Overview
Domain 4 steps back from individual objects to the wider cloud native picture. Observability covers the three signal types (metrics, logs and traces), Prometheus and its pull model with PromQL, Grafana dashboards, OpenTelemetry as the vendor-neutral instrumentation standard, and tracing backends such as Jaeger. Cloud Native Ecosystem and Principles covers microservices, immutable infrastructure, declarative APIs, autoscaling with the Horizontal and Vertical Pod Autoscalers and the Cluster Autoscaler, serverless and event-driven tools such as Knative and KEDA, open standards (OCI, CRI, CNI, CSI, SMI), and cost awareness. Cloud Native Community and Collaboration covers CNCF project maturity levels, the Technical Oversight Committee, Kubernetes SIGs and KEPs, and the release cycle.
In the November 2025 revision, the former Cloud Native Observability domain was folded into this one, and the combined weight dropped from 24% to 12%.
How it's tested
Questions here are short and definition-driven. You identify which signal or tool fits an observability need, which principle a design follows, which autoscaler addresses a scaling problem, or how a CNCF project progresses and who governs it. Distractors are usually real tools placed in the wrong category.
-
Pick the telemetry signal
A need such as finding which service slows a request or alerting on error rate is described, and you choose traces, metrics or logs and a fitting tool.
-
Match the autoscaler
A scaling problem is described and you choose the Horizontal Pod Autoscaler, Vertical Pod Autoscaler, Cluster Autoscaler or an event-driven tool such as KEDA.
-
CNCF governance
You identify maturity levels, the role of the Technical Oversight Committee, SIGs and KEPs, or the purpose of open standards in the ecosystem.
A user request crosses five microservices and is sometimes slow, and the team must find which service adds the delay. Metrics are tempting because latency is a number, but aggregated metrics hide the path of one request. Distributed tracing records spans for each service in the request, so a tracing setup using OpenTelemetry instrumentation and a backend such as Jaeger identifies the slow hop.
Topics 3
Official topics from the CNCF / The Linux Foundation outline, in outline order.
4.1 ObservabilityMetrics, logs and traces, and the CNCF tools that collect them.
- What it means
- Observability is the ability to understand a system's internal state from the telemetry it emits. In cloud native systems the main signals are metrics (numeric time series), logs (timestamped event records) and traces (the path of a request across services).
- What to understand
- Prometheus scrapes metrics from HTTP endpoints on a pull model, stores them as time series and is queried with PromQL; Alertmanager routes alerts and Grafana visualises data. OpenTelemetry provides APIs, SDKs and a Collector to generate and export metrics, logs and traces in a vendor-neutral way. Jaeger stores and displays traces. Fluent Bit and Fluentd collect logs. SLIs and SLOs turn telemetry into reliability targets.
- How it shows up
- Expect to choose the signal type or tool for a monitoring need, or identify Prometheus's pull model.
- Common confusion
- Treating OpenTelemetry as a storage backend; it instruments and exports telemetry but does not store it.
4.2 Cloud Native Ecosystem and PrinciplesDesign principles, scaling, serverless and open standards.
- What it means
- This topic covers the ideas that define cloud native systems: loosely coupled microservices, immutable and declarative infrastructure, automation, resilience and elasticity, plus the open standards and project landscape that make components interchangeable.
- What to understand
- The HPA changes replica counts based on metrics, the VPA adjusts a Pod's requests, and the Cluster Autoscaler adds or removes nodes. KEDA scales on event sources, including to zero, and Knative provides a serverless platform on Kubernetes. Open standards such as OCI, CRI, CNI and CSI let vendors plug in implementations. Immutable infrastructure replaces rather than patches running components. Cost management, often with tools like OpenCost, relies on right-sized requests and autoscaling.
- How it shows up
- Questions ask which autoscaler or principle fits a scenario, or what a given standard defines.
- Common confusion
- Using the HPA to fix a Pod whose single replica needs more memory; that is the VPA's job.
4.3 Cloud Native Community and CollaborationHow the CNCF and Kubernetes projects are organised and governed.
- What it means
- The CNCF is a Linux Foundation project that hosts open source cloud native projects and runs a vendor-neutral governance model. Projects move through sandbox, incubating and graduated maturity levels, with the Technical Oversight Committee deciding on acceptance and promotion.
- What to understand
- Kubernetes itself is organised into Special Interest Groups that own areas such as networking or storage, and Working Groups for cross-cutting efforts. Significant changes go through Kubernetes Enhancement Proposals. Kubernetes ships about three minor releases a year, and features progress from alpha to beta to stable. The CNCF Governing Board handles budget and marketing, while the TOC handles technical direction. The Cloud Native Landscape maps projects and products.
- How it shows up
- Expect questions on maturity levels, who approves projects, or how a feature enters Kubernetes.
