-a-Service, FaaS, and managed serverless container platforms), the provider abstracts away the underlying servers. You typically deploy code (functions) or a container image, define triggers (HTTP events, queues, schedules), and the platform automatically provisions the required compute, scales it based on demand, and handles much of the availability and fault tolerance behind the scenes.
It's important to compare this to Kubernetes: Kubernetes does automate scheduling, self-healing, rolling updates, and scaling, but it still requires you (or your platform team) to design and operate cluster capacity, node pools, upgrades, runtime configuration, networking, and baseline reliability controls. Even in managed Kubernetes services, you still choose node sizes, scale policies, and operational configuration. Kubernetes reduces toil, but it does not eliminate infrastructure concerns in the same way serverless does.
Docker Swarm and Mesos are orchestration platforms that schedule workloads, but they also require managing the underlying capacity and OS-level aspects. They are not "no longer have to deal with capacity and OS" frameworks.
From a cloud native viewpoint, serverless is about consuming compute as an on-demand utility. Kubernetes can be a foundation for a serverless experience (for example, with event-driven autoscaling or serverless frameworks), but the pure framework that removes the most operational burden from developers is serverless.

NEW QUESTION # 73
What feature must a CNI support to control specific traffic flows for workloads running in Kubernetes?

• A. Network Policies
• B. Border Gateway Protocol
• C. Pod Security Policy
• D. IP Address Management

Answer: A

Explanation:
To control which workloads can communicate with which other workloads in Kubernetes, you use NetworkPolicy resources-but enforcement depends on the cluster's networking implementation. Therefore, for traffic-flow control, the CNI/plugin must support Network Policies, making D correct.
Kubernetes defines the NetworkPolicy API as a declarative way to specify allowed ingress and egress traffic based on selectors (Pod labels, namespaces, IP blocks) and ports/protocols. However, Kubernetes itself does not enforce NetworkPolicy rules; enforcement is provided by the network plugin (or associated dataplane components). If your CNI does not implement NetworkPolicy, the objects may exist in the API but have no effect-Pods will communicate freely by default.
Option B (IP Address Management) is often part of CNI responsibilities, but IPAM is about assigning addresses, not enforcing L3/L4 security policy. Option A (BGP) is used by some CNIs to advertise routes (for example, in certain Calico deployments), but BGP is not the general requirement for policy enforcement.
Option C (Pod Security Policy) is a deprecated/removed Kubernetes admission feature related to Pod security settings, not network flow control.
From a Kubernetes security standpoint, NetworkPolicies are a key tool for implementing least privilege at the network layer-limiting lateral movement, reducing blast radius, and segmenting environments. But they only work when the chosen CNI supports them. Thus, the correct answer is D: Network Policies.
=========

NEW QUESTION # 74
......

Linux Foundation KCNA Exam covers a broad range of topics, including Kubernetes, containers, application deployment, and management, cloud-native architecture, and troubleshooting. Kubernetes and Cloud Native Associate certification also tests one's hands-on experience with cloud-native technologies and their ability to deploy, manage, and scale applications in a cloud-native environment. KCNA exam requires a deep understanding of the Kubernetes container orchestrator and its core components.

 

KCNA Free Certification Exam Material with 242 Q&As : https://www.examdumpsvce.com/KCNA-valid-exam-dumps.html

New Version KCNA Certificate & Helpful Exam Dumps is Online: https://drive.google.com/open?id=1Zv5m-fd3bQC4Q1n34VtKuURUWAM2thVd