KCNA: Kubernetes and Cloud Native Associate

Answer: C A container image should contain the bare minimum needed to run its packaged program: ideally only the application and its dependencies, built from the smallest suitable base image. This minimizes unnecessary content and reduces exposure to vulnerabilities; smaller images can also improve deployment efficiency. Kubernetes documentation also advises against relying on the `:latest` tag in production because it makes running versions and rollbacks harder to track. **Learn more:** [Kubernetes Security Checklist](https://kubernetes.io/docs/concepts/security/security-checklist/) · [Kubernetes Images](https://kubernetes.io/docs/concepts/containers/images/)

Answer: B CNCF projects commonly make decisions through open community discussion and, when agreement is not reached or a formal decision is needed, voting by the relevant maintainers or governing body. This provides a transparent, collaborative governance process rather than decisions based on financial analysis, chance, or a founder’s unilateral authority. **Learn more:** [CNCF Sandbox project voting example](https://github.com/cncf/sandbox/issues/462)

Answer: A `kube-proxy` is the node-level network proxy that maintains network rules for Kubernetes Services. Those rules enable communication with Pods from both within and outside the cluster, and `kube-proxy` uses the operating system packet-filtering layer when it is available. **Learn more:** [Kubernetes Cluster Architecture](https://kubernetes.io/docs/concepts/architecture/)