- Common confusion
- Assuming a single company controls Kubernetes development or decides which projects graduate.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Three pillars of observability
Metrics, logs and traces are the core telemetry signals.
- Remember
- Metrics show trends, logs show events, traces show request paths.
- Tested as
- Signal-selection questions are common.
- Trap
- Using logs alone to find latency between services.
-
Prometheus
A CNCF graduated monitoring system that scrapes metrics into a time series database.
- Remember
- It uses a pull model and PromQL; Alertmanager handles alert routing.
- Tested as
- Default answer for Kubernetes metrics collection.
- Trap
- Saying applications push metrics to Prometheus by default.
-
OpenTelemetry
A CNCF standard of APIs, SDKs and a Collector for generating and exporting telemetry.
- Remember
- It is vendor-neutral and covers metrics, logs and traces.
- Tested as
- Instrumentation and standardisation questions point here.
- Trap
- Treating it as a database or dashboard.
-
Distributed tracing
Following a single request through multiple services as linked spans.
- Remember
- Jaeger is a CNCF graduated tracing backend.
- Tested as
- Finding the slow service in a chain points here.
- Trap
- Picking metrics for per-request path analysis.
-
Horizontal Pod Autoscaler
Scales the number of Pod replicas based on metrics such as CPU.
- Remember
- It needs resource requests and a metrics source such as metrics-server.
- Tested as
- Scaling out under load points here.
- Trap
- Confusing it with adding nodes.
-
Vertical Pod Autoscaler
Adjusts container CPU and memory requests based on usage.
- Remember
- It right-sizes Pods rather than adding replicas.
- Tested as
- Questions about under- or over-provisioned Pods lead here.
- Trap
- Choosing HPA for a workload that cannot run multiple replicas.
-
Cluster Autoscaler
Adds nodes when Pods cannot be scheduled and removes idle ones.
- Remember
- It reacts to Pending Pods, not to CPU usage directly.
- Tested as
- Node capacity scenarios point here.
- Trap
- Expecting it to change replica counts.
-
Serverless and KEDA
Running code on demand with automatic scaling, including to zero.
- Remember
- Knative and KEDA bring event-driven and scale-to-zero patterns to Kubernetes.
- Tested as
- Event-driven scaling questions point here.
- Trap
- Assuming serverless means no servers exist at all.
-
Open standards
OCI for images and runtimes, CRI for runtimes, CNI for networking, CSI for storage.
- Remember
- Standards make components interchangeable and avoid lock-in.
- Tested as
- Matching a standard to its area is frequently tested.
- Trap
- Swapping CNI and CSI.
-
Immutable infrastructure
Replacing components with new versions instead of modifying them in place.
- Remember
- Containers are rebuilt and redeployed, not patched live.
- Tested as
- Principle identification questions use this.
- Trap
- Picking SSH-and-patch as a cloud native practice.
-
CNCF maturity levels
Sandbox, incubating and graduated describe project adoption and stability.
- Remember
- The Technical Oversight Committee votes on acceptance and promotion.
- Tested as
- Governance questions test the order and the deciding body.
- Trap
- Thinking projects start at incubating.
-
SIGs and KEPs
Special Interest Groups own Kubernetes areas; Enhancement Proposals document significant changes.
- Remember
- Features progress alpha, beta, stable across releases.
- Tested as
- Questions on how changes enter Kubernetes lead here.
- Trap
- Believing a vendor alone decides new features.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Metrics vs. logs vs. traces
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Metrics | Numeric measurements over time | Cheap to store, good for alerting and trends | Expecting them to show one request's path |
| Logs | Timestamped records of discrete events | Rich detail for a specific moment | Relying on them to compare latency across services |
| Traces | Spans linking one request across services | Show where time is spent in a call chain | Using them for long-term capacity trends |
HPA vs. VPA vs. Cluster Autoscaler
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Horizontal Pod Autoscaler | Changes the replica count | Scales out and in | Using it when the cluster has no room for new Pods |
| Vertical Pod Autoscaler | Changes a Pod's resource requests | Scales up and down per Pod | Expecting more replicas |
| Cluster Autoscaler | Changes the number of nodes | Triggered by unschedulable Pods | Expecting it to react to CPU alone |
Sandbox vs. incubating vs. graduated
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Sandbox | Entry level for early-stage projects | Low barrier; experimentation | Treating it as production-endorsed |
| Incubating | Projects with growing adoption and healthy contributors | Requires TOC due diligence | Assuming every project starts here |
| Graduated | Mature, widely adopted projects | Requires a security audit and governance criteria | Thinking graduation is decided by downloads alone |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Prometheus push
- What candidates pick
- Applications pushing metrics to Prometheus as the normal model.
- Why it looks right
- Many monitoring tools use agents that push.
- Why it's wrong
- Prometheus scrapes targets; the Pushgateway exists only for short-lived batch jobs.
