KCNA

Diagram the relationship between a Kubernetes control plane, worker nodes, and workloads.

Explain the role of etcd as Kubernetes cluster state storage.

Distinguish the responsibilities of the scheduler and controller manager.

Explain how the kubelet, container runtime, and kube-proxy support workloads on a node.

Interpret the apiVersion, kind, metadata, spec, and status fields of a Kubernetes object.

Trace Pod creation from a kubectl request through the API server, etcd, scheduler, controllers, and kubelet.

Discover and inspect cluster resources with kubectl get, describe, explain, and api-resources.

Organize and select Kubernetes objects using namespaces, labels, selectors, and annotations.

Write and apply a Pod manifest for a containerized application.

Inspect Pod phases, conditions, events, logs, and container processes to explain a Pod's current state.

Distinguish init containers and sidecar containers by lifecycle and purpose.

Create a Deployment and trace its ownership of ReplicaSets and Pods.

Scale a Deployment and verify that the controller reconciles the requested replica count.

Update a Deployment image and inspect or reverse its rollout.

Select among Deployments, DaemonSets, and StatefulSets for a workload scenario.

Select between Jobs and CronJobs for finite and scheduled tasks.

Create a ConfigMap and consume its values as environment variables or mounted files.

Create a Secret, consume it from a Pod, and explain why base64 encoding is not encryption.

Distinguish container-local ephemeral storage from Kubernetes persistent storage.

Explain how PersistentVolumes, PersistentVolumeClaims, and StorageClasses participate in dynamic provisioning.

Mount a PersistentVolumeClaim in a Pod and verify that data survives Pod replacement.

Set CPU and memory requests and predict Pod scheduling from the requests and available node capacity.

Constrain Pod placement with node selectors and node affinity.

Control Pod placement with node taints and tolerations.

Explain the Kubernetes pod networking model and the role of Container Network Interface plugins.

Trace in-cluster service discovery from DNS lookup through a Service and EndpointSlice to a Pod.

Expose a Deployment with a ClusterIP Service and verify connectivity from another Pod.

Select among ClusterIP, NodePort, LoadBalancer, and ExternalName Services for a stated requirement.

Explain how Ingress and the Gateway API route external HTTP traffic to Services.

Apply and verify a NetworkPolicy that permits an intended traffic flow while accounting for the cluster CNI's enforcement capabilities.

Diagnose basic Kubernetes connectivity failures using kubectl and DNS or HTTP test tools.

Configure startup, readiness, and liveness probes for a containerized application.

Configure container resource limits and predict CPU throttling or out-of-memory termination.

Explain how a HorizontalPodAutoscaler changes replica counts from observed metrics.

Apply namespace ResourceQuotas and LimitRanges to constrain resource consumption.

Trace a Kubernetes request through authentication, authorization, and admission control.

Determine and test permissions granted through ServiceAccounts, Roles, and RoleBindings.

Apply a Pod security context that follows least-privilege principles.

Map source control, build, test, image publication, and deployment to stages of a cloud-native CI/CD pipeline.

Explain how immutable infrastructure and externalized configuration improve repeatability.

Install, inspect, upgrade, and roll back an application release with Helm.

Select rolling, blue-green, or canary delivery for a stated release risk.

Explain how GitOps controllers reconcile cluster state from a version-controlled source of truth.

Distinguish CustomResourceDefinitions and operators from built-in Kubernetes resources and controllers.

Compare event-driven serverless platforms with long-running Kubernetes workloads and identify when scale-to-zero is appropriate.

Select image scanning, signing, or software-bill-of-materials controls for a stated supply-chain risk.

Distinguish metrics, logs, and traces by the operational questions each signal answers.

Explain the Prometheus pull model, targets, exporters, and time-series labels.

Interpret a basic Prometheus metric and use it to assess workload health.

Trace container logs from standard output through a collector such as Fluent Bit or Fluentd to a backend.

Explain how OpenTelemetry context connects spans into a distributed trace.

Define a service-level indicator, objective, agreement, and error budget for a simple service.

Explain the data-plane and control-plane roles of a service mesh and the purpose of Envoy.

Classify major CNCF projects by function and maturity, and explain how vendor-neutral CNCF governance supports the cloud-native ecosystem.

Deploy a multi-resource application using a ConfigMap, Deployment, and Service, then verify internal reachability.

Add persistent storage to an application, perform a controlled Pod replacement or rollout, and verify data survival.

Add probes and resource constraints to a workload and observe its behavior during a controlled failure.

Diagnose and repair workloads exhibiting Pending, ImagePullBackOff, and CrashLoopBackOff symptoms.

Choose appropriate workload, networking, configuration, and storage resources for a KCNA-style scenario.

Distinguish the responsibilities of application developers, platform engineers, site reliability engineers, and security engineers in cloud-native scenarios.

Apply time budgeting and option-elimination techniques to a timed KCNA practice set.

Analyze errors from a practice set and produce a targeted final-review checklist.