KCNA — Container Orchestration Practice Questions
Container Orchestration Practice Questions
Test your understanding of containers, runtimes, networking, service mesh, storage, and security.
Question 1
What Linux kernel feature provides process isolation for containers?
- A) cgroups
- B) Namespaces
- C) SELinux
- D) iptables
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | cgroups limit resource usage (CPU, memory) but don’t provide isolation |
| B | Namespaces provide process isolation — each container gets its own view of PIDs, network, mount points, etc. |
| C | SELinux is a security module that enforces access control policies, not the primary isolation mechanism |
| D | iptables manages network rules, not process isolation |
Question 2
What does a service mesh sidecar proxy do?
- A) Runs the application container
- B) Intercepts all network traffic to/from the application container
- C) Schedules pods on nodes
- D) Stores persistent data for the application
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | The sidecar is a separate container — the app runs in its own container |
| B | The sidecar proxy (usually Envoy) intercepts all incoming and outgoing traffic, handling mTLS, retries, observability, and traffic routing transparently |
| C | Pod scheduling is done by the kube-scheduler on the control plane |
| D | Persistent data is handled by PersistentVolumes via CSI, not sidecar proxies |
Question 3
What is the relationship between a PersistentVolumeClaim (PVC) and a PersistentVolume (PV)?
- A) PVC creates a PV automatically
- B) PVC is a request for storage that binds to an available PV
- C) PV is a request for storage that binds to a PVC
- D) PVC and PV are the same thing
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | PVCs don’t directly create PVs — StorageClasses handle dynamic provisioning |
| B | A PVC is a request from a pod for storage. Kubernetes matches it to an available PV with compatible size and access modes, creating a binding. |
| C | PV is the actual storage resource, not a request — the request is the PVC |
| D | They are distinct objects — PV is the storage, PVC is the claim/request |
Question 4
Which CNCF Graduated project is a high-performance L4/L7 proxy used by most service meshes?
- A) Nginx
- B) HAProxy
- C) Envoy
- D) Traefik
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Nginx is a popular web server/proxy but is not a CNCF project |
| B | HAProxy is a load balancer but not a CNCF project |
| C | Envoy is a CNCF Graduated project — a high-performance L4/L7 proxy used by Istio, AWS App Mesh, and many other service mesh implementations |
| D | Traefik is an ingress controller/proxy but not a CNCF Graduated project |
Question 5
What is the primary security benefit of using minimal base images (like Alpine or distroless)?
- A) Faster build times
- B) Smaller attack surface — fewer packages means fewer vulnerabilities
- C) Better performance at runtime
- D) Automatic vulnerability patching
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Faster builds are a side benefit, not the primary security benefit |
| B | Minimal images contain fewer packages, libraries, and tools — meaning fewer potential vulnerabilities (CVEs) and a smaller attack surface for attackers |
| C | Performance differences are usually negligible between base images |
| D | No container image patches itself automatically — you still need to rebuild and redeploy |
Question 6
What does CSI stand for in Kubernetes?
- A) Container Security Interface
- B) Cluster Storage Interface
- C) Container Storage Interface
- D) Cloud Service Interface
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Security interfaces include RBAC and admission controllers, not CSI |
| B | CSI operates at the container level, not cluster level exclusively |
| C | CSI (Container Storage Interface) is a standard interface that allows storage vendors to write plugins for Kubernetes without modifying K8s core code |
| D | CSI is specific to container storage, not cloud services generally |
Question 7
Which security model defines the layers as Cloud, Cluster, Container, and Code?
- A) Zero Trust Model
- B) Defense in Depth
- C) The 4C’s of Cloud Native Security
- D) Shared Responsibility Model
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Zero Trust is a security principle (“never trust, always verify”) but doesn’t define these 4 layers |
| B | Defense in Depth is a general security concept — the 4C’s is the specific cloud-native implementation |
| C | The 4C’s of Cloud Native Security: Cloud → Cluster → Container → Code. Each layer builds on the one below it. |
| D | Shared Responsibility Model is a cloud provider concept (customer vs provider responsibilities) |
Question 8
What happens to data in an emptyDir volume when the pod is deleted?
- A) Data is preserved and accessible to the next pod
- B) Data is backed up to etcd
- C) Data is permanently deleted
- D) Data is migrated to a PersistentVolume
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | emptyDir is tied to the pod’s lifecycle — it does not persist beyond the pod |
| B | etcd stores cluster state, not application data |
| C | An emptyDir volume is created when a pod starts and is permanently deleted when the pod is deleted. It DOES survive container restarts within the same pod. |
| D | There is no automatic migration — emptyDir and PVs are independent |
Question 9
Which approach is used by Cilium for high-performance container networking?
- A) iptables rules
- B) VXLAN overlay
- C) eBPF (extended Berkeley Packet Filter)
- D) BGP routing only
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | iptables is used by traditional approaches like kube-proxy — Cilium bypasses iptables |
| B | VXLAN overlay is used by Flannel and Calico in overlay mode — not Cilium’s primary approach |
| C | Cilium uses eBPF to run networking, security, and observability logic directly in the Linux kernel, providing better performance than iptables-based approaches |
| D | Cilium can use BGP routing but eBPF is its primary technology |
Question 10
What is the recommended practice for handling Kubernetes Secrets in production?
- A) Base64 encoding is sufficient security
- B) Store secrets directly in container images
- C) Use external secret managers and enable encryption at rest
- D) Use ConfigMaps instead of Secrets
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Base64 encoding is NOT encryption — anyone can decode it |
| B | Secrets should never be baked into images — they’d be visible to anyone with image access |
| C | In production, use external secret managers (HashiCorp Vault, AWS Secrets Manager) and enable encryption at rest in etcd for true security |
| D | ConfigMaps store non-sensitive data — Secrets provide additional features like RBAC restrictions and audit logging |
Score Yourself
| Score | Rating | Action |
|---|---|---|
| 9-10 | Excellent | Strong orchestration knowledge. Move to Chapter 5. |
| 7-8 | Good | Review topics you missed, then proceed. |
| 5-6 | Fair | Re-read service mesh, storage, and security sections. |
| Below 5 | Needs Work | Go back through all Orchestration sub-topics. |
What’s Next?
You’ve completed Chapter 4 — Container Orchestration. Now let’s explore cloud-native architecture concepts.