Clue to watch for Options describing scraping or a /metrics endpoint.
-
OpenTelemetry as storage
- What candidates pick
- OpenTelemetry as where traces are stored and viewed.
- Why it looks right
- It is closely tied to tracing.
- Why it's wrong
- OpenTelemetry instruments and exports telemetry; backends such as Jaeger or Prometheus store and display it.
Clue to watch for A question asking what standardises instrumentation.
-
HPA for node shortage
- What candidates pick
- Raising HPA limits when new Pods stay Pending for lack of capacity.
- Why it looks right
- The HPA is the best-known autoscaler.
- Why it's wrong
- More replicas cannot schedule without nodes; the Cluster Autoscaler adds node capacity.
Clue to watch for Pending Pods with insufficient resources across all nodes.
-
Graduated means vendor-backed
- What candidates pick
- A large vendor's sponsorship as what makes a project graduated.
- Why it looks right
- Big companies back many projects.
- Why it's wrong
- Graduation depends on adoption, governance, contributor diversity and a security audit, approved by the TOC.
Clue to watch for Questions mentioning the Technical Oversight Committee.
-
Standards mix-up
- What candidates pick
- CSI as the networking standard or CNI as the storage standard.
- Why it looks right
- The acronyms are nearly identical.
- Why it's wrong
- CNI covers container networking, CSI covers storage, and CRI covers runtimes.
Clue to watch for Three similar acronyms among the options.
-
Serverless means no servers
- What candidates pick
- Serverless as running code with no underlying infrastructure.
- Why it looks right
- The name implies it.
- Why it's wrong
- Servers still run the code; serverless means the platform manages scaling and provisioning, often to zero.
Clue to watch for Mention of Knative, KEDA or scale-to-zero.
Answer framework
Sort architecture questions into observability, design or community before choosing between similar-sounding tools.
- For monitoring needs, decide the signal first: trends and alerts mean metrics, individual events mean logs, and request paths across services mean traces.
- Then map the signal to a tool: Prometheus for metrics, Fluent Bit or Fluentd for logs, Jaeger for traces, and OpenTelemetry for vendor-neutral instrumentation.
- For scaling, ask what must grow: replicas point to HPA, per-Pod resources to VPA, nodes to the Cluster Autoscaler, and event-driven or zero-scale needs to KEDA or Knative.
- For design principles and standards, match the area to its standard, OCI, CRI, CNI or CSI, and prefer declarative, immutable and automated answers.
- For community questions, recall the maturity path sandbox, incubating, graduated, the TOC as the technical decision maker, and SIGs with KEPs for Kubernetes changes.
Practice question
Want more like this? The KCNA practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Treat this domain as a vocabulary and mapping exercise. Build a one-page table that maps each signal to its tools, each autoscaler to what it scales, and each open standard to its area. Review it daily in your last two weeks.
For observability, install the kube-prometheus-stack Helm chart on a local cluster, open the Prometheus targets page to see scraping in action, and run a few PromQL queries in Grafana. Then read the OpenTelemetry overview to understand the API, SDK and Collector split. This hands-on contact makes the pull-versus-push and storage-versus-instrumentation questions straightforward.
For autoscaling, create an HPA on a Deployment with CPU requests and generate load, watching replicas rise. Read about the VPA and Cluster Autoscaler to understand where each fits.
For community topics, browse the CNCF landscape and project maturity pages, note a few sandbox, incubating and graduated projects, and skim the Kubernetes community repository on SIGs and KEPs. Because this domain absorbed the old Observability domain in November 2025, check that your materials teach both together.
FAQ
How much is Cloud Native Architecture worth on the KCNA?
Cloud Native Architecture is 12% of the KCNA, about 7 of 60 questions. Since the November 2025 revision it also includes observability, which used to be its own domain.
Is observability still tested on the KCNA?
Yes. It is now a topic inside Cloud Native Architecture rather than a separate domain. Expect questions on metrics, logs, traces, Prometheus and OpenTelemetry.
Do I need to write PromQL queries?
No. Know what PromQL is for and recognise a simple query, but writing complex expressions is beyond the KCNA.
What are the CNCF maturity levels?
Sandbox, incubating and graduated. The Technical Oversight Committee decides on acceptance and promotion based on adoption, governance and, for graduation, a security audit.
Which autoscalers should I know?
The Horizontal Pod Autoscaler, Vertical Pod Autoscaler and Cluster Autoscaler, plus KEDA for event-driven scaling. Know what each one changes.
Is cost management still part of the exam?
It is no longer a named heading, but right-sizing, autoscaling and tools such as OpenCost fit within cloud native principles. Expect it only lightly.
Other DevOps & Containers certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
Practise choosing telemetry signals, autoscalers, open standards and CNCF governance answers in short timed sets before a full mock exam.