A company runs a microservices application in containers on a single host. They need to expose a public-facing service on port 443, but they also have internal services that should not be accessible from the outside. They want to minimize the attack surface. Which networking configuration is most appropriate?

Use a macvlan network to give each container its own IP address.

Use a user-defined bridge network and publish only the public service's port to the host.

Run all containers in the host network namespace and use firewall rules to restrict access.

Use the default bridge network and publish all container ports.

A security-conscious organization runs untrusted third-party binaries in containers on a shared host. They want to minimize the risk of a container breakout affecting the host. Which configuration is most effective?

Mount the host's root filesystem into the container for easier debugging.

Use the host's network namespace to simplify security monitoring.

Run the container as a non-root user and drop all Linux capabilities.

Run the container with the `--privileged` flag to ensure it has all capabilities.

A security team is reviewing a container image used in production. They want to reduce the attack surface by minimizing the number of packages and tools included in the image. Which approach is most effective?

Use a full-featured base image like `ubuntu` to ensure all tools are available.

Use a minimal base image like `scratch` or `alpine` and only install required packages.

Run the container in privileged mode to avoid permission errors.

Install all packages in a single layer to reduce image size.

An operator is managing a container that processes incoming files. The container writes processed files to a directory inside its own filesystem. The operator needs to ensure that the processed files are preserved even if the container is stopped and removed, and that they are accessible to other containers on the same host. What should the operator do?

Commit the container to a new image after processing.

Use a Docker volume mounted at the directory where the files are written.

Copy the files out of the container manually before stopping it.

Increase the container's storage quota.

A team is running a stateful database in a container on a single host. They need to ensure that the database data is not lost when the container is restarted or replaced. They also want to be able to back up the data easily. Which storage approach should they use?

Store the data in an environment variable.

Store the data in the container's writable layer.

Use a bind mount from the host filesystem.

Use a tmpfs mount for the data directory.

Kubernetes and Cloud Native Associate (KCNA)

Domain 2Objective 1

Containerization KCNA Practice Questions (Page 5)

Part of the Container Orchestration domain, which accounts for 28% of the KCNA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 5–9 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

28%of the exam

Questions 21–25

21expert · hard
A company runs a microservices application in containers on a single host. They need to expose a public-facing service on port 443, but they also have internal services that should not be accessible from the outside. They want to minimize the attack surface. Which networking configuration is most appropriate?
Select an answer first
22application · medium
A security-conscious organization runs untrusted third-party binaries in containers on a shared host. They want to minimize the risk of a container breakout affecting the host. Which configuration is most effective?
Select an answer first
23application · medium
A security team is reviewing a container image used in production. They want to reduce the attack surface by minimizing the number of packages and tools included in the image. Which approach is most effective?
Select an answer first
24application · medium
An operator is managing a container that processes incoming files. The container writes processed files to a directory inside its own filesystem. The operator needs to ensure that the processed files are preserved even if the container is stopped and removed, and that they are accessible to other containers on the same host. What should the operator do?
Select an answer first
25application · medium
A team is running a stateful database in a container on a single host. They need to ensure that the database data is not lost when the container is restarted or replaced. They also want to be able to back up the data easily. Which storage approach should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCNA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCNA” is a trademark of its owner, used for identification only.

Containerization KCNA Practice Questions (Page 5)

Questions 21–25

A security-conscious organization runs untrusted third-party binaries in containers on a shared host. They want to minimize the risk of a container breakout affecting the host. Which configuration is most effective?

A security team is reviewing a container image used in production. They want to reduce the attack surface by minimizing the number of packages and tools included in the image. Which approach is most effective?

A team is running a stateful database in a container on a single host. They need to ensure that the database data is not lost when the container is restarted or replaced. They also want to be able to back up the data easily. Which storage approach should they use?

Keep studying — Container Orchestration